A plug-in access type M-OTN equipment anomaly detection method and system

Abstract

The application provides a plug-in access type M-OTN equipment abnormality detection method and system, wherein the detection method comprises the following steps: obtaining monitoring data of monitoring terminals arranged at preset positions in a plug-in access type M-OTN equipment; performing a first abnormality judgment based on an abnormality judgment rule corresponding to each monitoring data to determine a first abnormality judgment result; performing correlation quantization on the monitoring data to form an analysis parameter set; and performing a second abnormality judgment according to the analysis parameter set and a preconfigured judgment library to determine a second abnormality judgment result. The plug-in access type M-OTN equipment abnormality detection method and system perform a first abnormality judgment starting from a single monitoring data, perform a second abnormality judgment by correlating the monitoring data, and thus accurate and effective abnormality detection is achieved.

Description

Technical Field

[0001] This invention relates to the field of equipment anomaly detection technology, and in particular to a method and system for anomaly detection of plug-in M-OTN equipment. Background Technology

[0002] M-OTN equipment is the main equipment used in Metro Optimized Optical Transport Network (OTN). Metro Optimized Optical Transport Networks (OTNs) are based on OTN technology and feature single-level multiplexing, more flexible time slot structures, and simplified overhead. M-OTN, by introducing Optical Service Units (OSUs) and OTU0 / OTU25u / OTU50u interfaces, provides a low-cost, low-latency, and low-power mobile 5G transport solution, and has become one of the mainstream solutions for 5G transport networks, recognized by major operators and equipment manufacturers worldwide. Plug-in M-OTN equipment allows for flexible service configuration by inserting various service boards into the equipment's service slots. However, how to detect anomalies in this configuration remains a critical technical challenge. Summary of the Invention

[0003] One of the objectives of this invention is to provide a method and system for detecting anomalies in plug-in M-OTN devices, in order to solve the aforementioned technical problems.

[0004] This invention provides a method for detecting anomalies in a plug-in M-OTN device, comprising:

[0005] Acquire monitoring data from monitoring terminals configured at various preset locations within the plug-in M-OTN device;

[0006] Based on the anomaly judgment rules corresponding to each monitoring data, a judgment is made to determine the first anomaly judgment result;

[0007] The monitoring data is correlated and quantified to form a set of analytical parameters;

[0008] A second judgment is made based on the set of analysis parameters and the corresponding pre-configured judgment library to determine the second anomaly judgment result.

[0009] Preferably, the method for detecting anomalies in plug-in M-OTN devices further includes:

[0010] Acquire monitoring data on the actions of plug-in M-OTN devices during service execution;

[0011] Feature extraction is performed on the monitoring data, and a monitoring parameter set is constructed based on the extracted features;

[0012] Based on the monitoring parameter set and the corresponding pre-configured business analysis library, three judgments are made to determine the third anomaly judgment result.

[0013] Preferably, the method for detecting anomalies in plug-in M-OTN devices further includes:

[0014] At preset intervals, pre-configured standard data is retrieved, and business tasks are generated based on the standard data.

[0015] The business tasks are sent to the plug-in M-OTN device for execution.

[0016] Obtain the output data after execution;

[0017] Based on standard data, retrieve standard output from the standard output library;

[0018] The fourth anomaly detection result is generated based on the comparison between the standard output and the output data.

[0019] Preferably, the method for detecting anomalies in plug-in M-OTN devices further includes:

[0020] Copy any historically executed business task as pending data;

[0021] Retrieve doping data from a pre-configured doping database;

[0022] Based on the data to be processed and the mixed data, generate new business tasks;

[0023] Obtain the output data from executing the new business task;

[0024] Based on the output data, the fifth anomaly judgment result is determined.

[0025] Preferably, the steps for constructing the dopant database are as follows:

[0026] The abnormal historical business tasks are categorized and grouped to obtain multiple groups;

[0027] Based on each group and the corresponding data extraction rules for that group, the extracted data is used as doping data in the doping database.

[0028] This invention also provides an anomaly detection system for plug-in M-OTN devices, comprising: a monitoring module, a primary judgment module, an association module, and a secondary judgment module; wherein, the monitoring module acquires monitoring data from monitoring terminals configured at various preset locations within the plug-in M-OTN device; the primary judgment module performs a primary judgment based on the anomaly judgment rules corresponding to each monitoring data to determine a first anomaly judgment result; the association module performs association quantification on the monitoring data to form an analysis parameter set; and the secondary judgment module performs a secondary judgment based on the analysis parameter set and the corresponding pre-configured judgment library to determine a second anomaly judgment result.

[0029] Preferably, the plug-in M-OTN device anomaly detection system further includes: a monitoring module and a three-stage judgment module; wherein, the monitoring module acquires monitoring data of the plug-in M-OTN device's actions in performing services; the three-stage judgment module extracts features from the monitoring data, constructs a monitoring parameter set based on the extracted features, and performs three judgments based on the monitoring parameter set and the corresponding pre-configured service analysis library to determine the third anomaly judgment result.

[0030] Preferably, the plug-in M-OTN device anomaly detection system further includes: a forward active detection module;

[0031] The active detection module performs the following operations

[0032] At preset intervals, pre-configured standard data is retrieved, and business tasks are generated based on the standard data.

[0033] The business tasks are sent to the plug-in M-OTN device for execution.

[0034] Obtain the output data after execution;

[0035] Based on standard data, retrieve standard output from the standard output library;

[0036] The fourth anomaly detection result is generated based on the comparison between the standard output and the output data.

[0037] Preferably, the plug-in M-OTN device anomaly detection system further includes: a reverse active detection module;

[0038] The reverse active detection module performs the following operations:

[0039] Copy any previously executed historical business task as pending data;

[0040] Retrieve doping data from a pre-configured doping database;

[0041] Based on the data to be processed and the mixed data, generate new business tasks;

[0042] Obtain the output data from executing the new business task;

[0043] Based on the output data, the fifth anomaly judgment result is determined.

[0044] Preferably, the steps for constructing the dopant database are as follows:

[0045] The abnormal historical business tasks are categorized and grouped to obtain multiple groups;

[0046] Based on each group and the corresponding data extraction rules for that group, the extracted data is used as doping data in the doping database.

[0047] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description and the accompanying drawings.

[0048] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0049] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0050] Figure 1 This is a schematic diagram of an anomaly detection method for a plug-in M-OTN device according to an embodiment of the present invention;

[0051] Figure 2 This is a schematic diagram of an M-OTN device anomaly detection system with plug-in access according to an embodiment of the present invention. Detailed Implementation

[0052] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0053] Example 1:

[0054] This invention provides a method for detecting anomalies in plug-in M-OTN devices, such as... Figure 1 As shown, it includes:

[0055] Step 1: Obtain monitoring data from monitoring terminals configured at various preset locations within the plug-in M-OTN device;

[0056] The plug-in M-OTN device has service board slots for multiple service boards. Its service capabilities include: supporting OSU-based Ethernet services, including point-to-point (EPL) and point-to-multipoint (EVPL) services; supporting EoS and VC-based STM1 / 4 / 16 services; supporting ODUk-based OTU1 / 2 services; bandwidth adjustment functionality: supporting OSU lossless bandwidth adjustment for OSU-based Ethernet services, including lossless bandwidth adjustment in protection scenarios; supporting LCAS bandwidth adjustment for VC-based EoS services; protection functionality: supporting OSU-layer SNCP I / S protection; supporting VC-layer SNCP I / N protection; Ethernet interfaces supporting LAG and cross-board LAG (D-LAG); cross-connect functionality requirements: supporting centralized OSU / ODU / VC cross-connect functionality, with VC cross-connect supporting VC12 / VC3 / VC4 cross-connect processing capabilities; and supporting Ethernet switching functionality, which is only used for aggregation nodes of point-to-multipoint services, with no specific implementation requirements. Interface capability requirements: Line side: OTU1 / 2, OTU1 / 2 should support

[0057] VC / OSU / ODUk three-way mixed line card; Customer side: FE / GE (supports EoS / EoO / EoOSU simultaneously), 10GE (supports EoO / EoOSU simultaneously); STM-1 / 4 / 16; Monitoring terminals are configured at various preset locations within the plug-in M-OTN device. The monitoring data collected by the monitoring terminals can be uploaded to the management platform for storage through the device's data interface; The monitoring data of each monitoring terminal can be obtained in real time through the data interface; The monitoring data includes: temperature data, fan speed, optical module basic data, voltage data, current data, etc.

[0058] Step 2: Based on the anomaly judgment rules corresponding to each monitoring data, make a judgment to determine the first anomaly judgment result;

[0059] Different monitoring terminals at different locations have different anomaly detection rules. Taking temperature data as an example, the rule for location A is that the temperature does not exceed the threshold temperature B; the rule for location C is that the temperature does not exceed the threshold temperature D. The first anomaly detection is achieved by judging each monitoring data separately.

[0060] Step 3: Correlate and quantify the monitoring data to form an analysis parameter set;

[0061] The correlation quantification between monitoring data is guided by a pre-configured correlation quantification library, which stores each set of related monitoring data and corresponding quantification templates. The set of analysis parameters is obtained by quantifying and sorting the related monitoring data.

[0062] Step 4: Perform a second judgment based on the analysis parameter set and the corresponding pre-configured judgment library to determine the second anomaly judgment result.

[0063] The secondary judgment is based on a pre-configured judgment library. A set of related monitoring data uses one judgment library. The second anomaly judgment result corresponding to the standard parameter set is retrieved by matching the analysis parameter set with the standard parameter set in the judgment library. The judgment library is pre-analyzed and constructed by professionals to guide the correlation analysis. In the judgment library, the standard parameter set is associated with the second anomaly judgment result one by one.

[0064] The anomaly detection method for plug-in M-OTN devices provided in this embodiment performs an anomaly judgment based on a single monitoring data point, and performs a secondary anomaly judgment by correlating the monitoring data, thereby achieving accurate and effective anomaly detection.

[0065] Example 2:

[0066] This invention provides a method for detecting anomalies in plug-in M-OTN devices, such as... Figure 1 As shown, it includes:

[0067] Acquire monitoring data from monitoring terminals configured at various preset locations within the plug-in M-OTN device;

[0068] Based on the anomaly judgment rules corresponding to each monitoring data, a judgment is made to determine the first anomaly judgment result;

[0069] The monitoring data is correlated and quantified to form a set of analytical parameters;

[0070] A second judgment is made based on the set of analysis parameters and the corresponding pre-configured judgment library to determine the second anomaly judgment result.

[0071] To enable anomaly monitoring at the data level, the anomaly detection method for plug-in M-OTN devices also includes:

[0072] Acquire monitoring data on the actions of plug-in M-OTN devices when performing services; the monitoring data includes: uplink and / or downlink speeds of each interface, data transmission duration, number of packets sent and received, and one or more combinations of OSU layer end-to-end latency;

[0073] Feature extraction is performed on the monitoring data, and a monitoring parameter set is constructed based on the extracted features. The extracted features include: the average, maximum, and minimum values ​​of each monitoring data point.

[0074] Based on the monitoring parameter set and the corresponding pre-configured business analysis library, three judgments are made to determine the third anomaly judgment result. The business analysis library is pre-analyzed and configured by professionals, and the monitoring parameter set in the business analysis library is associated with the third anomaly judgment result in a one-to-one correspondence; the third anomaly judgment result includes: whether each interface is abnormal or normal.

[0075] Example 3:

[0076] This invention provides a method for detecting anomalies in plug-in M-OTN devices, such as... Figure 1 As shown, it includes:

[0077] Acquire monitoring data from monitoring terminals configured at various preset locations within the plug-in M-OTN device;

[0078] Based on the anomaly judgment rules corresponding to each monitoring data, a judgment is made to determine the first anomaly judgment result;

[0079] The monitoring data is correlated and quantified to form a set of analytical parameters;

[0080] A second judgment is made based on the set of analysis parameters and the corresponding pre-configured judgment library to determine the second anomaly judgment result.

[0081] To achieve proactive anomaly detection, the anomaly detection method for plug-in M-OTN devices also includes:

[0082] At preset intervals (any value between 1 minute and 1000 minutes), pre-configured standard data is retrieved, and business tasks are generated based on the standard data.

[0083] The business tasks are sent to the plug-in M-OTN device for execution.

[0084] Obtain the output data after execution;

[0085] Based on standard data, retrieve standard output from the standard output library;

[0086] The fourth anomaly detection result is generated based on the comparison between the standard output and the output data.

[0087] This embodiment generates corresponding service tasks from known standard data and then actively detects plug-in M-OTN devices to proactively identify anomalies. The standard output library is pre-configured, with standard data and standard outputs linked one-to-one. Comparison between the standard outputs and the output data determines if there is a discrepancy; if so, the first anomaly is identified as an anomaly; otherwise, it is considered normal.

[0088] Example 4:

[0089] This invention provides a method for detecting anomalies in plug-in M-OTN devices, such as... Figure 1 As shown, it includes:

[0090] Acquire monitoring data from monitoring terminals configured at various preset locations within the plug-in M-OTN device;

[0091] Based on the anomaly judgment rules corresponding to each monitoring data, a judgment is made to determine the first anomaly judgment result;

[0092] The monitoring data is correlated and quantified to form a set of analytical parameters;

[0093] A second judgment is made based on the set of analysis parameters and the corresponding pre-configured judgment library to determine the second anomaly judgment result.

[0094] To achieve proactive anomaly detection, the anomaly detection method for plug-in M-OTN devices also includes:

[0095] Copy any previously executed historical business task as pending data;

[0096] Retrieve doping data from a pre-configured doping database;

[0097] Based on the data to be processed and the mixed data, generate new business tasks;

[0098] Obtain the output data from executing the new business task;

[0099] Based on the output data, the fifth anomaly judgment result is determined.

[0100] The steps for constructing the dopant database are as follows:

[0101] The abnormal historical business tasks are categorized and grouped to obtain multiple groups; the grouping requirement is that each group corresponds to a business category.

[0102] Based on each group and the corresponding data extraction rules, data is extracted and used as co-occurrence data in the co-occurrence database. For example, the data extraction rule for the group corresponding to data transmission services is to extract fields with transmission anomalies, statistically analyze the extracted fields, and use the data with the most anomalies in the same field as co-occurrence data.

[0103] This embodiment performs doping by calling historical business tasks, actively generating abnormal data, and then obtaining the fifth anomaly judgment result based on the output data; that is, when the output data is normal, the fifth anomaly judgment result can be determined to be abnormal; when the output data is abnormal, the fifth anomaly judgment result can be determined to be normal; therefore, when constructing the doping database, it is necessary to ensure the validity of the doping data, and multiple tests can be conducted, and the results of multiple tests can be comprehensively analyzed.

[0104] In addition, the system statistically analyzes the currently executed service tasks of the plug-in M-OTN devices and constructs a service parameter set; it calculates the similarity (using cosine similarity) of the service statistical parameters corresponding to multiple plug-in M-OTN devices; when the similarity is greater than or equal to a preset first threshold (any value between 0.90 and 0.99), it calculates the similarity of the first and second monitoring parameter sets constructed from the current monitoring data and surveillance data; when the calculated similarity is less than a preset second threshold (any value between 0.5 and 0.8), it outputs a comparison anomaly and simultaneously outputs a plug-in M-OTN device similarity. The identification information of the M-OTN device; staff identify the device and conduct secondary confirmation through the identification information; among them, the statistical parameters in the business statistics parameters include: statistical parameters representing the number of business tasks of the same business type, and statistical parameters representing the functional requirements (bandwidth, number of channels, etc.) of each business task; the first monitoring parameter set includes: parameters representing the maximum, minimum and average values ​​of temperature data, fan speed, optical module basic data, voltage data, current data, etc.; the second monitoring parameter set includes: parameters representing the maximum, minimum and average values ​​of uplink speed and / or downlink speed of each interface, data transmission duration, number of packets sent and received, etc.

[0105] Because triggering comparisons based on monitored business statistics parameters involves randomness, a low first threshold may result in a high triggering frequency, while an excessively high first threshold may prevent triggering. Therefore, a threshold adjustment table is configured to adjust the first threshold based on the triggering frequency, where the triggering frequency represents the number of triggers within a preset time period. The preset time period can be any from 1 hour to 100 hours. Minimum and maximum limits for the first threshold need to be configured to avoid over-adjustment.

[0106] When the first threshold is adjusted to its minimum value, and the pre-configured maximum standby time has not yet been triggered, the maximum value is determined by statistically analyzing the calculated similarity. When the threshold is reached again, the two devices are extracted, and the differences in the business statistical parameter sets are calculated. The calculated difference set is then matched with the business statistical parameter sets constructed for each business task, and the matching business task is cloned to another device for execution. The business parameter sets are then updated, and the similarity between the first and second monitoring parameter sets is calculated. When the calculated similarity is less than the preset second threshold (any value between 0.5 and 0.8), a comparison anomaly is output, and the identification information of the plug-in M-OTN device is output simultaneously. Staff identify the device using the identification information and perform secondary confirmation.

[0107] Example 5:

[0108] This invention also provides a plug-in M-OTN device anomaly detection system, such as... Figure 2 As shown, it includes: a monitoring module 1, a primary judgment module 2, an association module 3, and a secondary judgment module 4; wherein, the monitoring module 1 acquires monitoring data from monitoring terminals configured at various preset locations within the plug-in M-OTN device; the primary judgment module 2 performs a primary judgment based on the anomaly judgment rules corresponding to each monitoring data to determine the first anomaly judgment result; the association module 3 performs association quantification on the monitoring data to form an analysis parameter set; the secondary judgment module 4 performs a secondary judgment based on the analysis parameter set and the corresponding pre-configured judgment library to determine the second anomaly judgment result.

[0109] To achieve anomaly detection at the data level, the plug-in M-OTN device anomaly detection system also includes: a monitoring module and a three-stage judgment module; wherein, the monitoring module acquires monitoring data of the plug-in M-OTN device's actions during service execution; the three-stage judgment module extracts features from the monitoring data, constructs a monitoring parameter set based on the extracted features, and performs three judgments based on the monitoring parameter set and the corresponding pre-configured service analysis library to determine the third anomaly judgment result.

[0110] To enable proactive detection of anomalies, the plug-in M-OTN device anomaly detection system also includes: a forward proactive detection module;

[0111] The active detection module performs the following operations

[0112] At preset intervals, pre-configured standard data is retrieved, and business tasks are generated based on the standard data.

[0113] The business tasks are sent to the plug-in M-OTN device for execution.

[0114] Obtain the output data after execution;

[0115] Based on standard data, retrieve standard output from the standard output library;

[0116] The fourth anomaly detection result is generated based on the comparison between the standard output and the output data.

[0117] To enable further proactive detection of anomalies, the plug-in M-OTN device anomaly detection system also includes: a reverse proactive detection module;

[0118] The reverse active detection module performs the following operations:

[0119] Copy any previously executed historical business task as pending data;

[0120] Retrieve doping data from a pre-configured doping database;

[0121] Based on the data to be processed and the mixed data, generate new business tasks;

[0122] Obtain the output data from executing the new business task;

[0123] Based on the output data, the fifth anomaly judgment result is determined.

[0124] The steps for constructing the dopant database are as follows:

[0125] The abnormal historical business tasks are categorized and grouped to obtain multiple groups;

[0126] Based on each group and the corresponding data extraction rules for that group, the extracted data is used as doping data in the doping database.

[0127] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for detecting anomalies in a plug-in type M-OTN device, characterized in that, include: Acquire monitoring data from monitoring terminals configured at various preset locations within the plug-in M-OTN device; Based on the anomaly judgment rules corresponding to each monitoring data, a judgment is made to determine the first anomaly judgment result; The monitoring data is correlated and quantified to form a set of analytical parameters; A second judgment is made based on the set of analysis parameters and the corresponding pre-configured judgment library to determine the second anomaly judgment result; Copy any previously executed historical business task as pending data; Retrieve doping data from a pre-configured doping database; Based on the data to be processed and the mixed data, generate new business tasks; Obtain the output data from executing the new business task; Based on the output data, determine the result of the fifth anomaly judgment; The steps for constructing the dopant database are as follows: The abnormal historical business tasks are categorized and grouped to obtain multiple groups; Based on each group and the corresponding data extraction rules, the extracted data is used as doping data in the doping database. The doping database is a database composed of doping data, which is: based on the data of the group corresponding to the data transmission service, the fields of transmission anomalies are extracted, and the data with the most anomalies in the same field is selected.

2. The method for detecting anomalies in plug-in M-OTN devices as described in claim 1, characterized in that, Also includes: Acquire monitoring data on the actions of plug-in M-OTN devices during service execution; Feature extraction is performed on the monitoring data, and a monitoring parameter set is constructed based on the extracted features; Based on the monitoring parameter set and the corresponding pre-configured business analysis library, three judgments are made to determine the third anomaly judgment result.

3. The method for detecting abnormalities in plug-in M-OTN devices as described in claim 1, characterized in that, Also includes: At preset intervals, pre-configured standard data is retrieved, and business tasks are generated based on the standard data. The business tasks are sent to the plug-in M-OTN device for execution. Obtain the output data after execution; Based on standard data, retrieve standard output from the standard output library; A fourth anomaly detection result is generated based on the comparison between the standard output and the output data after execution.

4. A plug-in M-OTN device anomaly detection system, characterized in that, include: The system comprises a monitoring module, a primary judgment module, an association module, a secondary judgment module, and a reverse active detection module. The monitoring module acquires monitoring data from monitoring terminals configured at various preset locations within the plug-in M-OTN device. The primary judgment module performs a primary judgment based on the anomaly judgment rules corresponding to each monitoring data point, determining the first anomaly judgment result. The association module performs association quantification on the monitoring data, forming an analysis parameter set. The secondary judgment module performs a secondary judgment based on the analysis parameter set and the corresponding pre-configured judgment library, determining the second anomaly judgment result. The reverse active detection module performs the following operations: Copy any previously executed historical business task as pending data; Retrieve doping data from a pre-configured doping database; Based on the data to be processed and the mixed data, generate new business tasks; Obtain the output data from executing the new business task; Based on the output data, determine the result of the fifth anomaly judgment; The steps for constructing the dopant database are as follows: The abnormal historical business tasks are categorized and grouped to obtain multiple groups; Based on each group and the corresponding data extraction rules, the extracted data is used as doping data in the doping database. The doping database is a database composed of doping data, which is: based on the data of the group corresponding to the data transmission service, the fields of transmission anomalies are extracted, and the data with the most anomalies in the same field is selected.

5. The plug-in M-OTN device anomaly detection system as described in claim 4, characterized in that, Also includes: The system includes a monitoring module and a three-stage judgment module. The monitoring module acquires monitoring data on the actions of the plug-in M-OTN device when it performs services. The three-stage judgment module extracts features from the monitoring data and constructs a monitoring parameter set based on the extracted features. It then performs three judgments based on the monitoring parameter set and the corresponding pre-configured service analysis library to determine the third anomaly judgment result.

6. The plug-in M-OTN device anomaly detection system as described in claim 4, characterized in that, Also includes: Forward active detection module; The forward active detection module performs the following operations: At preset intervals, pre-configured standard data is retrieved, and business tasks are generated based on the standard data. The business tasks are sent to the plug-in M-OTN device for execution. Obtain the output data after execution; Based on standard data, retrieve standard output from the standard output library; A fourth anomaly detection result is generated based on the comparison between the standard output and the output data after execution.

Images