Fault self-recovery method and device of network equipment, storage medium and system

Abstract

The invention provides a fault self-recovery method and device of network equipment, a storage medium and a system. The method comprises the following steps: acquiring equipment basic information, equipment health degree information, equipment network link information and equipment traffic information of the network equipment for multiple times; determining a fault rate prediction value of the network equipment based on the equipment basic information, the equipment health degree information, the equipment network link information and the equipment flow information by adopting a Transform model; and under the condition that the fault rate predicted value is greater than or equal to the fault rate threshold value, determining a target self-healing operation based on the equipment basic information, the equipment health degree information, the equipment network link information and the equipment flow information by adopting an AI model, and calling a corresponding interface according to the target self-healing operation so as to realize self-healing of the network equipment. The problem that an effective self-healing strategy is difficult to realize in a complex scene through a network fault processing method in an existing scheme is solved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a fault self-healing method for network devices, a fault self-healing device for network devices, a computer-readable storage medium, and a fault self-healing system for network devices. Background Technology

[0002] Traditional network fault handling methods struggle to implement effective self-healing strategies in complex scenarios, especially when facing new hybrid faults such as hardware overload caused by software vulnerabilities. They lack standardized processing procedures and dynamic adjustment capabilities, resulting in prominent issues of response latency and policy consistency.

[0003] Furthermore, existing technologies also have shortcomings in data fusion and processing. Data acquisition is often limited to a single dimension, such as focusing only on the CPU (Central Processing Unit) utilization or memory usage of a device, failing to comprehensively integrate multi-source heterogeneous data such as device traffic information, health indicators, and configuration parameters. This leads to information silos and limits the predictive ability of the model. Simultaneously, the feature selection and extraction methods in the data preprocessing process are relatively simple, failing to effectively uncover the complex relationships and dynamic evolution patterns inherent in the data. This directly affects the accuracy and real-time performance of network fault prediction. Moreover, traditional fault handling strategies often lack the ability to self-learn and iteratively optimize. Once the environment changes, such as network topology adjustments or the evolution of business traffic models, the effectiveness of existing solutions will significantly decrease, making it difficult to guarantee long-term stability and efficiency.

[0004] In other words, existing network fault handling methods are difficult to implement effective self-healing strategies in complex scenarios. Summary of the Invention

[0005] The main objective of this application is to provide a fault self-healing method, a fault self-healing device, a computer-readable storage medium, and a fault self-healing system for network devices, so as to at least solve the problem that existing network fault handling methods are difficult to implement effective self-healing strategies in complex scenarios.

[0006] To achieve the above objectives, according to one aspect of this application, a fault self-healing method for a network device is provided, comprising: repeatedly acquiring basic device information, device health information, device network link information, and device traffic information of the network device; the basic device information including device model, device type, device configuration, network address, and device unique identifier; the device health information including processor utilization, memory utilization, hard disk utilization, and acquisition time; the device network link information including IP address, node information, bandwidth utilization, transmission latency, and packet loss rate; and the device traffic information including source IP, destination IP, source port, destination port, and protocol; using a Transformer model based on the basic device information, device health information, device network link information, and device traffic information to determine a predicted fault rate value for the network device; and when the predicted fault rate value is greater than or equal to a fault rate threshold, using an AI model based on the basic device information, device health information, device network link information, and device traffic information to determine a target self-healing operation, and calling a corresponding interface according to the target self-healing operation to achieve self-healing of the network device.

[0007] According to another aspect of this application, a fault self-healing device for a network device is provided, comprising: an acquisition unit, configured to acquire multiple times device basic information, device health information, device network link information, and device traffic information of the network device, wherein the device basic information includes device model, device type, device configuration, network address, and device unique identifier; the device health information includes processor utilization, memory utilization, hard disk utilization, and acquisition time; the device network link information includes IP address, node information, bandwidth utilization, transmission delay, and packet loss rate; and the device traffic information includes source IP, destination IP, source port, destination port, and protocol; a first processing unit, configured to use a Transformer model to determine a predicted fault rate of the network device based on the device basic information, device health information, device network link information, and device traffic information; and a second processing unit, configured to, when the predicted fault rate is greater than or equal to a fault rate threshold, use an AI model to determine a target self-healing operation based on the device basic information, device health information, device network link information, and device traffic information, and call a corresponding interface according to the target self-healing operation to achieve self-healing of the network device.

[0008] According to another aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform any of the methods described.

[0009] According to another aspect of this application, a fault self-healing system for a network device is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include methods for performing any one of the methods described.

[0010] By employing the technical solution of this application, the Transformer model is used to fuse and process multi-source heterogeneous data and output failure rate prediction values, overcoming the barriers of data type and source, and achieving a comprehensive and in-depth understanding of network device status. The Transformer model, based on a self-attention mechanism, can capture complex dependencies between multi-dimensional data in parallel, thereby accurately predicting failures in complex scenarios and avoiding misjudgments due to data bias. When the predicted failure rate is greater than or equal to the failure rate threshold, an AI model, particularly reinforcement learning technology, is used to generate self-healing operations based on real-time network device status information. This allows the model to learn optimal strategies in a dynamic environment, achieving a balance between fault prevention and system performance optimization. It can flexibly adjust according to the actual network conditions, improving the targeting and effectiveness of self-healing and reducing response latency. The AI ​​model of this application not only has fault prediction capabilities but can also derive optimal self-healing operations based on the prediction results, identify the root causes of failures, and generate targeted self-healing strategies. This enables automatic response to failures in complex scenarios, avoiding the delays and uncertainties of manual decision-making, improving the overall self-healing capability and efficiency of the system, and solving the problem that existing network fault handling methods struggle to implement effective self-healing strategies in complex scenarios. Attached Figure Description

[0011] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0012] Figure 1 A flowchart illustrating a fault self-healing method for a network device according to an embodiment of this application is shown.

[0013] Figure 2 A flowchart illustrating another fault self-healing method for a network device provided according to an embodiment of this application is shown.

[0014] Figure 3 A network topology diagram according to an embodiment of this application is shown;

[0015] Figure 4 Another network topology diagram provided according to an embodiment of this application is shown;

[0016] Figure 5 A schematic diagram of a Transformer standard encoder and optimized decoder provided according to an embodiment of this application is shown;

[0017] Figure 6 A schematic diagram of the internal structure of a computer device for implementing a fault self-healing method for network devices according to an embodiment of this application is shown.

[0018] Figure 7 A structural block diagram of a fault self-healing device for a network device provided according to an embodiment of this application is shown. Detailed Implementation

[0019] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0020] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0021] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0022] As described in the background section, existing network fault handling methods struggle to implement effective self-healing strategies in complex scenarios. To address these technical issues, embodiments of this application provide a network device fault self-healing method, a network device fault self-healing device, a computer-readable storage medium, and a network device fault self-healing system.

[0023] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0024] Figure 1This is a flowchart of a fault self-healing method for a network device according to an embodiment of this application. Figure 1 As shown, the method includes the following steps:

[0025] Step S101: Obtain the basic device information, device health information, device network link information, and device traffic information of the network device multiple times. The basic device information includes device model, device type, device configuration, network address, and device unique identifier. The device health information includes processor utilization, memory utilization, hard disk utilization, and collection time. The device network link information includes IP address, node information, bandwidth utilization, transmission delay, and packet loss rate. The device traffic information includes source IP, destination IP, source port, destination port, and protocol.

[0026] Specifically, basic device information is used to clarify the static attributes of the device, ensuring that different devices can be accurately distinguished in a large-scale network environment; health information is used to reflect the resource utilization and current operating load of the device; network link information is used to reveal the transmission performance and connection quality of the device in the topology; and traffic information reflects the behavioral characteristics and service load patterns of the device during the communication process.

[0027] Step S102: Using the Transformer model (a deep learning model based on a self-attention mechanism), based on the above-mentioned basic device information, the above-mentioned device health information, the above-mentioned device network link information, and the above-mentioned device traffic information, the predicted failure rate of the above-mentioned network device is determined.

[0028] Specifically, the Transformer model relies on a multi-head self-attention mechanism to analyze data features from different dimensions in parallel at the same time, capturing deep dependencies between multi-source information. For example, when device CPU utilization continues to rise and is accompanied by an increase in link packet loss rate, the model can automatically identify the strong correlation between this combination of features and potential faults. At the same time, the Transformer's time-series modeling capabilities can uncover the evolution trend of indicators over time, thereby identifying precursors before faults occur.

[0029] Step S103: When the predicted failure rate is greater than or equal to the failure rate threshold, the AI ​​model (artificial intelligence model) is used to determine the target self-healing operation based on the basic information of the device, the health information of the device, the network link information of the device, and the traffic information of the device. The corresponding interface is called according to the target self-healing operation to realize the self-healing of the network device.

[0030] Specifically, when the predicted failure rate calculated by the Transformer model is greater than or equal to a preset failure rate threshold, the system determines that the network device is at high risk of failure. At this point, the method further invokes an AI model (such as a reinforcement learning agent) to comprehensively analyze the current network operating status by combining the collected basic device information, device health information, network link information, and traffic information, in order to determine the target self-healing operation suitable for the current scenario.

[0031] Through the above embodiments, by employing the Transformer model to fuse and process multi-source heterogeneous data and output failure rate predictions, the barriers of data type and source are overcome, achieving a comprehensive and in-depth understanding of network device status. The Transformer model, based on a self-attention mechanism, can capture complex dependencies between multi-dimensional data in parallel, thereby accurately predicting failures in complex scenarios and avoiding misjudgments due to data bias. When the predicted failure rate is greater than or equal to the failure rate threshold, by utilizing an AI model, particularly reinforcement learning technology, to generate self-healing operations based on real-time network device status information, it can learn optimal strategies in a dynamic environment, achieving a balance between fault prevention and system performance optimization. This allows for flexible adjustments based on the actual network conditions, improving the targeting and effectiveness of self-healing and reducing response latency. The AI ​​model in this application not only possesses fault prediction capabilities but can also derive optimal self-healing operations based on prediction results, identify the root causes of failures, and generate targeted self-healing strategies. This enables automatic response to failures in complex scenarios, avoiding the delays and uncertainties of manual decision-making, improving the overall self-healing capability and efficiency of the system, and solving the problem that existing network fault handling methods struggle to implement effective self-healing strategies in complex scenarios.

[0032] In one optional scheme, a Transformer model is used to determine the predicted failure rate of the network device based on the aforementioned device basic information, device health information, device network link information, and device traffic information. This includes: sequentially preprocessing and concatenating the aforementioned device basic information, device health information, device network link information, and device traffic information to obtain concatenated features for each acquisition result; the preprocessing includes missing value imputation, outlier detection and removal, and normalization; performing feature fusion on the concatenated features of each acquisition result using a linear transformation to obtain fused features, and determining the positional encoding corresponding to the fused features; determining the final input as the sum of the fused features and the positional encoding, and processing the final input using a multi-head self-attention encoder of the Transformer model to obtain the input to the feedforward neural network layer of the Transformer model; processing the feedforward neural network layer input using the feedforward neural network layer of the Transformer model to obtain a feedforward processing encoding; and decoding the feedforward processing encoding using a decoder of the Transformer model to obtain the predicted failure rate.

[0033] In the above embodiments, missing value imputation, outlier detection and removal, and normalization processes are performed to standardize and clean the original multi-source heterogeneous data, avoiding biases caused by incomplete data collection, noise interference, or differences in measurement units. By concatenating various preprocessed features into a single feature space and then using linear transformation for feature fusion, the key attributes of each feature are preserved, enabling the model to simultaneously perceive device structural attributes, operational health status, link performance, and service traffic characteristics within a single vector representation. Based on the fused features, location encoding is introduced, allowing the model to identify the temporal sequence and periodicity of each data collection, thereby understanding the device's status and performance trends over time and detecting potential faults in advance. Utilizing a multi-head self-attention mechanism, the model can capture complex dependencies between features of different dimensions in parallel, avoiding false positives or false negatives caused by biased judgments based on a single dimension, thus improving the comprehensiveness and accuracy of predictions.

[0034] In another alternative approach, the spliced ​​features obtained from each of the above acquisitions are fused using a linear transformation to obtain fused features, including: determining that the feature product is the product of the spliced ​​features and the corresponding weights; and determining that the fused features are the sum of the feature product and the corresponding bias parameter.

[0035] In the above embodiments, feature fusion is achieved by applying linear transformations to the spliced ​​features of each acquisition result. Device basic information, health indicators, link parameters, and traffic features originally belong to different types and scales of data. Through linear transformation operations of feature product and bias, all spliced ​​features are mapped to a vector space of the same dimension, enabling the model to compare and calculate multi-source information in a unified feature space, avoiding training bias caused by inconsistent data types. The learnable weight parameters introduced in the linear transformation can dynamically adjust the importance of various features based on the training results. For example, CPU utilization contributes more to fault prediction in certain scenarios, so the model can automatically assign a higher weight to this indicator; while noise or weakly correlated features are compressed, thereby improving the model's sensitivity to key information and further enhancing the accuracy of fault rate prediction.

[0036] In some exemplary embodiments, before repeatedly acquiring the network device's basic information, health information, network link information, and traffic information, the method further includes: calculating the loss value of the Transformer model using a binary cross-entropy loss function; and using an Adam optimizer (adaptive moment estimator) to optimize the weights and bias parameters of the Transformer model based on the loss value.

[0037] In the above embodiments, before collecting device information multiple times based on the SNMP (Simple Network Management Protocol), the Transformer model is trained first. A binary cross-entropy loss function is used to compare the model's output with the true labels to calculate the loss value. Then, the Adam optimizer is used to iteratively optimize the weights and bias parameters in the model based on the loss value. This allows the Transformer model to gradually reduce errors and improve convergence speed in prediction tasks. The binary cross-entropy loss function accurately characterizes the difference between the predicted failure rate and the actual failure situation, giving the model stronger discriminative ability. The Adam optimizer, by introducing momentum and adaptive learning rate mechanisms, avoids the problem of slow convergence or getting trapped in local optima in traditional gradient descent methods, thus ensuring efficient convergence even with complex and multi-dimensional device information input.

[0038] In other exemplary embodiments, an AI model is used to determine a target self-healing operation based on the aforementioned device basic information, device health information, device network link information, and device traffic information. This includes: processing the aforementioned device basic information, device health information, device network link information, device traffic information, and the self-healing operation set of the AI ​​model using the aforementioned AI model to obtain a preliminary self-healing operation. The set of self-healing operations includes at least adjusting bandwidth allocation, restarting the device, increasing memory capacity, checking the status of physical or logical network cards, and adjusting processor priority; calculating a reward value for the aforementioned preliminary self-healing operation using a reward function to obtain a reward result; and determining whether the target self-healing operation is the aforementioned preliminary self-healing operation based on the reward result.

[0039] In the above embodiments, firstly, based on the input device basic information, health information, network link information, and traffic information, the AI ​​model generates a preliminary self-healing operation for the current fault environment from a preset set of self-healing operations. Then, the preliminary operation is quantitatively evaluated using a preset reward function. The reward function comprehensively considers multiple dimensions of indicators, such as the operation's effect on reducing the failure rate, the cost of resource consumption, the impact on system stability, and recovery speed, to calculate a reward value and obtain the reward result. If the reward result indicates that the preliminary self-healing operation can significantly reduce the failure rate, improve performance, and keep costs under control, then the preliminary self-healing operation is identified as the target self-healing operation and executed immediately; if the reward result is low, the system abandons the operation or continues to try other candidate operations, avoiding a self-healing method that simply relies on fixed rules and achieving a more intelligent self-healing decision.

[0040] In one optional approach, calling the corresponding interface based on the aforementioned target self-healing operation includes: when the aforementioned target self-healing operation includes at least two operations, sorting the operation order of the aforementioned target self-healing operation according to the magnitude of the aforementioned reward results of each of the aforementioned operations to obtain a target operation order, wherein the sorting rule of the aforementioned operation order is from largest to smallest; and calling the corresponding interface in sequence according to the aforementioned target operation order and the aforementioned target self-healing operation.

[0041] In the above embodiments, when the target self-healing operation includes at least two operations, the operation order is sorted from largest to smallest according to the reward result of each operation, and the corresponding interfaces are called sequentially according to the sorted target operation order. This ensures that the operation most likely to improve the network device's operating status is executed first, thereby enabling rapid and effective measures to be taken when the device fails or its performance degrades. This not only improves the execution efficiency of self-healing operations and avoids resource consumption from ineffective or inefficient operations, but also enables dynamic optimization of the operation order when multiple operations coexist. This allows the system to complete the most valuable self-healing measures first within a limited time, thereby minimizing device risk and improving the accuracy and stability of network device self-healing.

[0042] In some exemplary embodiments of this application, the device basic information, device health information, device network link information, and device traffic information of the network device are obtained multiple times, including: based on the SNMP protocol, the device basic information, device health information, device network link information, and device traffic information of the network device are obtained multiple times.

[0043] In the above embodiments, by repeatedly acquiring basic device information, device health information, device network link information, and device traffic information of network devices based on SNMP, a continuous data sequence can be formed in the time dimension. This avoids the impact of accidental fluctuations or data omissions that may occur in a single acquisition on subsequent predictions and judgments, thereby improving the comprehensiveness and reliability of device status monitoring. It also provides more complete and accurate input data for subsequent Transformer models or AI models, enabling the models to better capture the trends and changes in device operating status, thereby improving the accuracy and stability of failure rate prediction and self-healing decision-making.

[0044] To enable those skilled in the art to better understand the technical solution of this application, the implementation process of the fault self-healing method for network devices of this application will be described in detail below with reference to specific embodiments.

[0045] This embodiment relates to a specific fault self-healing method for network devices, such as... Figure 2 As shown, it includes the following steps:

[0046] Step S1: Construct a multi-source heterogeneous data acquisition engine;

[0047] Specifically, step S1 includes: Step S11: Deploying hardware, mainly including servers and storage devices. The server can be, for example, an SNMP (Simple Network Management Protocol Manager Node) management node. A high-performance server is deployed as the core processing unit of the data acquisition engine. This server is equipped with a multi-core processor (the number of cores can be selected according to the network scale, generally 8-16 cores for small networks and 32 cores or more for large networks), large-capacity memory (32GB recommended as a starting point, 128GB or even higher for large networks), and high-speed solid-state drives (1TB capacity for small networks, 5TB or more for large networks, used for fast storage and processing of collected data). The primary use case is a small ICT data center (an information and communication technology data center) (equipment scale ≤ 100 units). First, calculate the CPU's basic load: assuming each device generates 100 log / traffic records per second, 100 devices generate 10,000 data records per second; then calculate the processing time for a single data record: if cleaning and feature extraction of a single data record takes 0.5ms, then the single-core processing capacity is 2000 records / second. Final core count requirement: 10,000 records / second ÷ 2,000 records / second / core = 5 cores. Considering redundancy and burst traffic, 8-16 cores are recommended. Next, calculate memory capacity. Assuming 30 seconds of data needs to be cached (10,000 records / second × 30 seconds = 300,000 records), with each record occupying 2KB of memory, then 600MB is required. Operating system and processes: Reserve 4GB of memory. Total requirement: 600MB + 4GB ≈ 4.6GB. Configure 32GB of memory to support future expansion. Assuming a single device generates 1GB of logs per day, 100 devices will generate 100GB of data per day. Retention period: Calculated at 7 days, 700GB is required. Balancing security and efficiency, redundancy and compression are adopted. Using RAID 1 (Level 1 disk array) mode with data compression (compression ratio 50%), the actual required storage is 1.4TB. Therefore, a 2TB solid-state drive is recommended. In practical long-term storage scenarios, a large-capacity disk array should be configured as the long-term data storage device to ensure the storage of a large amount of historically collected data. The capacity of the disk array is determined based on the network size and data retention period. For example, for a medium-sized network, retaining one year's worth of data may require 10-50TB of storage space. The server is connected to the physical network. Step S12: Connect the above server to the network's core switch to ensure it can communicate at high speed with all devices in the network. Use a gigabit or 10-gigabit Ethernet connection to meet the needs of large-scale data transmission. The network topology is as follows: Figure 3 , Figure 4As shown. Step S13: Distributed Network Probe Selection. Select a suitable distributed network probe device based on network size and requirements. For small networks, low-cost probes developed on open-source hardware platforms can be selected; for large networks, professional network probe modules should be used. Step S14: Distributed Network Probe Installation. Install the probe devices in key nodes and links of the network, such as core switch ports, server access ports, and both ends of important business links. Ensure a stable connection between the probe devices and the network during installation. For wired connections, use Cat 5e or Cat 6 network cables to ensure a stable network connection; for wireless connections, select a suitable wireless frequency band (such as the 5GHz band) and a high-speed wireless access point to ensure real-time data transmission. The above connection measures can ensure that the probe can capture network traffic data in real time, including traffic data in formats such as NetFlow (a network traffic monitoring technology) and sFlow (SampledFlow, a sampling traffic analysis protocol), comprehensively reflecting the network traffic distribution and transmission characteristics. Step S15: Assign independent IP addresses to the distributed network probes and configure network parameters such as subnet masks and gateways. Step S16: Verify the physical and logical connectivity of the network probe using methods such as ping testing (Packet Internet Groper, a network diagnostic tool). Specifically, secure communication between the SNMP management node and network devices employs encryption technology to protect transmitted data, preventing data theft or tampering during collection and ensuring data collection security. The collection tool primarily utilizes SNMP protocol integration, and the software chosen is an open-source SNMP collection tool, such as Net-SNMP (NetworkSimple Network Management Protocol, an open-source toolkit for implementing the simple network management protocol), which offers rich functionality and flexible configuration options. Step S17: Install the Net-SNMP software package on the server and configure it accordingly based on the SNMP version of the network devices. For SNMPv3 (the third version of the SNMP protocol), secure usernames, authentication protocols such as MD5 (Message Digest Algorithm 5) or SHA (Secure Hash Algorithm), and encryption protocols such as DES (Data Encryption Standard) or AES (Advanced Encryption Standard) are configured to ensure the security of data transmission. For router devices, traffic data is collected via the SNMP protocol, including input and output traffic at each port.For switches, SNMP protocol is used to collect port traffic data and device health data, such as processor and memory usage. For servers, an agent program is installed to collect traffic data (e.g., network interface card traffic) and health information (e.g., processor utilization, memory utilization, hard drive utilization). The data collection intervals and frequencies are designed, and different collection strategies are developed for different types of data (e.g., device logs and traffic data). Different collection intervals are set based on the importance of network devices and the speed of data changes. The real-time nature and integrity of important data are ensured, while avoiding resource waste and congestion caused by excessive collection. During data collection, timestamps are recorded to ensure the chronological order of the data. Preliminary verification of the collected health information is performed, such as checking if the temperature is within the normal operating range and if the fan speed is reasonable. For data collected by the agent program, the stable operation of the agent program is ensured, its status is checked regularly, and program anomalies are handled promptly. A device polling strategy is configured. Create a device list containing the IP addresses, SNMP community names (for SNMPv1 (the first version of the SNMP protocol) and SNMPv2c (the second version of the SNMP protocol), or security usernames (for SNMPv3) of all SNMP-enabled devices on the network (such as routers, switches, servers, etc.). Create a device configuration file recording information for all SNMP-enabled devices on the network, including device IP addresses, SNMP versions (SNMPv2c or SNMPv3), community strings (for SNMPv2c) or security usernames, authentication protocols (MD5 or SHA), encryption protocols (DES or AES), and keys (for SNMPv3). For example:

[0048] Json[{"ip":"192.168.1.1","version":"v2c","community":"public"},{"ip":"192.168.1.2","version":"v3","usern ame":"admin","auth_proto":"sha","auth_key":"auth_key_123","priv_proto":"aes","priv_key":"priv_key_456"}].

[0049] Step S18: Write and configure the polling script to periodically poll the device's status information using the command-line tool provided by Net-SNMP. For example, poll the device's CPU utilization, memory usage, interface traffic, and other key indicators every 5 minutes. Note that an anomaly handling mechanism for data collection should be established. When encountering device failures, network connection interruptions, or other situations, the system should automatically record abnormal information and re-collect missing data after the fault is recovered, ensuring data continuity. Perform preliminary format verification on the collected raw data to check whether the data conforms to the SNMP protocol specification and the network probe's output format, removing obviously erroneous or incomplete data to improve the initial data quality. Key device nodes (such as core switches) are integrated with the NetFlow parser. NetFlow device configuration: Enable the NetFlow function on the core switches and edge routers in the network. The configuration methods for devices from different manufacturers vary slightly. Generally, NetFlow export parameters are configured through the command-line interface, including the export target IP address (i.e., the IP address of the data acquisition engine server), the export port (usually 9995), and the activity timeout (e.g., 30 minutes). Setting up the NetFlow parser: We selected the open-source NetFlow parser software nfdump (NetFlowDump, an open-source tool for collecting, storing, and analyzing NetFlow data). Install nfdump on the SNMP management node server and configure it to listen on the specified NetFlow import port. nfdump will receive NetFlow data sent by network devices in real time and parse it. The parsed traffic data includes detailed information such as collection time, source IP, destination IP, source port, destination port, protocol type, packet rate, and bit rate.

[0050] Step S19: Store the polled data in the server's database. A relational database can be selected. Design a suitable table structure to store device information and collected data. For example, the device table could include fields such as device unique identifier, IP address, and device type, while the device health collection table could include fields such as collection time, device unique identifier, CPU usage, and memory usage. Store the key node data parsed from NetFlow in the database. Create a dedicated table to store NetFlow data, with fields including collection time, source IP, destination IP, source port, destination port, protocol type, packet rate, and bit rate. Furthermore, to facilitate subsequent analysis, the NetFlow data can be periodically aggregated, for example, by hourly or daily time intervals to analyze traffic between different IP addresses.

[0051] Step S2: Preprocess the multi-source heterogeneous data;

[0052] Specifically, step S2 includes: S21: Read the collected parameter data from the database and perform data cleaning and preprocessing. This includes removing outliers (such as data points significantly exceeding a reasonable range) and filling missing values ​​(using the mean, median, or time-series-based interpolation methods to fill missing values) to ensure data quality and accuracy. For the collected traffic and health data, missing value processing is performed. For a small number of missing data points, interpolation is used to fill in the missing data using data from adjacent time points; for a large number of missing data points, they are marked as invalid and discarded. Step S22: Outlier detection is performed on the data using statistical methods (such as Z-score) or machine learning methods (such as isolated forest). The outlier data is analyzed to determine whether the data anomaly is caused by equipment failure or noise during the data collection process. Step S23: Data normalization is performed, converting data of different ranges and units into a unified range (such as [0,1]) for subsequent model training and processing. Specifically, assuming n sample points have a certain attribute A value, the maximum value is max. A The minimum value is min A Then the normalized value of attribute A of sample point A is... After standard normalization, ensure that all training data values ​​are within the 0-1 range for easy training and testing. Step S24: Extract the temporal features of the traffic data, such as the specific collection time, as auxiliary features for model training. Step S25: Extract the statistical features of the device traffic data, such as mean, variance, maximum, minimum, kurtosis, and skewness, to describe the distribution and variation of traffic. Extract the statistical features of the health data, such as the mean of processor utilization and the peak of memory utilization, to describe the health status of the device. Step S26: Non-numerical data processing: Encode the device information, converting non-numerical data such as device model and configuration into numerical data, such as using label encoding. Sort the processed data in chronological order to ensure the time-series characteristics of the data. Step S27: Re-import the preprocessed data into the storage database for subsequent model training. After the above steps, the training data is ready.

[0053] Step S3: Based on the preprocessed multi-source heterogeneous data, feature fusion and modeling input are performed, and the Transformer model is used to extract features and calculate the predicted failure rate of network devices;

[0054] Specifically, the Transformer model possesses advantages such as long dependency capture, high parallel computing efficiency, flexible feature interaction, and heterogeneous data adaptation, which aligns with the core requirements of network fault prediction, including large data scale, multiple correlation dimensions, and strong temporal sequence. Therefore, the Transformer model is selected to construct a high-performance network fault prediction model. In this example, the schematic diagram of the applied Transformer standard encoder and optimized decoder is shown below. Figure 5 As shown, step S3 includes: Step S31: Designing a multimodal feature embedding layer for a standard encoder. The embedding layer dimension is consistent with the preprocessed data feature dimension, including device information features, health features, device link features, and device traffic features, etc. That is, multimodal status data input. Specifically, the four preprocessed modal features include: device information features... Includes vectors such as device type and device model; health features Includes vectors such as processor utilization, memory utilization, temperature, power status, and acquisition time; device link characteristics. Includes vectors such as unique device identifier, IP address, uplink node information, downlink node information, bandwidth utilization, and collection time; traffic characteristics. It includes vectors containing unique traffic identifiers, collection time, source IP, destination IP, source port, destination port, protocol type, packet rate, and bit rate. A linear transformation maps these modal features to a unified model dimension d. model Specifically, such as embedding device information features: E dev =X dev W dev +b dev . These are embedded device information features. It is a learnable weight matrix. It is a learnable bias vector. The other three modality features are similar. Device information feature embedding: E dev =X dev W dev +b dev Health feature embedding: It is the embedded health information feature, E health =X health W health +b health Link feature embedding: It is the embedded device network link information characteristic, E link =W link +b link Traffic feature embedding: It is a characteristic of device flow information, E traffic=X traffic W traffic +b traffic Where m is the number of samples in different time series, and d dev d health d link d traffic These are the feature dimensions of each modality, and R is the set of real numbers.

[0055] By concatenating the feature dimensions, we obtain: Specifically, for each sample i (i = 1, 2, 3, ..., m), the concatenated feature vector is: Although the concatenated features include information from all modalities, there may be redundancy and conflicts between the features of different modalities. Therefore, feature fusion is performed again through linear transformation: E fused =E concat W fusion +b fusion ,in, It is a learnable weight matrix used to adjust the weights of features across different modalities. Its parameters are learned through model training and backpropagation. It assigns different weights to features of different dimensions in Econcat, giving higher weights to important features (such as bandwidth utilization) and lower weights to redundant features (such as acquisition time), thereby suppressing redundancy and highlighting key information. It also performs dimensionality transformation. Dimensionality is mapped through matrix multiplication, achieving dimensionality reduction and reducing redundancy. It is a learnable bias vector, whose parameters are learned through training. Its function is to provide an offset for linear transformations, increasing the flexibility of the model's feature space. Without a bias vector, the transformed features always pass through the origin, but the bias vector breaks this constraint, allowing features to shift freely in space. Furthermore, bias compensation can make the feature distribution more reasonable. It provides an offset for linear transformations, increasing the flexibility of the model's feature space and making the feature distribution more reasonable. This is the fused feature, a linear transformation performed on the concatenated feature vector Econcat. Finally, the high-dimensional concatenated features (four modal features: device information, device health information, device network link information, and device traffic information) are compressed to the original dimension, which is the output after linear transformation and the final fusion feature used in subsequent steps. The original dimension mentioned above is the dmodel dimension, referring to the unified vector dimension used by the Transformer model when encoding and processing input features. This dimension ensures that different modal features are in the same feature space after entering the model, facilitating subsequent feature fusion and attention calculation. In this example, after integrating the key information of the four modalities, redundancy and conflicts are eliminated, making it more discriminative. The dimension is determined by the number of columns in Wfusion, which is significantly reduced compared to the dimension of Econcat, reducing the computational complexity of subsequent tasks. It integrates the key information of multiple modalities, eliminating redundancy and conflicts, where m is the sequence length, d... model This is the model dimension. After feature fusion, the concatenated features are weighted and combined to learn the relationships between features from different modalities. This is achieved by adjusting the weight matrix W. fusion This allows more important features to be emphasized. Ultimately, the high-dimensional concatenated features are compressed back to the original dimensions, retaining the most important information. To further stabilize the feature representation, layer normalization is performed after feature fusion: E = LayerNorm(E fused The mathematical formula for layer normalization is:

[0056] Where μ is the mean of the input, σ 2 is the output variance, ∈ is a small constant to prevent division by zero, γ and β are learnable scaling and translation parameters, ⊙ denotes element-wise multiplication, and x is the input fused feature vector. After mapping the multimodal network features to a unified feature space, the subsequent Transformer processing mainly includes the encoder (including positional encoding, multi-head self-attention mechanism, etc.), decoder, and output layer prediction.

[0057] Step S32: Set positional encoding. An improved periodic positional encoding method is adopted, incorporating temporal information. The odd / even dimension is separated using sine or cosine functions, supporting sequences of arbitrary length. The aim is to enhance the model's explicit capture of periodicity, improve temporal interpretability, and increase prediction accuracy. Encoding formula: Where P is the target period. For example, when capturing a daily periodic pattern, P = 86400 seconds; when capturing a periodic pattern, P = 604800 seconds. pos represents the position index, and i represents the dimension index. The output of the unified feature space is then used. Adding this to the position code PE yields the final input representation X: (X = E + PE), where E = LayerNorm(E fused ).

[0058] Step S33: Set up a multi-head self-attention encoder. The multi-head self-attention mechanism is a core component of the Transformer. It captures complex dependencies between different positions in the input sequence by computing multiple attention heads in parallel. Essentially, it's a dynamically weighted aggregation of information, covering more potential combinations of fault causes, reducing the probability of missing key associations, and improving the accuracy and precision of the prediction model. Specifically, set the input sequence... Where m is the sequence length, d model For the aforementioned feature dimensions, Q (query), K (key), and V (value) matrices are generated through three independent fully connected layer linear transformations: Q = XW Q K = XW K V = XW V , In this structure, the Q matrix represents the sequence's focus, indicating which historical states need to be analyzed to determine if a failure is likely; the K matrix represents the sequence's feature labels, reflecting the flow and health characteristics at different historical points in time; and the V matrix represents the sequence's feature content, characterizing the specific values ​​of historical features. Q, K, and V are then split into h parallel "attention heads" (h = 8 in this example) along the feature dimension, with each head having a dimension of d. k =d model / h. Specifically, Where i = 1, 2, 3, ..., h, Attention scores are calculated independently for each head: Specifically, divided by Scaling is applied to prevent excessively large scores from causing the gradient to vanish in the Softmax (normalized exponential function) step. Softmax normalizes scores into weights, representing the degree to which the i-th time point needs to be considered in relation to the j-th time point. These weights are then used to adjust V. i The weighted sum of the (i.e., feature content) yields the output of this head (features focused on important information). Multi-head result concatenation and fusion: The outputs of h attention heads are concatenated and then fused into the final feature through a linear transformation.

[0059] MultiHead(Q,K,V)=Concat(Head1,Head2,...,Head h )·W o Each attention head i (i∈[1,2,...,h]) includes local differential representations, which are combined into a high-dimensional vector through a concatenation operation, and then transformed by a linear transformation W. oThe fusion process ultimately yields the global output features. The core of this step is to integrate information from multiple subspaces, enhancing the model's ability to capture diverse associations while simultaneously outputting unified features for subsequent classification tasks. Specifically, the concatenated dimension is m×(h·d). k )=m×d model ; This is a learnable weight matrix. The final output dimension remains m×d. model The h attention heads essentially extract localized and differentiated features from the input sequence, focusing on different types of associations. After splitting the original high-dimensional features into h low-dimensional subspaces, each head focuses on learning a specific pattern within its subspace, avoiding high-dimensional interference. The output of each head is obtained after splitting and calculating attention weights. The final global output features are obtained by concatenating and fusing the multi-head outputs and performing a linear transformation. Step S34: Residual Connections and Layer Normalization. To stabilize training, accelerate convergence, and efficiently capture multi-level, complex associations, residual connections and layer normalization are added after the multi-head attention output. Specifically: δ = LayerNorm(X + MultiHead(Q, K, V)). This result serves as the input to the feedforward neural network layer. Step S35: Setting up the Feedforward Neural Network Layer. A non-linear transformation is performed on the features at each position to enhance the model's expressive power: FFN(δ) = W2·max(0, W1·δ + b1) + b2. Where δ represents the input features derived from the multi-head attention output, residual connections, and layer normalization, and W1 and b1 are the weight matrices and biases of the first-layer linear transformation, which transform the input features from d model The dimension is mapped to a higher dimension; then, the ReLU (Rectified Linear Unit) non-linear activation function max() is introduced; W2 and b2 are the weight matrix and bias of the second-layer linear transformation, mapping the high-dimensional features back to the original dimension d. modelTo maintain consistency with the input dimension, subsequent residual connections and layer normalization are facilitated. Step S36: Perform residual connections and layer normalization again. The output is Output = LayerNorm(δ + FFN(δ)). Where δ is the input feature derived from the multi-head attention output, residual connections, and layer normalization, and FFN(δ) is the output of δ after processing by the feedforward neural network layer. The multi-head self-attention encoder relies on multiple independent attention heads operating in parallel, which can deeply analyze the complex dependencies of network data from multiple dimensions, taking into account both global correlations and local details, and output features rich in accurate and comprehensive correlation information to the decoder, greatly improving prediction accuracy. Compared with CNN (Convolutional Neural Network, a deep learning model) which is limited by local receptive fields and RNN (Recurrent Neural Network, an artificial neural network structure) which is limited by sequence calculation mode, the multi-head self-attention mechanism significantly reduces the computation time while efficiently integrating multi-source information through parallel weight calculation, achieving a dual breakthrough of accurate dependency capture and efficient parallel computation, and significantly improving the accuracy and efficiency of the prediction model. Step S37: Construct the optimized decoder. For network fault prediction tasks, the decoder's role is to further process the fused features (containing multimodal information and global dependencies) output by the encoder, extracting key features strongly correlated with fault prediction, and preparing for the final binary classification output (whether a fault will occur or not in the future). For binary classification problems, since no sequence generation is required, the decoder can omit the original "masked self-attention" and "encoder-decoder attention" of the Transformer, omitting the complex attention mechanism and reducing model complexity. Only feature transformation and nonlinear activation are retained, with the following structure: global pooling → fully connected layer + nonlinear activation → dropout layer (a network layer that improves the model's generalization ability by randomly masking some neurons during training) → decoder output. Fault prediction requires a global feature vector as the classification basis. Global pooling compresses the input sequence (i.e., the output vector obtained after step S36) into a single vector. Global average pooling or global max pooling can be used. Global average pooling is used if the long-term trend of network device faults is being considered, while global max pooling is used if short-term extreme outliers are being considered. The final output is global features. Here, hglobal represents the result of global pooling of the residual connections and layer normalization performed again in S36. This is applied to the global feature h. global Dimensional adjustments and nonlinear mappings are performed to enhance the model's ability to fit failure modes. in: It is the weight matrix of the decoder; This is the bias term; the ReLU activation function introduces non-linearity to capture the complex relationships between features. Since fault prediction data may contain imbalanced samples or noise, a dropout layer is added to suppress overfitting. After this step, the final output of the decoder is a compressed and transformed feature vector: Decoder output h dec The fault probability is directly passed to the output layer and output through the Sigmoid function (an activation function). in, Let b2 be the output layer weight matrix, where b2 ∈ R. 1 As an output layer bias, the Sigmoid function maps the output to the interval [0, 1], and the result represents the probability of future device failure. If a problem is classified as a potential fault, it is considered normal; otherwise, it is considered normal. Define the model's loss function. For this binary classification (fault or no) problem, the binary cross-entropy loss function is used. Binary cross-entropy loss function: Among them, y i ∈{0,1} represents the true label. This represents the predicted probability, and N is the number of samples. The Adam optimizer is chosen to update the model's parameters during training. Adam trainer: Where, m t =β1m t-1 +(1-β1)g t , v t =β2m t-1 +(1-β2)g t 2 , g t Let η be the gradient, β1 be the exponentially weighted average of the gradients, β2 be the exponentially weighted average of the squared gradients, and m be the learning rate. t Let m represent the exponentially weighted average of the gradient at step t. t-1 Let θ represent the gradient-weighted average result at step t-1, and θ represent the model's parameter set. Initialize the model by randomly initializing the weights and biases. Input the preprocessed time-series data into the Transformer model and perform forward propagation calculations as described above to obtain the model's prediction results. Based on the prediction results and the true labels, calculate the loss value using the binary cross-entropy loss function, and update the model's parameters using the backpropagation algorithm, adjusting the model's weights and biases. During training, evaluate the Transformer model using the training set, calculating metrics such as the training set's loss value, accuracy, precision, recall, and F1 score (harmonic mean score). In this embodiment, the metric evaluation table is shown in Table 1.

[0060] Table 1

[0061]

[0062] During the validation process, the Transformer model is evaluated using a validation set, and metrics such as the validation set loss, accuracy, precision, recall, and F1 score are calculated. In this embodiment, the metric evaluation table is shown in Table 2:

[0063] Table 2

[0064]

[0065] The model converged after 50 rounds of training, achieving an F1 score of 90.7% on the validation set, indicating good predictive ability for equipment failures with high accuracy and precision. Furthermore, the difference between the training and validation set metrics was small (approximately 1%), showing no significant overfitting and strong generalization ability. An API (Application Programming Interface) was then provided for this Transformer network failure prediction model, allowing it to be used by reinforcement learning AI models.

[0066] Step S4: Construct the AI ​​model; specifically, Step S4 includes: Step S41: Define the state space for reinforcement learning, where the state includes device information encoding of network devices, device health data, real-time network link indicators of devices, real-time traffic data of devices, etc. State vector S t It consists of the following dimensions: S t =[D,H t ,L t ,F t Where D represents the equipment information code. This is the one-hot encoding of static characteristics such as equipment type, model, and configuration. The dimension is N. D Among them, H t This provides real-time health information, specifically including processor utilization, memory utilization, disk I / O, temperature, power status, and data acquisition time. H One indicator or dimension. Such as H t (1) For processor load, H t (2) This represents the memory load. Where, L... t This refers to the device's network link information. Specifically, it includes the device's unique identifier, IP address, uplink node information, downlink node information, bandwidth utilization, and data collection time. L Several indicators or dimensions. Among them, F t This provides real-time device traffic information. Specifically, it includes a unique identifier, collection time, source IP, destination IP, source port, destination port, protocol type, packet rate, bit rate, etc. F Each indicator or dimension. Determine the dimension of the state space by calculating its size based on the number of defined state parameters. The total dimension D of the state space is the sum of the dimensions of each subspace: D = ND +N H +N L +N F Step S42: Define the action space for reinforcement learning and the specific network self-healing operations. These include self-healing operations such as adjusting bandwidth allocation, inspecting the physical (or logical) network interface card status, restarting the device, increasing memory capacity, adjusting processor priority, inspecting and adjusting uplink and downlink ports, and resetting and adjusting the routing table. The action set A contains the discretized self-healing operations, indexed by a∈{1,2,...,N}. a}express:

[0067]

[0068] Step S43: Discretize the continuous actions, transforming the continuous action space into a discrete action set to facilitate processing by the reinforcement learning algorithm. For example, adjust the bandwidth allocation, dividing the continuous interval [-30%, +30%] into 5 discrete levels: [-30%, -15%, 0%, +15%, +30%]. Increase the memory capacity, mapping the continuous capacity to discrete values ​​{0, 1, 2, 3...}GB (0 indicates no expansion). The final action space is the Cartesian product of each discrete action, such as A = {bandwidth level} × {memory level} × {other discrete actions}. Step S44: Define the reward function. The basic reward function R(S t ,a,S t+1 It consists of three parts: R = R 故障避免 +R 性能指标 -R 操作成本 The reward function is used to measure the quality of an action. Based on the fault prediction results and changes in equipment status, the reward function is designed; for example, avoiding a fault gives a positive reward, while a fault occurring or equipment performance deteriorating gives a negative reward. Specifically, if a predicted fault is avoided, the fault avoidance reward is +R. fix Otherwise, it is 0. Additionally, based on flow stability (e.g., variance) ) and health (such as the distance δ from the threshold) h )calculate: Where, λ f , λ h This represents the weighting coefficient. The resource consumption of operations such as restarting and scaling is the operational cost, such as R. 操作成本 =C a (C a Given the fixed cost of action a, the mathematical form of the specific reward function is:

[0069] Among them, R fix >0 represents a positive reward for successfully avoiding a fault; R fail >0 represents a negative penalty for the occurrence of a fault; This represents the total number of health statuses exceeding the standard. Step S45: Determine the dynamic transition process of the environment, that is, how the state of the network device changes after performing an action, and establish a state transition model. Specifically, after performing action a, the state changes from S... t Transfer to S t+1 Satisfying the equation: S t+1 =f(S) t ,a,ε t Where f is the transfer function, ε t For environmental noise (such as sudden traffic surges), a dynamic transition model of the environment is modeled, establishing a state transition probability matrix based on historical data statistical analysis or machine learning methods. Specifically, for each action a∈A, a transition probability is defined. Among them, S i For the current state (index i), S j The next state (index j) Indicates that in state S i After performing action a, the state transitions to state S. j The probability of [the transition probability] is calculated. Therefore, the transition probability matrix P = |S| × N is constructed. a ×|S|, where |S| is the size of the discretized state space. Step S46: Set the training objective of reinforcement learning, i.e., maximize the cumulative reward through learning, thereby obtaining the optimal self-healing strategy. The expected cumulative discounted reward to be maximized is: Determine the number of training cycles and step size, and set appropriate training iterations and time steps for each training iteration. Step S47: Initialize the reinforcement learning agent, setting its parameters, specifically the learning rate α (set to 0.001), discount factor γ (set to 0.95), and exploration rate ∈ (set initial value ∈ = 0.9). Step S48: Integrate the network fault prediction model into the reinforcement learning environment. The agent obtains prediction information about the future device state through the fault prediction model to make decisions. At the start of each training iteration, obtain the current state of the network device, including real-time traffic data, health data, etc. The agent selects an action based on the current state and policy network. The action selection can adopt an ε-greedy policy, exploring new actions with a certain probability and selecting the action currently considered optimal with a certain probability. Execute the selected action to obtain the new state of the network device and the obtained reward value. Store the state, action, reward, and new state information in the experience replay buffer for subsequent batch training. When the number of samples in the experience replay buffer reaches a certain threshold, randomly sample a batch of samples to update the agent's policy network and value network. Based on the sampled data, calculate the policy gradient and update the network parameters. During training, gradually decrease the exploration rate ∈, allowing the agent to gradually transition from exploration-based to exploit-based, selecting the optimal action. Step S49: Periodically evaluate the agent's performance using test set data or a real network environment, calculating metrics such as cumulative reward, fault prediction accuracy, and self-healing success rate. Based on the evaluation results, adjust the reinforcement learning hyperparameters, such as learning rate, discount factor, and experience replay buffer size, to continuously optimize the training process. Continuously train the agent until it can obtain stable high rewards in a given environment, forming an effective self-healing strategy.

[0070] Step S5: Execute network fault prediction and self-healing strategy decisions;

[0071] Specifically, the validation set data of the network devices is input into the trained Transformer network fault prediction model for forward propagation calculation to obtain the model's prediction of the device's future state, such as predicting whether the device will experience processor overload or memory shortage failures within the next 10 minutes. The confidence level of the prediction results is calculated, and the reliability of the prediction is judged by the model's output probability. If the confidence level of the prediction results exceeds a set threshold, the device is considered to have a fault risk, triggering a fault warning mechanism. Specifically, different confidence thresholds are set for different types of faults, such as processor faults, memory faults, and abnormal network traffic, to achieve more accurate fault prediction. As in step S3, the results and related data of each fault prediction are recorded, and metrics such as accuracy, recall, and F1 score are calculated to evaluate model performance. Based on information such as prediction time, device identification, predicted fault type, and confidence level, subsequent model optimization is used to adapt to changes in the network environment. When the network fault prediction model detects a fault risk in a device, the current state information of the device is input into the agent trained by reinforcement learning. Based on the current state and learned strategies, the agent selects the optimal self-healing action, such as adjusting the processor's scheduling strategy, releasing memory space, or increasing network bandwidth. A feasibility analysis is performed on the selected self-healing action to check if it complies with device configuration and network constraints, such as whether the device supports memory expansion and whether the network has sufficient bandwidth resources for allocation. If an action is infeasible, the agent selects a suboptimal action until a feasible self-healing action is found. The agent generates specific self-healing operation instructions, writing corresponding instruction code based on the action type and device interface protocol, such as sending configuration commands via SNMP or executing device restart commands via SSH. The agent sets execution priorities for the self-healing operation instructions, determining different priorities based on the severity and urgency of the fault to ensure that critical faults are handled first. The generated self-healing strategy is recorded, including device identifier, fault type, self-healing action, execution instruction, execution priority, and estimated execution time, for subsequent execution and traceability. Furthermore, a rationality check is performed on the self-healing strategy to ensure that the action will not cause new faults in the network system or affect normal business operations. The generated self-healing operation commands are sent to the self-healing execution module, which rationally arranges the execution order based on the command execution priority and the current state of the device. The self-healing execution module communicates with the network device through a hardware or software interface to execute specific self-healing operations, such as adjusting device configuration parameters, restarting device services, and switching to backup components. During the self-healing operation, the module monitors device status changes in real time and records the execution time and any anomalies encountered. After the self-healing operation is completed, the module acquires new device status data, including traffic data and health data, to evaluate the effectiveness of the self-healing operation.The reward value for the self-healing operation is calculated based on this. Depending on the improvement in the device's condition and whether the fault has been eliminated, the reward value is calculated according to a predefined reward function and fed back to the reinforcement learning agent. The results and reward values ​​of the self-healing execution are stored in an experience replay buffer as sample data for subsequent reinforcement learning training. If the self-healing operation fails to resolve the fault or causes new problems, a secondary self-healing mechanism is triggered, regenerating and executing the self-healing policy.

[0072] This embodiment provides a schematic diagram of a network fault prediction and self-healing device based on deep reinforcement learning. The device includes a multi-source heterogeneous data acquisition module, a data preprocessing module, a network fault prediction model module, a reinforcement learning training module, a self-healing strategy generation module, a self-healing strategy execution module, and a network detection feedback module. Specifically: The multi-source heterogeneous data acquisition module is used to collect network device traffic, health data, etc., in various ways. Parallel acquisition (adding SNMP management nodes and asynchronous input / output technology) improves the efficiency and accuracy of data acquisition and reduces latency and errors. The data preprocessing module is used to preprocess (including cleaning, standardization, etc.) the characteristics of device data. More efficient data processing algorithms and data structures (such as hash tables) can be used to improve the speed of data preprocessing and reduce computational resource consumption. The network fault prediction model module constructs a network fault prediction model based on Transformer deep learning. Specifically, the multi-head self-attention mechanism captures global and local dependencies in parallel through multiple sets of attention heads, providing accurate correlation features for prediction; feature fusion capability breaks down data silos, deeply integrates traffic and device health data, and constructs cross-layer correlations; location encoding preserves temporal information, accurately capturing the temporal evolution patterns of network fault precursors. These three elements work together to improve prediction accuracy and optimize efficiency through parallel computing, fully adapting to the dynamic characteristics of the network. The reinforcement learning training module constructs a network fault self-healing decision-making agent. It employs distributed training technology, utilizes parallel computing across multiple computing nodes, and adopts a dynamic load balancing strategy. The self-healing strategy generation and execution modules connect the network fault prediction model API to the reinforcement learning agent, enabling the generation and execution of network fault self-healing strategies. The network detection feedback module re-detects network devices through an SNMP management node and provides feedback on fault repair results. For specific limitations of the deep reinforcement learning-based network fault prediction and self-healing device, please refer to the previous detailed explanation of network fault prediction and self-healing methods. Each of the above modules, whether operating independently or in synergy, can flexibly leverage its core functions through software, hardware, or a combination of both. These modules can be integrated into the processor of a computer device, becoming part of its hardware, or exist as independent units; simultaneously, they can also be stored in the computer device's memory in software form, enabling the processor to quickly call and execute the corresponding module's operations as needed. In the above embodiments, the computer device can be a server, and its internal structure diagram is shown in the attached figure. Figure 6As shown, the device includes a central processing unit (CPU), internal memory, a network interface, and a database connected via a system bus. Specifically, the CPU provides computing and control capabilities; the operating system manages and schedules software and hardware resources, while providing an interactive interface for the user; the internal memory supports the operation of the operating system and computer programs; the database stores fields for characteristic data; and the network interface is used for connecting and communicating with external terminals or devices via a network. When the computer program executes on the CPU, it can implement the aforementioned network fault prediction and self-healing methods.

[0073] This application also provides a specific implementation scenario for network device self-healing based on a reward function mechanism. Specifically, a server gateway device experiences a sudden drop in network throughput, while its CPU utilization abnormally spikes, health indicators show high temperature, and continuously increasing link latency and packet loss rate. AI model processing: AI model input: device model, current configuration parameters, CPU utilization 95%, memory utilization 88%, port latency 180ms, packet loss rate 8%, traffic characteristics. Self-healing operation set: {adjust bandwidth allocation, restart device, increase memory capacity, check physical / logical network card status, adjust processor priority}. Reward function calculation: The initial operation "adjust bandwidth allocation" scores low and fails to significantly reduce CPU pressure. The initial operation "check logical network card status and automatically restart abnormal network cards" scores the highest. The initial operation "adjust processor priority" scores second highest. The AI ​​model selects restarting the abnormal network card and adjusting processor priority as the target self-healing operations based on the reward function output. The system sequentially calls the interfaces: first, the logical network card is restarted, then the processor priority is adjusted. The entire process was completed within 20 seconds, the network returned to normal, and the packet loss rate dropped to 0.5%. Compared to traditional preset scripts, the AI ​​model can make optimal decisions based on real-time data and dynamically adjust the order of operations. By selecting the optimal operation through a reward function mechanism, the average repair time is significantly shortened.

[0074] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0075] This application also provides a fault self-healing device for network devices. It should be noted that the fault self-healing device for network devices in this application can be used to execute the fault self-healing method for network devices provided in this application. This device is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0076] The following describes the fault self-healing device for network equipment provided in the embodiments of this application.

[0077] Figure 7 A schematic diagram of a fault self-healing device for a network device according to an embodiment of this application. (See diagram below.) Figure 7 As shown, the device includes:

[0078] The acquisition unit 10 is used to acquire the basic device information, device health information, device network link information, and device traffic information of the network device multiple times. The basic device information includes the device model, device type, device configuration, network address, and device unique identifier. The device health information includes processor utilization, memory utilization, hard disk utilization, and acquisition time. The device network link information includes IP address, node information, bandwidth utilization, transmission delay, and packet loss rate. The device traffic information includes source IP, destination IP, source port, destination port, and protocol.

[0079] The first processing unit 20 is used to determine the predicted failure rate of the network device based on the above-mentioned device basic information, the above-mentioned device health information, the above-mentioned device network link information and the above-mentioned device traffic information using the Transformer model.

[0080] The second processing unit 30 is used to determine the target self-healing operation by using an AI model based on the device's basic information, device health information, device network link information, and device traffic information when the predicted failure rate is greater than or equal to the failure rate threshold, and to call the corresponding interface according to the target self-healing operation to realize the self-healing of the network device.

[0081] Through the above embodiments, the first processing unit uses the Transformer model to fuse multi-source heterogeneous data and output a fault rate prediction value, overcoming the barriers of data type and source, and achieving a comprehensive and in-depth understanding of the network device status. The second processing unit, using a self-attention mechanism, enables the Transformer model to capture complex dependencies between multi-dimensional data in parallel, thus accurately predicting faults in complex scenarios and avoiding misjudgments due to data bias. When the fault rate prediction value is greater than or equal to the fault rate threshold, an AI model, particularly reinforcement learning technology, is used to generate self-healing operations based on real-time network device status information. This allows the system to learn optimal strategies in a dynamic environment, achieving a balance between fault prevention and system performance optimization. This allows for flexible adjustments based on the actual network conditions, improving the targeting and effectiveness of self-healing and reducing response latency. The AI ​​model in this application not only has fault prediction capabilities, but also derives the optimal self-healing operation based on the prediction results, identifies the root cause of the fault, and generates targeted self-healing strategies. This enables it to automatically cope with faults in complex scenarios, avoids the delays and uncertainties of manual decision-making, improves the overall self-healing capability and efficiency of the system, and solves the problem that existing network fault handling methods are difficult to implement effective self-healing strategies in complex scenarios.

[0082] In one optional embodiment, the first processing unit includes: a preprocessing module, used to sequentially preprocess and concatenate the device basic information, device health information, device network link information, and device traffic information to obtain concatenated features of each acquisition result, wherein the preprocessing includes missing value imputation, outlier detection and removal, and normalization; a fusion module, used to perform feature fusion on the concatenated features of each acquisition result using a linear transformation to obtain fused features, and determine the position code corresponding to the fused features; a first determination module, used to determine that the final input is the sum of the fused features and the position code, and to process the final input using the multi-head self-attention encoder of the Transformer model to obtain the input of the feedforward neural network layer of the Transformer model; a first processing module, used to process the input of the feedforward neural network layer using the feedforward neural network layer of the Transformer model to obtain the feedforward processing code; and a decoding module, used to decode the feedforward processing code using the decoder of the Transformer model to obtain the failure rate prediction value.

[0083] In the above embodiments, missing value imputation, outlier detection and removal, and normalization processes are performed to standardize and clean the original multi-source heterogeneous data, avoiding biases caused by incomplete data collection, noise interference, or differences in measurement units. By concatenating various preprocessed features into a single feature space and then using linear transformation for feature fusion, the key attributes of each feature are preserved, enabling the model to simultaneously perceive device structural attributes, operational health status, link performance, and service traffic characteristics within a single vector representation. Based on the fused features, location encoding is introduced, allowing the model to identify the temporal sequence and periodicity of each data collection, thereby understanding the device's status and performance trends over time and detecting potential faults in advance. Utilizing a multi-head self-attention mechanism, the model can capture complex dependencies between features of different dimensions in parallel, avoiding false positives or false negatives caused by biased judgments based on a single dimension, thus improving the comprehensiveness and accuracy of predictions.

[0084] In another alternative embodiment, the fusion module includes: a first determining submodule, used to determine that the feature product is the product of the concatenated features and the corresponding weights; and a second determining submodule, used to determine that the fused feature is the sum of the feature product and the corresponding bias parameter.

[0085] In the above embodiments, feature fusion is achieved by applying linear transformations to the spliced ​​features of each acquisition result. Device basic information, health indicators, link parameters, and traffic features originally belong to different types and scales of data. Through linear transformation operations of feature product and bias, all spliced ​​features are mapped to a vector space of the same dimension, enabling the model to compare and calculate multi-source information in a unified feature space, avoiding training bias caused by inconsistent data types. The learnable weight parameters introduced in the linear transformation can dynamically adjust the importance of various features based on the training results. For example, CPU utilization contributes more to fault prediction in certain scenarios, so the model can automatically assign a higher weight to this indicator; while noise or weakly correlated features are compressed, thereby improving the model's sensitivity to key information and further enhancing the accuracy of fault rate prediction.

[0086] In some exemplary embodiments, the apparatus further includes: a calculation unit for calculating the loss value of the Transformer model using a binary cross-entropy loss function; and an optimization unit for optimizing the weights and bias parameters of the Transformer model using an Adam optimizer based on the loss value.

[0087] In the above embodiments, before collecting device information multiple times based on the SNMP protocol, the Transformer model is trained first, and the binary cross-entropy loss function is used to compare the model output with the true label to calculate the loss value. Then, the Adam optimizer is used to iteratively optimize the weights and bias parameters in the model based on the loss value. This enables the Transformer model to gradually reduce errors and improve convergence speed in prediction tasks. The binary cross-entropy loss function can accurately characterize the difference between the predicted failure rate and the actual failure situation, giving the model a stronger discriminative ability. The Adam optimizer, by introducing momentum and adaptive learning rate mechanisms, can avoid the problem of slow convergence or getting trapped in local optima in traditional gradient descent methods, thereby ensuring that the model can still converge efficiently under complex and multi-dimensional device information input.

[0088] In other exemplary embodiments, the second processing unit includes: a second processing module, configured to use the AI ​​model to process the device basic information, device health information, device network link information, device traffic information, and the self-healing operation set of the AI ​​model to obtain a preliminary self-healing operation, wherein the self-healing operation set includes at least adjusting bandwidth allocation, restarting the device, increasing memory capacity, checking the status of physical or logical network cards, and adjusting processor priority; a calculation module, configured to use a reward function to calculate a reward value for the preliminary self-healing operation to obtain a reward result; and a second determining module, configured to determine whether the target self-healing operation is the preliminary self-healing operation based on the reward result.

[0089] In the above embodiments, firstly, based on the input device basic information, health information, network link information, and traffic information, the AI ​​model generates a preliminary self-healing operation for the current fault environment from a preset set of self-healing operations. Then, the preliminary operation is quantitatively evaluated using a preset reward function. The reward function comprehensively considers multiple dimensions of indicators, such as the operation's effect on reducing the failure rate, the cost of resource consumption, the impact on system stability, and recovery speed, to calculate a reward value and obtain the reward result. If the reward result indicates that the preliminary self-healing operation can significantly reduce the failure rate, improve performance, and keep costs under control, then the preliminary self-healing operation is identified as the target self-healing operation and executed immediately; if the reward result is low, the system abandons the operation or continues to try other candidate operations, avoiding a self-healing method that simply relies on fixed rules and achieving a more intelligent self-healing decision.

[0090] In one alternative embodiment, the second processing unit further includes: a sorting module, configured to sort the operation order of the target self-healing operation according to the size of the reward result of each of the above operations when the target self-healing operation includes at least two operations, to obtain a target operation order, wherein the sorting rule of the operation order is from largest to smallest; and a calling module, configured to call the corresponding interface in sequence according to the target operation order and the target self-healing operation.

[0091] In the above embodiments, when the target self-healing operation includes at least two operations, the operation order is sorted from largest to smallest according to the reward result of each operation, and the corresponding interfaces are called sequentially according to the sorted target operation order. This ensures that the operation most likely to improve the network device's operating status is executed first, thereby enabling rapid and effective measures to be taken when the device fails or its performance degrades. This not only improves the execution efficiency of self-healing operations and avoids resource consumption from ineffective or inefficient operations, but also enables dynamic optimization of the operation order when multiple operations coexist. This allows the system to complete the most valuable self-healing measures first within a limited time, thereby minimizing device risk and improving the accuracy and stability of network device self-healing.

[0092] In some exemplary embodiments of this application, the acquisition unit includes an acquisition module, configured to acquire, multiple times, the basic device information, health information, network link information, and traffic information of the network device based on the SNMP protocol.

[0093] In the above embodiments, by repeatedly acquiring basic device information, device health information, device network link information, and device traffic information of network devices based on SNMP, a continuous data sequence can be formed in the time dimension. This avoids the impact of accidental fluctuations or data omissions that may occur in a single acquisition on subsequent predictions and judgments, thereby improving the comprehensiveness and reliability of device status monitoring. It also provides more complete and accurate input data for subsequent Transformer models or AI models, enabling the models to better capture the trends and changes in device operating status, thereby improving the accuracy and stability of failure rate prediction and self-healing decision-making.

[0094] The self-healing device for the aforementioned network equipment includes a processor and a memory. The aforementioned acquisition unit, the first processing unit, and the second processing unit are all stored as program units in the memory. The processor executes these program units stored in the memory to achieve the corresponding functions. All of the aforementioned modules are located in the same processor; alternatively, the aforementioned modules may be located in different processors in any combination.

[0095] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can address the problem that existing network fault handling methods struggle to implement effective self-healing strategies in complex scenarios.

[0096] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0097] This invention provides a computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device containing the computer-readable storage medium to perform the fault self-healing method of the network device.

[0098] Specifically, self-healing methods for network devices include:

[0099] Step S101: Obtain the basic device information, device health information, device network link information, and device traffic information of the network device multiple times. The basic device information includes device model, device type, device configuration, network address, and device unique identifier. The device health information includes processor utilization, memory utilization, hard disk utilization, and collection time. The device network link information includes IP address, node information, bandwidth utilization, transmission delay, and packet loss rate. The device traffic information includes source IP, destination IP, source port, destination port, and protocol.

[0100] Step S102: Using the Transformer model, based on the above-mentioned basic device information, the above-mentioned device health information, the above-mentioned device network link information, and the above-mentioned device traffic information, determine the predicted failure rate of the above-mentioned network device.

[0101] Step S103: When the predicted failure rate is greater than or equal to the failure rate threshold, the AI ​​model is used to determine the target self-healing operation based on the device basic information, device health information, device network link information, and device traffic information, and the corresponding interface is called according to the target self-healing operation to realize the self-healing of the network device.

[0102] This invention provides a fault self-healing system for network devices, including a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs at least the following steps:

[0103] Step S101: Obtain the basic device information, device health information, device network link information, and device traffic information of the network device multiple times. The basic device information includes device model, device type, device configuration, network address, and device unique identifier. The device health information includes processor utilization, memory utilization, hard disk utilization, and collection time. The device network link information includes IP address, node information, bandwidth utilization, transmission delay, and packet loss rate. The device traffic information includes source IP, destination IP, source port, destination port, and protocol.

[0104] Step S102: Using the Transformer model, based on the above-mentioned basic device information, the above-mentioned device health information, the above-mentioned device network link information, and the above-mentioned device traffic information, determine the predicted failure rate of the above-mentioned network device.

[0105] Step S103: When the predicted failure rate is greater than or equal to the failure rate threshold, the AI ​​model is used to determine the target self-healing operation based on the device basic information, device health information, device network link information, and device traffic information, and the corresponding interface is called according to the target self-healing operation to realize the self-healing of the network device.

[0106] The devices mentioned in this article can be servers, PCs, tablets, mobile phones, etc.

[0107] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0108] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0109] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0110] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0111] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0112] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0113] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0114] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0115] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0116] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0117] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A fault self-healing method for network devices, characterized in that, include: The system repeatedly acquires basic device information, device health information, device network link information, and device traffic information of network devices. The basic device information includes device model, device type, device configuration, network address, and unique device identifier. The device health information includes processor utilization, memory utilization, hard disk utilization, and collection time. The device network link information includes IP address, node information, bandwidth utilization, transmission latency, and packet loss rate. The device traffic information includes source IP, destination IP, source port, destination port, and protocol. The Transformer model is used to determine the predicted failure rate of the network device based on the device's basic information, health information, network link information, and traffic information. When the predicted failure rate is greater than or equal to the failure rate threshold, an AI model is used to determine the target self-healing operation based on the device's basic information, device health information, device network link information, and device traffic information. The corresponding interface is then called according to the target self-healing operation to achieve self-healing of the network device.

2. The method according to claim 1, characterized in that, The Transformer model is used to determine the predicted failure rate of the network device based on the device's basic information, health information, network link information, and traffic information, including: The device basic information, device health information, device network link information, and device traffic information are sequentially preprocessed and spliced ​​to obtain the splicing features of each acquisition result. The preprocessing includes missing value filling, outlier detection and removal, and normalization. The splicing features of each acquisition result are fused using a linear transformation to obtain fused features, and the position code corresponding to the fused features is determined. The final input is determined to be the sum of the fused features and the positional encoding, and the multi-head self-attention encoder of the Transformer model is used to process the final input to obtain the feedforward neural network layer input of the Transformer model; The feedforward processing code is obtained by processing the input of the feedforward neural network layer using the feedforward neural network layer of the Transformer model. The feedforward encoding is decoded using the decoder of the Transformer model to obtain the predicted failure rate.

3. The method according to claim 2, characterized in that, The spliced ​​features of each acquisition result are fused using a linear transformation to obtain fused features, including: The feature product is determined to be the product of the concatenated features and their corresponding weights; The fused feature is determined to be the sum of the feature product and the corresponding bias parameter.

4. The method according to claim 1, characterized in that, Before repeatedly acquiring basic device information, device health information, device network link information, and device traffic information of the network device, the method further includes: The loss value of the Transformer model is calculated using the binary cross-entropy loss function; The Adam optimizer is used to optimize the weights and bias parameters of the Transformer model based on the loss value.

5. The method according to claim 1, characterized in that, An AI model is used to determine the target self-healing operation based on the device's basic information, health information, network link information, and traffic information, including: The AI ​​model is used to process the device's basic information, device health information, device network link information, device traffic information, and the self-healing operation set of the AI ​​model to obtain preliminary self-healing operations. The self-healing operation set includes at least adjusting bandwidth allocation, restarting the device, increasing memory capacity, checking the status of physical or logical network cards, and adjusting processor priority. A reward function is used to calculate the reward value for the preliminary self-healing operation, and the reward result is obtained. Based on the reward result, determine whether the target self-healing operation is the preliminary self-healing operation.

6. The method according to claim 5, characterized in that, The corresponding interface is invoked according to the target self-healing operation, including: When the target self-healing operation includes at least two operations, the operation order of the target self-healing operation is sorted according to the size of the reward result of each operation to obtain the target operation order, wherein the sorting rule of the operation order is from large to small. According to the target operation sequence and the target self-healing operation, the corresponding interfaces are called sequentially.

7. The method according to claim 1, characterized in that, Multiple acquisitions of basic device information, device health information, device network link information, and device traffic information of network devices, including: Based on the SNMP protocol, the device's basic information, health information, network link information, and traffic information are obtained multiple times.

8. A fault self-healing device for network equipment, characterized in that, include: The acquisition unit is used to acquire basic device information, device health information, device network link information, and device traffic information of network devices multiple times. The basic device information includes device model, device type, device configuration, network address, and device unique identifier. The device health information includes processor utilization, memory utilization, hard disk utilization, and acquisition time. The device network link information includes IP address, node information, bandwidth utilization, transmission delay, and packet loss rate. The device traffic information includes source IP, destination IP, source port, destination port, and protocol. The first processing unit is used to determine the predicted failure rate of the network device based on the device's basic information, device health information, device network link information, and device traffic information using the Transformer model. The second processing unit is used to determine the target self-healing operation based on the device basic information, the device health information, the device network link information and the device traffic information using an AI model when the predicted failure rate is greater than or equal to the failure rate threshold, and to call the corresponding interface according to the target self-healing operation to realize the self-healing of the network device.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the method according to any one of claims 1 to 7.

10. A fault self-healing system for network devices, characterized in that, include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs comprising methods for performing any one of claims 1 to 7.

Images