A network operation automation monitoring real-time response method

Abstract

The application belongs to the technical field of network system operation and maintenance, and provides a network operation and maintenance automatic monitoring real-time response method, which comprises the following steps: determining the predicted fault node and the predicted fault time in a first operation period through prediction analysis of network delay; identifying a new predicted fault node through comparison of the predicted fault nodes determined in the first operation period and a second operation period, and performing continuous growth analysis to determine whether there is a fault node surge phenomenon; determining whether the predicted fault node in the first operation period triggers a delay fault chain reaction and causes the fault node surge phenomenon to occur through causality and delay fault synchronicity analysis; if so, determining the fault isolation priority of the predicted fault node in the first operation period, realizing delay fault chain reaction identification of network nodes in a continuous operation period of a network system, and determining the delay fault isolation priority, thereby improving the health management efficiency of network system operation and maintenance.

Description

Technical Field

[0001] This invention belongs to the field of network system operation and maintenance technology, specifically a real-time response method for automated monitoring of network operation and maintenance. Background Technology

[0002] As network systems continue to expand in scale and increase in complexity, network node latency failures have become one of the core issues affecting the stable operation of systems. In scenarios with extremely high real-time requirements, such as industrial control and cloud computing, abnormal fluctuations in network latency can directly lead to business interruptions, data loss, or security incidents. However, existing network operation and maintenance technologies still have many shortcomings in practical applications.

[0003] Existing technologies typically manage network nodes as independent units, neglecting the topological dependencies between nodes. When a node experiences performance degradation due to abnormal latency, its neighboring nodes may also fail, creating a strong cascading failure. However, existing methods lack the ability to analyze such chain reactions, leading to an underestimation of the scope of the failure and failing to provide optimization strategies for subsequent network system operation and maintenance.

[0004] In scenarios with concurrent failures of multiple nodes, maintenance personnel often adopt a "one-size-fits-all" isolation approach. This crude approach may not only mistakenly isolate critical nodes, but also cause load imbalance on the remaining nodes due to improper isolation order, which is detrimental to the stable operation of the network system.

[0005] Therefore, the present invention provides a real-time response method for automated monitoring of network operation and maintenance. Summary of the Invention

[0006] In order to overcome the shortcomings of the prior art, at least one technical problem raised in the background art is solved.

[0007] The technical solution adopted by this invention to solve its technical problem is: a real-time response method for automated monitoring of network operation and maintenance, comprising:

[0008] During the first run, network nodes whose network latency exceeds the warning baseline and is close to the safety baseline are marked as high-risk fault nodes. Through predictive analysis of network latency, the expected fault nodes and expected fault times are determined among the high-risk fault nodes.

[0009] During the second running phase, the expected failure nodes and expected failure times are determined again. By comparing the expected failure nodes determined in the first and second running phases, new expected failure nodes are identified.

[0010] By analyzing the continuous growth of newly predicted fault nodes during the second runtime period, it can be determined whether there is a surge in fault nodes.

[0011] If present, combine the network node topology, the network node historical fault database, and the expected fault time to perform causal relationship and delayed fault synchronization analysis on the new expected fault nodes and the expected fault nodes in the first running segment, and determine whether the expected fault nodes in the first running segment trigger a fault chain reaction, leading to a surge in fault nodes.

[0012] If so, determine the fault isolation priority of the expected fault nodes in the first running segment, and perform fault isolation on the expected fault nodes in the first running segment in sequence according to the fault isolation priority.

[0013] Furthermore, the process for marking high-risk faulty nodes is as follows:

[0014] When the network latency of a network node exceeds the warning baseline, the network latency deviation between the network latency and the safety baseline is calculated to obtain the network latency approximation value.

[0015] If the network latency is close to or less than the network latency threshold, the network node is marked as a high-risk fault node.

[0016] Furthermore, the process of determining the expected failure node and the expected failure time within the high-risk failure node is as follows:

[0017] The time period between the point when the network latency of a high-risk fault node exceeds the warning baseline and the point when the network latency approaches the safety baseline is marked as the analysis period.

[0018] The network latency at different time points within the analysis period is summarized into a network latency sequence according to time order.

[0019] After normalizing the network delay sequence, network delay is predicted using an LSTM model. The time point when the network delay reaches the safe baseline is extracted from the network delay prediction results to obtain the delay critical point of high-risk fault nodes.

[0020] If the latency threshold is within the network system's required operating period, then high-risk fault nodes are marked as expected fault nodes, and the latency threshold is the expected fault time.

[0021] Furthermore, the method for identifying newly predicted fault nodes is as follows:

[0022] During the second runtime phase, anticipated fault nodes with different types from those anticipated fault nodes in the first runtime phase are marked as new anticipated fault nodes.

[0023] Furthermore, the process of performing continuous growth analysis on newly predicted fault nodes during the second runtime period is as follows:

[0024] Obtain the number of newly predicted fault nodes at different time points within the second runtime period, and integrate them into a sequence of newly predicted fault node numbers according to time order;

[0025] After performing linear regression on the sequence of newly predicted failure nodes, the significance P-value is calculated. If both the linear regression and the significance P-value meet the requirements, it indicates that there is a continuous increase.

[0026] If a sustained increase occurs, the number of newly predicted fault nodes is proportional to the number of predicted fault nodes in the first running segment to obtain the fault node surge value.

[0027] If the surge value of fault nodes is greater than or equal to the surge threshold of fault nodes, it indicates that a surge of fault nodes has occurred.

[0028] Furthermore, the process of conducting causal relationship analysis is as follows:

[0029] Based on the network node topology, if there is a connection causal relationship between the expected fault node and the newly expected fault node in the first runtime segment and the connection causal relationship is consistent, then fault synchronization analysis is performed.

[0030] Furthermore, the fault synchronization analysis process is as follows:

[0031] In the historical fault database of network nodes, based on the delay fault data group with the same causal relationship between the newly expected fault node and the expected fault node in the first running segment, the delay impact frequency value and delay impact simultaneous value are processed, and the deviation is calculated to obtain the delay fault chain value.

[0032] If the delay fault cascading value is greater than or equal to the delay fault cascading threshold, then the expected fault node in the first runtime segment corresponding to the new expected fault node is marked as a delay-affected node.

[0033] If a newly predicted faulty node has at least one corresponding delay-affected node, then the newly predicted faulty node is marked as a delay-affected node.

[0034] The proportion of nodes affected by the statistical delay among the newly predicted faulty nodes is used to obtain the fault cascading determination value.

[0035] If the fault cascading determination value meets the requirements, the expected fault node in the first running segment will trigger a fault cascading reaction, resulting in a surge of fault nodes.

[0036] Furthermore, the method for obtaining the delay-affected frequency value is as follows:

[0037] The number of delayed fault data groups with the same causal relationship between the newly predicted fault node and the predicted fault node in the first running segment is counted. The number of delayed fault impacts of the predicted fault node in the first running segment is obtained, and the ratio is calculated with the total number of delayed faults of the predicted fault node in the first running segment to obtain the frequency value of delayed impact.

[0038] The total number of delayed failures of the expected fault nodes during the first running period can be obtained by statistically analyzing the occurrence count of the expected fault nodes during the first running period in the historical fault database.

[0039] Furthermore, the method for obtaining the simultaneous value of the delay effect is as follows:

[0040] Based on the delayed fault data group with the same connection causal relationship between the new expected fault node and the expected fault node in the first runtime segment, the delayed fault time difference of the delayed fault data group is obtained, wherein the delayed fault time difference is the difference in the delayed fault time of two network nodes contained in the delayed fault data group.

[0041] The delay fault time difference of all delay fault data groups is averaged to obtain the delay reference time.

[0042] The actual delay time is obtained by subtracting the delayed failure time of the expected fault node in the first running segment from the delayed failure time of the newly expected fault node.

[0043] The ratio of the absolute deviation between the actual delay time and the delay reference time is calculated to obtain the simultaneous value of the delay impact.

[0044] Furthermore, the method for determining the fault isolation priority is as follows:

[0045] Based on any expected fault node in the first runtime segment, count the number of times the expected fault node is marked as a delay-affected node. Sort the expected fault nodes in the first runtime segment in descending order according to the number of times the expected fault node is marked as a delay-affected node, and determine the fault isolation priority of the expected fault nodes in the first runtime segment.

[0046] The beneficial effects of this invention are as follows: During the first operating period, network nodes whose network latency exceeds the warning baseline and is close to the safety baseline are marked as high-risk fault nodes. Through predictive analysis of network latency, expected fault nodes and their expected failure times are determined within the high-risk fault nodes. During the second operating period, expected fault nodes and their expected failure times are determined again. By comparing the expected fault nodes determined in the first and second operating periods, new expected fault nodes are identified. Through continuous growth analysis of the new expected fault nodes in the second operating period, it is determined whether there is a surge in fault nodes. If so, the network node topology, the historical fault database of the network nodes, and the expected failure times are considered. This invention performs causal relationship and delayed fault synchronization analysis on newly predicted fault nodes and predicted fault nodes within the first operating period to determine whether the predicted fault nodes within the first operating period trigger a fault chain reaction, leading to a surge in fault nodes. If so, it determines the fault isolation priority of the predicted fault nodes within the first operating period and isolates them sequentially according to the fault isolation priority. This invention mainly realizes the identification of delayed fault chain reactions of network nodes within the continuous operating period of the network system, and determines the delayed fault isolation priority of network nodes when the delayed fault chain reaction is strong (a surge in newly predicted fault nodes), thereby effectively improving the health management efficiency of network system operation and maintenance. Attached Figure Description

[0047] The invention will now be further described with reference to the accompanying drawings.

[0048] Figure 1 This is a flowchart illustrating the steps of a real-time response method for automated monitoring of network operation and maintenance as described in an embodiment of the present invention.

[0049] Figure 2 This is a schematic diagram of the logic judgment of a real-time response method for automated monitoring of network operation and maintenance as described in an embodiment of the present invention. Detailed Implementation

[0050] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0051] Please see Figures 1-2 As shown in the embodiment of the present invention, a real-time response method for automated monitoring of network operation and maintenance includes:

[0052] Step 1: During the first runtime period, network nodes whose network latency exceeds the warning baseline and is close to the safety baseline are marked as high-risk fault nodes. Through predictive analysis of network latency, the expected fault nodes and expected fault times are determined among the high-risk fault nodes.

[0053] In step one, the process of marking network nodes whose network latency exceeds the warning baseline but is close to the safety baseline as high-risk fault nodes is as follows:

[0054] During the first runtime period, the network latency of the network node is monitored. When the network latency of the network node exceeds the warning baseline, the network latency deviation between the network latency and the safety baseline is calculated to obtain the network latency approximation value.

[0055] In some embodiments, a network latency proximity value is compared with a network latency proximity threshold;

[0056] If the network latency is close to or less than the network latency threshold, the network node is marked as a high-risk fault node.

[0057] If the network latency value is greater than the network latency threshold, no action is taken, and network latency monitoring and calculation continue.

[0058] It should be noted that the security baseline represents the normal network latency of a network node, while the warning baseline is a warning value set by those skilled in the art to prevent the latency of a network node from exceeding the normal latency.

[0059] In step one, the process of determining the expected failure node and the expected failure time among high-risk failure nodes through predictive analysis of network latency is as follows:

[0060] A1, based on high-risk fault nodes, marks the time period between the time point when the network latency of the high-risk fault node exceeds the warning baseline and the time point when the network latency approaches the safety baseline as the analysis period;

[0061] A2, obtain the network latency at different time points within the analysis period, and summarize it in time sequence to obtain the network latency sequence;

[0062] A3. After normalizing the network delay sequence, training data features are constructed. Each training data feature includes input and output features. Specifically, the first k values ​​in the network delay sequence are used as input features, and the (k+1)th value is used as output features to construct multiple training data features. The value of k is determined by the elbow rule. The LSTM model is trained using multiple training data features to obtain a trained LSTM model.

[0063] A4. Combining network delay sequences, network delay is predicted using an LSTM model. The time point at which the network delay reaches the safe baseline is extracted from the network delay prediction results, thus obtaining the delay critical point of high-risk fault nodes.

[0064] If the latency threshold is within the network system's required operating period, then high-risk fault nodes are marked as expected fault nodes, and the latency threshold is the expected fault time.

[0065] If the latency threshold is outside the network system's required operating time, no action will be taken.

[0066] It should be noted that the required runtime of the network system is set according to the usage requirements of the network system;

[0067] It is understandable that the purpose of obtaining the expected failure node and the expected failure time is:

[0068] Function 1: To predict network node latency and obtain the expected faulty nodes and their corresponding expected fault times, which is helpful to identify or understand network node latency faults in advance and facilitate subsequent optimization operations on faulty nodes.

[0069] Function 2: Obtaining the expected failure node and the corresponding expected failure time is beneficial for analyzing the delay failure of network nodes in subsequent continuous operation periods, thereby effectively identifying the chain reaction of delay failure of network nodes in the network system.

[0070] Function 3: Obtain the expected failure node and the corresponding expected failure time, which facilitates the subsequent judgment of the failure chain reaction, thereby determining the failure isolation priority of the expected failure node in the case of failure chain reaction (such as prioritizing the isolation of core nodes that are prone to chain reaction), avoiding the waste of resources or excessive intervention caused by "one-size-fits-all" isolation.

[0071] Step 2: During the second running segment, the expected failure node and the expected failure time are determined again. By comparing the expected failure nodes determined in the first and second running segments, new expected failure nodes are identified.

[0072] In step two, the method for identifying new expected failure nodes is as follows:

[0073] During the second running period, the expected failure node and the expected failure time are determined again;

[0074] It should be noted that the method for determining the expected fault nodes and expected fault times in the second running segment is the same as that for determining the expected fault nodes and expected fault times in the first running segment. It should also be noted that the expected fault times of the expected fault nodes that appear in the first and second running segments are all after the second running segment. It can be understood that the present invention mainly judges the delay fault chain reaction between network nodes by analyzing the predicted network node delays in consecutive running segments. For network nodes whose expected fault times in the first running segment may be in the second running segment, fault isolation of the network nodes can be performed directly at the beginning or end of the second running segment.

[0075] The expected fault nodes in the first running segment are compared with the expected fault nodes in the second running segment. In the second running segment, the expected fault nodes with different types from the expected fault nodes in the first running segment are marked as new expected fault nodes.

[0076] Step 3: By analyzing the continuous growth of newly predicted fault nodes during the second running segment, determine whether there is a surge in fault nodes;

[0077] In step three, the process of performing a continuous growth analysis on the newly predicted fault nodes during the second runtime period is as follows:

[0078] Obtain the number of newly predicted fault nodes at different time points within the second runtime period, and integrate them into a sequence of newly predicted fault node numbers according to time order;

[0079] Linear regression was performed on the sequence of newly predicted failure nodes to determine the linear regression equation y=kx+b for the growth of newly predicted failure nodes, where y is the number of newly predicted failure nodes, k is the slope, x is time, and b is the intercept.

[0080] The significance p-value of the linear regression equation concerning the growth of newly predicted failure nodes was calculated.

[0081] If the slope of the linear regression equation for the growth of newly predicted fault nodes is greater than 0 and the significance P-value is greater than the significance P-th threshold, it indicates that the newly predicted fault nodes are experiencing continuous growth; otherwise, it indicates that there is no continuous growth.

[0082] If a sustained increase occurs, the number of newly predicted fault nodes is proportional to the number of predicted fault nodes in the first running segment to obtain the fault node surge value.

[0083] In some embodiments, the fault node surge value is compared with the fault node surge threshold;

[0084] If the surge value of fault nodes is greater than or equal to the surge threshold of fault nodes, it indicates that there is a surge of fault nodes.

[0085] If the surge value of fault nodes is less than the surge threshold of fault nodes, it means that there is no surge of fault nodes and no operation is performed.

[0086] Step 4: If present, combine the network node topology, the network node historical fault database, and the expected fault time to perform causal relationship and delayed fault synchronization analysis on the new expected fault node and the expected fault node in the first running segment, and determine whether the expected fault node in the first running segment will trigger a fault chain reaction, leading to a surge in fault nodes.

[0087] In step four, the topology of the network nodes is obtained through the design architecture of the network system, wherein the topology of the network nodes includes the causal relationships between the connections of each network node.

[0088] In step four, the historical fault database of the network node contains other network nodes that caused the same delay fault when the network node experienced multiple delay faults. The historical fault database of the network node is composed of multiple delay fault data groups. For example, when network node A experienced a delay fault in the past, it caused delay faults in network node B and network node C respectively. Then the delay fault data groups are (AB) and (AC). It should be noted that in the historical fault database, if network node A has multiple historical delay faults, it may contain multiple delay fault data groups (AB) or (AC). The delay fault data group also contains the delay fault time of the network node, for example, (A[8.00]-B[8.01]).

[0089] In step four, the process of performing causal relationship analysis on the newly predicted fault nodes and the predicted fault nodes within the first running segment is as follows:

[0090] Based on the network node topology, determine whether there is a connection causal relationship between the expected fault node and the newly expected fault node in the first runtime segment, and whether the connection causal relationship is consistent with the connection causal relationship in the topology.

[0091] If there is a causal relationship between the expected fault node and the new expected fault node in the first running segment and the causal relationship is consistent, then fault synchronization analysis is performed; otherwise, no operation is performed.

[0092] It should be noted that the consistent connection causal relationship means that: the present invention analyzes the delayed failure chain reaction, so if the expected failure node in the first running segment is the causal relationship before the new expected failure node is the causal relationship after the new expected failure node is the causal relationship, then the connection causal relationship is consistent if the connection causal relationship between the expected failure node in the first running segment and the new expected failure node is the same in the network node topology, otherwise the connection causal relationship is inconsistent.

[0093] Understandably, the purpose of determining whether there is a causal relationship between the expected fault node in the first running segment and the new expected fault node, and whether the causal relationship is consistent, is to: by analyzing the causal relationship, we can initially identify whether the expected fault node in the first running segment has a delayed chain reaction effect on the new expected fault node. If there is a causal relationship and the causal relationship is consistent, it indicates that there is a high probability, so delayed fault synchronization analysis is performed.

[0094] In step four, the process of performing delay fault synchronization analysis on the newly predicted fault nodes and the predicted fault nodes in the first running segment is as follows:

[0095] In the historical fault database of network nodes, the number of delay fault data groups with the same causal relationship between the newly expected fault nodes and the expected fault nodes in the first running segment is counted to obtain the number of delay fault impacts of the expected fault nodes in the first running segment. The delay impact frequency value is obtained by proportionally calculating the number of delay faults of the expected fault nodes in the first running segment.

[0096] Understandably, the frequency value of delay impact reflects the proportion of times that a delayed failure of a predicted fault node in the first running segment in history leads to a delayed failure of a newly predicted fault node. The higher the proportion, the higher the probability that the delayed failure of the predicted fault node in the first running segment will have an impact on the delayed failure of the newly predicted fault node.

[0097] The total number of delayed failures of the expected fault nodes during the first running segment can be obtained by statistically analyzing the number of occurrences of the expected fault nodes during the first running segment in the historical fault database.

[0098] Based on the delayed fault data group with the same connection causal relationship between the new expected fault node and the expected fault node in the first runtime segment, the delayed fault time difference of the delayed fault data group is obtained, wherein the delayed fault time difference is the difference in the delayed fault time of two network nodes contained in the delayed fault data group.

[0099] The delay fault time difference of all delay fault data groups is averaged to obtain the delay reference time.

[0100] The actual delay time is obtained by subtracting the delayed failure time of the expected fault node in the first running segment from the delayed failure time of the newly expected fault node.

[0101] Calculate the ratio of the absolute deviation between the actual delay time and the delay reference time to obtain the simultaneous value of the delay impact;

[0102] Wherein, the delay affects the simultaneous value = ;

[0103] It is understandable that the delay impact value reflects the degree of deviation between the current delay failure time difference and the historical delay failure time difference. The smaller the deviation, the higher the probability that the expected failure node in the first running segment will have a delay failure impact on the newly expected failure node.

[0104] The deviation between the delay effect at the same frequency and the delay effect at the same time is calculated to obtain the delay fault cascading value;

[0105] In some embodiments, a delay fault cascading value is compared with a delay fault cascading threshold;

[0106] If the delay fault cascading value is greater than or equal to the delay fault cascading threshold, then the expected fault node in the first runtime segment corresponding to the new expected fault node is marked as a delay-affected node.

[0107] If the delay fault cascading value is less than the delay fault cascading threshold, no action will be taken;

[0108] Based on the newly predicted faulty node, if the newly predicted faulty node has at least one corresponding delay-affected node, then the newly predicted faulty node is marked as a delay-affected node;

[0109] Conversely, if the newly predicted faulty node does not have any corresponding delay-affected node, no action will be taken.

[0110] The proportion of nodes affected by the statistical delay among the newly predicted faulty nodes is used to obtain the fault cascading determination value.

[0111] In some embodiments, if the fault chain determination value is greater than or equal to the fault chain determination threshold, it indicates that the expected fault node in the first running period triggers a fault chain reaction, resulting in a surge of fault nodes; otherwise, it indicates that the expected fault node in the first running period does not trigger a fault chain reaction.

[0112] Step 5: If so, determine the fault isolation priority of the expected fault nodes in the first running segment, and perform fault isolation on the expected fault nodes in the first running segment in sequence according to the fault isolation priority;

[0113] In step five, the process of determining the fault isolation priority of the expected faulty node within the first runtime segment is as follows:

[0114] Based on any expected fault node in the first runtime segment, count the number of times the expected fault node is marked as a delay-affected node, sort the expected fault nodes in the first runtime segment in descending order according to the number of times the expected fault node is marked as a delay-affected node, and determine the fault isolation priority of the expected fault nodes in the first runtime segment.

[0115] Based on the fault isolation priority, and in conjunction with Kubernetes (container orchestration), the nodes expected to fail in the first runtime segment are isolated sequentially.

[0116] The technical solution of this invention is as follows: During the first runtime phase, network nodes whose network latency exceeds the warning baseline and is close to the safety baseline are marked as high-risk fault nodes. Through predictive analysis of network latency, expected fault nodes and their expected failure times are determined within the high-risk fault nodes. During the second runtime phase, expected fault nodes and their expected failure times are determined again. By comparing the expected fault nodes determined in the first and second runtime phases, new expected fault nodes are identified. Through continuous growth analysis of the new expected fault nodes in the second runtime phase, it is determined whether there is a surge in fault nodes. If so, the network node topology and historical fault data are considered. Based on the database and the expected failure time, causal relationship and delayed failure synchronization analysis are performed on the newly expected failure nodes and the expected failure nodes in the first running segment. It is determined whether the expected failure nodes in the first running segment will trigger a failure chain reaction, leading to a surge in failure nodes. If so, the failure isolation priority of the expected failure nodes in the first running segment is determined, and the expected failure nodes in the first running segment are isolated in sequence according to the failure isolation priority. This invention mainly realizes the identification of delayed failure chain reaction of network nodes in the continuous running segment of the network system and determines the priority of delayed failure isolation of network nodes, thereby effectively improving the health management efficiency of network system operation and maintenance.

[0117] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A real-time response method for automated monitoring of network operation and maintenance, characterized in that: include: During the first run, network nodes whose network latency exceeds the warning baseline and is close to the safety baseline are marked as high-risk fault nodes. Through predictive analysis of network latency, the expected fault nodes and expected fault times are determined among the high-risk fault nodes. During the second running phase, the expected failure nodes and expected failure times are determined again. By comparing the expected failure nodes determined in the first and second running phases, new expected failure nodes are identified. By analyzing the continuous growth of newly predicted fault nodes during the second runtime period, it can be determined whether there is a surge in fault nodes. If present, combine the network node topology, the network node historical fault database, and the expected fault time to perform causal relationship and delayed fault synchronization analysis on the new expected fault nodes and the expected fault nodes in the first running segment, and determine whether the expected fault nodes in the first running segment trigger a fault chain reaction, leading to a surge in fault nodes. If so, determine the fault isolation priority of the expected fault nodes in the first running segment, and perform fault isolation on the expected fault nodes in the first running segment in sequence according to the fault isolation priority.

2. The real-time response method for automated monitoring of network operation and maintenance according to claim 1, characterized in that: The process of marking high-risk fault nodes is as follows: When the network latency of a network node exceeds the warning baseline, the network latency deviation between the network latency and the safety baseline is calculated to obtain the network latency approximation value. If the network latency is close to or less than the network latency threshold, the network node is marked as a high-risk fault node.

3. The real-time response method for automated monitoring of network operation and maintenance according to claim 1, characterized in that: The process of determining the expected failure node and the expected failure time within the high-risk failure node is as follows: The time period between the point when the network latency of a high-risk fault node exceeds the warning baseline and the point when the network latency approaches the safety baseline is marked as the analysis period. The network latency at different time points within the analysis period is summarized into a network latency sequence according to time order. After normalizing the network delay sequence, network delay is predicted using an LSTM model. The time point when the network delay reaches the safe baseline is extracted from the network delay prediction results to obtain the delay critical point of high-risk fault nodes. If the latency threshold is within the network system's required operating period, then high-risk fault nodes are marked as expected fault nodes, and the latency threshold is the expected fault time.

4. The real-time response method for automated monitoring of network operation and maintenance according to claim 3, characterized in that: The method for identifying newly predicted fault nodes is as follows: During the second runtime phase, anticipated fault nodes with different types from those anticipated fault nodes in the first runtime phase are marked as new anticipated fault nodes.

5. The real-time response method for automated monitoring of network operation and maintenance according to claim 4, characterized in that: The process of performing continuous growth analysis on newly predicted fault nodes during the second operating period is as follows: Obtain the number of newly predicted fault nodes at different time points within the second runtime period, and integrate them into a sequence of newly predicted fault node numbers according to time order; After performing linear regression on the sequence of newly predicted failure nodes, the significance P-value is calculated. If both the linear regression and the significance P-value meet the requirements, it indicates that there is a continuous increase. If a sustained increase occurs, the number of newly predicted fault nodes is proportional to the number of predicted fault nodes in the first running segment to obtain the fault node surge value. If the surge value of fault nodes is greater than or equal to the surge threshold of fault nodes, it indicates that a surge of fault nodes has occurred.

6. The real-time response method for automated monitoring of network operation and maintenance according to claim 5, characterized in that: The process of conducting causal relationship analysis is as follows: Based on the network node topology, if there is a connection causal relationship between the expected fault node and the newly expected fault node in the first runtime segment and the connection causal relationship is consistent, then fault synchronization analysis is performed.

7. The real-time response method for automated monitoring of network operation and maintenance according to claim 6, characterized in that: The fault synchronization analysis process is as follows: In the historical fault database of network nodes, based on the delay fault data group with the same causal relationship between the newly expected fault node and the expected fault node in the first running segment, the delay impact frequency value and delay impact simultaneous value are processed, and the deviation is calculated to obtain the delay fault chain value. If the delay fault cascading value is greater than or equal to the delay fault cascading threshold, then the expected fault node in the first runtime segment corresponding to the new expected fault node is marked as a delay-affected node. If a newly predicted faulty node has at least one corresponding delay-affected node, then the newly predicted faulty node is marked as a delay-affected node. The proportion of nodes affected by the statistical delay among the newly predicted faulty nodes is used to obtain the fault cascading determination value. If the fault cascading determination value meets the requirements, the expected fault node in the first running segment will trigger a fault cascading reaction, resulting in a surge of fault nodes.

8. The real-time response method for automated monitoring of network operation and maintenance according to claim 7, characterized in that: The method for obtaining the delay-affected frequency value is as follows: The number of delayed fault data groups with the same causal relationship between the newly predicted fault node and the predicted fault node in the first running segment is counted. The number of delayed fault impacts of the predicted fault node in the first running segment is obtained, and the ratio is calculated with the total number of delayed faults of the predicted fault node in the first running segment to obtain the frequency value of delayed impact. The total number of delayed failures of the expected fault nodes during the first running period can be obtained by statistically analyzing the occurrence count of the expected fault nodes during the first running period in the historical fault database.

9. The real-time response method for automated monitoring of network operation and maintenance according to claim 8, characterized in that: The method for obtaining the simultaneous value of the delay effect is as follows: Based on the delayed fault data group with the same connection causal relationship between the new expected fault node and the expected fault node in the first runtime segment, the delayed fault time difference of the delayed fault data group is obtained, wherein the delayed fault time difference is the difference in the delayed fault time of two network nodes contained in the delayed fault data group. The delay fault time difference of all delay fault data groups is averaged to obtain the delay reference time. The actual delay time is obtained by subtracting the delayed failure time of the expected fault node in the first running segment from the delayed failure time of the newly expected fault node. The ratio of the absolute deviation between the actual delay time and the delay reference time is calculated to obtain the simultaneous value of the delay impact.

10. A real-time response method for automated monitoring of network operation and maintenance according to claim 8, characterized in that: The method for determining the fault isolation priority is as follows: Based on any expected fault node in the first runtime segment, count the number of times the expected fault node is marked as a delay-affected node. Sort the expected fault nodes in the first runtime segment in descending order according to the number of times the expected fault node is marked as a delay-affected node, and determine the fault isolation priority of the expected fault nodes in the first runtime segment.

Images