Path fault processing method and device, equipment, medium and product

Abstract

The invention discloses a path fault processing method and device, equipment, a medium and a product, and relates to the technical field of network diagnosis, and the method comprises the steps: obtaining detection data of a data transmission path; obtaining a fault prediction result of the data transmission path based on the data features of the detection data and a preset machine learning algorithm; if the fault prediction result is that the data transmission path is the suspected fault path, starting cross-regional multi-source detection to determine first confidence data of a path fault of the suspected fault path; according to SDN global topology information inquired by a software defined network SDN controller, determining second confidence data of the path fault of the suspected fault path; and when the suspected fault path is a real fault path, the flow table is updated through the SDN controller, and the flow on the real fault path is switched to other transmission paths. According to the invention, whether the data transmission path has a fault can be accurately determined, the data transmission path with the fault is switched, and the data transmission quality is improved.

Description

Technical Field

[0001] This invention relates to the field of network diagnostics technology, and in particular to a method, apparatus, device, medium, and product for handling path faults. Background Technology

[0002] With the development and use of network technology, network users have increasingly higher demands for network transmission quality, such as data transmission efficiency, accuracy, and stability. Network transmission quality is closely related to network faults in the data transmission path. Therefore, timely detection and diagnosis of network faults is an important aspect of ensuring network transmission quality.

[0003] Currently, network fault diagnosis methods include fixed threshold diagnosis and single-protocol probing. Fixed threshold diagnosis relies on static thresholds set by operations and maintenance personnel based on their experience, resulting in low efficiency and accuracy. Single-protocol probing typically detects network faults through probe packets. This method relies on the fault detection capabilities of network nodes (e.g., servers, switches, routers), placing high demands on these nodes and incurring high costs. Furthermore, single-protocol probing struggles to handle scenarios involving multi-path load balancing, dynamic topology changes, and hidden faults, leading to low fault location efficiency, a high false positive rate, and limited accuracy in fault detection. Summary of the Invention

[0004] This invention provides a method, apparatus, device, medium, and product for handling path faults, which can efficiently, accurately, and cost-effectively diagnose whether there are faults in the data transmission path, and switch the faulty data transmission path, thereby improving the data transmission quality.

[0005] According to one aspect of the present invention, a method for handling path failures is provided, the method comprising:

[0006] Obtain the probe data corresponding to the data transmission path. The probe data includes the performance indicators of the data transmission path.

[0007] Extract data features from the probe data, and obtain fault prediction results for the data transmission path based on the extracted data features and a preset machine learning algorithm;

[0008] If the fault prediction result indicates that the data transmission path is a suspected fault path, then cross-regional multi-source detection is initiated to determine the first confidence level data of the suspected fault path where the path failure has occurred.

[0009] The global topology information of the Software Defined Network (SDN) is obtained by querying the SDN controller, and the second confidence data of the suspected fault path is determined based on the global topology information of the SDN.

[0010] In a case where the suspected fault path is determined to be a real fault path based on the first confidence data and the second confidence data, the path switching module is configured to update a flow table by an SDN controller to switch traffic on the real fault path to other transmission paths.

[0011] According to another aspect of the present application, there is provided a path fault processing apparatus for implementing the path fault processing method in any of the embodiments of the present application, the apparatus comprising:

[0012] a data acquisition module configured to acquire detection data corresponding to the data transmission path, the detection data comprising performance indicators of the data transmission path;

[0013] a fault prediction module configured to extract data features of the detection data, and obtain a fault prediction result of the data transmission path based on the extracted data features and a preset machine learning algorithm;

[0014] a first diagnosis module configured to, if the fault prediction result indicates that the data transmission path is a suspected fault path, initiate cross-region multi-source detection to determine first confidence data of the suspected fault path having a path fault;

[0015] a second diagnosis module configured to query SDN global topology information from a software defined network (SDN) controller, and determine second confidence data of the suspected fault path having a path fault based on the SDN global topology information;

[0016] a path switching module configured to, in a case where the suspected fault path is determined to be a real fault path based on the first confidence data and the second confidence data, update a flow table by an SDN controller to switch traffic on the real fault path to other transmission paths.

[0017] According to another aspect of the present application, there is provided an electronic device comprising:

[0018] at least one processor; and a memory communicatively connected to the at least one processor;

[0019] wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the path fault processing method in any of the embodiments of the present application.

[0020] According to another aspect of the present application, there is provided a computer readable storage medium storing computer instructions for enabling a processor to implement the path fault processing method in any of the embodiments of the present application when executed by the processor.

[0021] According to another aspect of the present application, there is provided a computer program product comprising a computer program which, when executed by a processor, implements the method for processing path failure of any of the embodiments of the present application.

[0022] The method for processing path failure comprises: obtaining detection data corresponding to a data transmission path, the detection data comprising performance indicators of the data transmission path; extracting data features of the detection data, and obtaining a failure prediction result of the data transmission path based on the extracted data features and a preset machine learning algorithm; if the failure prediction result is that the data transmission path is a suspected failure path, starting cross-regional multi-source detection to determine first confidence data of path failure of the suspected failure path; querying and obtaining SDN global topology information from a software-defined network (SDN) controller, and determining second confidence data of path failure of the suspected failure path based on the SDN global topology information; and in the case that the suspected failure path is determined to be a real failure path based on the first confidence data and the second confidence data, updating a flow table through the SDN controller to switch traffic on the real failure path to other transmission paths. According to the technical solution of the present application, after obtaining the detection data corresponding to the data transmission path, the data features (for example, statistical features and time sequence features of the performance indicators of the data transmission path) of the detection data are extracted, and the preset machine learning algorithm is used to process the data features of the detection data to obtain the failure prediction result of the data transmission path. When the failure prediction result is that the data transmission path is a suspected failure path, two confidence data of path failure of the suspected failure path are determined through cross-regional multi-source detection and SDN global topology information respectively, so as to efficiently, accurately and at low cost diagnose whether the data transmission path has a failure through quantitative data evaluation, and switch the data transmission path having a failure, so as to ensure that data can be stably transmitted from a source server to a destination server, thereby improving the transmission quality of data. The problems of low efficiency and accuracy of failure diagnosis due to the dependence of fixed threshold diagnosis on static threshold set by operation and maintenance personnel are solved. The problems of high requirement for network nodes, high cost of failure detection, difficulty in coping with scenarios of multi-path load balancing, dynamic topology change and hidden failure, low efficiency of failure positioning and high rate of misjudgment, and limited accuracy of failure detection of single protocol detection mode are also solved.

[0023] It should be understood that the matters described in this detailed description are intended to be illustrative and not restrictive. Other aspects will become apparent to those skilled in the art from the following detailed description. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to make the technical solutions in the present application clearer, the drawings needed in the following embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some of the embodiments of the present application, and all other drawings obtained by those skilled in the art without any creative effort should be within the protection scope of the present application.

[0025] Figure 1 is a flowchart of a path fault processing method provided by the present application;

[0026] Figure 2 is a flowchart of a determination method of a fault prediction result of a data transmission path provided by the present application;

[0027] Figure 3 is a flowchart of a determination method of first confidence data of a path fault of a suspected fault path provided by the present application;

[0028] Figure 4 is a flowchart of a determination method of second confidence data of a path fault of a suspected fault path provided by the present application;

[0029] Figure 5 is a flowchart of a determination method of detection data provided by the present application;

[0030] Figure 6 is a structural diagram of a path fault processing device provided by the present application;

[0031] Figure 7 is a structural diagram of an electronic device provided by the present application. DETAILED DESCRIPTION

[0032] In order to make the technical solutions in the present application clearer, the drawings needed in the following embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some of the embodiments of the present application, and all other drawings obtained by those skilled in the art without any creative effort should be within the protection scope of the present application.

[0033] It should be noted that the terms "first", "second", "initial", "intermediate", "candidate", "alternative", "target" and the like in the description, claims, and drawings of the application are used to distinguish like objects and are not necessarily used to describe a particular sequential or chronological order. It should be understood that the data thus used can be interchanged, where appropriate, so that the embodiments of the application described herein can be carried out in other than the order shown or described herein. Furthermore, the terms "comprising" and "having", as well as any variations thereof, are intended to cover non-exclusive inclusion, for example, processes, methods, systems, products, or devices that include a series of steps or units not necessarily limited to those clearly listed, but can include other steps or units not clearly listed or inherent to such processes, methods, products, or devices.

[0034] The acquisition, storage, use, processing, etc. of data in the technical solutions of the application comply with relevant provisions of national laws and regulations. Specifically, the user information collected in the application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure, and application of relevant data comply with relevant national and regional laws, regulations, and standards, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portals for users to choose to authorize or refuse automated decision results; if the user chooses to refuse, the expert decision process is entered. It should be noted that in the embodiments of the present application, some existing industry solutions may be mentioned, such as software, components, models, etc., which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the implementation of the technical solutions of the present application, but it does not mean that the applicant has or will necessarily use the related content of the solution.

[0035] Figure 1 is a flowchart of a path fault processing method provided by the application, the embodiment can be applied to efficiently, accurately and low-cost diagnose network path faults, and switch the path with faults to improve the transmission quality of data, the method can be executed by a path fault processing device provided by the application, the device can be realized in the form of hardware and / or software, in a specific embodiment, the device can be integrated in an electronic device. The following embodiments will be described with the device integrated in the electronic device as an example, referring to Figure 1 , the method specifically includes the following steps:

[0036] S101, acquiring detection data corresponding to a data transmission path.

[0037] The probe data includes performance indicators of the data transmission path. The data transmission path can be understood as a sequence of network nodes and links through which data travels from a sending end (usually a source server) to a receiving end (usually a destination server). The data transmission path is essentially the route that a data packet or data flow travels in the network at the logical or physical level. The probe data of the data transmission path can be small test data packets of a few dozen bytes that are sent specifically for the purpose of discovering, measuring, or verifying the feasibility of the data transmission path. The data packets only carry protocol headers and do not carry service loads. The purpose of this setting is to quickly pass between nodes and be discarded or returned, so as to efficiently verify whether the data transmission path is feasible. The performance indicators of the data transmission path can be understood as data for evaluating the performance of the data transmission path, including but not limited to bandwidth, throughput, latency, packet loss rate, jitter, availability, and path symmetry.

[0038] Among them, the bandwidth is the maximum theoretical data transmission rate of the link or path, which is the "pipe thickness" basis of the data transmission path and will affect the upper limit of the throughput; the throughput is the actual measured end-to-end data transmission rate of the path, which is affected by congestion, packet loss, retransmission, protocol overhead, etc., and is generally less than the bandwidth, which belongs to the "real data transmission speed" perceived by users; the latency is the total time consumed by the data packet from the source server to the destination server, including sending latency, propagation latency, queuing latency, caching latency, and processing latency; the packet loss rate is the proportion of lost data packets in the transmission process, and high packet loss will reduce the throughput and increase the retransmission burden, and in severe cases, it may even cause business stalls or disconnections; the jitter is the variation degree (i.e., the standard deviation of the latency) of the end-to-end latency of consecutive data packets; the availability is the probability of the path operating without failure within a specified time, including the self-healing time after link / node failure (e.g., route convergence, protection switching time); the path symmetry is used to evaluate whether the data goes and returns through the same link, and asymmetry may affect performance measurement, security policy, and fault location. The bandwidth and throughput can be used to evaluate the data transmission rate of the data transmission path, the packet loss and availability can be used to evaluate the stability of the data transmission path, and the latency and jitter can be used to evaluate the real-time performance of the data transmission path.

[0039] The probe data further includes path attributes and context information. The path attributes are used to describe what the data transmission path looks like. The context information is used to describe what test task is performed under what condition. The performance indicators, the path attributes, and the context information are combined to convert the path hops into an operable and interpretable network performance view, and thus better assess whether the data transmission path has a fault. Further, the path attributes include a path hop count. The hop count is a number of routing / switching nodes that the path passes through. The more the hop count is, the higher the latency, the fault point, and the congestion probability are. The context information includes a time period and / or a service type. The time period includes a probe start time, a probe end time, and a response time of each hop, and is used to distinguish a service peak from a service valley, calculate a round-trip time (RTT), and establish a timing baseline. The service type can be understood as a service using the data transmission path, and is used to determine what application traffic is transmitted on the data transmission path. The service type includes but is not limited to a Web (World Wide Web) service and a database synchronization service.

[0040] Specifically, at the network layer, the data transmission path is determined by a routing protocol, and is usually represented as a series of router hop counts, for example, a source host (i.e., a source server) - a local router (i.e., a default gateway) - a core router -... - a destination host (i.e., a destination server). At the physical layer, data is transmitted through physical media (for example, optical fiber, twisted pair, wireless channel, etc.) and network devices (for example, switches, hubs, etc.). The data transmission path can be a source device (i.e., a source server) - an access switch - a convergence switch - a core switch - a router -... - a destination device (i.e., a destination server). Therefore, the data transmission path is a sequence of "network nodes + links" that the source server passes through, and can be a logical path or a physical path.

[0041] The advantage of such a setting is that real-time evaluation parameters (for example, performance indicators, path attributes, and context information) of the data transmission path are obtained to assess whether the data transmission path has a fault.

[0042] S102, extracting data features of the probe data, and obtaining a fault prediction result of the data transmission path based on the extracted data features and a preset machine learning algorithm.

[0043] The preset machine learning algorithm can be understood as a pre-trained and regularly updated fault determination model that can analyze the data features of the probe data of the data transmission path and then determine whether the data transmission path has a fault. The data features include timing features, statistical features, and topology features. The data features of the probe data are extracted based on the historical data of the data transmission path, aiming to extract the timing features, statistical features, and topology features of the data transmission path as the input of the machine learning model (equivalent to the preset machine learning algorithm) to predict whether the data transmission path has a fault. The output data of the machine learning model is the reference data of the fault diagnosis result, which has a certain correspondence with the fault diagnosis result. The fault prediction result of the data transmission path can be obtained by combining the output data of the machine learning model and the correspondence between the model output and the diagnosis conclusion. The fault prediction result includes but is not limited to that the data transmission path may have a fault (i.e., the data transmission path is a suspected fault path), the data transmission path has no fault, and the data transmission path definitely has a fault.

[0044] The timing features include fluctuation features and / or trend features within a time window, the statistical features include at least one of an average value, a standard deviation, a minimum value, and a maximum value, and the topology features include path redundancy. Specifically, when extracting the timing features, the time series data such as the delay and the packet loss rate of the data transmission path are analyzed by using a sliding window to calculate the fluctuation features (i.e., the standard deviation) and / or the trend features (i.e., the linear regression slope) within the time window, for example, the delay standard deviation and the linear regression slope of path A within a past 5-minute time window are calculated to quantitatively evaluate the stability of path A. When extracting the statistical features, the statistical values of the performance indicators of the data transmission path within a certain time period (for example, the past 30 minutes, the past 1 hour, the past 2 hours, etc.) are calculated, for example, the average value, the standard deviation, the maximum value, etc. of the packet loss rate / delay / jitter. When extracting the topology features, the path-level features need to be extracted from the network topology, for example, the path redundancy (referring to the number of equivalent multi-paths to the same destination), which helps to evaluate the richness of the switching options of the fault path.

[0045] The purpose of such a setting is to analyze the timing features, statistical features, and topology features of the extracted data transmission path by using the preset machine learning algorithm to determine whether the data transmission path has a fault. In order to ensure the accuracy of fault determination while saving the cost of fault diagnosis, the present application only further diagnoses the suspected fault path, and the fault path and the fault-free path do not need to be determined again. S103, if the fault prediction result is that the data transmission path is a suspected fault path, start the cross-region multi-source probe to determine the first confidence data of the suspected fault path having a path fault.

[0046] Among them, the cross-regional multi-source detection refers to simultaneously starting multiple detection sources distributed in different geographical regions, different networks (or physical domains) to cooperatively detect the same target, and then splicing the path, RTT, packet loss and other data obtained by each source into a "global-multi-view" map. The purpose is to exclude errors or local network fluctuations caused by a single detection source or a single detection protocol, and it is a method of verifying the authenticity and range of faults from multiple dimensions. The first confidence data can be understood as the probability value of the suspected fault path occurring path failure. For example, if the verification of multiple dimensions indicates that the suspected fault path has a failure, it is determined that the first confidence data is high, for example, the first confidence data is 80%, 90%, etc. If the verification of multiple dimensions indicates that the suspected fault path has no failure, it is determined that the first confidence data is low, for example, the first confidence data is 10%, 15%, etc. If the verification of multiple dimensions includes both failure results and no failure results, the first confidence data can be determined according to the proportion of failure results in all results. The purpose of such setting is to use quantitative data to intuitively determine whether the suspected fault path is a real fault path.

[0047] S104, obtain the SDN global topology information from the software defined network (SDN) controller, and determine second confidence data of the suspected fault path occurring path failure based on the SDN global topology information.

[0048] The SDN controller is the brain of the network, which is a logically centralized and programmable control system, responsible for abstracting the forwarding devices (such as switches, routers, firewalls, etc.) of the entire network into a unified "resource pool", and issuing flow tables, policies and tunnel information through a standardized southbound interface, so as to define the path, policy and service of the network by software. The SDN global topology information can be understood as a dynamic panoramic map of the data transmission path containing node-link-quality-domain attributes that is real-time spliced by the SDN controller using multiple protocols. The SDN global topology information can count the traffic load on the data transmission path, so as to evaluate whether the data on the data transmission path is excessive. The failure caused by data excess is not counted as path failure. The advantage of such setting is to combine the SDN global real-time topology of the suspected fault path obtained by the SDN controller to exclude the misjudgment of path failure caused by temporary congestion, and to improve the diagnosis accuracy of the fault path.

[0049] The second confidence data can be understood as a probability value of the suspected fault path having a path fault determined in combination with real-time traffic of the data transmission path, for example, if the real-time traffic of the current data transmission path is high and other links are normal, it is determined that the reason for the abnormality of the suspected fault path is probably temporary congestion, not a device hardware fault, and it is considered that the probability of the suspected fault path having a path fault is low, the second confidence data is low, for example, the second confidence data is 10%, 15%, etc., on the contrary, if the real-time traffic of the data transmission path is normal, it is determined that the reason for the abnormality of the suspected fault path is probably a hardware fault, the probability of the suspected fault path having a path fault is high, and the second confidence data is large, for example, the second confidence data is 90%, 85%, etc., so as to intuitively express the possibility of the suspected fault path having a path fault by using quantitative data.

[0050] In a case where it is determined that the suspected fault path is a real fault path based on the first confidence data and the second confidence data, the flow table is updated by the SDN controller to switch traffic on the real fault path to other transmission paths.

[0051] The application adopts a double determination mode to detect the fault path, and only when the first confidence data and the second confidence data both indicate that the suspected fault path is a fault path, it is determined that the suspected fault path is a real fault path. Specifically, it can be considered that the abnormality of the suspected fault path is a hardware device abnormality and the suspected fault path is a real fault path when the first confidence data and the second confidence data are both greater than a preset confidence threshold (for example, 70%, 75%, etc.).

[0052] The flow table is a rule table for telling the switch how to forward data in the SDN, which is equivalent to a "programmable version" of the traditional routing table. The flow table also records the alternative paths of each data transmission path, so as to use the alternative paths for data transmission when the data transmission path is abnormal, and to ensure that data can be transmitted to the destination server in time.

[0053] Further, the flow table is updated by the SDN controller to switch traffic on the real fault path to other transmission paths, including:

[0054] 1) A second combined probe is initiated to the specified redundant path, and a second combined probe result is obtained.

[0055] The designated redundant path can be understood as another physical or logical path preset for key services in a data center network for load balancing or fault backup. Specifically, the designated redundant path is another network transmission path preset in addition to the real fault path, and the other network transmission path corresponds to the same source server and destination server as the real fault path. The purpose is to force the probe traffic (even part of the production traffic) to the designated redundant path through the SDN controller issuing a temporary flow table with higher priority when the main path is suspected to be faulty or the standby path needs to be periodically checked for health, to test its real performance and ensure its availability when needed. The second combination probe includes network probe and connection probe. The network probe is an Internet Control Message Protocol (ICMP) probe, which is used to verify the basic connectivity and delay; the connection probe is a TCP ACK (Transmission Control Protocol Acknowledgment) probe, which is an ACK packet sent to the destination server to simulate an established connection, and verifies the state processing capability of the intermediate device (for example, a stateful firewall) in the network for the established connection, so as to more accurately measure the reachability of the application layer. The combination probe can more comprehensively reflect the availability and performance of the path than a single protocol, and realizes accurate and directional testing of the specific and preset redundant path, avoids the path uncertainty caused by load balancing, and improves the path diagnosis quality.

[0056] 2) Determine the performance indicators of the designated redundant path according to the second combination probe result.

[0057] The determination method of the performance indicators of the designated redundant path is the same as that of the data transmission path, which will not be described here.

[0058] 3) In the case where the performance indicators of the designated redundant path meet the preset conditions, update the flow table through the SDN controller to switch the traffic on the real fault path to the designated redundant path.

[0059] The preset condition can be understood as that the designated redundant path does not have a path fault. The purpose of this setting is to switch the traffic on the real fault path to a safe path to ensure that information can be stably, safely and timely transmitted from the source server to the destination server.

[0060] It is worth noting that after confirming the faulty node, the flow table will be updated immediately through the SDN controller, and the affected traffic will be automatically switched to the pre-calculated backup path in seconds. After switching the traffic on the real fault path to other transmission paths, the path diagnosis system will also periodically initiate a lightweight health probe (e.g., ICMP) on the isolated node or link and continuously monitor the state information of the node from the SDN controller feedback (e.g., port state from down to up, error count zero, etc.). When the health probe is successful for multiple times in a row, and the SDN state information shows that the path is normal for more than a preset time stabilization period, it is determined that the node has recovered and is automatically reintroduced into the load balancing pool for subsequent traffic scheduling.

[0061] Optionally, in the case of determining that the suspected fault path is a real fault path, the method further comprises: determining the location and impact range of the data transmission path in the global network based on the global topology data output by the SDN controller; and generating a network status heat map based on the location and impact range of the data transmission path in the global network to highlight (e.g., highlight, bold, etc.) the fault area in the network status heat map. The purpose of this setting is to combine the SDN topology data with the detection results to generate a network status heat map and highlight the fault area to allow users to intuitively view the location, impact range, etc. of the fault path in the network; secondly, the application supports backtracking of fault events according to a time axis to summarize the causes of the fault.

[0062] The technical solutions of the above embodiments will extract the data features of the detection data of the data transmission path, i.e., the statistical features and time sequence features of the performance indicators of the data transmission path, after obtaining the detection data corresponding to the data transmission path, and then determine the fault prediction result of the data transmission path by combining a preset machine learning algorithm and the data features of the detection data. Further, when the fault prediction result is that the data transmission path is a suspected fault path, two confidence data of the suspected fault path occurring path failure are determined through cross-regional multi-source detection and SDN global topology information respectively, to efficiently, accurately and low-cost diagnose whether the data transmission path has a fault through quantitative data evaluation, and switch the data transmission path having a fault to ensure that data can be stably transmitted from a source server to a destination server, thereby improving the transmission quality of data. This not only solves the problem of low efficiency and accuracy of fault diagnosis caused by the fixed threshold diagnosis relying on the static threshold set by the operation and maintenance personnel according to the operation and maintenance experience; but also solves the problem of high fault detection cost, low fault positioning efficiency and high misjudgment rate caused by the single protocol detection method relying on the fault detection function of the network node, which has high requirements for the network node, is difficult to cope with the scenes of multi-path load balancing, dynamic topology change and hidden fault, and has limited accuracy of fault detection.

[0063] Figure 2is a flow diagram of a method for determining a fault prediction result of a data transmission path provided by the present application. The embodiment is based on the above-mentioned embodiment and provides a preferred method for determining a fault prediction result of a data transmission path with more complete flow details. It is a detailed description of "obtaining a fault prediction result of a data transmission path based on the extracted data features and a preset machine learning algorithm" in S102. Specifically, as shown in Figure 2 The method comprises the following steps:

[0064] S201, obtaining an anomaly prediction result of a data transmission path based on the extracted data features and an isolation forest algorithm model.

[0065] The data features used in this step can be statistical features or statistical features and time series features. The isolation forest (Isolation Forest, iForest) algorithm model is an unsupervised anomaly detection algorithm. In path anomaly detection, the number of hops, RTT, AS-Path length (i.e., the number of autonomous systems through which a BGP (Border Gateway Protocol) route passes from generation to receipt), jitter, delay, packet loss rate, and sliding window standard deviation of the data transmission path can be combined into features. The isolation forest algorithm model analyzes the combined features and outputs abnormal flow data, which is the anomaly prediction result of the data transmission path, used to determine the abnormality of the data transmission path.

[0066] In one example, the extracted data features are input into the isolation forest algorithm model for processing. The model outputs an anomaly score value of the data transmission path. The higher the score, the greater the difference between the current behavior of the path and the historical normal mode, and the more likely the path is a fault path. The advantage of this setting is that it can use the historical normal mode as a benchmark to comparatively evaluate the abnormality of the data transmission path.

[0067] S202, obtaining a performance index prediction result of a data transmission path based on the extracted data features and a pre-trained long short-term memory artificial neural network LSTM model.

[0068] The data features used in this step are generally time sequence features, and according to the fault diagnosis requirements, they can also be statistical features and time sequence features, and the application does not limit this. The long short-term memory artificial neural network (LSTM, Long Short-Term Memory) is a special recurrent neural network architecture that can perform time series prediction tasks, such as network traffic prediction, load prediction, weather prediction, etc. Specifically, the data features of the data transmission path in the future (for example, 2 minutes in the future, 3 minutes in the future, 5 minutes in the future, etc.) can be determined according to the data features of the data transmission path in the past period of time (the data features are determined according to the transmission data of the data transmission path in the past period of time), and the prediction result is the performance index prediction result, which is used to indicate whether the data transmission path will have performance degradation or failure in the future period of time. The advantage of such setting is to predict the running state of the data transmission path in the future period of time, so as to evaluate the availability of the data transmission path and intervene in advance to ensure the stability of the data transmission path.

[0069] S203, obtaining the fault prediction result of the data transmission path based on the abnormal prediction result and the performance index prediction result.

[0070] Among them, the abnormal prediction result is used to indicate the difference between the data transmission path and the historical normal path, and the fault condition of the data transmission path at the current time can be determined, and the performance index prediction result is used to indicate the fault condition of the data transmission path in the future period of time, and according to the abnormal prediction result and the performance index prediction result, the current and future two cases can be considered, and the accurate and comprehensive fault evaluation conclusion of the data transmission path is obtained, for example, when the abnormal prediction result and the performance index prediction result both indicate that the data transmission path has a fault, the fault prediction result of the data transmission path is determined as a suspected fault path.

[0071] Further, when only one of the abnormal prediction result and the performance index prediction result indicates that the data transmission path has a fault, the fault prediction result of the data transmission path can be determined as a suspected fault path, or the data transmission path can be determined twice. The specific processing mode is related to the path diagnosis logic, and the application does not limit this.

[0072] Figure 3 is a flowchart of a method for determining a first confidence data of a suspected fault path occurring path fault provided by the application, and the embodiment is a detailed description of "starting cross-regional multi-source detection to determine the first confidence data of the suspected fault path occurring path fault" in S103. Specifically, as shown in Figure 3 The method comprises:

[0073] S301, instructing multiple servers to initiate a first combined probe to a destination server corresponding to the data transmission path, to obtain a first combined probe result.

[0074] The multiple servers are servers located in different regions from a source server corresponding to the data transmission path, the first combined probe includes port probe and service probe, and the first combined probe result can be understood as a probe conclusion of the first combined probe initiated by the multiple servers to the destination server corresponding to the data transmission path. The port probe is a Transmission Control Protocol Synchronize sequence numbers (TCPSYN) probe, which is used to check port reachability. The principle is to send a TCP packet carrying only the SYN flag to detect whether the target port (i.e. the destination server) is open and the path is reachable without completing the three-way handshake. The service probe is a User Datagram Protocol (UDP) probe, which is used to check specific application services.

[0075] For example, assuming that the path "server A-server B" is diagnosed as a suspected fault path by a preset machine learning algorithm, the path diagnosis system will immediately send TCP SYN probe and UDP probe from multiple servers located in different regions from server A to server B, to obtain multiple server probe results, such as whether the port of server B is reachable in the probe conclusion of server C, whether the specific service of server B is normal in the probe conclusion of server C, whether the port of server B is reachable in the probe conclusion of server D, whether the specific service of server B is normal in the probe conclusion of server D, whether the port of server B is reachable in the probe conclusion of server E, and whether the specific service of server B is normal in the probe conclusion of server E.

[0076] S302, determining first confidence data of the suspected fault path occurring path failure based on the first combined probe result.

[0077] Specifically, if all cross-region probes show path abnormalities, the confidence of the suspected fault path occurring failure will be increased, which means that the probability of the suspected fault path occurring path failure is relatively high. If only the probe of server A is abnormal, it is considered that the problem may be limited to the export network of server A, and the probability of the suspected fault path occurring path failure is relatively low. The advantage of such setting is that the multi-dimensional probe is used to further evaluate the possibility of the suspected fault path occurring path failure.

[0078] Figure 4is a flowchart of a method for determining second confidence data of a suspected fault path that has a path fault, provided by the present application, and the embodiment is a detailed description of "determining second confidence data of a suspected fault path that has a path fault based on SDN global topology information" in S104, specifically, as shown in Figure 4 The method comprises the following steps:

[0079] S401, determining whether the traffic load on the suspected fault path exceeds a preset threshold based on the SDN global topology information.

[0080] The SDN global topology information includes the connection relationship (i.e., link) between switches, routers, and hosts in the entire network, the real-time traffic load of each link, the port state, the error count, and other information. Analyzing the SDN global topology information can obtain the real-time traffic load on the data transmission path. The preset threshold can be understood as an index for measuring whether the traffic load of the key link on the data transmission path is excessive, for example, 90%, 85%, etc. The specific value is related to the traffic load diagnosis logic, and the present application does not limit it.

[0081] In a specific embodiment, taking the preset threshold of 90% as an example, when the machine learning model prompts that a certain path is abnormal, the path diagnosis system will query the global topology of the SDN controller. If it is found that the traffic load of the key link on the path exceeds 90% while other links are normal, it is determined that the traffic load on the suspected fault path exceeds the preset threshold. If the traffic load of the key link is high, it may cause temporary congestion of the path. The advantage of such setting is that it can quantitatively evaluate whether the traffic load on the suspected fault path is excessive, so as to check the misjudgment caused by temporary congestion.

[0082] Optionally, determining whether the traffic load on the suspected fault path exceeds the preset threshold based on the SDN global topology information comprises: determining the SDN switches contained in the suspected fault path according to the SDN global topology information, sending a statistical request message to each SDN switch respectively, since each switch records the traffic data; receiving the response message returned by each SDN switch, reading the flow table counter data contained in each response message; determining the total data amount passing through the suspected fault path according to each flow table counter data, and determining whether the traffic load on the suspected fault path exceeds the preset threshold according to the total data amount.

[0083] The sending of the statistics request message to each SDN switch can be an OFPT_STATS_REQUEST message (a statistics query message sent by a controller to a switch in the OpenFlow protocol, used to read the running data on the switch side at one time or periodically) in the OpenFlow protocol (the first generation of southbound standard language in the SDN era), and the response message returned by the SDN switch can be an OFPT_STATS_REPLY message (a statistics reply message used by the switch to respond to the OFPT_STATS_REQUEST in the OpenFlow protocol. When the controller wants to know the "running data" of the switch, it will first send the OFPT_STATS_REQUEST message to the switch. After receiving the OFPT_STATS_REQUEST message sent by the controller, the switch will package the corresponding flow table counter data and send it back to the controller with the OFPT_STATS_REPLY). The OpenFlow protocol is a remote control specification between the controller and the switch. The controller can issue a flow table, read and write a state, and receive an event through the OpenFlow protocol. The switch can report a non-matching packet, a link change, and a counter through the OpenFlow protocol, so that the controller can directly, finely, and in real time manipulate the forwarding behavior of the switch, thereby changing the network from "distributed self-negotiation" to "centralized programmable". The OFPT_STATS_REQUEST message is a "data probe" of the SDN controller. One query can pull the real-time counters of the flow, port, queue, table, and group in the switch back to the controller at one time, providing comprehensive raw data for visualization, billing, traffic engineering, and fault location. The flow table counter data represents the number of data packets that are successfully matched and forwarded.

[0084] Specifically, the response message includes a matching field (for example, a source server address, a destination server address, a source server port, a destination server port, etc.), a counter (for example, a number of data packet bytes matched by a flow table item, a number, etc.), an execution instruction, etc. A key path usually refers to a data path that carries core business traffic or known high bandwidth demand.

[0085] Further, the purpose of obtaining the whole network topology, traffic distribution, and switch state information (i.e., the response message returned by the SDN switch) is to: 1) understand the specific location and impact range of the fault path in the network; 2) find the optimal backup path for traffic switching; 3) combine the switch port state / error information to determine whether the cause of the path anomaly is a link fault or a device fault.

[0086] S402, obtaining second confidence data of the suspected fault path according to the determination result.

[0087] The second confidence data when the traffic load exceeds the preset threshold is less than the second confidence data when the traffic load does not exceed the preset threshold, that is, the probability of the suspected fault path causing the path fault when the traffic load exceeds the preset threshold is less than the probability of the suspected fault path causing the path fault when the traffic load does not exceed the preset threshold. Specifically, different confidence data can be set in advance for the two cases of the traffic load exceeding the preset threshold and the traffic load not exceeding the preset threshold, so as to quickly obtain the second confidence data of the suspected fault path causing the path fault according to the determination result (the relative relationship between the traffic load on the suspected fault path and the preset threshold). Further, the corresponding relationship between the traffic load and the confidence data can be summarized, so as to calculate the second confidence data of the suspected fault path causing the path fault with high accuracy according to the specific value of the traffic load and the corresponding relationship between the traffic load and the confidence data, and improve the fault diagnosis quality of the path.

[0088] For example, when the load traffic of the key link on the data transmission path exceeds the preset threshold and other links are normal, it can be preliminarily inferred that the abnormality is caused by temporary congestion rather than device hardware failure. The path diagnosis system can select to wait for congestion relief or immediately start path switching in combination with this information, thereby avoiding misjudging the temporary congestion as device failure requiring immediate intervention, and improving the stability and availability of the network.

[0089] Figure 5 is a flowchart of a determination method of detecting data provided by the application, and the embodiment is a detailed description of S101 "obtaining the detection data corresponding to the data transmission path". Specifically, as shown in Figure 5 The method comprises the following steps.

[0090] S501, obtaining a data packet transmission delay value from a source server to a destination server, and if the data packet transmission delay value exceeds a dynamic threshold, triggering a route tracing task to obtain a data transmission path of the data packet from the source server to the destination server and a delay of each hop.

[0091] The data packet transmission delay value can be a real transmission delay obtained after two-end clock difference elimination and alignment processing of the local clock difference between the data sending time and the receiving time, the dynamic threshold is a multiple of a preset baseline threshold, and the preset baseline threshold is obtained by counting the transmission delay values of historical data packets. The route tracking task can be traceroute detection, for example, a group of probe packets with TTL (Time To Live) increasing from 1 are continuously sent, and the path of the end-to-end route (i.e., the data transmission path of the data packet from the source server to the destination server) and the round-trip delay of each hop (i.e., the delay of each hop) measured by using the ICMP unreachable return mechanism to expose the three-layer devices (for example, routers) along the way hop by hop and stop when the final target "port unreachable" is received are drawn.

[0092] Specifically, the calculation method of the preset baseline threshold is T1=A+3xB, wherein T1 is the preset baseline threshold, A is the average value of the historical data packet transmission delay values in the preset time window, and B is the standard deviation of the historical data packet transmission delay values. The calculation method of the dynamic threshold is T2=1.5xT1, wherein T2 is the dynamic threshold, and T1 is the preset baseline threshold. The purpose of such setting is to quantify the triggering condition of the route tracking task, so as to accurately control the start of the route tracking task, detect the data transmission path in time, and check the path fault in time.

[0093] Further, the application also includes: sliding the preset time window backward, and updating the preset baseline threshold and the dynamic threshold according to the historical data packet transmission delay values in the sliding time window. The purpose of such setting is to ensure the real-time and accuracy of the preset baseline threshold and the dynamic threshold, and to improve the acquisition quality of the detection data. The time window can be 3 minutes, 5 minutes, 7 minutes, etc., and the application does not limit the specific value.

[0094] S502, if it is determined that there is at least N-hop delay anomaly according to the delay of each hop, a third combined detection is initiated on the data transmission path to obtain detection data corresponding to the data transmission path.

[0095] Wherein, N is a positive integer, the specific value is related to the total number of hops of the data transmission path and the detection demand, and the application does not limit this. When the route tracking test finds that there is at least N-hop delay anomaly on the data transmission path, it is considered that the data transmission quality of the data transmission path is not high, and the path may be abnormal. The third combined detection is initiated on the data transmission path to obtain detection data corresponding to the data transmission path, and then verify whether the data transmission path has a fault. The third combined detection includes network detection and port detection, which belongs to multi-protocol joint detection.

[0096] Figure 6Fig. 1 is a structural schematic diagram of a path fault processing device provided by the present application. As shown in the figure, the device comprises a data acquisition module 601, a fault prediction module 602, a first diagnosis module 603, a second diagnosis module 604 and a path switching module 605. Figure 6

[0097] The data acquisition module 601 is configured to acquire detection data corresponding to a data transmission path, wherein the detection data comprises performance indicators of the data transmission path.

[0098] The fault prediction module 602 is configured to extract data features of the detection data, and obtain a fault prediction result of the data transmission path based on the extracted data features and a preset machine learning algorithm.

[0099] The first diagnosis module 603 is configured to, if the fault prediction result is that the data transmission path is a suspected fault path, start cross-region multi-source detection to determine first confidence data of path fault of the suspected fault path.

[0100] The second diagnosis module 604 is configured to query and obtain SDN global topology information from a software defined network (SDN) controller, and determine second confidence data of path fault of the suspected fault path based on the SDN global topology information.

[0101] The path switching module 605 is configured to, in a case where it is determined based on the first confidence data and the second confidence data that the suspected fault path is a real fault path, update a flow table through the SDN controller to switch traffic on the real fault path to other transmission paths.

[0102] Optionally, the fault prediction module 602 is specifically configured to: obtain an anomaly prediction result of the data transmission path based on the extracted data features and an isolation forest algorithm model; obtain a performance indicator prediction result of the data transmission path based on the extracted data features and a pre-trained long short-term memory (LSTM) artificial neural network model; and obtain the fault prediction result of the data transmission path based on the anomaly prediction result and the performance indicator prediction result.

[0103] Optionally, the first diagnosis module 603 is specifically configured to: instruct a plurality of servers to initiate a first combined detection to a destination server corresponding to the data transmission path to obtain a first combined detection result; wherein the plurality of servers are servers located in different regions from a source server corresponding to the data transmission path, and the first combined detection comprises port detection and service detection; and determine the first confidence data of path fault of the suspected fault path based on the first combined detection result.

[0104] ​Optionally, the second diagnosis module 604 is specifically configured to: determine whether the traffic load on the suspected fault path exceeds a preset threshold based on the SDN global topology information; and obtain second confidence data of the suspected fault path having a path fault according to a determination result, wherein the second confidence data when the traffic load exceeds the preset threshold is less than the second confidence data when the traffic load does not exceed the preset threshold.

[0105] Optionally, the second diagnosis module 604 is specifically configured to: determine each SDN switch contained in the suspected fault path based on the SDN global topology information, send a statistical request message to each SDN switch, receive a response message returned by each SDN switch, read flow table counter data contained in each response message, determine a total data amount passing through the suspected fault path based on the flow table counter data, and determine whether the traffic load on the suspected fault path exceeds a preset threshold based on the total data amount.

[0106] Optionally, the path switching module 605 is specifically configured to: initiate a second combined detection on a specified redundant path to obtain a second combined detection result, wherein the second combined detection includes network detection and connection detection, the specified redundant path is a network transmission path other than the real fault path and pre-set, and the network transmission path and the real fault path correspond to the same source server and destination server; determine a performance index of the specified redundant path based on the second combined detection result; and update a flow table through an SDN controller to switch traffic on the real fault path to the specified redundant path in a case where the performance index of the specified redundant path meets a preset condition.

[0107] Optionally, the data acquisition module 601 is specifically configured to: acquire a data packet transmission delay value from a source server to a destination server, trigger a route tracing task to obtain a data transmission path of a data packet from the source server to the destination server and a delay of each hop if the data packet transmission delay value exceeds a dynamic threshold, and initiate a third combined detection on the data transmission path to acquire detection data corresponding to the data transmission path if it is determined that there is at least N-hop delay anomaly according to the delay of each hop, wherein the third combined detection includes network detection and port detection.

[0108] Optionally, the dynamic threshold is a multiple of a preset baseline threshold, and the preset baseline threshold is obtained by statistically processing historical data packet transmission delay values.

[0109] Optionally, the preset baseline threshold is calculated in the following manner: T1=A+3×B; T1 is the preset baseline threshold, A is a mean value of historical data packet transmission delay values in a preset time window, and B is a standard deviation of the historical data packet transmission delay values; and the dynamic threshold is calculated in the following manner: T2=1.5×T1, T2 is the dynamic threshold, and T1 is the preset baseline threshold.

[0110] Optionally, the path fault processing apparatus further comprises a parameter updating module configured to slide the preset time window backward, and update the preset baseline threshold and the dynamic threshold according to the historical packet transmission delay values in the time window after sliding.

[0111] Optionally, the path fault processing apparatus further comprises a fault display module configured to, in a case that the suspected fault path is determined to be a real fault path, determine a location and an influence range of the data transmission path in the global network based on the global topology data output by the SDN controller, and generate a network state heat map based on the location and the influence range of the data transmission path in the global network, so as to highlight a fault area in the network state heat map.

[0112] Optionally, the probe data further comprises path attributes and context information, the path attributes comprise path hop counts, and the context information comprises time periods and / or service types; and the data features comprise timing features, statistical features and topology features, the timing features comprise fluctuation features and / or trend features in a time window, the statistical features comprise at least one of an average value, a standard deviation, a minimum value and a maximum value, and the topology features comprise path redundancy.

[0113] The path fault processing apparatus provided in the embodiment can execute the path fault processing method provided in any embodiment of the application, and has the corresponding function modules and beneficial effects of the execution method.

[0114] Figure 7 is a structural schematic diagram of an electronic device. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smart phones, wearable devices (e.g., headgear, eyewear, watches, etc.), and other similar computing devices. The components shown in the figure, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the applications described and / or claimed in this document.

[0115] As Figure 7As shown, the electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory 12, a random access memory (also referred to as a random access memory) 13, etc., which is communicatively connected to the at least one processor 11, wherein the memory stores a computer program that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory 12 or loaded from the storage unit 18 into the random access memory 13. In the random access memory 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the read-only memory 12, and the random access memory 13 are connected to each other through a bus 14. An input / output interface 15 is also connected to the bus 14.

[0116] A plurality of components in the electronic device 10 are connected to the input / output interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, a speaker, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0117] The processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit, a graphics processing unit, various special-purpose artificial intelligence computing chips, various processors running machine learning model algorithms, a digital signal processor, and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as the processing method of the path failure.

[0118] In some embodiments, the processing method of the path failure can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the read-only memory 12 and / or the communication unit 19. When the computer program is loaded into the random access memory 13 and executed by the processor 11, one or more steps of the processing method of the path failure described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to perform the processing method of the path failure by any other appropriate means (for example, by means of firmware).

[0119] The various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, specially designed application specific integrated circuits, application specific standard products, chips, microprocessors, computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0120] Computer programs implementing methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed, implements the functions / acts specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0121] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store computer programs for use by or in connection with an instruction execution system, apparatus, or device. Computer-readable storage media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory, read-only memory, erasable programmable read-only memory / flash memory, optical fibers, portable compact disc read-only memories, optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0122] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0123] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), a blockchain network, and the Internet.

[0124] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of large management difficulty and weak business scalability in traditional physical hosts and virtual private servers.

[0125] In one specific embodiment, the present application also includes a computer program product comprising a computer program which, when executed by a processor, implements the method for processing path failure of any embodiment of the present application.

[0126] The computer program product, in implementation, can be written in one or more programming languages or combinations of languages to implement the operations of the present application, including object oriented programming languages and conventional procedural programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network or a wide area network, or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0127] It should be understood that the various forms of flow shown above can be re-ordered, added to, or have steps deleted. For example, the steps recited in the present application can be performed in parallel, in series, or in a different order, without limitation herein, so long as the desired results of the technical solutions of the present application are achieved.

[0128] The above detailed description does not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method of handling a path failure, characterized by, The method comprises: obtaining probe data corresponding to a data transmission path, wherein the probe data comprises performance indicators of the data transmission path; extracting data features of the probe data, and obtaining a fault prediction result of the data transmission path based on the extracted data features and a preset machine learning algorithm; if the fault prediction result is that the data transmission path is a suspected fault path, starting cross-region multi-source detection to determine first confidence data of path failure of the suspected fault path; obtaining SDN global topology information from a software defined network (SDN) controller, and determining second confidence data of path failure of the suspected fault path based on the SDN global topology information; in a case where it is determined that the suspected fault path is a real fault path based on the first confidence data and the second confidence data, updating a flow table through the SDN controller to switch traffic on the real fault path to other transmission paths.

2. The method of claim 1, wherein, The method comprises: obtaining an anomaly prediction result of the data transmission path based on the extracted data features and an isolation forest algorithm model; obtaining a performance indicator prediction result of the data transmission path based on the extracted data features and a pre-trained long short-term memory (LSTM) artificial neural network model; obtaining a fault prediction result of the data transmission path based on the anomaly prediction result and the performance indicator prediction result.

3. The method of claim 1, wherein, The method comprises: instructing a plurality of servers to initiate a first combined probe to a destination server corresponding to the data transmission path to obtain a first combined probe result, wherein the plurality of servers are servers located in different regions from a source server corresponding to the data transmission path, and the first combined probe comprises a port probe and a service probe; determining first confidence data of path failure of the suspected fault path based on the first combined probe result.

4. The method of claim 1, wherein, The method comprises: determining whether traffic load on the suspected fault path exceeds a preset threshold based on the SDN global topology information; obtaining second confidence data of path failure of the suspected fault path according to the determination result; wherein the second confidence data when the traffic load exceeds the preset threshold is less than the second confidence data when the traffic load does not exceed the preset threshold.

5. The method of claim 4, wherein, The method comprises: determining each SDN switch included in the suspected fault path according to the SDN global topology information, and sending a statistical request message to each SDN switch; receiving response messages returned by each SDN switch, and reading flow table counter data included in each response message; According to the flow table counter data, a total data amount passing through the suspected fault path is determined, and whether a traffic load on the suspected fault path exceeds a preset threshold is determined according to the total data amount.

6. The method of claim 1, wherein, The updating of the flow table by the SDN controller to switch the traffic on the real fault path to other transmission paths comprises: a second combined probe is initiated on a designated redundant path to obtain a second combined probe result; the second combined probe comprises a network probe and a connection probe; the designated redundant path is a network transmission path other than the real fault path and corresponding to the same source server and destination server as the real fault path; a performance index of the designated redundant path is determined according to the second combined probe result; in a case where the performance index of the designated redundant path meets a preset condition, the flow table is updated by the SDN controller to switch the traffic on the real fault path to the designated redundant path.

7. The method of claim 1, wherein, The acquisition of the probe data corresponding to the data transmission path comprises: a data packet transmission delay value from the source server to the destination server is acquired, and if the data packet transmission delay value exceeds a dynamic threshold, a route tracing task is triggered to obtain a data transmission path of a data packet from the source server to the destination server and a delay of each hop; if it is determined according to the delay of each hop that there is at least N-hop delay anomaly, a third combined probe is initiated on the data transmission path to acquire the probe data corresponding to the data transmission path; the third combined probe comprises a network probe and a port probe.

8. The method of claim 7, wherein, The dynamic threshold is a multiple of a preset baseline threshold, and the preset baseline threshold is obtained by statistical analysis of historical data packet transmission delay values.

9. The method of claim 8, wherein the preset baseline threshold is calculated in a manner of T1=A+3×B; wherein T1 is the preset baseline threshold, A is a mean value of historical data packet transmission delay values in a preset time window, and B is a standard deviation of historical data packet transmission delay values; the dynamic threshold is calculated in a manner of T2=1.5×T1, wherein T2 is the dynamic threshold and T1 is the preset baseline threshold.

10. The method of claim 9, wherein, The method further comprises: sliding the preset time window backward and updating the preset baseline threshold and the dynamic threshold according to historical data packet transmission delay values in the time window after the sliding.

11. The method of claim 1, wherein, In a case where it is determined that the suspected fault path is a real fault path, the method further comprises: determining a location and an influence range of the data transmission path in a global network based on global topology data output by the SDN controller; generating a network state heat map based on the location and the influence range of the data transmission path in the global network to highlight a fault area in the network state heat map.

12. The method according to any one of claims 1-11, characterized in that, The probe data further comprises path attributes and context information; the path attributes comprise a path hop count, and the context information comprises a time period and / or a service type. The data features include timing features, statistical features, and topology features. The timing features include fluctuation features and / or trend features within a time window. The statistical features include at least one of a mean value, a standard deviation, a minimum value, and a maximum value. The topology features include path redundancy.

13. A path failure handling apparatus, characterized by comprising: The method comprises the following steps: a data acquisition module configured to acquire probe data corresponding to a data transmission path, the probe data including performance indicators of the data transmission path; a fault prediction module configured to extract data features of the probe data, and obtain a fault prediction result of the data transmission path based on the extracted data features and a preset machine learning algorithm; a first diagnosis module configured to, if the fault prediction result indicates that the data transmission path is a suspected fault path, initiate cross-region multi-source probing to determine first confidence data of path failure of the suspected fault path; a second diagnosis module configured to query SDN global topology information from a software-defined network (SDN) controller, and determine second confidence data of path failure of the suspected fault path based on the SDN global topology information; a path switching module configured to, if the suspected fault path is determined to be a real fault path based on the first confidence data and the second confidence data, update a flow table by the SDN controller to switch traffic on the real fault path to other transmission paths.

14. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the method for processing path failure according to any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for enabling a processor to execute the method for processing path failure according to any one of claims 1 to 12 when executed by the processor.

16. A computer program product comprising a computer program, characterized in that, The computer program, when executed by a processor, implements the method for processing path failure according to any one of claims 1 to 12.

Images