A method, system, medium, and device for local area network fault detection

Abstract

The application belongs to the technical field of communication, and discloses a local area network fault detection method, system, medium and equipment, the method comprises the following steps: tracking active interaction flow through an export gateway, calculating user delay and service delay based on message arrival time, establishing multi-dimensional reference delay data in combination with network topology and IP address library, and realizing accurate fault positioning from user equipment to an export link. Compared with traditional device monitoring, the method adopts user experience-oriented non-invasive monitoring, supports TCP / UDP full protocol coverage, quickly identifies internal and external network faults through multi-dimensional correlation analysis, and significantly improves operation and maintenance efficiency. The application can actively identify the abnormalities of local area network users, devices and export links, and can perform problem confirmation on user complaints based on historical data, thereby improving business response speed, reducing labor consumption and improving operation and maintenance efficiency.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method, system, medium, and device for detecting local area network faults. Background Technology

[0002] With the development of network technology and content creation, internet resources are becoming increasingly abundant. However, network latency fluctuations can negatively impact users' online experience.

[0003] Traditional network maintenance techniques detect faults by monitoring the status of network devices. When a network device's critical parameters exceed a threshold, or when the device becomes disconnected, a fault alarm is triggered. However, device alarms rely on threshold settings, and the alarms do not necessarily reflect actual device faults. If the threshold is too low, the alarms are too sensitive, triggering numerous false alarms; if the threshold is too high, the alarms are delayed, hiding many real network faults. Furthermore, users typically use logical links composed of multiple network devices, and the coordination of these devices is essential for maintaining normal network operation. Faults involving the interconnectedness of multiple network devices generally cannot be detected through parameter alarms from a single device.

[0004] Meanwhile, for LAN users, internal network links, network exit points, and service provider selection all affect the user experience, constituting network failures in terms of user experience. Traditional methods based on internal network monitoring are also ineffective in detecting failures outside the campus. Summary of the Invention

[0005] This invention provides a method, system, medium, and device for local area network (LAN) fault detection, addressing the problem in the prior art of quickly identifying network faults affecting user experience, including internal LAN faults, outbound faults, and related service faults. To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not intended as a general commentary, nor is it intended to identify key / important components or describe the scope of protection of these embodiments. Its sole purpose is to present some concepts in a simple form as a prelude to the detailed description that follows.

[0006] According to a first aspect of the present invention, a method for detecting local area network (LAN) faults is provided.

[0007] In one embodiment, the method includes:

[0008] S1: Active Interaction Stream Acquisition

[0009] Deploy gateway devices at the local area network egress point to perform five-tuple parsing and session tracking on passing network packets. Packets with the same five-tuple are grouped into the same network flow and the arrival time of each packet is recorded. Active interaction flows are identified based on the interaction characteristics of the packets, and the user address, service address, and corresponding data time information of the active interaction flow are output.

[0010] S2: Delayed computation

[0011] At the gateway of the local area network (LAN) exit, taking the same active interaction flow as a unit, extract the arrival time of user-side request messages and server response messages at the gateway, and calculate the delay:

[0012] The service latency of the request is obtained by subtracting the arrival time of the user's request message from the arrival time of the server's response message; the user latency of the request is obtained by subtracting the arrival time of the server's response message from the arrival time of the user's response message.

[0013] S3: Multidimensional Annotation

[0014] Based on the park's business patterns, the time characteristics of the active interaction stream obtained in step S1 are labeled to distinguish the time dimension characteristics of weekends, weekdays, holidays, and different times of the day.

[0015] By using user authentication data, the local link information of active interactive streams obtained by S1 is labeled to identify their geographical location and user device information, and to determine their corresponding network link and exit type.

[0016] The server-side information of the active interactive flow obtained in step S1 is parsed and labeled using the IP address database to determine the application type, service provider, and service address of the flow.

[0017] S4: Delay Analysis

[0018] Statistical analysis and feature analysis are performed on the service latency data after step S3 to extract the latency distribution patterns of each exit link, service provider and application in the park, and to obtain the spatiotemporal distribution of each service latency feature.

[0019] Statistical analysis and feature analysis are performed on the user latency data after step S3. The data is grouped and statistically analyzed by the same application type. The latency distribution pattern of each internal link in the park is extracted, and the latency performance of different geographical locations and user devices in the park is analyzed to obtain the multi-dimensional distribution of each latency feature.

[0020] S5: Anomaly Detection and Fault Location

[0021] Based on the multi-dimensional delay features established in step S4, the delay distribution of the current flow is calculated and compared with the reference value to obtain the deviation state:

[0022] If the latency data of the current stream significantly exceeds the reference value, it is determined that the stream has poor performance in the application scenario, indicating that there is an anomaly in the network path it traverses.

[0023] Based on the above scheme, the active interaction flow identified in step S1 includes at least the following network processes:

[0024] User equipment C sends a request message Message exist At any time, a request message is sent from the gateway (GW) to the server (SR). ;

[0025] Server-side SR processing message ,time consuming Then send a response message. Message exist The time is forwarded by the gateway GW and then received by the user equipment C;

[0026] User equipment C processes messages ,time consuming and send a new request. ; exist The data is sent from the gateway (GW) to the server (SR).

[0027] Based on the above scheme, in step S2, the relative service delay is defined as follows, based on the message timing data collected by the gateway:

[0028] = - ;

[0029] The relative user latency is:

[0030] = - ;

[0031] in, The time when the user request message arrives at the gateway. The time when the server response message arrives at the gateway. The time when the user-side response message arrives at the gateway.

[0032] Based on the above scheme, in step S1, when identifying active interactive streams, the message type of the TCP three-way handshake process and the UDP real-time service with stable bidirectional flow are selected.

[0033] The message types include SYN messages, SYN-ACK messages, and ACK messages.

[0034] Based on the above scheme, step S4 involves feature analysis of the active interaction flow, specifically including:

[0035] Iterate through each dimension, group by time period, user ID, and access location, aggregate to generate statistical analysis results, form a wide table record and store it in the database for use as a refined reference benchmark.

[0036] Based on the above scheme, step S5 uses the multi-dimensional delay features established in step S4 as a reference to calculate the delay distribution of the current flow and compares it with the reference value to obtain the deviation state, specifically including:

[0037] First, based on the characteristics of the park's business, the monitoring granularity and grouping dimensions are selected. For scenarios that focus on user experience, the active interaction flow of each user is monitored by user ID as the group, and for scenarios that focus on the park's exit, the active interaction flow on the exit link is monitored by exit ID as the group.

[0038] Secondly, for newly identified active interactive streams, the corresponding reference values ​​are queried in the benchmark library using the same multidimensional features as in the training phase. If the delay of the current stream is significantly larger than the benchmark and exceeds the set threshold, the stream is determined to be abnormal, and the abnormal count is accumulated over several consecutive time slices. When the abnormal count reaches a preset proportion, the combination of dimensions is considered to be abnormal.

[0039] Finally, for the identified abnormally active interaction flow, abnormal clustering feature analysis is performed by traversing other dimensions according to business semantics. Dimensions with similar abnormal features are marked as abnormal dimensions, and dimensions that maintain normal delay distribution are marked as normal dimensions. By combining abnormal and normal dimensions, the clustering points of the fault are identified, and the fault points are accurately located.

[0040] Based on the above scheme, the anomaly determination criterion can adopt scenario-specific thresholds:

[0041] User-level anomalies are determined by comparing the user ID, time slice, and specific application with the average user latency of the corresponding dimension in the park. When the latency exceeds m times the benchmark value, an anomaly can be identified. When the anomaly count reaches n% of the total number of combined flows in that dimension, it is determined that the user has a fault in the time slice and specific application and subsequent location is triggered.

[0042] Where m = 1.8~2.5 and n = 30~65.

[0043] According to a second aspect of the present invention, a local area network (LAN) fault detection system is provided, the system comprising:

[0044] The data acquisition module is used to deploy gateway devices at the local area network exit, perform five-tuple parsing and session tracking on the network packets passing through, group packets with the same five-tuple into the same network flow and record the arrival time of each packet, identify active interaction flows based on the interaction characteristics of the packets, and output the user address, service address and corresponding data time information of the active interaction flow.

[0045] The latency calculation module is used at the gateway of the local area network (LAN) exit to extract the arrival times of user-side request packets and server response packets at the gateway, taking the same active interaction flow as a unit, and calculate the latency.

[0046] The service latency of the request is obtained by subtracting the arrival time of the user's request message from the arrival time of the server's response message; the user latency of the request is obtained by subtracting the arrival time of the server's response message from the arrival time of the user's response message.

[0047] The data annotation module is used to perform multi-dimensional annotations on active interaction flows;

[0048] The latency analysis module is used to perform statistical and feature analysis on the labeled service latency data, extract the latency distribution patterns of each exit link, service provider and application in the park, and obtain the spatiotemporal distribution of each service latency feature.

[0049] Statistical analysis and feature analysis were performed on the labeled user latency data. The data was grouped and statistically analyzed by the same application type. The latency distribution pattern of each internal link in the park was extracted, and the latency performance of different geographical locations and user devices in the park was analyzed to obtain the multi-dimensional distribution of each latency feature.

[0050] The fault identification module is used to calculate the current flow's delay distribution based on established multi-dimensional delay features as a reference, and compare it with the reference value to obtain the deviation status. If the current flow's delay data significantly exceeds the reference value, it is determined that the flow has poor performance in this time, space and application scenario, indicating that there is an anomaly in the network path it traverses.

[0051] According to a third aspect of the present invention, a computer-readable storage medium is provided.

[0052] In some embodiments, the computer-readable storage medium includes a computer program for storing a computer program that, when executed by a processor, implements the local area network fault detection method.

[0053] According to a fourth aspect of the present invention, a computer device is provided.

[0054] In some embodiments, the computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the method described above.

[0055] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects:

[0056] This invention identifies user latency and service latency by recognizing active interaction flows at the gateway. Combined with multiple static link information, it can identify both internal and external faults within the campus. This method requires no additional detection equipment within the local area network, no user or server intervention, and no on-site visits from network maintenance personnel. It can quickly classify faults and locate critical fault nodes.

[0057] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0058] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0059] Figure 1 This is a flowchart illustrating a local area network fault detection method according to an exemplary embodiment;

[0060] Figure 2 This is a schematic diagram illustrating the request-response and latency between a user device, a gateway, and a server according to an exemplary embodiment.

[0061] Figure 3 This is a flowchart illustrating a local area network fault detection system according to an exemplary embodiment;

[0062] Figure 4 This is a schematic diagram of the structure of a computer device according to an exemplary embodiment. Detailed Implementation

[0063] The following description and accompanying drawings fully illustrate specific embodiments described herein to enable those skilled in the art to practice them. Some embodiments may include or substitute parts and features of other embodiments. The scope of the embodiments herein encompasses the entire scope of the claims and all available equivalents thereof. Throughout this document, the terms “first,” “second,” etc., are used only to distinguish one element from another without requiring or implying any actual relationship or order between the elements. Indeed, a first element can also be referred to as a second element, and vice versa. Furthermore, the terms “comprising,” “including,” or any other variations thereof are intended to cover non-exclusive inclusion, such that a structure, apparatus, or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a structure, apparatus, or device. Without further limitation, an element defined by the phrase “comprising one…” does not exclude the presence of other identical elements in the structure, apparatus, or device that includes said element. The various embodiments described herein are presented in a progressive manner, with each embodiment focusing on its differences from other embodiments; similar or identical parts between embodiments can be referred to interchangeably.

[0064] The terms "longitudinal," "lateral," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer" used in this document to indicate orientations or positional relationships are based on the orientations or positional relationships shown in the accompanying drawings. They are used solely for the convenience of describing the document and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. In the description herein, unless otherwise specified and limited, the terms "installed," "connected," and "linked" should be interpreted broadly. For example, they can refer to mechanical or electrical connections, or internal connections between two elements; they can be direct connections or indirect connections through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms according to the specific circumstances.

[0065] In this document, unless otherwise stated, the term "multiple" means two or more.

[0066] In this article, the character " / " indicates that the objects before and after it are in an "or" relationship. For example, A / B means: A or B.

[0067] In this article, the term "and / or" describes an association between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or A and B.

[0068] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0069] This invention discloses a local area network (LAN) fault detection method, comprising the following steps:

[0070] S1: Active Interaction Stream Acquisition

[0071] Deploy gateway devices at the local area network egress point to perform five-tuple parsing and session tracking on passing network packets. Packets with the same five-tuple are grouped into the same network flow and the arrival time of each packet is recorded. Active interaction flows are identified based on the interaction characteristics of the packets, and the user address, service address, and corresponding data time information of the active interaction flow are output.

[0072] The 5-tuple includes the user address, service address, user port, service port, and transport layer protocol.

[0073] S2: Delayed computation

[0074] At the gateway of the local area network (LAN) exit, taking the same active interaction flow as a unit, extract the arrival time of user-side request messages and server response messages at the gateway, and calculate the delay, specifically including:

[0075] The service latency of the request is obtained by subtracting the arrival time of the user's request message from the arrival time of the server's response message; the user latency of the request is obtained by subtracting the arrival time of the server's response message from the arrival time of the user's response message.

[0076] S3: Multidimensional Annotation

[0077] Based on the park's business patterns / rules, the time characteristics of the active interaction streams obtained by S1 are labeled to distinguish time dimension characteristics such as weekends, weekdays, holidays, and different times of the day.

[0078] By using user authentication data, the local link information of active interactive streams obtained by S1 is labeled to identify their geographical location and user equipment information, and to determine their corresponding network link and exit type (such as broadband operator, line type, bandwidth level, etc.).

[0079] The service-side information of the active interactive flow obtained in step S1 is parsed and labeled using the IP address database to determine the application type, service provider, and service address of the flow.

[0080] S4: Delay Analysis

[0081] Statistical analysis and feature analysis are performed on the service latency data after S3 labeling to extract the latency distribution patterns of each exit link, service provider and application in the park, and obtain the spatiotemporal distribution of each service latency feature, which generally includes application type, service provider, exit type, physical location, time and other dimensions.

[0082] Statistical analysis and feature analysis are performed on the user latency data after S3 annotation. The data is grouped and statistically analyzed by the same application type. The latency distribution pattern of each internal link in the park is extracted. The latency performance of different geographical locations and user devices in the park is analyzed. The multi-dimensional distribution of each latency feature is obtained, which generally includes dimensions such as park access point, aggregation node / path, application type, and device.

[0083] S5: Anomaly Detection and Fault Location

[0084] Based on the multi-dimensional latency features established in step S4, the latency distribution of the current flow is calculated and compared with the reference value to obtain the deviation status. If the latency data of the current flow significantly exceeds the reference value, it is determined that the flow has poor performance in the application scenario, indicating that there is an anomaly in the network path it traverses, and the degree of deviation can reflect the severity of the anomaly.

[0085] By combining other active interactive flows passing through the gateway at the same time, and comprehensively collecting the latency distribution of other active interactive flows in terms of network link path, application type, exit, etc., and associating it with the campus topology, the location of the specific faulty device causing the anomaly can be located by identifying common abnormal paths and excluding normal paths. In special cases, by using the latency distribution of other users on the same link, network device faults can be ruled out and user device-level problems can be located.

[0086] The aforementioned local area network fault detection method achieves closed-loop analysis from flow-level monitoring to path anomaly diagnosis and fault location.

[0087] As a specific implementation plan, step S1, active interaction flow collection, involves deploying a gateway device at the LAN egress point to perform five-tuple parsing and session tracking on passing network packets. Packets with the same five-tuple are grouped into the same network flow, and the arrival time of each packet is recorded. Based on the interaction characteristics of the packets, active interaction flows are identified, and the user address, service address, and corresponding data time information of the active interaction flow are output. Specifically, this includes:

[0088] Regarding the selection method for active interactive streams, session identification is first based on the TCP three-way handshake: by capturing and matching SYN, SYN-ACK, and ACK packets, a large number of active sessions can be quickly and reliably discovered, thereby obtaining sufficient latency data samples;

[0089] For some applications that use UDP communication (such as online games), filtering and identification can be performed based on domain name and IP address databases to obtain active interactive streams of the UDP protocol, which can be used to evaluate UDP latency data.

[0090] like Figure 2As shown, in a specific implementation scheme, the gateway device in step S1 is a customized device with network flow tracking capability, deployed at the local area network egress, forwarding network packets according to routing rules, and tracking each network flow based on the network 5-tuple, recording the time when the packet arrives at the gateway, and identifying active interactive flows according to rules;

[0091] An active interactive flow F includes at least the following network processes:

[0092] User equipment C sends a request message The message is in At any time, a request message is sent from the gateway (GW) to the server (SR). Server-side SR processing It takes time Then send a response message. Message exist After being forwarded by the gateway GW, the message is received by user equipment C; user equipment C processes the message. ,time consuming and send a new request. ; exist The time is transmitted through the gateway GW and then sent to the SR.

[0093] A client interacts with a server, receiving and responding to each other's messages multiple times. Such a set of network communication messages is identified as an active interaction stream.

[0094] Specifically, message , Time difference to the gateway ( - This indicates the network latency from the gateway to the server. Add service processing time ; message , Time difference to the gateway ( - This indicates the network latency from the gateway to the user device within the campus network. Adding client-side processing time .

[0095] If a specific network procedure is selected, it can maintain , Relatively stable, that is, it can ( - ), ( - )represent , The relative value of . Where, is defined = - For relative service latency, it represents twice the network latency from the network egress to the service side; defined = - Relative user latency represents double the network latency from the user device to the egress gateway. By selecting network processes with stable interaction characteristics, service processing time can be ensured. Client processing time The time difference is relatively constant, thus enabling it to effectively reflect double the network path delay and providing a key indicator for LAN fault location.

[0096] As a specific implementation plan, step S1, in selecting the active interaction flow, specifically includes:

[0097] The TCP three-way handshake (SYN, SYN-ACK, ACK) does not involve complex business processing, is mainly affected by the operating system type and system load, and can provide relatively stable client processing time. Server processing time References; and UDP voice interaction for real-time services and some game interactions, provided that a stable bidirectional stream is available, can also serve as a stable... , Reference source. These processes are widespread in network communication processes and can effectively cover internal and external network devices and links. By tracing these network processes, a wide range of reference data on user latency and service latency can be obtained.

[0098] As a specific implementation plan, step S4 aims to reduce client processing time. Server processing time The impact of fluctuations on latency statistics is calculated within the same application scope, ensuring that the operating system, business processing logic, and system load remain approximately consistent, thus obtaining a more stable reference baseline. Furthermore, to provide a more refined reference baseline, short-term reference baselines at the minute level, based on the business fluctuation cycle, are provided. Based on data labeled by user address and service address, statistics are grouped and statistically analyzed according to factors such as the same application, the same time period, the same exit point, service provider, and geographical location. Multi-dimensional distribution characteristics of service latency and user latency are extracted to mask system and business differences, more accurately representing the actual latency status of the network and providing a reliable basis for S5 anomaly detection and localization.

[0099] Specifically, the latency distribution pattern is a spatiotemporal characteristic pattern of network latency formed based on active interaction flow data collected by the gateway, after multi-dimensional annotation and statistical analysis. This pattern system includes two core components:

[0100] Service latency distribution pattern: reflects the network path performance characteristics from the campus exit to the external server, including the spatiotemporal distribution characteristics of latency for each exit link, service provider and application;

[0101] User latency distribution patterns reflect the performance characteristics of network paths within the park, including latency patterns across different geographical locations, user devices, and internal links.

[0102] In the process of extracting latency distribution patterns, the first step is to group and statistically analyze service latency and user latency data based on the multi-dimensional labeled data (including time features, user geographic location, device information, network links, egress type, application type, and service provider) completed in the S3 phase. For service latency, spatiotemporal distribution statistics are performed according to dimensions such as egress link, service provider, and application type to obtain the latency characteristics of each service under different time and spatial dimensions. For user latency, the latency performance of links within the park is analyzed by using the same application type as the grouping benchmark, combined with user geographic location and device information. The impact of client and server processing time fluctuations is reduced by limiting the scope of the same application. At the same time, minute-level short-term statistics and business cycle adaptation are adopted to generate percentage distributions (such as 80%, 90%, and 95% quantile latency values) as multi-dimensional benchmark data. Finally, wide table records are formed and stored in the database to provide a refined reference for anomaly detection.

[0103] As a specific implementation plan, step S3 involves multi-dimensional annotation of active interaction flows based on user and service addresses, specifically including:

[0104] First, by utilizing the daily activity patterns of users in the park, the time characteristics of the active interaction stream obtained by S1 are labeled, including different time characteristics such as weekends, weekdays, holidays, and different times on weekdays;

[0105] Second, it utilizes an IP address database (containing IP address, application type, service provider, geographical location, etc., with each destination IP corresponding to a tag data entry) and combines it with the service address to identify its link, service provider, application type, and geographical location;

[0106] Third, by combining the park topology (including device identification and interconnection relationships for critical path identification and fault analysis) with user authentication data (including IP address, user ID, user device type, access location, network egress, broadband operator, etc.), the geographical location of the user address and user device information are identified. The username is used to aggregate and generate historical network access indicators at the user level, and the access location is used to reconstruct network links and support fault location. The network egress and broadband operator are identified to support fault location at the egress and operator link levels.

[0107] After completing the three types of annotations, each active interaction stream records information from multiple dimensions, including time period, user ID, user device type, access location, network egress, broadband operator, application type, service provider, and geographical location.

[0108] As a specific implementation plan, step S4 involves feature analysis of the active interaction flow, specifically including:

[0109] Iterate through each dimension, group common dimensions such as time period, user ID, access location, etc., aggregate to generate statistical analysis results, form wide table records and store them in the database for use as a fine-grained reference benchmark;

[0110] For other dimensions, based on business needs, only the aggregated results of a single dimension are recorded to form a reference benchmark for that dimension.

[0111] The above benchmark results can characterize multi-dimensional delay features, supporting anomaly detection and localization in step S5.

[0112] As a specific implementation plan, step S5 involves anomaly detection and fault diagnosis of the network based on multi-dimensional delay characteristics, specifically including:

[0113] The detection module monitors active interaction flows in different dimensions according to the settings: based on the business characteristics of the park, different dimensions of active interaction flows are selected. For example, if the focus is on user experience, the active interaction flow of each user needs to be used as the monitoring unit, and different flows need to be monitored by user ID as the grouping basis; if the focus is on the park exit, the flow needs to be monitored by exit ID as the grouping basis.

[0114] Real-time evaluation and detection of abnormal active interaction flows using benchmark data: Newly identified active interaction flows are labeled and output to the anomaly detection module. The module queries benchmark data using the same multi-dimensional features according to settings. If the latency of the current flow is significantly higher than the benchmark and the difference exceeds a threshold, the current active interaction flow is considered abnormal. Anomaly counts are accumulated over several time slices. If the anomaly count reaches a preset value, the combination of dimensions is deemed abnormal. Specifically, when focusing on user-level anomalies, user ID, time slice, and specific application are used as benchmarks, and the average user latency of the corresponding dimension in the park is compared. If it exceeds m times the benchmark value, an anomaly is determined. When the anomaly count reaches n% of the total number of flows, it can be determined that the user experienced a fault during that time period (a continuous time interval divided based on time slices) and while using that application (a specific network application predefined in the fault detection rules), triggering the subsequent fault localization process. The specific values ​​of m and n are determined by the nature and sensitivity of the park's business; generally, m is between 1.8 and 2.5, and n is between 30 and 65.

[0115] For fault localization of abnormally active interaction flows: When the detection module detects an anomaly, it traverses other dimensions according to the business meaning and tries to find the clustering characteristics of the anomaly. Dimensions with similar abnormal characteristics are abnormal dimensions; dimensions that maintain normal delay distribution are normal dimensions; by combining abnormal and normal dimensions, the clustering point of the fault can be found, thereby accurately locating the fault point.

[0116] As a specific implementation case, step S5 involves anomaly detection and fault diagnosis for a user based on multi-dimensional latency characteristics, specifically including:

[0117] For a user's active interaction stream, query the latency parameter benchmark using the current time, access location, and application type. If the current latency exceeds the benchmark by m times, the stream is marked as abnormal. Accumulate the abnormal count and stream count within the time slice. At the end of the time slice, if the abnormal count accounts for more than n% of the total stream count, the user is identified as having a network fault, and fault diagnosis is performed.

[0118] In the fault diagnosis phase, the user's network links are first traversed, starting from the access point. It's checked whether other users at the same access point are also experiencing a fault. If other users are functioning normally, it's determined to be a single point of failure. Next, it's checked whether this is a single-point or application-level fault. If other users are also experiencing a fault, the link is traced back to check if the upstream aggregation node / path is faulty, until a normal area / node is found. The aggregation path before this node is the faulty path. For a faulty path / node, parameters at the application, egress, and protocol levels are checked sequentially to further determine the scope of the fault's impact.

[0119] Figure 3 An embodiment of the local area network fault detection system of the present invention is shown.

[0120] The system includes:

[0121] The data acquisition module is used to deploy gateway devices at the local area network exit, perform five-tuple parsing and session tracking on the network packets passing through, group packets with the same five-tuple into the same network flow and record the arrival time of each packet, identify active interaction flows based on the interaction characteristics of the packets, and output the user address, service address and corresponding data time information of the active interaction flow.

[0122] The delay calculation module is used at the gateway of the local area network (LAN) exit to extract the arrival times of user-side request packets and server response packets at the gateway, based on the same active interaction flow. Specifically, it includes:

[0123] The service latency of the request is obtained by subtracting the arrival time of the user's request message from the arrival time of the server's response message; the user latency of the request is obtained by subtracting the arrival time of the server's response message from the arrival time of the user's response message.

[0124] The data annotation module is used to annotate the current flow in various dimensions using annotation data sources: it divides and annotates the current flow using time information and business rules to determine the time characteristics of the flow; it parses and annotates the active interactive flow service addresses obtained in step S1 using the IP address database to determine their corresponding geographical location, service provider, and application type; and it annotates the active interactive flow user addresses obtained in step S1 based on the campus topology and user authentication data to identify their geographical location, key links, egress links, broadband operators, and user equipment information.

[0125] The latency analysis module combines the service latency data obtained in step S3 to perform statistical and feature analysis, extract the latency distribution patterns of each exit link, service provider, and application in the park, and obtain the multidimensional distribution of each service latency feature; combined with the user latency data obtained in S3, it performs group statistics by the same application type, analyzes the latency performance of different geographical locations and user devices in the park, and obtains the multidimensional distribution of each latency feature.

[0126] The fault identification module is used to calculate the current flow's delay distribution based on the multi-dimensional delay features established in step S4, and compare it with the reference value to obtain the deviation status. If the current flow's delay data significantly exceeds the reference value, it is determined that the flow has poor performance in this time, space and application scenario, indicating that there is an anomaly in the network path it traverses, and the degree of deviation can reflect the severity of the anomaly.

[0127] By combining other active interactive flows passing through the gateway at the same time, integrating deviation values ​​from different spatial locations and application types, and comparing them with the campus topology provided by S3, the specific faulty device location causing the anomaly is located through the process of elimination.

[0128] The fault identification module can identify these fault types:

[0129] If a single user has a high latency, but other users nearby have normal latency data, it can be determined that the user's device performance is poor or the user's Wi-Fi signal is weak.

[0130] The latency data of a certain user and its neighboring users is not good, but other users in the same VLAN are normal. This can rule out any abnormalities in the VLAN aggregation point to the gateway and external services. It can be determined that the user's Wi-Fi is faulty or there is abnormal interference nearby.

[0131] If users in a certain VLAN all perform poorly, it can be basically determined that the problem is at the level of the aggregation device for that VLAN, and maintenance personnel should be dispatched to check and repair it.

[0132] In practice, latency data provided from both a network-wide and regional perspective can also be used for network optimization assessment. By combining regional spatiotemporal data and comparing network latency metrics at two different time points, the effectiveness of network optimization measures can be determined, and the optimization results can be evaluated.

[0133] The data annotation module also includes:

[0134] The time rules component is used to store and retrieve time slicing information and business rule time data, such as holidays, weekends, working hours, and daily time slicing rules;

[0135] The network topology information component is used to store and retrieve campus topology information, including access point locations, device interconnection relationships, egress types, and broadband operators.

[0136] The user access authentication data component is used to record the current user's online authentication status, including IP address, username, online location, device type, etc.

[0137] The IP address data component records information including IP address, geographical location, service provider, and application type, and is used to record the correspondence between configured IP addresses and service providers, applications, etc.

[0138] The delay analysis module also includes:

[0139] The multidimensional latency benchmark data component is used to access multidimensional network latency data generated during the latency analysis process, recording network latency data for each reference location, time, and application in the form of spatiotemporal data.

[0140] As a specific implementation plan, the latency analysis module, based on the application tags of the data, uses the user latency of the same application, with milliseconds as the unit of latency, to generate the percentage distribution of each latency value at the current moment, and accumulates the percentages to obtain the latency values ​​corresponding to 80%, 90%, and 95% of the data, which serve as the baseline latency for the current moment. Similarly, location information is overlaid, and latency data of the same VLAN is selected, and the same method is used to obtain the regional latency data represented by a certain VLAN, which serves as the latency value for that region. By combining application, location, and user, along with the network usage time information of users in the park, spatiotemporal and application-specific user latency data for the park can be generated. Based on a similar method, the spatiotemporal distribution of service latency in the park is statistically analyzed.

[0141] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 4As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores static and dynamic information data. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps in the above method embodiments.

[0142] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present invention and does not constitute a limitation on the computer device to which the present invention is applied. A specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0143] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0144] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the method embodiments described above.

[0145] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0146] In summary, the device of this invention receives network data packets through a network interface, parses the 5-tuple and identifies active interaction flows, calculates and generates user latency and service latency, and combines multiple data sources to complete the labeling of active interaction flows. It then analyzes and generates benchmark latency data across multiple dimensions. By comprehensively analyzing this multi-dimensional benchmark data, both internal and external faults within the campus can be identified. This method does not require additional detection equipment within the local area network, nor does it require user or server intervention, and it eliminates the need for network maintenance personnel to visit the site. It can quickly classify faults and locate critical fault nodes.

[0147] This invention is not limited to the structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this invention is limited only by the appended claims.

Claims

1. A method for detecting faults in a local area network, characterized in that, Includes the following steps: S1: Active Interaction Stream Acquisition Deploy gateway devices at the local area network egress point to perform five-tuple parsing and session tracking on passing network packets. Packets with the same five-tuple are grouped into the same network flow and the arrival time of each packet is recorded. Active interaction flows are identified based on the interaction characteristics of the packets, and the user address, service address, and corresponding data time information of the active interaction flow are output. S2: Delayed computation At the gateway of the local area network (LAN) exit, taking the same active interaction flow as a unit, extract the arrival time of user-side request messages and server response messages at the gateway, and calculate the delay: The service latency of the request is obtained by subtracting the arrival time of the user's request message from the arrival time of the server's response message; the user latency of the request is obtained by subtracting the arrival time of the server's response message from the arrival time of the user's response message. S3: Multidimensional Annotation Based on the park's business patterns, the time characteristics of the active interaction stream obtained in step S1 are labeled to distinguish the time dimension characteristics of weekends, weekdays, holidays, and different times of the day. By using user authentication data, the local link information of active interactive streams obtained by S1 is labeled to identify their geographical location and user device information, and to determine their corresponding network link and exit type. The server-side information of the active interactive flow obtained in step S1 is parsed and labeled using the IP address database to determine the application type, service provider, and service address of the flow. S4: Delay Analysis Statistical analysis and feature analysis are performed on the service latency data after step S3 to extract the latency distribution patterns of each exit link, service provider and application in the park, and to obtain the spatiotemporal distribution of each service latency feature. Statistical analysis and feature analysis are performed on the user latency data after step S3. The data is grouped and statistically analyzed by the same application type. The latency distribution pattern of each internal link in the park is extracted, and the latency performance of different geographical locations and user devices in the park is analyzed to obtain the multi-dimensional distribution of each latency feature. S5: Anomaly Detection and Fault Location Based on the multi-dimensional delay features established in step S4, the delay distribution of the current flow is calculated and compared with the reference value to obtain the deviation state: If the latency data of the current stream significantly exceeds the reference value, it is determined that the stream has poor performance in the application scenario, indicating that there is an anomaly in the network path it traverses.

2. The local area network fault detection method according to claim 1, characterized in that, The active interaction stream identified in step S1 includes at least the following network processes: User equipment C sends a request message Message exist At any time, a request message is sent from the gateway (GW) to the server (SR). ; Server-side SR processing message ,time consuming Then send a response message. Message exist The time is forwarded by the gateway GW and then received by the user equipment C; User equipment C processes messages ,time consuming and send a new request. ; At any moment It is then sent to the server SR via the gateway GW.

3. The local area network fault detection method according to claim 2, characterized in that, In step S2, based on the message timing data collected by the gateway, the relative service delay is defined as: = - ； The relative user latency is: = - ； in, The time when the user request message arrives at the gateway. The time when the server response message arrives at the gateway. The time when the user-side response message arrives at the gateway.

4. The local area network fault detection method according to claim 1, characterized in that, In step S1, when identifying active interactive streams, the message types of the TCP three-way handshake process and UDP real-time services with stable bidirectional streams are selected. The message types include SYN messages, SYN-ACK messages, and ACK messages.

5. A local area network fault detection method according to claim 1, characterized in that, Step S4 involves feature analysis of the active interaction flow, specifically including: Iterate through each dimension, group by time period, user ID, and access location, aggregate to generate statistical analysis results, form a wide table record and store it in the database for use as a refined reference benchmark.

6. The local area network fault detection method according to claim 1, characterized in that, In step S5, based on the multi-dimensional delay features established in step S4 as a reference, the delay distribution of the current flow is calculated and compared with the reference value to obtain the deviation state, specifically including: First, based on the characteristics of the park's business, the monitoring granularity and grouping dimensions are selected. For scenarios that focus on user experience, the active interaction flow of each user is monitored by user ID as the group, and for scenarios that focus on the park's exit, the active interaction flow on the exit link is monitored by exit ID as the group. Secondly, for newly identified active interactive streams, the corresponding reference values ​​are queried in the benchmark library using the same multidimensional features as in the training phase. If the delay of the current stream is significantly larger than the benchmark and exceeds the set threshold, the stream is determined to be abnormal, and the abnormal count is accumulated over several consecutive time slices. When the abnormal count reaches a preset proportion, the combination of dimensions is considered to be abnormal. Finally, for the identified abnormally active interaction flow, abnormal clustering feature analysis is performed by traversing other dimensions according to business semantics. Dimensions with similar abnormal features are marked as abnormal dimensions, and dimensions that maintain normal delay distribution are marked as normal dimensions. By combining abnormal and normal dimensions, the clustering points of the fault are identified, and the fault points are accurately located.

7. A local area network fault detection method according to claim 6, characterized in that, The criteria for determining anomalies use scenario-specific thresholds: User-level anomalies are compared with the average user latency of the corresponding dimension in the park based on user ID, time slice, and specific application. When the latency exceeds m times the benchmark value, an anomaly is judged. When the anomaly count reaches n% of the total number of combined flows in that dimension, it is determined that the user has a fault in the time slice and specific application and subsequent location is triggered. Where m = 1.8~2.5 and n = 30~65.

8. A local area network fault detection system, characterized in that, The local area network fault detection method according to any one of claims 1-7, wherein the system comprises: The data acquisition module is used to deploy gateway devices at the local area network exit, perform five-tuple parsing and session tracking on the network packets passing through, group packets with the same five-tuple into the same network flow and record the arrival time of each packet, identify active interaction flows based on the interaction characteristics of the packets, and output the user address, service address and corresponding data time information of the active interaction flow. The latency calculation module is used at the gateway of the local area network (LAN) exit to extract the arrival times of user-side request packets and server response packets at the gateway, taking the same active interaction flow as a unit, and calculate the latency. The service latency of the request is obtained by subtracting the arrival time of the user's request message from the arrival time of the server's response message; the user latency of the request is obtained by subtracting the arrival time of the server's response message from the arrival time of the user's response message. The data annotation module is used to perform multi-dimensional annotations on active interaction flows; The latency analysis module is used to perform statistical and feature analysis on the labeled service latency data, extract the latency distribution patterns of each exit link, service provider and application in the park, and obtain the spatiotemporal distribution of each service latency feature. Statistical analysis and feature analysis were performed on the labeled user latency data. The data was grouped and statistically analyzed by the same application type. The latency distribution pattern of each internal link in the park was extracted, and the latency performance of different geographical locations and user devices in the park was analyzed to obtain the multi-dimensional distribution of each latency feature. The fault identification module is used to calculate the current flow's delay distribution based on established multi-dimensional delay features as a reference, and compare it with the reference value to obtain the deviation status. If the current flow's delay data significantly exceeds the reference value, it is determined that the flow has poor performance in this time, space and application scenario, indicating that there is an anomaly in the network path it traverses.

9. A computer-readable storage medium, characterized in that, Used to store a computer program, wherein the computer program, when executed by a processor, implements the local area network fault detection method as described in any one of claims 1-7.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1-7.

Images