An operation and maintenance network fault resolution system and method

Abstract

The present disclosure belongs to the technical field of network communication, and particularly relates to a network fault operation and maintenance solution and method, which comprises a data acquisition module for collecting multi-source original network data of a target network device, pre-processing the multi-source original network data to obtain multi-source standard network data; a semantic reconstruction module for identifying non-business purpose fields in the multi-source standard network data and performing semantic reconstruction processing thereon to obtain a target state set; a fault diagnosis module for performing fault analysis on the target state set to determine a fault type and a root location; and an execution module for generating and executing a predictive isolation strategy according to the fault type and the root location, recording a fault processing process and updating a dynamic coding rule and a diagnosis weight distribution strategy. The present disclosure can solve the problems of low efficiency and insufficient accuracy caused by the dependence of network fault diagnosis methods on manual experience and rule analysis.

Description

Technical Field

[0001] This disclosure belongs to the field of network communication technology, specifically relating to a network fault troubleshooting system and method. Background Technology

[0002] Network communication connects isolated devices through networks, enabling communication between people, between people and computers, and between computers through information exchange. With the rapid development of network communication technology, the ever-expanding scale of networks, and the diversification of services, the frequency and complexity of network failures are also constantly increasing. In order to ensure the reliability and stability of the network, network operators and maintenance personnel need to promptly detect and locate faults and take corresponding solutions. However, traditional network fault diagnosis methods mainly rely on manual experience and rule analysis, which is inefficient and difficult to cope with complex fault scenarios in large-scale network environments.

[0003] With the rise of artificial intelligence and deep learning technologies, some data-driven fault diagnosis methods have been gradually applied. These methods attempt to extract valuable information from the analysis and learning of a large amount of historical data, thereby improving the accuracy and efficiency of fault diagnosis.

[0004] Problems with existing technology:

[0005] However, existing technologies still have some limitations, such as insufficient adaptability to new network protocols and complex network environments, and limited ability to deeply analyze network traffic characteristics. In addition, existing fault diagnosis models often fail to accurately reflect the actual situation in the network environment, especially in special network types such as power line carrier networks. Due to the diverse types of equipment and complex network structures, noise is relatively high, which affects the performance of diagnostic algorithms. At the same time, although network slicing technology improves resource utilization, it also makes the network architecture more complex, bringing new challenges to network fault management. Therefore, how to improve the accuracy and efficiency of fault diagnosis, especially when facing complex network environments and new network protocols, and how to fully explore and utilize network traffic characteristics, have become problems that need to be solved. Summary of the Invention

[0006] To address the aforementioned issues, this disclosure provides a network fault diagnosis system and method that can resolve the problems of network fault diagnosis methods relying on manual experience and rule analysis, resulting in low efficiency and insufficient accuracy.

[0007] Firstly, this disclosure provides a network fault diagnosis and maintenance system, including:

[0008] The data acquisition module is used to collect multi-source raw network data from the target network device, preprocess the multi-source raw network data, and obtain multi-source standard network data.

[0009] A semantic reconstruction module, connected to the data acquisition module, is used to identify non-business-purpose fields in the multi-source standard network data and perform semantic reconstruction processing on them to obtain a target state set.

[0010] The semantic reconstruction module includes: a field decoding unit, a sub-item encoding unit, and a semantic mapping unit;

[0011] The field decoding unit is used to adjust the preset initial field splitting strategy based on real-time network traffic characteristics, and to split the non-business-purpose field into several semantic sub-items based on the adjusted real-time field splitting strategy.

[0012] The sub-item encoding unit is used to perform feature encoding on each semantic sub-item to generate an encoded sub-item;

[0013] The semantic mapping unit is used to map several of the encoded sub-items to a predefined set of implicit states to obtain a target set of states;

[0014] The fault diagnosis module is connected to the semantic reconstruction module to perform fault analysis based on the target state set and determine the fault type and root cause location.

[0015] The execution module, connected to the fault diagnosis module, is used to generate and execute a predictive isolation strategy based on the fault type and the root cause location, and to record the fault handling process and update the dynamic coding rules and diagnostic weight allocation strategy.

[0016] Furthermore,

[0017] The field decoding unit includes:

[0018] The feature recognition subunit is used to monitor network traffic in real time and identify the real-time type distribution, burst characteristics, and proportion of real-time protocols in real-time network traffic.

[0019] The adjustment subunit is connected to the feature recognition subunit to determine the real-time traffic pattern based on the real-time type distribution, real-time traffic burst characteristics and real-time protocol composition ratio. The real-time traffic pattern is compared with the historical traffic pattern to determine the degree of change based on the comparison result, and the preset initial field splitting strategy is adjusted based on the degree of change.

[0020] The splitting subunit, connected to the adjustment subunit, is used to split the non-business-purpose field based on the adjusted real-time field splitting strategy to obtain several semantic sub-items.

[0021] Furthermore,

[0022] The adjustment subunit includes:

[0023] The comparison block is used to compare the real-time traffic pattern with the historical traffic pattern corresponding to the historical baseline of the same period, and obtain the comparison result.

[0024] The adjustment block is connected to the comparison block to calculate the actual deviation based on the comparison result. The actual deviation is compared with a preset deviation threshold, and the preset initial field splitting strategy is adjusted based on the comparison result.

[0025] Furthermore,

[0026] The sub-item encoding unit includes:

[0027] A sub-item feature extractor is used to extract temporal change features corresponding to any of the semantic sub-items;

[0028] A dynamic weight allocator is used to assign dynamic diagnostic weights to the temporal variation characteristics of the semantic sub-items based on the network topology and historical fault data.

[0029] An encoder is used to fuse the temporal variation features with the dynamic diagnostic weights to generate coded sub-items.

[0030] Furthermore,

[0031] The semantic mapping unit includes;

[0032] A fault fingerprint generator is used to combine several coded sub-items to form a unique fault fingerprint, wherein the fault fingerprint includes time feature components, protocol feature components, topology feature components, and pattern feature components, wherein:

[0033] The time feature components are the temporal variation characteristics of each semantic sub-item, and periodic features are extracted through spectral analysis;

[0034] The protocol feature components represent the distribution of abnormal patterns in different protocol layers;

[0035] The topological feature component represents the criticality of the faulty device within the network topology.

[0036] The pattern feature components are the cyclic and synchronization characteristics of the coded sub-items;

[0037] An anomaly pattern identifier is used to identify anomaly patterns by comparing the similarity between the current fault fingerprint and the historical fault fingerprint. When the similarity exceeds a preset threshold, it is determined that there is an anomaly pattern that matches the historical fault pattern.

[0038] When a new abnormal pattern is detected, if the coded sub-item exhibits a preset cyclic sequence pattern or a cross-device synchronous change pattern, and the similarity does not reach a preset threshold, it is determined that a new abnormal pattern exists.

[0039] Furthermore,

[0040] The fault diagnosis module includes:

[0041] The fault analysis unit is used to analyze the target state set and determine the fault type;

[0042] The fault tracing unit is used to construct a propagation path map based on the propagation path of the abnormal mode and the network topology, calculate the temporal correlation of abnormal modes between devices, and identify the starting point of the abnormal mode, i.e. the root cause device of the fault, based on the propagation path map and the temporal correlation.

[0043] Furthermore,

[0044] The execution module includes:

[0045] A predictive isolation unit is used to dynamically generate an isolation strategy based on the location and fault type of the fault-causing device.

[0046] The fault process recording unit is used to completely record key information throughout the entire fault handling process;

[0047] The strategy update unit is used to update dynamic coding rules and diagnostic weight allocation strategies based on historical data recorded during the fault process.

[0048] Secondly, based on the same inventive concept, this disclosure provides a solution for network maintenance faults, including the following steps:

[0049] Obtain non-business-purpose fields, split them into multiple semantic sub-items according to dynamic encoding rules, perform feature encoding on each semantic sub-item, and map the encoded sub-items to a predefined implicit state set;

[0050] Fault analysis is performed based on the mapped implicit state set to detect abnormal patterns;

[0051] When an abnormal pattern is detected, the root cause device of the fault is determined by calculating the temporal correlation between abnormal patterns within the device.

[0052] Based on the location and fault type of the root cause device, predictive isolation strategies are dynamically generated and executed to implement preventive isolation measures before the fault occurs.

[0053] Record the fault handling process and update the dynamic coding rules and diagnostic weight allocation strategy.

[0054] Furthermore,

[0055] The calculation of the temporal correlation uses a cross-correlation function, which introduces a network topology distance attenuation factor to make the calculation results reflect the actual propagation path of the abnormal pattern.

[0056] The network topology distance attenuation factor is dynamically adjusted based on the number of physical connection hops and bandwidth limitations between devices.

[0057] Furthermore,

[0058] The steps for dynamically generating and executing predictive isolation strategies include:

[0059] Calculate the impact of the root cause device of the failure on critical business nodes;

[0060] Selective delay parameters are generated based on the degree of impact, and the selective delay parameters are positively correlated with the degree of impact.

[0061] Selective delay is applied only to data packets in the direction of fault propagation, and the delay time is dynamically adjusted according to the selective delay parameter;

[0062] Selective delay, while ensuring the quality of critical business data transmission, blocks the path of fault propagation, enabling the fault resolution system to complete preventative isolation before the fault actually occurs.

[0063] Compared with the prior art, this disclosure has the following advantages:

[0064] 1. This disclosure, by setting up a semantic reconstruction module, can split non-business-purpose fields in network communication protocols into multiple semantic sub-items according to dynamic decoding rules, and perform feature encoding and mapping of each semantic sub-item to a predefined implicit state set, thereby realizing in-depth analysis of network traffic characteristics, overcoming the problem of low efficiency of traditional manual experience and rule analysis, and improving the accuracy and efficiency of fault diagnosis.

[0065] 2. This disclosure adopts dynamic decoding rules, which can automatically adjust the field splitting method according to network traffic characteristics, improve the adaptability of the fault resolution system to new network protocols and complex network environments, and enable it to have corresponding analysis capabilities when facing complex network environments.

[0066] 3. This disclosure effectively extracts the temporal variation features of semantic sub-items through the sub-item feature extractor and dynamic weight allocator of the sub-item coding unit, and dynamically allocates diagnostic weights according to the network topology and historical fault data, thereby improving the accuracy and reliability of fault diagnosis.

[0067] Other features and advantages of this disclosure will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the disclosure. The objects and other advantages of this disclosure may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description

[0068] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0069] Figure 1 A schematic diagram of the structure of an operation and maintenance network fault resolution system according to an embodiment of the present disclosure is shown;

[0070] Figure 2 A flowchart illustrating a method for resolving network faults according to an embodiment of this disclosure is shown. Detailed Implementation

[0071] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0072] Figure 1 A schematic diagram of a network fault resolution system according to an embodiment of this disclosure is shown. See also: Figure 1 As shown, an embodiment of the network fault resolution system disclosed herein includes: a data acquisition module 10, a semantic reconstruction module 20, a fault diagnosis module 30, and an execution module 40, wherein...

[0073] Data acquisition module 10 is used to acquire multi-source raw network data from the target network device, preprocess the multi-source raw network data, and obtain multi-source standard network data.

[0074] In this embodiment of the disclosure, the data acquisition module acquires network data in the following manner:

[0075] For example, configure the rsyslog service on port 514 of the SNA (System Network Architecture) system to receive system logs from network devices. At the same time, monitor network traffic through the libpcap library, paying particular attention to non-business-purpose fields in the TCP / IP protocol stack.

[0076] In this embodiment of the disclosure, the received raw data is preprocessed, including timestamp synchronization, data packet reassembly, and abnormal data filtering, wherein...

[0077] Timestamp synchronization includes: using the NTP (Network Time Protocol) clock of the central maintenance server as the reference time source, when collecting raw data packets from the target network device through the mirror port or network splitter, simultaneously recording the "data packet capture timestamp" (central server time) and the "data packet generation timestamp" (network device local time); calculating the difference between the "capture timestamp" and "generation timestamp" of the same data packet; if the deviation exceeds a preset threshold (default 10ms), then matching the pre-stored "device time deviation compensation table" (which calculates the average time deviation of each device based on historical data) according to the device IP address, compensating and correcting the generation timestamp to ensure that the data packet timestamps of all devices are unified to the NTP reference clock; and arranging the calibrated data packets in ascending order of "unified timestamp" to solve the problem of data packet timing disorder caused by device clock asynchrony, providing accurate time dimension data for subsequent data packet reassembly and fault timing analysis.

[0078] Packet reassembly includes: parsing the protocol header information of the original data packet (such as the "fragment offset" and "more fragments" flags in the IP protocol header), identifying the fragmented data packets (such as IP fragments and TCP segments), and grouping the fragmented data packets according to the combination key of "source IP + destination IP + protocol type + source port + destination port + fragment ID"; for fragmented data packets within the same group, sorting them according to the "fragment offset" value from smallest to largest, removing duplicate fragments (through checksum verification), and then concatenating the payload data of each fragment in sequence to restore the complete original data packet (such as concatenating 3 IP fragments into 1 complete TCP data packet); for connection-oriented protocols such as TCP, stream reassembly of the concatenated data packets is performed based on the "sequence number" and "acknowledgment number" to ensure that data packets in the same TCP session are arranged in the order of transmission, avoiding the omission of fault characteristics caused by network transmission out-of-order (such as the timing changes of TCP reserved bits need to be analyzed based on the complete session).

[0079] Abnormal data filtering includes invalid data removal, interference data filtering, and redundant data deduplication.

[0080] Specifically, the data acquisition module uses the rsyslog tool to collect alarm information from the network log through port 514 of the SNA system. It then performs information parsing and data cleaning on the received raw alarm information to obtain processed alarm information. The processed alarm information contains a "message" field, which is represented in string form and contains a large amount of information. This field is split and processed according to a preset information template to obtain new fields.

[0081] The semantic reconstruction module 20 is connected to the data acquisition module 10 and is used to identify non-business-purpose fields in the multi-source standard network data and perform semantic reconstruction processing on them to obtain a target state set.

[0082] In this embodiment of the disclosure, the semantic reconstruction module 20 includes: a field decoding unit 21, a sub-item encoding unit 22, and a semantic mapping unit 23;

[0083] The field decoding unit 21 is used to adjust the field splitting strategy based on real-time network traffic characteristics, and split the non-business-purpose field into several semantic sub-items based on the field splitting strategy.

[0084] The sub-item encoding unit 22 is used to perform feature encoding on each of the semantic sub-items to generate encoded sub-items;

[0085] The semantic mapping unit 23 is used to map several of the encoded sub-items to a predefined set of implicit states to obtain a target set of states.

[0086] In this embodiment, the semantic reconstruction module is located between the data acquisition module and the fault diagnosis module to form a data processing pipeline. It is deployed on the central operation and maintenance server and accesses the core network switch through a mirror port or network splitter to capture network traffic in real time. It is used to perform semantic reconstruction processing on non-business-purpose fields in the network communication protocol. The semantic reconstruction module converts the bit pattern of the protocol field into a semantic representation that reflects the potential fault state of the network device.

[0087] It should be further explained that non-business-purpose fields in network communication protocols specifically refer to fields in network protocols that are mainly used for protocol control rather than directly carrying business data. These include fields such as the type of service field in the IP protocol header, the reserved bit field in the TCP protocol header, and the type and code fields in the ICMP protocol. These fields usually remain static or follow a specific pattern in normal network communication. When abnormal changes occur, they may indicate potential problems with network devices or links.

[0088] Alternatively, non-business-purpose fields in network communication protocols can also be represented as fields in the operation and maintenance network based on the protocol type or a custom protocol string.

[0089] In this embodiment of the disclosure, the field decoding unit 21 includes:

[0090] The feature recognition subunit is used to monitor network traffic in real time and identify the real-time type distribution, burst characteristics, and proportion of real-time protocols in real-time network traffic.

[0091] The adjustment subunit is connected to the feature recognition subunit to determine the real-time traffic pattern based on the real-time type distribution, real-time traffic burst characteristics and real-time protocol composition ratio. The real-time traffic pattern is compared with the historical traffic pattern to determine the degree of change based on the comparison result, and the preset initial field splitting strategy is adjusted based on the degree of change.

[0092] The splitting subunit, connected to the adjustment subunit, is used to split the non-business-purpose field based on the adjusted real-time field splitting strategy to obtain several semantic sub-items.

[0093] In this embodiment, the field decoding unit adopts dynamic adaptive decoding, which automatically adjusts the field splitting strategy according to real-time network traffic characteristics. The field decoding unit has a built-in traffic feature analysis engine to continuously monitor the distribution of network traffic types (such as the proportion of traffic from HTTP, video streams, FTP, etc.), traffic burst characteristics (such as fluctuations in the number of data packets per unit time and the frequency of peak traffic occurrence), and protocol composition ratio (such as the proportion of TCP, IP, and UDP protocol data packets). When a significant change in network traffic pattern is detected, the fault resolution system automatically adjusts the bit width configuration and starting position of the field splitting to ensure that the split semantic sub-items can accurately reflect the potential fault state characteristics in the current network environment.

[0094] It should be noted that the field decoding unit can identify and extract microsecond-level state change patterns that traditional monitoring systems cannot detect. For example, when the explicit congestion notification bit in the IP protocol header exhibits a specific transition pattern in a very short time, the field decoding unit system will automatically adjust the splitting strategy and extract the bit as an independent semantic sub-item for analysis. The above field processing capability enables the fault resolution system to detect impending network congestion in advance and issue early warning information.

[0095] In this embodiment of the disclosure, the adjustment subunit includes:

[0096] The comparison block is used to compare the real-time traffic pattern with the historical traffic pattern corresponding to the historical baseline of the same period, and obtain the comparison result.

[0097] The adjustment block is connected to the comparison block to calculate the actual deviation based on the comparison result. The actual deviation is compared with a preset deviation threshold, and the preset initial field splitting strategy is adjusted based on the comparison result.

[0098] In this embodiment of the disclosure, a "single-dimensional difference value" is calculated for each core dimension of the real-time and historical data, using the following formula:

[0099] Single-dimensional variance = |(real-time value - historical baseline value) / historical baseline value| × 100%;

[0100] Example: If the real-time video stream accounts for 60% and the historical baseline accounts for 20%, then the difference value in this dimension = |(60-20) / 20|×100%=200%.

[0101] Output a "Multi-dimensional Comparison Result Table", which includes the name of each dimension, real-time value, historical baseline value, and single-dimensional difference value, as input for subsequent adjustment blocks.

[0102] In this embodiment of the disclosure, based on the "single-dimensional difference value" output by the comparison block, the comprehensive actual deviation is calculated according to the "diagnostic weight" of each dimension (preset weights: business type distribution 50%, protocol composition 35%, burst intensity 15%), as follows:

[0103] Actual deviation = Σ (single-dimensional difference value × corresponding dimension weight).

[0104] In this embodiment of the disclosure, the adjustment block includes:

[0105] When the actual deviation is less than or equal to the deviation threshold, it is determined that the traffic pattern has not changed significantly, and the current initial field splitting strategy is maintained.

[0106] When the actual deviation exceeds the deviation threshold, it is determined that the traffic pattern has changed significantly, triggering a splitting strategy adjustment.

[0107] In this implementation, the field decoding unit first performs bit-level parsing on the original non-business-purpose fields, and then selects the optimal field splitting scheme based on the current network traffic characteristics. Different business types have different sensitivities to fault characteristics and correspond to different splitting strategies. For example, in a network environment dominated by HTTP traffic, the field decoding unit system adopts a 3+3 bit balanced splitting method; while in a network environment dominated by video streams, it automatically switches to a 2+2+2 bit refined splitting strategy. In mixed business scenarios, it dynamically matches the business type with the highest proportion and prioritizes adapting to its corresponding splitting strategy (e.g., if the proportion of video streams exceeds 50%, it splits according to video stream rules). The dynamic adjustment mechanism enables the fault resolution system to adapt to the potential fault state representation needs under different business scenarios, significantly improving the accuracy and relevance of state information extraction.

[0108] In this embodiment of the disclosure, the starting position of the "critical bit" that is strongly related to the fault in the non-business application field is adjusted, for example:

[0109] When frequent changes in the "IP explicit congestion notification bit" are detected (which is directly related to network congestion faults), the splitting start position is adjusted to the starting index of this bit, and this bit is split separately as an independent semantic sub-item to avoid interference from other irrelevant bits;

[0110] When the TCP reserved bit changes periodically (related to device hardware failure), the splitting width of the region containing that bit is increased (e.g., from 1 bit to 2 bits) to fully capture the periodic feature.

[0111] In summary, one possible embodiment of this disclosure is that if the difference in "business type distribution" is the greatest (e.g., a sudden increase in the proportion of video streams): the initial "3+3" split is adjusted to a finer "2+2+2" split in order to capture microsecond-level fault characteristics (e.g., device processing delay) in video stream scenarios.

[0112] If the difference in "non-business field changes" is the greatest (e.g., frequent changes in the IP explicit congestion notification bit): adjust the splitting starting position from the 2nd position of the field to the starting index of the key non-business field (e.g., the 3rd position), and split the field separately as an independent semantic sub-item to improve the accuracy of fault feature capture.

[0113] As an optional embodiment, the field decoding unit executes dynamic decoding rules. The dynamic decoding rules adjust the field splitting method according to network traffic characteristics. When the dynamic decoding rules detect a change in network traffic pattern, they automatically adjust the bit width and starting position of the field splitting so that the split semantic sub-items can reflect the potential fault state characteristics in the current network environment. The potential fault state characteristics are the network device operating status reflected by non-business-purpose fields that cannot be directly observed by traditional monitoring methods.

[0114] Specifically, when HTTP traffic is detected as dominant, a bit width configuration method is adopted to evenly split non-business-purpose fields into two parts; when video streaming traffic is detected as dominant, a bit width configuration method is adopted to finely split non-business-purpose fields into three parts; when a specific traffic pattern related to historical fault events is detected, the splitting strategy of protocol fields that are highly correlated with the fault is adjusted first.

[0115] Dynamic decoding rules adjust the bit width and starting position of field splitting to enable the split semantic sub-items to effectively extract key feature information reflecting the potential fault state of the current network environment, thereby improving the consistency of identification of potential fault modes under different business scenarios.

[0116] It should be further explained that the dynamic decoding rules executed by the field decoding unit are traffic feature perception mechanisms. By deploying multi-dimensional traffic feature monitors, it continuously analyzes the protocol composition ratio, packet size distribution, traffic burst characteristics, and service type characteristics of network traffic to form a real-time traffic feature profile.

[0117] When the traffic feature monitor detects a change in network traffic patterns, the dynamic decoding rule engine triggers an adjustment to the field splitting strategy. This adjustment involves not only reconfiguring the bit width of the field splitting but also intelligent offsetting of the splitting start position, ensuring that the most diagnostically valuable potential fault status information can be effectively extracted in different business scenarios.

[0118] As a further step in this implementation, the dynamic decoding rule engine adopts a pattern matching algorithm based on historical fault data, which can identify specific traffic pattern changes related to historical fault events. When such a pattern is detected, the engine prioritizes adjusting the splitting strategy of protocol fields that are highly correlated with the fault, rather than making uniform adjustments based on the current traffic ratio.

[0119] As mentioned above, the same protocol field exhibits significant differences in characteristics under different business scenarios, making it impossible to establish a unified fault diagnosis model. However, by dynamically adjusting the field splitting method, the same potential fault state can be stably represented under different business scenarios, solving the problem of fault diagnosis across business scenarios. Therefore, it can improve the consistency of fault feature identification in mixed business scenarios.

[0120] Specifically, by dynamically adjusting the bit width and starting position, more effective diagnostic information can be extracted from the same protocol field than with a fixed splitting method. When new fault modes appear in the network, the dynamic decoding rules can detect abnormal modes by adjusting the field splitting strategy.

[0121] Specifically, dynamic decoding rules adjust the field parsing method to match the assessment of potential fault states with the current business scenario, thereby reducing the false alarm rate caused by changes in traffic patterns.

[0122] Furthermore, dynamic decoding rules can obtain potential fault state change patterns related to potential faults through adaptive optimization of field splitting strategies without the need for predefined fault types.

[0123] The sub-item encoding unit includes:

[0124] A sub-item feature extractor is used to extract temporal change features corresponding to any of the semantic sub-items;

[0125] A dynamic weight allocator is used to assign dynamic diagnostic weights to the temporal variation characteristics of the semantic sub-items based on the network topology and historical fault data.

[0126] An encoder is used to fuse the temporal variation features with the dynamic diagnostic weights to generate coded sub-items.

[0127] In this embodiment of the disclosure, the sub-item encoding unit performs feature encoding on the semantic sub-items output by the field decoding unit, and transforms them into technical indicators with clear diagnostic significance. The sub-item encoding unit adopts multi-dimensional feature extraction technology to calculate the temporal change characteristics of each semantic sub-item, including key parameters such as change frequency, periodic intensity, mutation point density and long-term trend.

[0128] In terms of weight allocation, the sub-item coding unit uses a network topology awareness mechanism and historical fault correlation analysis to assign basic weights to semantic sub-items generated by devices in different locations based on their key positions in the network topology. At the same time, it combines the historical fault database to analyze the degree of correlation between each semantic sub-item and specific fault types and dynamically adjusts its diagnostic weights. The above dual weight mechanism can ensure that potential fault state changes on the critical path are given priority attention, thereby improving the accuracy and timeliness of fault diagnosis.

[0129] In this disclosure, by long-term monitoring of the timing characteristics of data packets processed by network devices, including the distribution entropy value of data packet processing delay, the trend of error frame rate change, and hardware-related indicators such as checksum error rate, the performance degradation degree of network device hardware components can be quantitatively assessed.

[0130] When the combined entropy value of the above multi-dimensional indicators is consistently below a certain threshold and shows a downward trend, it is determined that the device has entered a hardware aging state and requires periodic and planned maintenance or replacement. Time-series characteristic monitoring includes, but is not limited to: statistical analysis of changes in processing delays, erroneous data packet ratios, and data packet verification anomaly rates in the TCP / IP protocol stack processed by the device. These indicators have a clear causal relationship with the degradation of device hardware performance.

[0131] Network equipment hardware aging can lead to a decline in data processing capabilities, specifically manifested in the following ways:

[0132] 1. Changes in circuit timing characteristics lead to increased fluctuations in data packet processing latency;

[0133] 2. Decreased signal integrity leads to an increased verification error rate;

[0134] 3. Memory aging leads to an increase in packet loss rate.

[0135] The aforementioned changes manifest at the protocol level as measurable characteristics such as a decrease in packet processing latency distribution entropy and an increase in checksum error rate. By continuously monitoring these network traffic characteristics that have a clear causal relationship with hardware status, a hardware health assessment model can be established to achieve early warning of device hardware aging.

[0136] As an optional embodiment, the sub-item encoding unit includes a sub-item feature extractor and a dynamic weight allocator. The sub-item feature extractor is used to extract the temporal variation features of each semantic sub-item, and the dynamic weight allocator is used to assign different diagnostic weights to different semantic sub-items based on the network topology and historical fault data. The allocation of diagnostic weights satisfies the following rules:

[0137] Semantic items generated by devices at key nodes in the network topology receive the highest weight, and the weight of semantic items related to historical faults dynamically decays over time.

[0138] Based on the above, the sub-item encoding unit uses a sub-item feature extractor and a dynamic weight allocator to work together to transform the original semantic sub-items output by the field decoding unit into technical indicators with clear diagnostic value. The sub-item encoding unit can achieve intelligent screening and value assessment of potential fault status information.

[0139] Specifically, the sub-item feature extractor performs deep feature mining on each semantic sub-item, including but not limited to: frequency spectrum distribution of changes, periodic intensity index, mutation point density function and long-term trend slope. These features together constitute a multi-dimensional feature vector describing the potential fault state of the network.

[0140] The sub-item feature extractor can automatically adjust the time scale of feature extraction according to the dynamic characteristics of semantic sub-items. For rapidly changing sub-items (such as TCP reserved fields), a short window is used for high-frequency feature extraction, while for slowly changing sub-items (such as equipment aging indicators), a long window is used to capture long-term trends. It can simultaneously monitor transient failures and long-term performance degradation.

[0141] Specifically, the dynamic weight allocator constructs a topology criticality model and a historical fault correlation model. The topology criticality model is based on the dynamic analysis of the network topology and calculates the criticality of each device in the network in real time. The topology criticality not only refers to the connectivity and centrality of the device, but also to the service traffic impact factor and the fault propagation potential factor. For example, although the connectivity of the switch located at the core-convergence boundary is not high, it may be given a high topology criticality because its failure may affect a large number of service flows.

[0142] Specifically, the historical fault correlation model analyzes the historical fault database to calculate the statistical correlation between each semantic sub-item and a specific fault type. Based on the time decay characteristic, the historical fault correlation model gives higher weights to semantic sub-items that are highly correlated with recent faults, while the weights of sub-items that are correlated with long-standing faults are reduced. The model also makes intelligent adjustments based on the recurrence cycle of the fault type and the rate of change of the network environment.

[0143] In summary, dynamic weight allocation can amplify potential fault signals related to the current network state while effectively suppressing irrelevant noise signals. When potential hardware fault signs appear in the network, the weight of semantic sub-items related to hardware aging is increased, making the weak fault signals stand out from the background noise.

[0144] Specifically, dynamic weights enable the prediction of fault propagation paths. By analyzing the temporal changes in the weights of semantic sub-items of devices at different locations, the potential propagation direction and speed of potential faults can be inferred. In addition, through the time decay of the dynamic weight allocator, the importance of historical data can be automatically backtracked and reassessed based on the current network state. When a pattern similar to any major historical fault is detected, the weight of the relevant historical data will be increased accordingly, thereby enhancing the judgment weight of the dynamic weight allocator system. When facing recurrent faults, the diagnosis speed is faster. By adjusting the topology criticality in real time, the dynamic weight allocator system can adapt to topology changes and reduce the false alarm rate caused by topology changes.

[0145] As an optional implementation, the encoder first standardizes the temporal variation features (e.g., converts "500ms period" into a standardized value of 0.6), then calculates them by weighting them with diagnostic weights (0.8) (e.g., 0.6 × 0.8 = 0.48), and finally combines information such as device IP and protocol field type to generate structured coded sub-items (example: {Device IP: 192.168.0.1, Protocol field: TCP reserved bit, Feature weight value: 0.48}).

[0146] In this embodiment of the disclosure, the semantic mapping unit 23 includes;

[0147] A fault fingerprint generator is used to combine several coded sub-items to form a unique fault fingerprint, wherein the fault fingerprint includes time feature components, protocol feature components, topology feature components, and pattern feature components, wherein:

[0148] The time feature components are the temporal variation characteristics of each semantic sub-item, and periodic features are extracted through spectral analysis;

[0149] The protocol feature components represent the distribution of abnormal patterns in different protocol layers;

[0150] The topological feature component represents the criticality of the faulty device within the network topology.

[0151] The pattern feature components are the cyclic and synchronization characteristics of the coded sub-items;

[0152] An anomaly pattern identifier is used to identify anomaly patterns by comparing the similarity between the current fault fingerprint and the historical fault fingerprint. When the similarity exceeds a preset threshold, it is determined that there is an anomaly pattern that matches the historical fault pattern.

[0153] When a new abnormal pattern is detected, if the coded sub-item exhibits a preset cyclic sequence pattern or a cross-device synchronous change pattern, and the similarity does not reach a preset threshold, it is determined that a new abnormal pattern exists.

[0154] Specifically, the semantic mapping unit maps the encoded sub-items to a predefined set of implicit states, realizing the semantic transformation from raw data to diagnostic states. The semantic mapping unit contains a diagnostic space of five key implicit states, each state corresponding to a specific network operating condition and technical meaning.

[0155] It should be noted that the implicit state set includes, but is not limited to, normal state, device hardware state, processing capacity fluctuation state, protocol state, potential congestion state, hidden fault source state, fault propagation risk state, and security state.

[0156] Specifically, in terms of fault fingerprint generation, the semantic mapping unit adopts multi-protocol field fusion technology to combine key semantic sub-items from different protocol layers such as TCP, IP and UDP according to specific rules to form a unique fault fingerprint. Cross-protocol feature fusion can identify complex fault modes that cannot be detected by a single protocol layer.

[0157] In this embodiment of the disclosure, anomaly pattern recognition is the main function of the semantic mapping unit, which mainly includes and focuses on two types of key anomaly patterns:

[0158] 1. A specific cyclic sequence of encoded sub-items indicates a potential fault when the same state sequence repeats at a fixed period.

[0159] Second, cross-device synchronous change pattern: when the semantic sub-items of multiple network devices show a highly correlated change trend, it indicates that there is a systemic failure risk that has not yet appeared.

[0160] By identifying the above-mentioned abnormal patterns, preventative measures can be implemented before a failure actually occurs.

[0161] In this embodiment, when the semantic mapping unit detects that the TCP reserved field of the core network device presents a specific circular pattern and that the pattern is highly synchronized with the adjacent device, even if the CPU utilization and memory utilization of the device are both normal, the semantic mapping unit system can accurately determine that the device is in a hidden fault source state, thus solving the false negative diagnosis problem and significantly reducing the fault false alarm rate.

[0162] Based on the above, the semantic reconstruction module outputs implicit state information, and the fault diagnosis module can analyze the location and root cause of network faults. By using a time-series correlation analysis algorithm, it calculates the propagation path and delay of abnormal patterns between devices, thereby identifying the root cause device of the fault. It is not affected by the surface operating status of the device and can discover devices that appear to be operating normally but actually have potential faults.

[0163] Based on the fault diagnosis results, the execution module implements a predictive isolation strategy, dynamically calculates the risk of fault propagation, and selectively delays the data streams along the fault propagation path. It applies control delays only to data packets in the potential fault propagation direction, while critical business data streams maintain extremely low latency transmission. Through the above isolation method, fault propagation can be effectively blocked without the user's awareness, ensuring business continuity.

[0164] In summary, by utilizing non-business-purpose fields in protocols, early prediction and preventative handling of potential network faults are achieved. Early warnings enable the earlier detection of potential faults, and the identification of potential faults reduces false alarm rates and further improves fault resolution efficiency, ensuring continuous business operation, reducing operating costs caused by equipment maintenance, and eliminating the need for additional monitoring hardware. It fully utilizes the potential information in existing network protocols, has low deployment costs, and possesses superior market application value.

[0165] As a supplement to this embodiment, it should be noted that:

[0166] The fault fingerprint F consists of four feature components: F=(T,P,D,C), where:

[0167] 1. Temporal feature component T: For each semantic sub-item Spectral analysis was performed on the observed sequences to calculate their periodic characteristics. First, the autocorrelation function R(τ) was calculated, and then the main periodic components were determined by peak detection.

[0168] ;

[0169] Where μ is the sequence mean. N is the total length of the observation sequence (number of sampling points). Let τ represent the observation of the i-th semantic sub-item in practice t, where τ is the time delay, representing the time interval in the autocorrelation calculation;

[0170] Periodic intensity Defined as:

[0171] ;

[0172] in and The minimum and maximum period lengths are considered respectively, typically Set to 5 sampling periods, Let it be N / 4. = For the sequence variance, The normalized autocorrelation function value, ranging from [-1, 1];

[0173] Time feature vector The periodic intensity of all semantic sub-items is aggregated to reflect the temporal variation characteristics of the network state.

[0174] It should be further explained that the time feature component performs spectral analysis on the observation sequence of each semantic sub-item to calculate its periodicity characteristics. Specifically, the time feature component system first calculates the autocorrelation function, and then determines the main periodic components through peak detection. The calculation of the autocorrelation function takes into account the number of effective samples, that is, for a time delay τ, only N-τ effective data pairs are used for calculation, where N is the total length of the observation sequence.

[0175] The periodic intensity is determined by finding the maximum value of the normalized autocorrelation function within a specific range, typically set between 5 sampling periods and a quarter of the sequence length. The temporal feature component aggregates the periodic intensity of all semantic sub-items, reflecting the temporal variation characteristics of the network state.

[0176] 2. The protocol feature component P is used to represent the distribution of anomalies in the network protocol stack. As a simple three-part status indicator, it corresponds to the three main network protocols TCP, IP and UDP respectively. However, it is not only applied to these three network protocols, but can also include protocols such as ICMP and ARP.

[0177] The semantic mapping unit system performs independent checks on each protocol layer:

[0178] When a semantic sub-item in any protocol layer exhibits a sufficiently obvious periodic change pattern, the protocol layer is considered to be abnormal. Different protocol layers use different sensitivity standards. This is because the TCP protocol layer is more sensitive to periodic changes, so it sets a lower detection threshold. The IP protocol layer sets a medium sensitivity threshold, and the UDP protocol layer sets a higher detection threshold. Only very strong periodic changes are considered abnormal.

[0179] If any semantic sub-item in the TCP protocol layer exhibits periodic changes of moderate or greater intensity, the TCP layer marks it as an anomaly (represented by 1).

[0180] If any semantic sub-item in the IP protocol layer exhibits a periodic change intensity that reaches a relatively high level, the IP layer is marked as anomalous (represented by 1).

[0181] If any semantic sub-item in the UDP protocol layer exhibits a periodic change intensity that is very strong, the UDP layer is marked as abnormal (represented by 1).

[0182] The terms "moderate," "relatively strong," and "very strong" mentioned above are merely expressions of intensity, not relative standards or comparisons of intensity.

[0183] Protocol layers that do not meet the corresponding strength standards are marked as normal (can be represented by 0);

[0184] For example:

[0185] When only the TCP layer detects the anomaly, the protocol characteristics are [1,0,0];

[0186] When both the TCP and IP layers detect anomalies while the UDP layer is normal, the protocol characteristics are [1,1,0].

[0187] When all three protocol layers detect an anomaly, the protocol characteristic is [1,1,1];

[0188] Among the aforementioned network protocol-based operating characteristics, TCP, as a connection-oriented reliable transmission protocol, often indicates early signs of failure due to periodic changes in its fields; while UDP, as a connectionless protocol, typically only shows periodic changes in its fields when the failure is more severe. By setting different sensitivity thresholds, the semantic mapping unit can more accurately identify network failures at different stages.

[0189] It should be further explained that the protocol feature components analyze the semantic sub-items of the TCP, IP, and UDP protocol layers through system analysis. If an abnormal pattern is detected in the semantic sub-item of a certain protocol layer, it is marked as 1 at the corresponding position in that protocol layer; otherwise, it is marked as 0. Specifically, when there is a semantic sub-item in a certain protocol layer with a periodic intensity exceeding a preset threshold, it is determined that there is an abnormal pattern in that protocol layer. The protocol feature components reflect the distribution characteristics of anomalies in the network protocol stack.

[0190] 3. The topological feature component D is used to calculate the locational importance of the faulty device based on the network topology graph. Let h be the shortest hop count from the core device (root node) to the faulty device, and H be the network diameter (maximum hop count). Then, the topological feature value D is calculated as follows:

[0191] ;

[0192] When H=1, it is a single-node network, and D=1 is directly defined. When H>1, the value of D is in the range of [0,1]. The larger the value, the more critical the position of the device in the network.

[0193] It should be further explained that the topology feature component first determines the shortest hop count from the core device to the faulty device, as well as the diameter of the entire network (i.e., the longest shortest path length between any two nodes in the network). When there is only one device in the network, the topology feature value is directly set to 1. For multi-device networks, the topology feature value is calculated by normalizing the shortest hop count to the range of the network diameter, so that the topology feature value of the core device is 1, and the topology feature value of the edge device is close to 0. The larger the value, the more critical the position of the device in the network.

[0194] 4. The pattern feature component C is used to comprehensively evaluate the cyclic characteristics and cross-device synchronization characteristics of the coded sub-items. The cyclic characteristics are determined by calculating the significant peak value of the autocorrelation function, and the synchronization characteristics are determined by calculating the correlation coefficient of semantic sub-items across multiple devices. The pattern feature value C is calculated as follows:

[0195] ;

[0196] Where ω is the balance coefficient, typically taken as 0.6. Cyclic characteristic strength (0≤ ≤1), Synchronous characteristic strength (0≤ ≤1).

[0197] Specifically, a fault fingerprint consists of time feature components, protocol feature components, topology feature components, and pattern feature components.

[0198] It should be further explained that the pattern feature components are calculated by weighted combination. The cyclic characteristic strength is determined by finding the maximum value of the normalized autocorrelation function within the effective period range; the synchronization characteristic strength is obtained by calculating the correlation coefficient of semantic sub-items between directly connected devices and taking the average value. The cyclic characteristic weight and the synchronization characteristic weight are assigned to reflect the fact that the cyclic characteristic is usually more valuable for diagnosis in network faults.

[0199] Specifically, after normalizing the fault fingerprints, a historical fault fingerprint database is maintained. When a new fault fingerprint is detected, the pattern feature component system calculates its weighted distance with each fingerprint in the historical fault fingerprint database. The weight coefficients associated with the weighted distance are obtained through training on historical fault data, and this distance consists of four parts:

[0200] Temporal feature distance: Calculates the Euclidean distance between two temporal feature vectors;

[0201] Protocol Feature Distance: Calculates the normalized representation distance (i.e., the proportion of different protocol layer labels) between two protocol feature vectors.

[0202] Topological feature distance: Calculates the absolute difference between two topological feature values;

[0203] Pattern feature distance: Calculates the absolute difference between two pattern feature values;

[0204] The distances mentioned above are assigned different weights, summed, and then squared to obtain the final weighted distance. The total weight coefficients are 1. The weights are time feature weight, protocol feature weight, topology feature weight, and pattern feature weight. These weights can be dynamically adjusted according to the specific network environment and historical fault data to optimize the fault identification effect.

[0205] Specifically, the fault fingerprint generator adopts a multi-protocol layer feature fusion approach, combining coded sub-items from different protocol layers according to their technical relevance and time synchronization. By constructing a fault fingerprint as a multi-dimensional state vector, where each dimension corresponds to a specific network potential fault state feature, the fault fingerprint generation process uses a dynamic weight fusion algorithm to automatically adjust the contribution of each coded sub-item in the fingerprint according to the current network state.

[0206] Specifically, the fault fingerprint generator can identify non-linear relationships between coded sub-items. For example, when a specific change pattern in the TCP reserved field occurs simultaneously with an oscillation pattern in the IP identifier field, a unique fault fingerprint is formed by assigning higher diagnostic weight to this combination.

[0207] In addition to detecting periodic repetition, the specific cyclic sequence detection also analyzes the phase relationship, amplitude changes and continuous stability of the cyclic sequence. When a closed-loop transition pattern with multiple states is detected in the coded sub-item, and the duration exceeds a certain threshold but has not yet caused business interruption, it is determined that there is a potential fault risk.

[0208] Based on topology-aware correlation analysis, a weighted synchronization index is constructed according to the network topology, physical distance between devices, and service dependencies. When the coding sub-items of multiple devices show a highly synchronized change trend, and the synchronization pattern does not match the network topology (such as strong synchronization of non-directly connected devices), it is determined that there is a potential systemic fault risk.

[0209] In summary, the semantic mapping unit can identify network devices in a potential fault state, and by analyzing the topological distribution of abnormal patterns in the fault fingerprint, it can generate a fault propagation heatmap, showing the potential propagation path and impact range of potential faults.

[0210] In this embodiment of the disclosure, the fault diagnosis module 30 includes:

[0211] The fault analysis unit is used to analyze the target state set and determine the fault type;

[0212] The fault tracing unit is used to construct a propagation path map based on the propagation path of the abnormal mode and the network topology, calculate the temporal correlation of abnormal modes between devices, and identify the starting point of the abnormal mode, i.e. the root cause device of the fault, based on the propagation path map and the temporal correlation.

[0213] In this embodiment of the disclosure, the specific process of the fault tracing unit includes:

[0214] Based on the chronological order of the occurrence of abnormal patterns on different devices, and in combination with the physical connection relationship between the devices, the initial transmission direction of the abnormal signal is marked;

[0215] Exclude devices that are not associated with the abnormal pattern characteristics (e.g., no corresponding fault fingerprint was detected) and have no physical connection, narrowing down the propagation path range and forming a propagation path map (e.g., a one-way path from device A to device B to device C).

[0216] The cross-correlation function is used to calculate the temporal correlation of abnormal modes between different devices. By calculating the correlation coefficient of abnormal signals (such as the periodic intensity of coded sub-items and the density of mutation points) of device X and device Y under different time delays, the temporal correlation of the abnormal signals of the two devices is reflected.

[0217] The time correlation coefficients of all devices in the propagation path map are calculated pairwise after correction. The closer the coefficient is to 1, the stronger the time correlation between the abnormal signals of the two devices (i.e., the former is the source of the propagation of the latter's abnormality).

[0218] Sort by correlation coefficient from high to low and select the devices with the highest correlation coefficient and no upstream propagation source (e.g., device A has a correlation coefficient of 0.95 with device B, and no other device has a higher correlation coefficient with device A).

[0219] By combining the direction and temporal correlation ranking results of the propagation path map, the device that first exhibited the abnormal mode and was the source of the abnormal signal propagation of other devices is identified as the starting point of the abnormal mode.

[0220] If multiple candidate starting points exist (e.g., neither device A nor device D has an upstream propagation source), the completeness of their abnormal patterns is further compared (e.g., device A detects the complete four components of the fault fingerprint, while device D only detects some components). The device with higher completeness is determined as the final starting point.

[0221] In this embodiment of the disclosure, the execution module 40 includes:

[0222] A predictive isolation unit is used to dynamically generate an isolation strategy based on the location and fault type of the fault-causing device.

[0223] The fault process recording unit is used to completely record key information throughout the entire fault handling process;

[0224] The strategy update unit is used to update dynamic coding rules and diagnostic weight allocation strategies based on historical data recorded during the fault process.

[0225] In this embodiment of the disclosure, the isolation strategy includes selectively delaying the communication between the fault root cause device and the critical business node, with the delay time being positively correlated with the severity of the fault, and ensuring that the end-to-end transmission delay of the critical business data does not exceed a preset threshold.

[0226] The selective delay includes,

[0227] Identify key business data packets based on application layer protocol type, data packet destination port, load characteristics, and business relevance;

[0228] Adjustable delays are applied only to non-critical business data packets along the fault propagation path;

[0229] By monitoring end-to-end transmission latency in real time and dynamically adjusting latency parameters

[0230] In this embodiment of the disclosure, the execution module isolates the corresponding fault occurrence point based on the obtained fault root cause device, and achieves predictive isolation of the fault through the predictive isolation unit, which can avoid interception or isolation before the fault enters the core of the operation and maintenance system. The predictive isolation unit generates and runs a dynamic isolation strategy based on the location of the root cause device in the network topology, the characteristics of the fault type, and the real-time status of the service traffic.

[0231] Predictive isolation units identify multiple potential propagation paths from the root cause device to critical business nodes, then assess the sensitivity of business traffic on each path, and categorize business traffic into critical business flows (such as real-time transactions and voice communication) and non-critical business flows (such as backup and log synchronization). For critical business flows, a minimal intervention strategy is implemented, while for non-critical business flows, a precise control delay is applied.

[0232] Specifically, selective delay employs traffic identification technology, which identifies critical business data packets based on application layer features and implements delay control at the data packet labeling layer. Data packets identified as critical business packets maintain their original transmission path, while non-critical business data packets are subject to controllable delay. This selective delay is not a simple queue waiting, but rather dynamically adjusts the transmission timing of data packets through intelligent scheduling algorithms to ensure that the delay effect is controllable.

[0233] In summary, predictive isolation units can maintain a safe end-to-end latency for critical business data while effectively blocking the propagation of faults. By selectively delaying non-critical business flows, they can improve the overall network performance. This is because, during application, blocking abnormal or unnecessary data can effectively improve the flow of valid data, thereby achieving efficient data transmission.

[0234] Specifically, by introducing big data models and other methods into predictive isolation units, the predictive isolation units can learn autonomously, enabling automatic fault isolation or traffic control.

[0235] In this embodiment of the disclosure, dynamic encoding rule updates include:

[0236] If a certain type of fault (such as hardware aging) occurs multiple times, and the current coding rule does not have sufficient precision in splitting the corresponding non-business-purpose fields (such as failing to capture microsecond-level timing changes), then adjust the splitting bit width of the field (such as changing it from "3+3 bits" to "2+2+2 bits") or the starting position (such as focusing on the key bits of hardware-related fields).

[0237] In this embodiment of the disclosure, the diagnostic weight allocation strategy update includes:

[0238] If a certain semantic sub-item (such as the sub-item corresponding to the TCP reserved bit field) is highly correlated with the fault type in multiple faults and its current weight is low, then its diagnostic weight will be increased.

[0239] For semantic sub-items that have not been associated with faults for a long time (such as UDP field sub-items of an edge node), their weight is reduced according to the time decay rule to avoid resource waste.

[0240] Figure 2 A flowchart illustrating a method for resolving network faults according to an embodiment of this disclosure is shown below. Please refer to... Figure 2 As shown in the embodiments of this disclosure, a method for resolving network faults in operation and maintenance is provided, including the following steps:

[0241] S1. Obtain non-business-purpose fields, split the non-business-purpose fields into multiple semantic sub-items according to dynamic encoding rules, perform feature encoding on each semantic sub-item, and map the encoded sub-items to a predefined implicit state set.

[0242] S2. Perform fault analysis based on the mapped implicit state set to detect abnormal patterns;

[0243] S3. When an abnormal mode is detected, the root cause device of the fault is determined by calculating the temporal correlation between abnormal modes within the device.

[0244] S4. Based on the location and fault type of the fault-causing device, dynamically generate and execute predictive isolation strategies to implement preventive isolation measures before the fault occurs.

[0245] S5. Record the fault handling process and update the dynamic coding rules and diagnostic weight allocation strategy.

[0246] As an optional embodiment, the calculation of the temporal correlation uses a cross-correlation function, which introduces a network topology distance attenuation factor to make the calculation results reflect the actual propagation path of the abnormal pattern;

[0247] The network topology distance attenuation factor is dynamically adjusted based on the number of physical connection hops and bandwidth limitations between devices.

[0248] In this embodiment of the disclosure, the network topology distance attenuation factor is dynamically adjusted according to the number of physical connection hops and bandwidth limitations between devices (e.g., the more hops and the smaller the bandwidth, the larger the attenuation factor, with a default range of 0.1-1), correcting the cross-correlation function results and avoiding "false high correlation" caused by physical distance (e.g., abnormal signals between devices spanning 3 hops, even if the original correlation coefficient is high, will have their weight reduced after attenuation).

[0249] As an optional embodiment, the steps of dynamically generating and executing a predictive isolation strategy include:

[0250] Calculate the impact of the root cause device of the failure on critical business nodes;

[0251] Selective delay parameters are generated based on the degree of impact, and the selective delay parameters are positively correlated with the degree of impact.

[0252] Selective delay is applied only to data packets in the direction of fault propagation, and the delay time is dynamically adjusted according to the selective delay parameter;

[0253] Selective delay, while ensuring the quality of critical business data transmission, blocks the path of fault propagation, enabling the fault resolution system to complete preventative isolation before the fault actually occurs.

[0254] Based on the same inventive concept as the above disclosure, this disclosure also provides an electronic device. The electronic device of this disclosure includes at least one processor and at least one memory electrically connected to the processor. The memory is electrically connected to the processor, wherein the memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the method described above.

[0255] It should be noted that the electrical connection between the above-mentioned units does not necessarily mean the connection between lines. The indirect connection method can be applied to the embodiments of this disclosure as long as it achieves the purpose of this disclosure.

[0256] Based on the same inventive concept, this disclosure also provides a computer storage medium storing a computer program, which, when executed by a processor, implements the steps of the above method.

[0257] Although the present disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure.

Claims

1. A network fault diagnosis and maintenance system, characterized in that, include: The data acquisition module is used to collect multi-source raw network data from the target network device, preprocess the multi-source raw network data, and obtain multi-source standard network data. A semantic reconstruction module, connected to the data acquisition module, is used to identify non-business-purpose fields in the multi-source standard network data and perform semantic reconstruction processing on them based on dynamic encoding rules and diagnostic weight allocation strategies to obtain a target state set. The semantic reconstruction module includes: a field decoding unit, a sub-item encoding unit, and a semantic mapping unit; The field decoding unit is used to split non-business-purpose fields into multiple semantic sub-items according to dynamic encoding rules, including adjusting the preset initial field splitting strategy based on real-time network traffic characteristics, and splitting the non-business-purpose fields into several semantic sub-items based on the adjusted real-time field splitting strategy. The sub-item encoding unit is used to encode features for each semantic sub-item and assign dynamic diagnostic weights based on the temporal change features of the semantic sub-item to generate encoded sub-items. The semantic mapping unit is used to map several of the encoded sub-items to a predefined set of implicit states to obtain a target set of states; The fault diagnosis module is connected to the semantic reconstruction module to perform fault analysis based on the target state set and determine the fault type and root cause location. The execution module, connected to the fault diagnosis module, is used to generate and execute a predictive isolation strategy based on the fault type and the root cause location, and to record the fault handling process and update the dynamic coding rules and diagnostic weight allocation strategy.

2. The network fault resolution system according to claim 1, characterized in that, The field decoding unit includes: The feature recognition subunit is used to monitor network traffic in real time and identify the real-time type distribution, burst characteristics, and proportion of real-time protocols in real-time network traffic. The adjustment subunit is connected to the feature recognition subunit to determine the real-time traffic pattern based on the real-time type distribution, real-time traffic burst characteristics and real-time protocol composition ratio. The real-time traffic pattern is compared with the historical traffic pattern to determine the degree of change based on the comparison result, and the preset initial field splitting strategy is adjusted based on the degree of change. The splitting subunit, connected to the adjustment subunit, is used to split the non-business-purpose field based on the adjusted real-time field splitting strategy to obtain several semantic sub-items.

3. The network fault resolution system according to claim 2, characterized in that, The adjustment subunit includes: The comparison block is used to compare the real-time traffic pattern with the historical traffic pattern corresponding to the historical baseline of the same period, and obtain the comparison result. The adjustment block is connected to the comparison block to calculate the actual deviation based on the comparison result. The actual deviation is compared with a preset deviation threshold, and the preset initial field splitting strategy is adjusted based on the comparison result.

4. The network fault resolution system according to claim 3, characterized in that, The sub-item coding unit include: A sub-item feature extractor is used to extract temporal change features corresponding to any of the semantic sub-items; A dynamic weight allocator is used to assign dynamic diagnostic weights to the temporal variation characteristics of the semantic sub-items based on the network topology and historical fault data. An encoder is used to fuse the temporal variation features with the dynamic diagnostic weights to generate coded sub-items.

5. The network fault resolution system according to claim 4, characterized in that, The semantic mapping unit includes; A fault fingerprint generator is used to combine several coded sub-items to form a unique fault fingerprint, wherein the fault fingerprint includes time feature components, protocol feature components, topology feature components, and pattern feature components, wherein: The time feature components are the temporal variation characteristics of each semantic sub-item, and periodic features are extracted through spectral analysis; The protocol feature components represent the distribution of abnormal patterns in different protocol layers; The topological feature component represents the criticality of the faulty device within the network topology. The pattern feature components are the cyclic and synchronization characteristics of the coded sub-items; An anomaly pattern identifier is used to identify anomaly patterns by comparing the similarity between the current fault fingerprint and the historical fault fingerprint. When the similarity exceeds a preset threshold, it is determined that there is an anomaly pattern that matches the historical fault pattern. When a new abnormal pattern is detected, if the coded sub-item exhibits a preset cyclic sequence pattern or a cross-device synchronous change pattern, and the similarity does not reach a preset threshold, it is determined that a new abnormal pattern exists.

6. The network fault resolution system according to claim 5, characterized in that, The fault diagnosis module includes: The fault analysis unit is used to analyze the target state set and determine the fault type; The fault tracing unit is used to construct a propagation path map based on the propagation path of the abnormal mode and the network topology, calculate the temporal correlation of abnormal modes between devices, and identify the starting point of the abnormal mode, i.e. the root cause device of the fault, based on the propagation path map and the temporal correlation.

7. The network fault resolution system according to claim 6, characterized in that, The execution module includes: A predictive isolation unit is used to dynamically generate an isolation strategy based on the location and fault type of the fault-causing device. The fault process recording unit is used to completely record key information throughout the entire fault handling process; The strategy update unit is used to update dynamic coding rules and diagnostic weight allocation strategies based on historical data recorded during the fault process.

8. A method for resolving network faults in operations and maintenance, comprising implementing a network fault resolution system as described in any one of claims 1-7, characterized in that, Includes the following steps: Obtain non-business-purpose fields, split them into multiple semantic sub-items according to dynamic encoding rules, perform feature encoding on each semantic sub-item, and map the encoded sub-items to a predefined implicit state set; Fault analysis is performed based on the mapped implicit state set to detect abnormal patterns; When an abnormal pattern is detected, the root cause device of the fault is determined by calculating the temporal correlation between abnormal patterns within the device. Based on the location and fault type of the root cause device, predictive isolation strategies are dynamically generated and executed to implement preventive isolation measures before the fault occurs. Record the fault handling process and update the dynamic coding rules and diagnostic weight allocation strategy.

9. The network fault diagnosis method according to claim 8, characterized in that, The calculation of the temporal correlation uses a cross-correlation function, which introduces a network topology distance attenuation factor to make the calculation results reflect the actual propagation path of the abnormal pattern. The network topology distance attenuation factor is dynamically adjusted based on the number of physical connection hops and bandwidth limitations between devices.

10. The network fault diagnosis method according to claim 9, characterized in that, The steps for dynamically generating and executing predictive isolation strategies include: Calculate the impact of the root cause device of the failure on critical business nodes; Selective delay parameters are generated based on the degree of impact, and the selective delay parameters are positively correlated with the degree of impact. Selective delay is applied only to data packets in the direction of fault propagation, and the delay time is dynamically adjusted according to the selective delay parameter; Selective delay, while ensuring the quality of critical business data transmission, blocks the path of fault propagation, enabling the fault resolution system to complete preventative isolation before the fault actually occurs.

Images