Traffic pattern analysis method and system for pons topology anomaly identification

Abstract

The application discloses a traffic mode analysis method and system for PON topology anomaly identification, and relates to the technical field of optical communication network management, wherein the method comprises the following steps: collecting operation and maintenance indexes such as traffic, optical power and frame error rate of each optical network unit, and constructing a traffic distribution vector based on the data, and combining historical normal states to perform time sequence characteristic modeling; using a self-encoder model, learning the mode of traffic behavior and detecting anomalies by calculating reconstruction error and information divergence; using traffic correlation matrix difference analysis to further quantify changes in the topology structure, and forming a comprehensive anomaly index by comprehensively considering three anomaly indexes, so that PON topology anomalies can be determined once the index exceeds a set threshold. Therefore, the real-time monitoring and intelligent identification of PON network faults can be realized through multi-dimensional operation and maintenance index fusion and time sequence convolution self-encoder modeling without additional physical equipment.

Description

Technical Field

[0001] This application relates to the field of optical communication network management technology, and in particular to a traffic pattern analysis method and system for identifying PON topology anomalies. Background Technology

[0002] Passive Optical Network (PON) is a point-to-multipoint access network architecture that uses passive optical splitters in the Optical Distribution Network (ODN) to split a single optical fiber into multiple branches, providing Fiber to the Home (FTTH) services to a large number of homes or businesses. PON has become an important development direction for broadband access technology due to its high bandwidth, low power consumption, and low operation and maintenance costs. The basic components of a PON system include an Optical Line Terminal (OLT) at the central office, an Optical Network Unit (ONU) at the user end, and the ONU carrying intermediate links. The OLT is responsible for exchanging data with the backbone network and performing uplink / downlink scheduling control, while the ONU converts optical signals to electrical signals to adapt to user-side cabling, Wi-Fi, or Ethernet devices.

[0003] Because PON uses a tree topology, when one fiber fails, all users on subsequent branches will be affected, potentially expanding the fault range from one user to dozens. ODN primarily uses passive devices, which cannot actively report their status like active devices. Therefore, fault isolation and location rely on measurements and inferences from the central office. Traditional maintenance methods use an Optical Time Domain Reflectometer (OTDR) to inject optical pulses into the fiber and measure the intensity and delay of Rayleigh and Fresnel reflections to determine fiber attenuation and reflection events.

[0004] While OTDRs can provide precise location information on insertion loss and reflection events in fiber optic links, helping technicians identify issues such as dirty connectors, macro bends, and micro bends, OTDR measurements require setting parameters such as pulse width, averaging time, and dead zone. Narrow pulse widths improve resolution but reduce measurement distance, while wide pulse widths improve dynamic range but reduce resolution; parameter trade-offs often rely on experience. At low signal-to-noise ratios, normal and fault waveforms are difficult to distinguish. Furthermore, while configuring tuned OTDRs for each branch or installing reflectors at branch ends in PON systems can improve identification, these methods are costly, complex to install, and require reconfiguration after topology changes. Summary of the Invention

[0005] This application provides a traffic pattern analysis method, system, storage medium, computer program product, and electronic device for PON topology anomaly identification, which at least solves the problem that the fault identification of PON networks in current related technologies relies on expensive and complex OTDR measurement methods, making it difficult to locate topology anomalies in a timely, low-cost, and accurate manner.

[0006] In a first aspect, embodiments of this application provide a traffic pattern analysis method for PON topology anomaly identification, applied to an optical line terminal (OLT). The method includes: collecting and recording timestamps of operation and maintenance indicators (O&M) of each managed optical network unit (ONU) according to an observation window; the O&M indicators include traffic, optical power, and frame error rate; for each sampling time in the observation window, constructing a traffic vector containing the traffic of each O&M at the sampling time, and calculating the total global traffic of the OLT at the sampling time to calculate the traffic share of each O&M, and constructing a traffic distribution vector containing the traffic share of each O&M at the sampling time; fusing the traffic distribution vector at each sampling time with the average traffic value, peak traffic value, traffic fluctuation, optical power, and frame error rate within the observation window to form an observation feature sequence, and inputting the observation feature sequence into a time-series volume. A convolutional autoencoder model is used to obtain the reconstruction error. The temporal convolutional autoencoder model is trained using a set of normal feature sequences from historical normal operation periods to learn normal traffic characteristic patterns. Information-theoretic divergence is calculated based on the traffic distribution vector at each sampling moment within the observation window and the average distribution of the normal feature sequence set during the training period. The observed traffic correlation matrix between the traffic vectors of each optical network unit within the observation window is calculated, and the difference between the observed traffic correlation matrix and a reference traffic correlation matrix is ​​calculated. The reference correlation matrix is ​​the mean of the traffic correlation matrix calculated based on the normal feature sequence set for the corresponding historical normal operation period. A comprehensive anomaly index is determined based on the calculated reconstruction error, information-theoretic divergence, and the difference in traffic correlation matrices. A topological anomaly is determined to exist when the comprehensive anomaly index exceeds a threshold.

[0007] In a second aspect, the embodiments of the present application provide a traffic pattern analysis system for PON topology anomaly identification, which is deployed in an optical line terminal, and comprises: a data collection unit, configured to collect operation and maintenance indexes of each optical network unit managed by the optical line terminal according to an observation window and record a time stamp; the operation and maintenance indexes comprise traffic, optical power and frame error rate; a feature construction unit, configured to, for each sampling moment in the observation window, construct a traffic vector comprising traffic of each optical network unit at the sampling moment, and statistically determine a global total traffic of the optical line terminal at the sampling moment, to calculate a traffic proportion of each optical network unit, and construct a traffic distribution vector comprising traffic proportions of each optical network unit at the sampling moment; a reconstruction error analysis unit, configured to fuse the traffic distribution vector of each sampling moment with a traffic average value, a traffic peak value, a traffic fluctuation degree, optical power and frame error rate in the observation window, to form an observation feature sequence, and input the observation feature sequence into a time series convolution autoencoder model, to obtain a reconstruction error; wherein the time series convolution autoencoder model is trained by using a normal feature sequence set during a historical normal operation period, to learn a normal traffic feature mode; an information divergence analysis unit, configured to calculate an information divergence based on the traffic distribution vector of each sampling moment in the observation window and a training period average distribution corresponding to the normal feature sequence set; a correlation difference analysis unit, configured to calculate an observation traffic correlation matrix between the traffic vectors of each optical network unit in the observation window, and calculate a traffic correlation matrix difference between the observation traffic correlation matrix and a reference traffic correlation matrix; the reference correlation matrix is a mean value of traffic correlation matrices corresponding to the historical normal operation period, which is calculated according to the normal feature sequence set; a topology anomaly identification unit, configured to determine a comprehensive anomaly index according to the calculated reconstruction error, information divergence and traffic correlation matrix difference, and determine that there is a topology anomaly when the comprehensive anomaly index exceeds a threshold value.

[0008] In a third aspect, an electronic device is provided, which comprises at least one processor, and a memory connected with the at least one processor in communication, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the steps of the traffic pattern analysis method for PON topology anomaly identification according to any of the embodiments of the present application.

[0009] In a fourth aspect, the embodiments of the present application provide a storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the steps of the traffic pattern analysis method for PON topology anomaly identification according to any of the embodiments of the present application.

[0010] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising computer programs / instructions, which, when executed by a processor, implement the steps of the traffic pattern analysis method for PON topology anomaly identification of any embodiment of the present application.

[0011] Through the traffic pattern analysis method and system for PON topology anomaly identification provided by the present application, at least the following technical effects can be achieved:

[0012] (1) By collecting the running indexes of each ONU in the PON system at the OLT end and constructing a time series feature vector based on the traffic proportion, the sensitivity to abnormal behavior under topology change is effectively enhanced. Unlike the traditional detection method which only relies on physical link parameters, the global total traffic is normalized, and the relative traffic distribution vector of each ONU is constructed, thereby weakening the disturbance influence of the absolute value of the traffic. Thus, the structural change characteristics are highlighted, so that even in the case of stable total traffic, the relative traffic distribution mutation caused by an abnormal branch can also be effectively captured.

[0013] (2) By constructing a multi-dimensional observation feature sequence including traffic proportion, optical power, frame error rate, traffic peak value and fluctuation degree at each sampling time within the observation window, and introducing a time series convolution autoencoder model to extract the reconstruction error, the model is unsupervised trained with data sequences in the historical normal state to learn the typical business behavior pattern of the PON network in normal operation, so that it can identify the change of feature mode caused by network structure anomaly (such as fiber breakage, optical attenuation, etc.) in time, and through the reconstruction error, the detection process no longer relies on prior knowledge of specific abnormal types, significantly improving the generalization ability and stability of topology anomaly detection.

[0014] (3) The distribution deviation measurement method based on information divergence is introduced to measure the deviation degree of the traffic distribution vector of the current sampling window compared with the average distribution of the historical normal training period. Such anomalies often lead to local traffic imbalance, and information divergence can quantify the disturbance caused by such imbalance to the overall system behavior structure, and analyze the system running state from the probability distribution level.

[0015] (3) A traffic correlation matrix difference analysis mechanism is constructed to determine whether the traffic behavior coordination between ONUs changes during the current observation period. By comparing with the reference correlation matrix (generated by historical normal period data), local behavior mismatch or traffic deviation phenomenon caused by topology disturbance can be found, and the fault influence range and propagation path can also be further determined.

[0016] (4) By fusing the three dimensions of abnormal index of reconstruction error, information divergence and correlation matrix difference, a multi-element joint comprehensive abnormal index is constructed, and a dynamic threshold is set for abnormal alarm judgment, which significantly improves the accuracy and robustness of abnormal detection.

[0017] Through the technical scheme, by constructing a traffic distribution feature space facing the PON topology structure, and using a time sequence auto-encoder to model and compare the behavior evolution mode, supplemented by statistical correlation and distribution deviation analysis, the efficient identification of PON structural anomalies is realized without relying on physical measurement means. Thus, the traditional idea of relying on optical fiber echo signal analysis is broken through, and a more data-driven and structure-aware method is used to realize intelligent monitoring of the running state of the PON network. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0019] Figure 1 A flow chart of an example of a traffic pattern analysis method for PON topology anomaly identification according to an embodiment of the present application is shown;

[0020] Figure 2 A flow chart of another example of a traffic pattern analysis method for PON topology anomaly identification according to an embodiment of the present application is shown;

[0021] Figure 3 A structural connection diagram of an example of an auto-encoder model according to an embodiment of the present application is shown;

[0022] Figure 4 An F1 score comparison bar chart of an example of different anomaly detection methods is shown;

[0023] Figure 5 An ROC curve comparison chart of an example of different anomaly detection methods is shown;

[0024] Figure 6 A time series heat map of an example of traffic proportion deviation from the mean is shown;

[0025] Figure 7 A structural block diagram of an example of a traffic pattern analysis system for PON topology anomaly identification according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0026] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0027] It should be noted that in the prior art, some experts and scholars have proposed some novel directions for PON topology anomaly management. Specifically, OTDR is a typical fiber link monitoring instrument. It measures the attenuation distribution and reflection event location along the fiber by injecting high-power optical pulses into the fiber and using Rayleigh scattering and Fresnel reflection. This technology can accurately locate events such as connectors, bends, and cracks, helping technicians identify high-loss joints. However, as described earlier, OTDR faces challenges in the PON environment: branch overlap makes reflections indistinguishable, long averaging is needed to improve the signal-to-noise ratio when noise is large, and the device is expensive and relies on experience-based parameter tuning. Therefore, although OTDR is an important tool for operation and maintenance, it cannot solve all problems alone in complex PON scenarios.

[0029] Recently, there have been studies on using machine learning for OTDR data analysis. Abdelli et al. proposed a gated recurrent unit (GRU)-based network-dependent model to identify which branch in the PON is faulty. They built an experimental network with 1:128 branches to collect OTDR data, placed a fixed optical attenuator in a single branch to simulate a fault, and trained a GRU model using noisy OTDR signals. The model outputs the probability of each category (normal or fault in a certain branch), and the average diagnostic accuracy reaches 97.45%. However, this model is trained for a specific topology, and if the number or length of branches changes, it needs to be retrained; in a new topology, the accuracy drops to 93.4%, and it must rely on additional hardware such as reflectors.

[0030] To overcome the network dependence problem, researchers have also proposed a "generalized" model that divides long OTDR data into short sequences containing only one or two reflections and predicts the reflection type and location through a machine learning model, then compares it with a reference waveform to identify the faulty branch. This method does not need to be retrained in different PON topologies, but still relies on the installation of reflectors at the end of the branch to produce clear reflection signals, and requires accurate reference waveforms for comparison.

[0031] In addition to OTDR, some research attempts to directly use traffic flow and transmission characteristics to identify abnormalities. For example, the patent CN109039444B of China Telecom proposes an ONU abnormality detection method, device, OLT and optical network, which can identify abnormal ONUs according to the uplink frame error rate. The method first calculates the uplink frame error rate of each ONU under the OLT port, and classifies the ONUs with frame error rates exceeding the threshold into an abnormal problem group, and then adjusts their uplink time slots in the DBA cycle to the tail of the queue to detect their optical signals without affecting normal user traffic. If an abnormal optical signal (such as light drift causing intensity exceeding the threshold) is detected, the ONU is marked as abnormal and isolated; otherwise, its normal time slot is restored. This scheme is effective for soft faults such as light drift, and can avoid traversing all ONUs, positioning faster and more accurately. However, this method relies on the prior setting of frame error rate and optical power threshold, and may not accurately identify complex topology abnormalities (such as shunt aging and local congestion).

[0032] In summary, the current related technologies mainly focus on fault monitoring at the signal level (such as OTDR) or the bit error rate level, or use traffic anomaly detection algorithms similar to general networks.

[0033] It should be understood that the purpose of the above description of the current related technologies is only to facilitate the public to better understand the spirit and motives of the application, and is not considered as a limitation of the application. In addition, the technical solutions described in the above current related technologies are not prior art, and can also be undisclosed technical solutions, such as solutions under research or in the laboratory stage.

[0034] In the technical solutions of the present application, the collection, storage, use, processing, transmission, provision and disclosure of user personal information, etc. comply with relevant laws and regulations and do not violate public order and good customs.

[0035] It should be noted that as the network scale expands and business diversifies, operators hope to achieve early fault detection, accurate positioning and root cause analysis through intelligent operation and maintenance means, reduce operation and maintenance costs and ensure user experience. Simply relying on OTDR or manual inspection cannot meet the requirements of large-scale and real-time.

[0036] In a PON system, the OLT schedules the uplink and downlink time slots of multiple ONUs through a Dynamic Bandwidth Allocation (DBA) mechanism. Under normal circumstances, the traffic in each branch exhibits a clear daily cycle; for example, internet access demand is higher during peak weekday hours than at night, and the traffic proportions of each branch are relatively stable. When topology anomalies occur, such as fiber breakage, splitter failure, or ONU light drift, the traffic in the affected branch will change abruptly. For example, a fiber break causes the traffic in that branch to plummet to zero, or light drift leads to an increased bit error rate and triggers DBA scheduling adjustments. These anomalies alter the distribution of traffic from each ONU within the total bandwidth, resulting in significant traffic anomalies. Therefore, analyzing the normality of the PON topology from a traffic perspective is feasible. Analyzing traffic patterns can compensate for the limitations of signal-level monitoring such as OTDRs and provide a macroscopic perspective on service operation outside the equipment layer.

[0037] From a broader cybersecurity perspective, much research focuses on the application of unsupervised learning in network traffic anomaly detection. Traffic-based anomaly detection often employs network flow analysis rather than packet-by-packet parsing to reduce data volume and adapt to the high-traffic scenarios of the 5G era. Autoencoders, Adversarially Learned Anomaly Detection (ALAD), and Self-Organizing Maps (SOM) are all unsupervised algorithms; however, these methods are mostly designed for IP network attacks and lack in-depth consideration of the characteristics of PON architecture and traffic patterns.

[0038] Figure 1 A flowchart illustrating an example of a traffic pattern analysis method for PON topology anomaly identification according to an embodiment of this application is shown.

[0039] Regarding the execution subject of the method in this application embodiment, it can be any controller or processor with computing or processing capabilities, such as the controller integrated in the OLT. Based on the traffic distribution characteristics of the PON topology, a more refined traffic model is established by combining unsupervised learning to analyze PON topology anomalies from a traffic perspective.

[0040] In some examples, it can be integrated into electronic devices or terminals through software, hardware, or a combination of both, and the types of terminals or electronic devices can be diverse, such as various optical line terminals, etc.

[0041] like Figure 1 As shown, in step S110, the operation and maintenance indicators of each managed optical network unit are collected according to the observation window and the timestamp is recorded.

[0042] Here, with the observation window as the basic unit, all the managed optical network units are periodically collected for full-quantity operation and maintenance data. The operation and maintenance indicators not only include the most intuitive uplink and downlink traffic, but also cover the core indicators such as optical power and frame error rate reflecting the physical health status of the link and the reliability of data transmission. Each collection is accompanied by an accurate timestamp to achieve consistency of multi-source data in the time sequence dimension.

[0043] Specifically, as the control center of the PON system, the OLT periodically collects key operating status indicators from each ONU it manages at a fixed sampling period (for example, every 5 seconds or 10 seconds). The downlink / uplink traffic represents the data size transmitted by the ONU at the current time; the received optical power is used to reflect the optical signal strength of the optical fiber link, which is an important indicator for identifying physical problems such as optical loss, cable bending, and loose connection; the frame error rate represents the ratio of transmission frame errors in a unit of time, which can reflect the link quality and data stability. All data need to be recorded with accurate timestamps and labeled according to the ONU number to build a clear multi-dimensional time sequence structure.

[0044] In step S120, for each sampling time in the observation window, a traffic vector of the sampling time containing the traffic of each optical network unit is constructed, and the global total traffic of the optical line terminal at the sampling time is counted to calculate the traffic proportion of each optical network unit and construct a traffic distribution vector of the sampling time containing the traffic proportion of each optical network unit.

[0045] Here, for each sampling time in the observation window, the traffic indicators of all ONUs are integrated into a traffic vector in turn. Further, the global total traffic at the sampling time is counted, and based on this, the traffic of each ONU is normalized to calculate the traffic proportion of each ONU at that time. The traffic proportion vector (i.e., the traffic distribution vector) can directly reflect the contribution relationship of each ONU in the global traffic, eliminate the impact of business volume fluctuations, and focus on structural changes within the network.

[0046] In some embodiments, at each sampling time, an ONU traffic vector including each optical network unit is constructed , the global total traffic and the traffic proportion of each optical network unit are calculated to form a traffic distribution vector , and the traffic distribution vector is fused with the average traffic, peak traffic, fluctuation degree, optical power, and frame error rate in the observation window to form an observation feature sequence; represents the traffic value of the th optical network unit at the sampling time , and represents the traffic vector of all optical network units at time denotes the global total traffic at the sampling time denotes the traffic proportion of the th optical network unit at the sampling time denotes the traffic distribution vector at the sampling time

[0047] It should be noted that traditional anomaly identification often focuses on fluctuations in absolute traffic values, but in PONs, the absolute values of traffic are often affected by business time periods (such as morning and evening peak hours), and fluctuations are large and have no abnormal meaning. By introducing the traffic proportion, the perception ability of the relative behavior structure is strengthened. For example, when a branch is disconnected due to a broken fiber, its original traffic proportion will drop sharply, and the traffic proportions of other ONUs will relatively increase, thereby forming a significant traffic distribution variation. Thus, by analyzing the traffic distribution vector, the system pays more attention to structural deviation rather than absolute traffic fluctuations, thereby enhancing the sensitivity and robustness to topology anomalies.

[0048] In step S130, the traffic distribution vector of each sampling time is fused with the average traffic, peak traffic, traffic fluctuation, optical power and frame error rate in the observation window to form an observation feature sequence, and the observation feature sequence is input into a time series convolutional autoencoder model to obtain a reconstruction error.

[0049] Here, the time series convolutional autoencoder model is trained using a normal feature sequence set during the historical normal operation to learn the normal traffic feature mode, and can automatically capture the time series rules, local features and periodic changes in the normal traffic mode, and generate a higher reconstruction error for abnormal patterns.

[0050] In some embodiments, the traffic distribution vector is horizontally fused with the traffic statistical features (such as average value, peak value, fluctuation), optical power and frame error rate in the observation window, for example, the above features are spliced to form a joint multi-dimensional feature vector sequence, and an observation feature sequence of an observation window is formed according to time sequence. Subsequently, the trained time series convolutional autoencoder model is input for modeling and reconstruction, and the reconstructed feature sequence is output, which is compared with the original input observation feature sequence to obtain a reconstruction error value.

[0051] In step S140, the information theory divergence is calculated based on the traffic distribution vector of each sampling time in the observation window and the average distribution corresponding to the training period of the normal feature sequence set.

[0052] ​​​It should be understood that the form of the information divergence can be diversified, such as KL divergence, JS divergence, etc., to compare the degree of deviation between the traffic distribution vector of each time in the current observation window and the average distribution between the historical normal characteristic sequence. Thus, by depicting the deviation between the probability distributions, the small abnormal fluctuations and potential branch abnormalities of the traffic proportion are captured.

[0053] It should be noted that during normal operation, the traffic proportion of each ONU of the PON system usually has stability or periodicity. When a branch is interrupted or the link quality is reduced, the distribution weight of the branch will change. Through the divergence calculation, the structural change can be accurately captured from the probability space level, which is independent of the model prediction, and is used as an independent discriminant to supplement the time series modeling ability of the reconstruction error, thereby improving the accuracy and interpretability of the overall detection.

[0054] In step S150, an observed traffic correlation matrix between the traffic vectors of each optical network unit in the observation window is calculated, and a traffic correlation matrix difference between the observed traffic correlation matrix and a reference traffic correlation matrix is calculated.

[0055] Here, the reference correlation matrix is the average of the traffic correlation matrix corresponding to the historical normal operation period calculated according to the normal characteristic sequence set. The correlation analysis is performed on all ONU traffic vectors in the observation window to obtain the current observed correlation matrix; then the reference correlation matrix average calculated based on the normal characteristic sequence is compared to quantify the difference between the two, which reflects the overall deviation of the cooperative relationship between the traffic of each node in the network, and effectively reveals the imbalance or interruption of the traffic transmission mechanism under the abnormal topology.

[0056] Exemplarily, the Pearson correlation coefficient can be used to measure the correlation between the traffic of each pair of ONUs. In addition, the quantification method of the structural difference can be diversified, such as matrix norm, eigenvalue distance.

[0057] It should be noted that under the normal topology, the traffic correlation between some ONUs often has statistical consistency due to the proximity of the region and the synchronization of the service; if the topology structure is disturbed (such as some branch chain is interrupted or exchanged), the correlation structure will change. Through the correlation matrix difference analysis, not only the fault can be identified, but also the abnormal influence range and the change of the behavior linkage between nodes can be reflected.

[0058] In step S160, a comprehensive abnormality index is determined according to the calculated reconstruction error, information divergence and traffic correlation matrix difference, and it is determined that there is a topology anomaly when the comprehensive abnormality index exceeds a threshold value.

[0059] Here, the three abnormality indicators of reconstruction error, information divergence and correlation matrix difference calculated by the observation window are fused, for example, normalized and aggregated by weighted combination, rule set or shallow neural network, to output a comprehensive abnormality index in the interval of 0~1, which not only reflects the intensity of the abnormality, but also takes into account the sensitivity of different abnormality types. In addition, by comparing with a dynamic or static threshold, once the abnormality index exceeds the threshold, it is determined that there is a topological structure abnormality in the current observation window, realizing real-time and automatic discrimination and alarm of the topological abnormality, which facilitates the subsequent operation and maintenance personnel to quickly intervene.

[0060] Thus, the accuracy and response speed of abnormality detection are significantly improved, the burden of manual inspection and the user influence range caused by fault propagation are greatly reduced, and the efficient and automated transformation of the PON network intelligent operation and maintenance system is enabled.

[0061] In some examples of the embodiments of the present application, the early warning threshold can adopt a dynamic adaptive threshold.

[0062] More specifically, the sequence of comprehensive abnormality indexes of the last observation windows is dynamically recorded, and the threshold is adaptively updated by using a quantile method.

[0063] , formula (1)

[0064] In the formula, represents the adaptive threshold corresponding to the observation window, represents the initial reference threshold, is a quantile function, which represents the quantile of the input data set; represents the set of comprehensive abnormality indexes from the observation window to the observation window, represents the comprehensive abnormality index of the observation window.

[0065] Regarding formula (1), It is initialized by the system to provide minimum safety guarantee; if the recent window score distribution is lower than , the threshold will not be lowered too much, avoiding misjudgment of abnormality in the low load stage. The quantile parameter in the quantile function can be selected as 0.95~0.99, which can tolerate occasional fluctuations and efficiently detect persistent abnormalities. The sequence data structure adopts a circular queue or a double-ended queue, and each batch of observation data is automatically added to the sequence with the latest window score. If the total number exceeds , the oldest data is removed to realize sliding update.

[0066] Through the embodiments of the present application, the sliding window quantile adaptive threshold mechanism can dynamically extract high quantiles as the current alarm threshold based on the abnormal exponential distribution in the recent history window, effectively reflecting the latest running state and normal fluctuation range of the system. At the same time, by combining the initial safety baseline threshold, it is ensured that the threshold will not be abnormally reduced due to short-term business fluctuations, thereby realizing real-time self-adaptation to different network states and load environments.

[0067] Figure 2 A flowchart showing another example of a traffic pattern analysis method for PON topology anomaly identification according to an embodiment of the present application is shown.

[0068] In step S210, it is determined that there is a PON topology anomaly.

[0069] Regarding the operation of step S210, reference can be made to the above description of the operation of steps S110-S160 in combination with the above description of the operation of steps S210-S220, and thus detailed description is omitted here. Figure 1

[0070] In step S220, the contribution of each optical network unit to the information entropy divergence in the observation window is calculated, and the abnormal optical network unit is located from each optical network unit according to the calculated contribution.

[0071] It should be noted that in the case where the PON topology anomaly has been determined to exist, the network management system needs to further accurately locate the abnormal branch or abnormal ONU from the global anomaly. To this end, the group distribution anomaly is decomposed into the individual contribution of each ONU to highlight the physical location and traffic characteristics of the abnormal source.

[0072] Specifically, taking the information entropy divergence (such as JS divergence) as the abnormality measurement tool, the traffic distribution of each optical network unit in the observation window is compared with its historical normal distribution to quantitatively depict the degree of deviation of the current behavior of each unit from the normal mode. For each ONU, the component contribution of each sampling time in the observation window is calculated according to the JS divergence decomposition method, and then the component contribution of all sampling times is averaged or weighted aggregated to form a window-level contribution index, expressing the overall abnormal trend of the ONU in the current observation window.

[0073] In some examples of the embodiments of the present application, through the component decomposition method of information entropy divergence, the JS divergence contribution of each ONU is real-time and fine-grained depicted based on the comparison of traffic distribution and normal distribution at each sampling, and through the observation window-level aggregation, an interpretable index reflecting the abnormal trend of each ONU in the entire window is output.

[0074] Specifically, for each sampling time in the observation window, the component contribution of each optical network unit to the JS divergence at the sampling time is calculated.

[0075] ​For each sampling time within each observation window, the raw traffic data is first normalized, and the traffic share of each ONU is calculated. This ensures that the sum of all components is 1. Furthermore, based on the normal traffic sequence set from the historical training period, the baseline traffic percentage for each ONU is calculated. As a reference for the normal distribution.

[0076] For each sampling time within the observation window The influence of JS divergence is decomposed by using KL divergence components, and the component contribution of each ONU is calculated separately.

[0077] Equation (2)

[0078] Equation (3)

[0079] In the formula, Indicates at the sampling time The Middle The component contribution of each optical network unit to the JS divergence. Indicates at the sampling time The Middle Traffic percentage per optical network unit This indicates the first sequence determined based on the normal feature sequence set. The average traffic percentage of each optical network unit during the training period Indicates the first Each optical network unit at the sampling time The mean components of the current distribution and the normal distribution.

[0080] By component contribution It measures the impact of the actual distribution of a single ONU at a given moment on the JS divergence; a larger value indicates a greater degree of deviation from the norm.

[0081] The window-level contribution of information-theoretic divergence is calculated based on the component contribution at each sampling time.

[0082] Equation (4)

[0083] In the formula, Indicates the first observation within the observation window The window-level average contribution of each optical network unit to the information-theoretic divergence. This represents the total number of sampling times within the observation window. Indicates the first in the window The component contribution at each sampling time.

[0084] Here, to obtain more robust anomaly detection results, the contribution values ​​of all sampling time components within the observation window are averaged and aggregated. This significantly reduces the impact of instantaneous noise and random fluctuations on single-point indicators, improving the statistical stability of anomaly localization. Therefore, the application of window-level JS divergence component contribution significantly improves the accuracy and anti-interference capability of anomaly localization, enabling the system to more accurately identify ONUs that continuously deviate from normal flow patterns over a period of time.

[0085] Through the embodiments of this application, the component contribution method based on information theory divergence decomposition can refine the overall anomaly degree within the observation window to each optical network unit, realize the interpretable allocation of anomaly scores, and enable network administrators to quickly and intuitively locate ONU branches with significantly abnormal traffic behavior after a global anomaly alarm, reducing the scope and time of manual investigation.

[0086] Figure 3 A schematic diagram of the structural connection of an example of an autoencoder model according to an embodiment of this application is shown.

[0087] like Figure 3 As shown, the temporal convolutional autoencoder model 300 includes an encoder 310, an attention module 320, and a decoder 330. In the scenario of PON network traffic pattern analysis and anomaly detection, relying solely on static features is insufficient to comprehensively capture the temporal evolution and multi-scale anomalies of ONU traffic. Therefore, an autoencoder structure based on multi-layer dilated convolution is used to perform multi-scale temporal modeling of the original observed feature sequence, and a self-attention mechanism is introduced to capture the dynamic correlation between different time slices, achieving accurate modeling and reconstruction error quantification of complex abnormal behaviors within the observation window. Through end-to-end deep model learning and temporal reconstruction loss feedback, the model can automatically adapt to different types of anomaly patterns, improving the system's adaptive detection capability for fine-grained network anomalies.

[0088] Specifically, encoder 310 is used to extract observed feature sequences using multiple one-dimensional convolutional layers with increasing dilation rates. Multi-scale temporal features.

[0089] Equation (5)

[0090] In the formula, This indicates that a convolution kernel size of [size missing] is used. Expansion rate For one-dimensional convolution operations; and They represent the first Layer and first Hidden features output by the layer, Represents the observed feature sequence, and These represent the first and second elements in the observed feature sequence, respectively. the first and the feature values of the sampling time points.

[0091] Here, the encoder 310 extracts features from the input sequence through multiple layers of one-dimensional convolution layers with increasing dilation rates, and the output of each layer is used as the input of the next layer, so that the network can extract time-dependent dependencies and global / local features of different time scales. The use of dilated convolution increases the receptive field range and enables long-distance modeling of abnormal evolution processes.

[0092] The attention module 320 is used to calculate the attention weight between the encoding sequence features of the last layer of the encoder as input.

[0093] , formula (6)

[0094] In the formula, denotes the attention weight of the first sampling time point to the first sampling time point in the self-attention mechanism, and denote the hidden feature vectors of the first sampling time point and the first sampling time point in the encoding sequence feature, denotes the total number of layers of the encoder; denotes the vector transposition operation, and denote the query and key learnable weight matrices, respectively.

[0095] The encoding sequence features are weighted and fused according to the time-dependent self-attention weights of each sampling time point to obtain the attention output features:

[0096] , formula (7)

[0097] In the formula, is a learnable weight matrix, is the self-attention comprehensive feature of the first sampling time point.

[0098] Here, the hidden features output by the last layer of the encoder are used as the input of the attention module, and the self-attention mechanism is used to calculate the correlation between the hidden feature vectors of different time points using learnable weights such as queries and keys, and the attention weights between the time points are obtained through softmax normalization. The hidden features are weighted and summed according to the attention weights to obtain the self-attention comprehensive features of each sampling time point , which enhances the sensitivity of the model to abnormal mutations or key time points and realizes adaptive aggregation of cross-time slice features.

[0099] Decoder 330 is used for feature sequences based on the output of the attention module. Reconstruction is performed to obtain the reconstructed temporal characteristics.

[0100] Equation (8)

[0101] In the formula, Indicates the first Reconstructed features at each sampling time, For the first Self-attention integrated features at each sampling time point This represents the decoder function.

[0102] Calculate the reconstruction error of the observation window:

[0103] Equation (9)

[0104] In the formula, Indicates reconstruction error, Indicating the first element in the observed feature sequence Feature values ​​at each sampling time, It is the Euclidean norm.

[0105] In equations (8) and (9), the decoder 330 takes the attention output feature sequence as input and uses the deep neural network structure to invert and reconstruct the feature vector at each sampling time. The window-level reconstruction error is obtained by averaging the Euclidean distance reconstruction errors of all sampling points within the observation window. As a reconstruction error representing the abnormal score.

[0106] Specifically, the attention mechanism is used to dynamically capture the complex correlations between traffic features and different ONU units at different time steps, and its output... This demonstrates the model's joint attention to different time slices and the ONU space. Subsequently, the decoder utilizes deconvolution or upsampling structures to... Perform feature reconstruction.

[0107] The training objective of the temporal convolutional autoencoder model is to minimize the reconstruction error of the entire temporal window.

[0108] Equation (10)

[0109] In the formula, Represents the reconstruction loss function. For the first The true observational characteristics of a moment For the first The reconstructed features output by the time-series model. By jointly modeling temporal and spatial data, the system can learn the spatiotemporal coupling patterns of traffic characteristics in a PON network under normal operating conditions.

[0110] Through the embodiments of this application, an autoencoder model based on multi-layer dilated convolution and temporal self-attention mechanism can be used to simultaneously extract long-term and short-term traffic evolution patterns and adaptively aggregate important features at different sampling times, achieving accurate modeling and detection of complex anomaly patterns. Furthermore, by end-to-end reconstruction and error feedback of features at multiple time points within the observation window, sporadic noise is effectively smoothed, and the stability and sensitivity of anomaly detection are improved.

[0111] In some examples of embodiments of this application, information-theoretic divergence employs JS divergence. Comparing JS divergence with KL divergence, JS divergence is symmetric and bounded, and can fairly measure the overall difference between two probability distributions without leading to infinite or unstable results due to a distribution having a zero probability.

[0112] Specifically, in the calculation of JS divergence, the average vector of the flow distribution during the training period corresponding to the normal feature sequence set is obtained.

[0113] Equation (11)

[0114] In the formula, This is the average vector of the flow distribution during the training period. This represents the total number of training period sampling moments during the historical normal operation period. For the first The flow distribution vector at each sampling time point during the training period.

[0115] Based on the traffic distribution vector at each sampling time and the average traffic distribution vector during the training period, the JS divergence at the corresponding sampling time is calculated.

[0116] Equation (12)

[0117] Equation (13)

[0118] In the formula, Indicates the first The flow distribution vector at each sampling time. for and The mean distribution, Indicates the first The JS divergence at each sampling time is used to measure the distribution. and A measure of dissimilarity between them; Indicates the first The KL divergence at each sampling time is used to measure the distribution. With distribution Information loss between them.

[0119] The JS divergence at each sampling time is aggregated to obtain the corresponding window-level JS divergence.

[0120] Equation (14)

[0121] In the formula, Indicates window-level JS divergence. Indicates the first The flow distribution vector at each sampling time.

[0122] It should be noted that the normal and abnormal states of a PON network are often reflected in the overall changes in the traffic distribution of each ONU. The abnormal distribution at a single moment is easily affected by occasional traffic disturbances and cannot reliably reflect the true topology changes. Therefore, JS divergence, with its symmetry and finite value, is suitable for measuring the overall change of probability distribution. Using JS divergence as a global dissimilarity measure between the traffic distribution at multiple moments and the historical normal average distribution, and aggregating it at the window level, can effectively smooth noise and improve the stability and sensitivity of anomaly detection.

[0123] The explanation of the differences in the traffic correlation matrix is ​​that the traffic correlation matrix is ​​calculated to identify topology anomalies by measuring the traffic changes among ONUs in the PON network.

[0124] Specifically, regarding the observation window At each sampling time, the traffic time-series data of each optical network unit is acquired, and the correlation matrix between the traffic of each optical network unit is calculated.

[0125] Equation (15)

[0126] In the formula, Indicates the first Each optical network unit at time Flow observations Indicates the observation window Inner Average traffic per optical network unit; Correlation matrix The Middle Line number The elements of the column represent the observation window. Inner The and the first Pearson correlation coefficient between the traffic sequences of individual optical network units; It is a moment The correlation matrix of observed flow rates.

[0127] In formula (15), for each sampling time , by calculating the traffic time series data of each ONU, the Pearson correlation coefficient between each pair of ONUs is obtained, which captures the time correlation between each node in the network, and helps to identify the ONU with abnormal traffic change.

[0128] The mean of the traffic correlation matrix during the historical normal operation period is obtained as a reference traffic correlation matrix :

[0129] , formula (16)

[0130] In the formula, , the correlation matrix at the th training period sampling time.

[0131] The difference between the observed traffic correlation matrix and the reference traffic correlation matrix is calculated:

[0132] , formula (17)

[0133] In the formula, , the traffic correlation matrix difference degree corresponding to the observation window, , the Frobenius norm.

[0134] As shown in formula (16), by averaging the traffic correlation matrix during the historical normal operation period, a reference traffic correlation matrix is calculated, which is used to compare with the currently observed traffic correlation matrix to calculate the difference degree between the two, which is realized by the Frobenius norm as shown in formula 17. The Frobenius norm provides a standard for measuring the difference between matrices, which can objectively reflect the overall deviation degree of two matrices in the global, and the calculation process treats each element of the matrix equally, so that we can quantify the difference between the current traffic correlation matrix and the historical normal operation period traffic correlation matrix, so as to judge whether there is an abnormality.

[0135] Through the embodiments of the present application, the traffic correlation matrix is calculated for the traffic time series data of each optical network unit in the observation window, and further difference measurement is performed with the historical normal reference correlation matrix, the collaborative change rule between each unit is described based on the Pearson correlation coefficient, and the global measurement is combined with the Frobenius norm, which can effectively capture the abnormal change of the network structural correlation. Therefore, the system can not only find the sudden traffic anomaly of individual nodes, but also accurately identify the overall correlation structure deviation caused by topology change, link failure or group behavior change.

[0136] In some examples of the embodiments of the present application, the comprehensive anomaly index can be calculated in the following manner:

[0137] , formula (18)

[0138] In the formula, represents the comprehensive anomaly index corresponding to the observation window, , and represents the anomaly term weighting coefficient, , and respectively represent the reconstruction error standard deviation, JS divergence standard deviation and correlation matrix difference standard deviation of the training period window level determined according to the normal feature sequence set.

[0139] As shown in formula (18), a weighted and normalized multi-index fusion method is used to calculate the comprehensive anomaly index. By normalizing the reconstruction error , JS divergence and flow correlation matrix difference calculated by the observation window with the standard deviation , , of the training period window level respectively, and then weighting and synthesizing the unified anomaly measure.

[0140] Here, the time series convolution autoencoder is used to reconstruct the flow multi-dimensional time series features, and the reconstruction error of the observation window is calculated to measure the overall flow pattern change; secondly, the JS divergence is used to depict the overall difference between the flow distribution and the historical normal distribution, and to capture the subtle shift of the group flow structure; thirdly, the flow correlation matrix difference focuses on capturing the mutation of the cooperative relationship between each node in the network, and reflects the structural change of the topology level. Finally, the weighting coefficient can be adjusted according to the actual application scene and the anomaly risk sensitivity to balance the influence of the three types of anomaly signals on the comprehensive index, which can significantly improve the comprehensiveness and robustness of PON network anomaly detection.

[0141] To verify the effectiveness of the proposed method, we construct a simulated data set containing 8 ONUs, with a duration of two days (5-minute sampling interval). Under normal circumstances, the flow of each ONU presents a typical daily periodicity, and random noise is added to simulate network fluctuations. In the abnormal scenario, we designed two kinds of topology anomalies: one is branch fiber break, which reduces the flow to zero at the 200-220 time slices of the 3rd ONU; the other is branch misconnection / sudden congestion, which makes the flow surge to twice the original at the 100-110 time slices of the 6th ONU. The rest of the time maintains the normal mode. We define the abnormal label as the state within the above time period.

[0142] To demonstrate the advantages of the proposed algorithm, we selected the following methods for comparison experiments:

[0143] Z-Score threshold method: Calculate the overall mean and standard deviation for each ONU traffic. If the standardized score of any ONU exceeds the threshold (set to 3) at a certain time, it is judged as abnormal. This is a simple but common statistical detection method.

[0144] Principal Component Analysis (PCA) autoencoder: Train a PCA model using normal data, reconstruct the observed traffic and calculate the reconstruction error. Use the 95th percentile as the threshold, which refers to low-dimensional space anomaly detection.

[0145] Proposed SA-TCAE+JS-divergence method: Use the comprehensive anomaly index described in this paper, where the weight α=β=γ=1 / 3.

[0146] We mainly evaluate the precision, recall and F1 value; and draw the Receiver Operating Characteristic (ROC) curve to measure the detection performance under different thresholds. The experimental results are shown in the following table (the precision is three decimal places).

[0147] Table 1. Performance indicators of different anomaly detection methods in comparison experiments

[0148] Method Precision Recall F1 Score Z-Score 0.000 0.000 0.000 PCA 0.595 0.733 0.657 Proposed 0.460 0.767 0.575

[0149] As shown in Table 1, the Z-Score method failed to identify any anomalies due to the high threshold; the PCA method could detect some anomalies with an F1 value of 0.657; the proposed method had the highest recall rate (0.767), although the precision was slightly lower, but overall it was better than PCA in the ROC curve, with a higher AUC (0.904 vs 0.870). This shows that considering traffic patterns, distribution divergence and related structures can help achieve high detection rates with low false positive rates.

[0150] Figure 4 The F1 score comparison bar chart of an example of different anomaly detection methods is shown.

[0151] As Figure 4 shown, the Z-Score method has the lowest detection accuracy because it only relies on statistical thresholds; the PCA method can improve certain detection performance through low-dimensional reconstruction; while the proposed method has obvious advantages in overall detection accuracy after utilizing multiple features and JS divergence, indicating its strong recognition and detection ability for PON topology anomalies.

[0152] Figure 5 An ROC curve comparison chart of an example of different anomaly detection methods is shown.

[0153] As shown in Figure 5 , the horizontal axis of the coordinate system is the false positive rate (FPR), the vertical axis of the coordinate system is the true positive rate (TPR), the orange curve corresponds to the SA-TCAE+JS-divergence method proposed in this paper, and the blue curve corresponds to the PCA method. It is not difficult to see that the method proposed in this paper shows higher true positive rate at most thresholds, and the overall envelope is better than the PCA auto-encoding method, and the AUC (area under the curve) reaches 0.904, which is significantly higher than the 0.870 of the PCA method, indicating that the method in this paper has achieved a better balance between sensitivity and specificity, and can more stably and accurately detect the topology anomaly of the PON network.

[0154] Figure 6 A time series heat map of an example of traffic proportion deviation from the mean is shown.

[0155] As shown in Figure 6 , the horizontal axis is the time step index, the vertical axis is the ONU number, and the color bar represents the numerical value of the proportion deviation. The closer the color is to dark purple represents negative deviation, and the closer the color is to yellow represents positive deviation. It can be seen that the third ONU has a significant negative deviation (dark purple) during about 200-220 time steps, reflecting the traffic drop caused by fiber breakage or link failure; the sixth ONU has a short positive deviation (yellow) during about 100-110 time steps, corresponding to a sudden traffic congestion. Through the heat map, the dynamic changes of the traffic distribution of each ONU can be intuitively reflected, which is convenient for operation and maintenance personnel to quickly locate the abnormal ONU branch and verify the actual positioning ability of the anomaly detection algorithm.

[0156] It should be noted that although the F1 score of the SA-TCAE+JS-divergence method proposed in this paper is slightly lower than that of the PCA auto-encoding method (as shown in Figure 4 , the ROC curve in Figure 5 shows that the method in this paper has a higher true positive rate in most false positive rate ranges, with an AUC value of about 0.904, which is more excellent than the 0.870 of PCA, indicating that the method in this paper is better than the baseline method at different thresholds. In addition, Figure 6The heatmap effectively demonstrates the advantages of our proposed method in anomaly traffic detection and tributary localization, helping operations personnel intuitively identify network anomalies such as sudden traffic drops or congestion. Therefore, although the F1 score is slightly lower than the PCA method, it significantly improves the accuracy of anomaly event localization and recall, helping to reduce false negatives and enhance the timeliness and accuracy of fault response. By accurately locating anomaly tributaries, our proposed method is significant in improving system stability and reducing service interruption time, especially in high-load or complex network environments, ensuring timely problem detection and remediation, and maximizing network uptime.

[0157] This application proposes a topology anomaly identification method based on traffic patterns by deeply mining the structural information of traffic patterns in PON scenarios. Without relying on additional hardware, it constructs traffic distribution features by collecting ONU traffic and optical power data and combines them with a self-attention temporal convolutional autoencoder, information-theoretic divergence, and correlation analysis to achieve anomaly detection and localization. Comparative experiments show that the traditional Z-Score method cannot effectively detect topology anomalies, and the PCA autoencoder can detect anomalies to some extent, but it cannot utilize the details of traffic distribution. The proposed scheme is significantly better in terms of recall and overall performance, and has a larger ROC curve area. Heatmap illustrations further verify the algorithm's ability to locate anomalous branches.

[0158] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of combined actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Secondly, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application. In the above embodiments, the descriptions of each embodiment have their own emphasis; for parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0159] Figure 7 A structural block diagram of an example traffic pattern analysis system for PON topology anomaly identification according to an embodiment of this application is shown. The traffic pattern analysis system for PON topology anomaly identification is deployed at an optical line terminal.

[0160] like Figure 7 As shown, the PON topology anomaly identification traffic pattern analysis system 700 includes a data acquisition unit 710, a feature construction unit 720, a reconstruction error analysis unit 730, an information theory divergence analysis unit 740, a correlation difference analysis unit 750, and a topology anomaly identification unit 760.

[0161] The data collection unit 710 is configured to collect operation and maintenance indexes of each optical network unit managed by the system according to an observation window and record a time stamp; the operation and maintenance indexes include traffic, optical power and frame error rate.

[0162] The feature construction unit 720 is configured to, for each sampling time in the observation window, construct a traffic vector containing traffic of each optical network unit at the sampling time, and count a global total traffic of the optical line terminal at the sampling time, to calculate a traffic proportion of each optical network unit, and construct a traffic distribution vector containing traffic proportions of each optical network unit at the sampling time.

[0163] The reconstruction error analysis unit 730 is configured to fuse the traffic distribution vector of each sampling time with a traffic average value, a traffic peak value, a traffic fluctuation degree, optical power and frame error rate in the observation window, to form an observation feature sequence, and input the observation feature sequence into a time series convolutional autoencoder model to obtain a reconstruction error; the time series convolutional autoencoder model is trained by using a normal feature sequence set in a historical normal operation period, to learn a normal traffic feature mode.

[0164] The information divergence analysis unit 740 is configured to calculate an information divergence based on the traffic distribution vector of each sampling time in the observation window and a training period average distribution corresponding to the normal feature sequence set.

[0165] The correlation difference analysis unit 750 is configured to calculate an observation traffic correlation matrix between the traffic vectors of each optical network unit in the observation window, and calculate a traffic correlation matrix difference between the observation traffic correlation matrix and a reference traffic correlation matrix; the reference correlation matrix is a mean value of traffic correlation matrices corresponding to the historical normal operation period calculated according to the normal feature sequence set.

[0166] The topology anomaly identification unit 760 is configured to determine a comprehensive anomaly index according to the calculated reconstruction error, information divergence and traffic correlation matrix difference, and determine that a topology anomaly exists when the comprehensive anomaly index exceeds a threshold.

[0167] In some embodiments, the present application provides a non-volatile computer readable storage medium, wherein the storage medium stores one or more programs including execution instructions, the execution instructions can be read and executed by an electronic device (including but not limited to a computer, a server, or a network device, etc.) to perform the steps of the traffic mode analysis method for identifying a PON topology anomaly according to any one of the above embodiments of the present application.

[0168] In some embodiments, the embodiments of the present application further provide a computer program product, comprising a computer program stored on a non-volatile computer readable storage medium, the computer program comprising program instructions which, when executed by a computer, cause the computer to perform the steps of any of the above-mentioned PON topology anomaly identification traffic pattern analysis methods.

[0169] In some embodiments, the embodiments of the present application further provide an electronic device, comprising: at least one processor, and a memory connected to the at least one processor in communication, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the steps of the PON topology anomaly identification traffic pattern analysis method.

[0170] The above product can execute the method provided by the embodiments of the present application, and has the corresponding function modules and beneficial effects of executing the method. Technical details not described in detail in the embodiments can be referred to the method provided by the embodiments of the present application.

[0171] The electronic device of the embodiments of the present application exists in various forms, including but not limited to: a mobile communication device, an ultra-mobile personal computer device, a portable entertainment device, or other onboard electronic devices with data interaction functions.

[0172] The device embodiments described above are only schematic, and the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e. they may be located in one place, or distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments.

[0173] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be implemented by means of software plus a general hardware platform, and of course can also be implemented by hardware. Based on such understanding, the above technical solutions or the part that contributes to the related art can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in the various embodiments or some parts of the embodiments.

[0174] Finally, it should be noted that the above examples are only used to illustrate the technical solutions of the present application, and are not intended to limit the same; although the present application has been described in detail with reference to the foregoing examples, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing examples, or make equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A traffic pattern analysis method for PON topology anomaly identification, applied to an optical line terminal, characterized in that, The method comprises: According to the observation window, the operation and maintenance indicators of each optical network unit managed are collected and the time stamp is recorded; the operation and maintenance indicators include traffic, optical power and error frame rate; For each sampling time in the observation window, a traffic vector containing the traffic of each optical network unit at the sampling time is constructed, and the global total traffic of the optical line terminal at the sampling time is counted to calculate the traffic proportion of each optical network unit, and a traffic distribution vector containing the traffic proportion of each optical network unit at the sampling time is constructed; The traffic distribution vector of each sampling time is fused with the average value, peak value, fluctuation degree of traffic, optical power and error frame rate in the observation window to form an observation feature sequence, and the observation feature sequence is input into a time series convolutional autoencoder model to obtain a reconstruction error; wherein the time series convolutional autoencoder model is trained using a set of normal feature sequences during historical normal operation to learn normal traffic feature patterns; Based on the traffic distribution vector of each sampling time in the observation window and the training period average distribution corresponding to the set of normal feature sequences, the information divergence is calculated; The observation traffic correlation matrix between the traffic vectors of each optical network unit in the observation window is calculated, and the traffic correlation matrix difference between the observation traffic correlation matrix and a reference traffic correlation matrix is calculated; the reference traffic correlation matrix is the average value of the traffic correlation matrix corresponding to the historical normal operation period calculated according to the set of normal feature sequences; According to the calculated reconstruction error, information divergence and traffic correlation matrix difference, a comprehensive anomaly index is determined, and when the comprehensive anomaly index exceeds a threshold value, it is determined that there is a topology anomaly; the information divergence uses JS divergence; Wherein, the calculation of the information divergence comprises: Obtain the training period traffic distribution average vector corresponding to the set of normal feature sequences: ， In the formula, This is the average vector of the flow distribution during the training period. This represents the total number of training period sampling moments during the historical normal operation period. For the first The flow distribution vector at each sampling time point during the training period; Based on the traffic distribution vector of each sampling time and the training period traffic distribution average vector, the JS divergence of the corresponding sampling time is calculated: ， ， wherein, represents the flow distribution vector at the i-th sampling time, is the mean distribution of represents the JS divergence at the i-th sampling time, which is used to measure the dissimilarity between the distribution and the distribution represents the KL divergence at the i-th sampling time, which is used to measure the information loss between the distribution and the distribution ​​​​​​​ The JS divergences of each sampling time are aggregated to obtain the corresponding window-level JS divergence: ， wherein denotes the window-level JS divergence, denotes the flow distribution vector at the sampled time instant, denotes the total number of sampled time instants within the observation window.

2. The method of claim 1, wherein, The method further comprises: Dynamic recording recently The synthetic anomaly index sequence of the observation window is recorded, and the threshold is updated adaptively by using the quantile method: ， wherein, denotes the adaptive threshold value corresponding to the th observation window, denotes the initial reference threshold value, is a quantile function, and denotes the th quantile of the input data set; denotes the set of composite anomaly indices from the th to the th observation window, denotes the composite anomaly index of the th observation window.

3. The method of claim 1, wherein, After determining that there is a topology anomaly, the method further comprises: Calculate the contribution of each optical network unit in the observation window to the information divergence, and locate the abnormal optical network unit from the optical network units according to the calculated contribution.

4. The method of claim 3, wherein, The calculation of the contribution of each optical network unit in the observation window to the information divergence comprises: For each sampling time in the observation window, the component contribution of each optical network unit at the sampling time to the JS divergence is calculated respectively: ， ， wherein, represents the component contribution of the jth optical network unit to the JS divergence at the sampling time point , , represents the traffic proportion of the jth optical network unit at the sampling time point , , represents the average traffic proportion of the jth optical network unit in the training period determined according to the normal feature sequence set, , represents the mean component of the current distribution and the normal distribution of the jth optical network unit at the sampling time point , . According to the component contribution of each sampling time, the window-level contribution of the information divergence is calculated: ， In the formula, Indicates the first observation within the observation window The window-level average contribution of each optical network unit to the information-theoretic divergence. Indicates the first in the window The component contribution at each sampling time.

5. The method according to any one of claims 1-4, characterized in that, The time series convolutional autoencoder model includes an encoder, an attention module and a decoder; The encoder is configured to extract a sequence of observation features using a plurality of one-dimensional convolutional layers with increasing dilation rates of multiscale temporal features; ， In the formula, represents a one-dimensional convolution operation with a convolution kernel size of , an expansion rate of ; and respectively represent hidden features output by the first layer and the second layer, represents an observation feature sequence, and respectively represent feature values at the first and the second sampling time of the observation feature sequence; The attention module is configured to encode sequence features of the last layer output of the encoder As input, compute the timing self-attention weights: ， In the formula, This represents the first in the self-attention mechanism. The sampling time for the first sampling time Attention weights at each sampling time. and These represent the features of the encoded sequence, respectively. The sampling time and the first sampling time The hidden feature vector at each sampling time point, Indicates the total number of layers in the encoder; This represents the vector transpose operation. and These represent the learnable weight matrices for the query and the key, respectively. According to the time series self-attention weight of each sampling time, the encoding sequence features are weighted and fused to obtain attention output features: ， In the formula, The learnable weight matrix with values ​​of , For the first Self-attention integrated features at each sampling time; The decoder is configured to generate the sequence of features based on the sequence of features output by the attention module reconstructing to obtain reconstructed temporal features: ， In the formula, denotes the reconstructed feature at the sample time, is the self-attention integrated feature at the sample time, denotes the decoder function; Calculate the reconstruction error of the observation window: ， wherein denotes the reconstruction error, denotes the feature value at the sample time in the observed feature sequence, is the Euclidean norm.

6. The method of claim 5, wherein, The computing the observation traffic correlation matrix between the traffic vectors of each optical network unit in the observation window and computing the traffic correlation matrix difference between the observation traffic correlation matrix and the reference traffic correlation matrix comprises: For an observation window At each sampling time, the traffic time series data of each optical network unit is acquired, and a correlation matrix between the traffic of each optical network unit is calculated: ， wherein denotes the traffic observation value of the i-th optical network unit at time denotes the traffic mean value of the i-th optical network unit in the observation window denotes the element of the correlation matrix in the i-th row and j-th column, denotes the Pearson correlation coefficient between the traffic series of the i-th and j-th optical network unit in the observation window is the observation traffic correlation matrix at time ​​​​​​​​​​ obtaining the mean value of the flow correlation matrix during the historical normal operation as a reference flow correlation matrix : ， In the formula, denotes the correlation matrix at the sampled training period. computing the difference between the observation traffic correlation matrix and the reference traffic correlation matrix: ， In the formula, denotes the flow correlation matrix difference degree corresponding to the observation window, denotes the Frobenius norm.

7. The method of claim 6, wherein, The determining the comprehensive anomaly index according to the reconstruction error, the information divergence and the traffic correlation matrix difference calculated at each sampling time comprises: ， In the formula, represents a comprehensive anomaly index corresponding to the observation window, , and represents an anomaly item weighting coefficient, , and respectively represent a reconstruction error standard deviation, a JS divergence standard deviation and a correlation matrix difference standard deviation of a training period window level determined according to the normal feature sequence set.

8. A traffic pattern analysis system for PON topology anomaly identification, characterized by, The system is deployed in an optical line terminal, and the system comprises: A data acquisition unit is configured to acquire operation and maintenance indexes of each optical network unit managed by the optical line terminal and record timestamps according to an observation window; the operation and maintenance indexes comprise traffic, optical power and frame error rate; A feature construction unit is configured to, for each sampling time in the observation window, construct a traffic vector comprising traffic of each optical network unit at the sampling time, and statistically acquire global total traffic of the optical line terminal at the sampling time to calculate a traffic proportion of each optical network unit and construct a traffic distribution vector comprising traffic proportions of each optical network unit at the sampling time; A reconstruction error analysis unit is configured to fuse the traffic distribution vector at each sampling time with a traffic average value, a traffic peak value, a traffic fluctuation degree, optical power and frame error rate in the observation window to form an observation feature sequence, and input the observation feature sequence into a time series convolution autoencoder model to obtain a reconstruction error; wherein the time series convolution autoencoder model is trained by using a normal feature sequence set during a historical normal operation period to learn normal traffic feature patterns; An information divergence analysis unit is configured to calculate an information divergence based on the traffic distribution vector at each sampling time in the observation window and a training period average distribution corresponding to the normal feature sequence set; A correlation difference analysis unit is configured to compute an observation traffic correlation matrix between the traffic vectors of each optical network unit in the observation window and compute a traffic correlation matrix difference between the observation traffic correlation matrix and a reference traffic correlation matrix; the reference traffic correlation matrix is a mean value of traffic correlation matrices corresponding to historical normal operation periods calculated according to the normal feature sequence set; A topology anomaly identification unit is configured to determine a comprehensive anomaly index according to the calculated reconstruction error, information divergence and traffic correlation matrix difference, and determine that a topology anomaly exists when the comprehensive anomaly index exceeds a threshold value; the information divergence adopts a JS divergence; The calculation of the information divergence comprises: obtaining a training period traffic distribution average vector corresponding to the normal feature sequence set: ， In the formula, This is the average vector of the flow distribution during the training period. This represents the total number of training period sampling moments during the historical normal operation period. For the first The flow distribution vector at each sampling time point during the training period; calculating a JS divergence at a corresponding sampling time based on the traffic distribution vector at the sampling time and the training period traffic distribution average vector: ， ， In the formula, Indicates the first The flow distribution vector at each sampling time. for and The mean distribution, Indicates the first The JS divergence at each sampling time is used to measure the distribution. and A measure of dissimilarity between them; Indicates the first The KL divergence at each sampling time is used to measure the distribution. With distribution Information loss between them; aggregating the JS divergences at the sampling times to obtain a corresponding window-level JS divergence: ， wherein denotes the window-level JS divergence, denotes the flow distribution vector at the sampled time instant, denotes the total number of sampled time instants within the observation window.

Images