5G-R network multi-dimensional KPI anomaly detection method based on two-stage optimization

Abstract

The invention discloses a 5G-R network multi-dimensional KPI anomaly detection method based on dual-stage optimization, and belongs to the technical field of 5G-R intelligent operation and maintenance. The method comprises the following steps: firstly, acquiring multi-dimensional KPI data in a 5G-R network and preprocessing the multi-dimensional KPI data; then, a dual-stage optimization Transform model fused with a harmonic matrix is constructed, the model learns a dependency mode of a KPI sequence through an encoder-decoder structure, attention is guided to focus on a high-deviation subsequence by using a dual-stage optimization mechanism, and anomaly sensitivity is enhanced; and finally, calculating a reconstruction error and dynamically setting a threshold value by adopting an extreme value theory so as to realize accurate judgment of an abnormal point. According to the method, the problem that a traditional method is poor in adaptability to complex time sequence characteristics of the 5G-R network is effectively solved, the accuracy and efficiency of anomaly detection are remarkably improved, and reliable technical support is provided for guaranteeing safe and stable operation of the railway private network.

Description

Technical Field

[0001] This invention belongs to the field of intelligent operation and maintenance technology of 5G private network (5G-R), and particularly relates to a method for detecting multi-dimensional KPI anomalies in 5G-R network based on dual-stage optimization. Background Technology

[0002] Operation and maintenance (O&M) refers to the entire process of operating and maintaining a 5G-R network, including equipment, servers, and software. Anomaly detection, as a crucial step in fault diagnosis within network O&M, is one of the key technologies for improving network O&M capabilities. In recent years, China State Railway Group Co., Ltd. has actively promoted the deep integration of "railway + 5G," leading the digital transformation of railways through the construction of 5G-R systems. Simultaneously, it has released a series of 5G-R-related standards and actively promoted the trial process. However, this has led to an explosive growth in the number of network connections and traffic. To ensure service quality, it is necessary to monitor the status of network KPIs (Key Performance Indicators) and promptly identify and eliminate potential problems. Efficient 5G-R network KPI anomaly detection methods are key to solving these problems, thereby ensuring the safe operation of railways.

[0003] Existing anomaly detection methods are mainly divided into two categories: anomaly detection methods based on traditional time series analysis and anomaly detection methods based on machine learning. Anomaly detection methods based on traditional time series analysis are widely used in the field of anomaly detection, and their core is based on statistical methods such as ARIMA, exponential smoothing, and seasonal decomposition. In recent years, with the exponential growth of data scale, traditional methods have faced many challenges in handling complex, multidimensional, and nonlinear time series data. For example, the ARIMA model assumes that the data is stationary, but in real-world applications, such as network traffic or stock prices, the data often exhibits non-stationary characteristics, leading to a decrease in detection accuracy. Furthermore, traditional methods often define anomalies based on fixed thresholds, making it difficult to adapt to dynamically changing environments.

[0004] Machine learning-based anomaly detection methods mainly revolve around two main directions: identifying patterns in anomalous and normal data, and analyzing prediction / reconstruction errors. In pattern difference detection, supervised learning methods (such as random forests and SVMs) explicitly model the classification boundary between normal and anomalous data, achieving accuracy exceeding 90% in scenarios with sufficient labels, but facing limitations due to the scarcity of anomalous samples. In prediction / reconstruction error analysis, time series prediction models (such as LSTMs and Transformers) can capture temporal dependencies, while reconstruction models (such as AEs and GANs) can utilize normal data to reconstruct deviations and locate anomalies. While these methods perform well in handling complex, multidimensional, and nonlinear time series, breakthroughs are still needed in areas such as labeled data acquisition, dynamic environment adaptability, and scene generalization ability. Furthermore, the collaborative optimization of lightweight models and adaptive threshold mechanisms is crucial.

[0005] In general, machine learning-based methods are currently the mainstream approach in the field of anomaly detection. However, for 5G-R, a railway communication network with many specialties, large scale, complex configuration, and diverse scenarios, there is currently no effective method to detect anomalies in 5G-R network KPIs. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention proposes a multi-dimensional KPI anomaly detection method for 5G-R networks based on dual-stage optimization.

[0007] To achieve the above objectives, this invention provides a multi-dimensional KPI anomaly detection method for 5G-R networks based on two-stage optimization, comprising the following steps:

[0008] S1: Collect multi-dimensional KPI data during the operation of the 5G-R network. The KPI data comes from the network management system, monitoring system, and detection system, and constitutes the original dataset.

[0009] S2: Perform data preprocessing on the original dataset, including missing value imputation, noise reduction, and data normalization;

[0010] S3: Construct and train a two-stage optimized Transformer model that incorporates a harmonic matrix. This model takes a preprocessed KPI sequence as input and outputs a reconstructed KPI sequence.

[0011] S4: Based on the reconstruction output of the dual-stage optimized Transformer model, calculate the reconstruction error at each time point as an anomaly score, and use the extreme value theory method to dynamically set the threshold to determine anomalies.

[0012] Furthermore, the data preprocessing described in step S2 specifically includes:

[0013] The missing values ​​were filled using linear interpolation.

[0014] The denoising process is performed using the moving average method, and the denoising algorithm is evaluated and selected by calculating the root mean square error (RMSE). Based on the KPI data distribution characteristics analysis, the data is normalized using the Z-Score normalization method.

[0015] Furthermore, the two-stage optimized Transformer model described in step S3 is an encoder-decoder architecture, the construction process of which includes:

[0016] The preprocessed time series data is divided into sliding windows of fixed length as model input;

[0017] Each input window is concatenated with a harmonic matrix initialized to zero, and positional encoding is added.

[0018] The encoder consists of multiple Transformer blocks, each containing a multi-head self-attention mechanism and a feedforward network, and uses residual connections and layer normalization.

[0019] The decoder reconstructs the input window based on the encoder's output, using a feedforward network and the SiLU activation function, to obtain the first-stage reconstructed output.

[0020] The reconstruction output of the first stage is used as the harmonic matrix of the second stage, replacing the initial zero matrix. This matrix is ​​then input into the model again for forward computation to obtain the final reconstruction output of the second stage.

[0021] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described above.

[0022] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.

[0023] Compared with the prior art, the present invention has the following advantages and technical effects:

[0024] The multi-dimensional KPI anomaly detection method for 5G-R networks based on two-stage optimization proposed in this invention has the following significant technical advantages compared to existing technologies:

[0025] High detection accuracy: By introducing the Transformer model, its powerful parallel computing and global context awareness capabilities are fully utilized to effectively capture complex nonlinear temporal dependencies between multidimensional KPIs. Combined with a two-stage optimization mechanism and harmonic matrix designed specifically for 5G-R networks, the model's attention can adaptively focus on potential anomalous segments, significantly reducing false positive and false negative rates and improving the accuracy of anomaly detection.

[0026] Strong environmental adaptability: The dynamic threshold adaptive selection method based on extreme value theory (POT) can automatically adjust the anomaly judgment threshold according to the real-time data distribution, which overcomes the shortcomings of the traditional fixed threshold method in the dynamic environment of 5G-R network and enhances the robustness and generalization ability of the method in different operation and maintenance scenarios.

[0027] High operational efficiency: The method achieves end-to-end automated processing from data preprocessing to anomaly detection, avoiding tedious manual rule setting and threshold adjustment. The model trains quickly with a short convergence period (approximately 30 iterations), meeting the real-time online detection requirements of 5G-R networks, greatly improving the efficiency of intelligent network operation and maintenance, and providing strong support for rapid fault location and recovery. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is an overall flowchart of the 5G-R network multi-dimensional KPI anomaly detection method described in this invention.

[0030] Figure 2 This is a schematic diagram of the architecture of the core model Transformer and the two-stage joint optimization of this invention.

[0031] Figure 3 This is a schematic diagram of the data distribution for the FTP service download throughput KPI in the embodiment.

[0032] Figure 4 This is a schematic diagram of the data distribution for the FTP service upload throughput KPI in the embodiment.

[0033] Figure 5 It is a curve showing how the loss value changes over the training period during model training.

[0034] Figure 6 This is an example image showing the anomaly detection results of the model on the test dataset. Detailed Implementation

[0035] Various exemplary embodiments of the present invention will now be described in detail. This detailed description should not be considered as a limitation of the present invention, but rather as a more detailed description of certain aspects, features, and embodiments of the present invention.

[0036] All raw materials used in this invention are not particularly limited in their source; they can be purchased from the market or prepared using conventional methods known to those skilled in the art.

[0037] There are no particular restrictions on the purity of any of the raw materials used in this invention. However, this invention preferably uses raw materials of analytical grade or purity commonly used in the field of chemical synthesis.

[0038] The implementation of the method described in this invention mainly includes four core steps: data acquisition, data preprocessing, model construction and training, and anomaly detection inference. The following detailed description of the method is provided in conjunction with specific embodiments.

[0039] First, data collection was conducted. This embodiment collects service-related KPI data in the 5G-R network, with a sampling interval of 1 second, resulting in 12,470 data sets. KPI indicators are vertically divided according to the protocol stack layer, covering a total of 12 dimensions. Data sources mainly include network management systems and interface monitoring systems, specifically including network management data from base stations, core networks, and railway-specific equipment, as well as monitoring data from interface monitoring, leaky cable monitoring, interference monitoring, and tower monitoring. It also includes test data from field strength testing, quality of service testing, and MDT (Minimization of Drive Tests). These KPIs are closely related to the quality of key services carried by the 5G-R system (such as C3 train control and MC scheduling communication); for example, interface packet loss rate and signaling latency directly affect service availability.

[0040] Secondly, data preprocessing is performed to ensure that the data quality meets the model input requirements. Preprocessing includes three steps: missing value imputation, noise reduction, and normalization. For missing values, since this dataset has relatively few missing values, and considering that common polynomial interpolation may produce negative numbers that do not conform to the actual KPI value range, linear interpolation is used for imputation in this embodiment. In noise reduction, four methods—moving average, median filtering, Fourier transform, and wavelet transform—are compared. The RMSE value of each method is calculated to evaluate its noise reduction effect. The specific results are as follows: moving average is 3.0231, median filtering is 3.2720, Fourier transform is 3.3794, and wavelet transform is 3.0897. Finally, the moving average method with the lowest RMSE value is selected for noise reduction. In the data normalization stage, the distribution of KPI data (e.g., ...) is analyzed. Figure 3 and Figure 4 The FTP download and upload throughput distribution shown is closer to a Gaussian distribution. Therefore, the Z-Score normalization method is used to eliminate the influence of dimensions and improve the stability of model training.

[0041] Model building and training are the core of anomaly detection. This invention employs a Transformer-based encoder-decoder structure and introduces a two-stage joint optimization mechanism. Specifically, the preprocessed KPI sequence is organized into fixed-length sliding windows as input. Each input window is first concatenated with a harmonic matrix initialized to zero and then positionally encoded to inject positional information into the sequence. The encoder consists of multiple Transformer blocks, each containing a multi-head self-attention mechanism and a feedforward network. The self-attention mechanism uses h=8 attention heads, with the dimension of each head set to dk = dv = dmodel / h, to achieve a balance between computational efficiency and global context awareness. The feedforward network uses the SiLU (Swish) activation function to enhance nonlinear expressiveness and alleviate the gradient vanishing problem. Simultaneously, each layer employs residual connections and layer normalization to stabilize the training process and prevent network degradation.

[0042] The decoder reconstructs the input KPI sequence based on the hidden representation output by the encoder, obtaining the first-stage reconstructed output. This output is then used as the harmonic matrix for the second stage, replacing the initial zero matrix, and input back into the model for forward computation. This two-stage design aims to guide the model's attention mechanism to focus on subsequence regions with high reconstruction bias through a dynamic harmonic matrix, thereby enhancing the ability to capture potential anomalous patterns. During model training, the reconstruction error is used as the loss function, optimizing the model parameters by minimizing the difference between the input and reconstructed sequences. The training process is as follows: Figure 5 As shown, the model basically converged after 30 iterations, and the training time was about 60 seconds, demonstrating good convergence characteristics and training efficiency.

[0043] Finally, anomaly detection inference is performed. Based on the trained model, anomaly determination is performed on the new KPI data sequence. The specific process is shown in Algorithm 1: For each time point in the test set, the input model of its corresponding window is extracted, and the reconstruction result of that point is obtained; the Euclidean distance (norm 2) between the reconstructed sequence and the original sequence in each dimension is calculated as the anomaly score; the Peak Over Threshold (POT) method based on extreme value theory is used to automatically set a dynamic threshold, and points with anomaly scores exceeding the threshold are determined to be anomalies. Some detection results in this embodiment are shown below. Figure 6 As shown, the method can effectively identify outliers in the KPI sequence, verifying its effectiveness and practicality in multidimensional KPI anomaly detection in 5G-R networks.

[0044] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made by those skilled in the art to the technical solutions of the present invention without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A method for detecting multi-dimensional KPI anomalies in 5G-R networks based on two-stage optimization, characterized in that, Includes the following steps: S1: Collect multi-dimensional KPI data during the operation of the 5G-R network. The KPI data comes from the network management system, monitoring system, and detection system, and constitutes the original dataset. S2: Perform data preprocessing on the original dataset, including missing value imputation, noise reduction, and data normalization; S3: Construct and train a two-stage optimized Transformer model that incorporates a harmonic matrix. This model takes a preprocessed KPI sequence as input and outputs a reconstructed KPI sequence. S4: Based on the reconstruction output of the dual-stage optimized Transformer model, calculate the reconstruction error at each time point as an anomaly score, and use the extreme value theory method to dynamically set the threshold to determine anomalies.

2. The method according to claim 1, characterized in that, The data preprocessing described in step S2 specifically includes: The missing values ​​were filled using linear interpolation. The denoising process is performed using the moving average method, and the denoising algorithm is evaluated and selected by calculating the root mean square error (RMSE). Based on the KPI data distribution characteristics analysis, the data is normalized using the Z-Score normalization method.

3. The method according to claim 1, characterized in that, The two-stage optimized Transformer model described in step S3 is an encoder-decoder architecture, and its construction process includes: The preprocessed time series data is divided into sliding windows of fixed length as model input; Each input window is concatenated with a harmonic matrix initialized to zero, and positional encoding is added. The encoder consists of multiple Transformer blocks, each containing a multi-head self-attention mechanism and a feedforward network, and uses residual connections and layer normalization. The decoder reconstructs the input window based on the encoder's output, using a feedforward network and the SiLU activation function, to obtain the first-stage reconstructed output. The reconstruction output of the first stage is used as the harmonic matrix of the second stage, replacing the initial zero matrix. This matrix is ​​then input into the model again for forward computation to obtain the final reconstruction output of the second stage.

4. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1-3.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-3.

Images