Network anomaly analysis method, device, equipment, medium and product

Abstract

The invention relates to the technical field of network anomaly analysis, and provides a network anomaly analysis method and device, equipment, a medium and a product, and the method comprises the steps: obtaining network quality data; inputting the network quality data into a prediction model, and obtaining output prediction information; judging whether the prediction information exceeds a threshold range or not according to the network quality data and the prediction information; when it is determined that the prediction information exceeds a threshold range, abnormal alarm information is generated; and according to the abnormity alarm information, processing based on a root cause analysis algorithm to obtain network abnormity reason information. By predicting whether the network quality exceeds a threshold range or not, the effect of discovering network anomaly in time is achieved, Monte Carlo tree search is combined with a rapid action value estimation strategy, a reason combination with the maximum possibility of causing the network anomaly is determined through a scoring mechanism, and the effect of automatically positioning the root reason of the network anomaly is achieved. And the efficiency of network anomaly analysis can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network anomaly analysis, and in particular to a network anomaly analysis method, device, equipment, medium and product. BACKGROUND

[0002] With the development of digital home and smart home technologies, a home network has become the basis for supporting modern home life and network activities. Performance indicators of the home network, such as network rate, end-to-end latency, Wi-Fi signal strength, etc., directly affect the quality of home office, learning and entertainment, and smart device operation, and are related to user experience. When the performance indicators of the home network are abnormal, problems such as video lag, meeting interruption, and smart device failure occur, which reduces the user experience.

[0003] In the prior art, the home network environment is increasingly complex, such as diverse access devices, wireless interference, and different device configuration parameters, which makes the manifestation of network anomalies diverse and hidden. Ordinary users lack professional diagnostic knowledge and effective tools, making it difficult to identify and locate the anomaly, and thus the root cause of the network anomaly cannot be determined.

[0004] Therefore, how to automatically and timely discover the anomaly of the home network and locate the cause of the network anomaly is a problem to be solved. SUMMARY

[0005] The present application provides a network anomaly analysis method, device, equipment, medium and product to solve the defect that it is difficult to identify and locate the anomaly in the prior art, which leads to the inability to determine the root cause of the network anomaly.

[0006] The present application provides a network anomaly analysis method, comprising: obtaining network quality data, the network quality data comprising current network quality parameters and historical network quality parameters; inputting the network quality data into a prediction model to obtain output prediction information, the prediction model being used to predict future network quality parameters; judging whether the prediction information exceeds a threshold range according to the network quality data and the prediction information, the threshold range being determined by the network quality data; generating an anomaly alarm information when the prediction information exceeds the threshold range; obtaining network anomaly cause information based on root cause analysis algorithm processing according to the anomaly alarm information; The root cause analysis algorithm determines the reason combination with the largest possibility of causing the network anomaly by scoring different reason combinations based on Monte Carlo tree search and fast action value estimation strategy.

[0007] According to the network anomaly analysis method provided in the application, the network anomaly reason information is obtained based on the root cause analysis algorithm processing according to the abnormal alarm information, including: According to the abnormal alarm information, the abnormal time is determined and the corresponding multi-dimensional data is obtained, and the multi-dimensional data includes multiple network quality related data; According to the multi-dimensional data, the root cause analysis algorithm processing is used to determine the reason combination with the largest network anomaly probability, and the network anomaly reason information is generated.

[0008] According to the network anomaly analysis method provided in the application, the root cause analysis algorithm includes: According to the multi-dimensional data, a hierarchical data set is constructed, the hierarchical data set includes multiple layers of data groups, each layer of the data group includes at least one data cube, the data cube includes one-dimensional elements or at least two-dimensional combined elements, and the dimension number of the combined elements in the upper layer is greater than that in the lower layer; For each data cube in the current processing group, the potential score of the element or the combined element is evaluated based on the Monte Carlo tree search and the fast action value estimation strategy; According to the potential score, the data group of the previous layer of the current processing group is pruned to remove the element or the combined element with a potential score lower than a lower threshold, and the data group of the previous layer is taken as the current processing group until there is a potential score greater than an end score threshold or all layers of the data group are traversed; According to the element or the combined element corresponding to the maximum potential score, the reason combination with the largest network anomaly probability is determined, and the network anomaly reason information is generated.

[0009] According to the network anomaly analysis method provided in the application, for each data cube in the current processing group, the potential score of the element or the combined element is evaluated based on the Monte Carlo tree search and the fast action value estimation strategy, including: According to the data cube, the element or the combined element therein is taken as a node and a new element is combined as an action, and the Monte Carlo tree search processing is performed to determine the potential score of the node; Wherein, the potential score is obtained based on the Euclidean distance between the feature vector corresponding to the element or the combined element and the abnormal feature vector, and the return value corresponding to the action in the Monte Carlo tree search processing process is determined by the path score average and the element score average, the path score average represents the average score of each child node in the subsequent path of the action, and the element score average represents the average score of the newly added element in each node.

[0010] According to the network anomaly analysis method provided in the application, the return value is determined by an expression: wherein, is the return value; is the element score mean; the is the path score mean; the is a weight factor; is the number of times that an action a is selected from a state s in a Monte Carlo tree search process; is an adjustable parameter.

[0011] According to the network anomaly analysis method provided in the application, in the Monte Carlo tree search process, the action selected by the search is determined according to the action score, which is determined by an expression: wherein, the is the action selected by the search; state is a set of all legal selectable actions; argmax represents selecting the maximum value action; is the return value of the action; is the number of times that a node is selected; is the number of times that an action is selected from a state ; is an adaptive exploration factor, which decreases with the increase of .

[0012] According to the network anomaly analysis method provided in the application, the determining whether the prediction information exceeds a threshold range according to the network quality data and the prediction information comprises: determining a network quality sequence based on time variation according to the network quality data, calculating a mean and a standard deviation of the network quality sequence; determining the threshold range according to the mean and the standard deviation; comparing the prediction information with the threshold range to determine whether the prediction information exceeds the threshold range.

[0013] According to the network anomaly analysis method provided in the application, after the network anomaly cause information is obtained, the method further comprises: obtaining actual solution information corresponding to the network anomaly cause information; When it is determined that the network anomaly cause information is incorrect based on the actual solution information, the actual cause information, the network anomaly cause information, and the corresponding processing parameter information are recorded to form an error sample dataset. Based on the error sample dataset, decision adjustment rule information is obtained, which is used to adjust the algorithm parameters of the root cause analysis algorithm according to the characteristics of the multi-dimensional data. The actual cause information is determined by the actual solution information, and the processing parameter information is determined by the parameters of the root cause analysis algorithm.

[0014] According to the network anomaly analysis method provided in this application, it also includes: A network anomaly knowledge base is constructed based on the anomaly alarm information, the network anomaly cause information, and the actual solution information. Based on the network anomaly knowledge base, a causal relationship graph is generated, which represents the causal relationship between fault records, anomaly indicators, anomaly causes, and solutions. In response to user query information, a query feature vector is determined based on the user query information; Based on the query feature vector, retrieve the causal relationship graph information and obtain matching node information; Based on the matching node information, a reply text message is generated.

[0015] This application also provides a network anomaly analysis device, comprising: The acquisition module is used to acquire network quality data, which includes current network quality parameters and historical network quality parameters. The prediction module is used to input the network quality data into the prediction model and obtain the output prediction information. The prediction model is used to predict future network quality parameters. An anomaly detection module is used to determine whether the prediction information exceeds a threshold range based on the network quality data and the prediction information. The threshold range is determined by the network quality data. When it is determined that the prediction information exceeds the threshold range, an anomaly alarm message is generated. The anomaly analysis module is used to obtain network anomaly cause information based on the anomaly alarm information and the root cause analysis algorithm. The root cause analysis algorithm scores different combinations of causes and, based on Monte Carlo tree search and fast action value estimation strategies, determines the combination of causes most likely to cause network anomalies.

[0016] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement a network anomaly analysis method as described above.

[0017] This application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a network anomaly analysis method as described above.

[0018] This application also provides a computer program product, including a computer program that, when executed by a processor, implements a network anomaly analysis method as described above.

[0019] This application provides a network anomaly analysis method, apparatus, device, medium, and product, which has at least the following beneficial effects: By acquiring network quality data including current and historical parameters, a predictive model is used to predict future network quality parameters, obtaining predictive information. This predicted information is compared with a threshold range dynamically determined by the network quality data itself to determine whether future network quality changes are within the normal range, thereby determining whether a network anomaly exists. When the predicted information exceeds the threshold range, an anomaly alarm is generated. Based on the anomaly alarm information, a root cause analysis algorithm is used. This algorithm is based on Monte Carlo tree search and a fast action value estimation strategy. By scoring different combinations of causes, the most likely combination of causes leading to the network anomaly is determined, thus generating network anomaly cause information representing the root cause of the network anomaly. Therefore, by predicting whether network quality exceeds the threshold range, the effect of timely detection of network anomalies is achieved. Simultaneously, by using Monte Carlo tree search combined with a fast action value estimation strategy and a scoring mechanism to determine the most likely combination of causes leading to the network anomaly, the effect of automatically locating the root cause of the network anomaly is achieved, which is beneficial to improving the efficiency of network anomaly analysis. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is one of the flowcharts of a network anomaly analysis method provided in this application.

[0022] Figure 2 This is the second flowchart of a network anomaly analysis method provided in this application.

[0023] Figure 3 This is a schematic diagram of the hierarchical dataset in a network anomaly analysis method provided in this application.

[0024] Figure 4 This is a schematic diagram illustrating the process of obtaining a causal relationship graph in a network anomaly analysis method provided in this application.

[0025] Figure 5 This is a schematic diagram of the user query process in a network anomaly analysis method provided in this application.

[0026] Figure 6 This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0028] The following is combined with Figure 1 and Figure 2 This application describes a network anomaly analysis method, comprising: S100: Obtain network quality data, which includes current network quality parameters and historical network quality parameters; S200: Input the network quality data into the prediction model and obtain the output prediction information. The prediction model is used to predict future network quality parameters. S300: Based on the network quality data and the prediction information, determine whether the prediction information exceeds a threshold range, wherein the threshold range is determined by the network quality data; S400: When it is determined that the predicted information exceeds the threshold range, an abnormal alarm message is generated; S500: Based on the abnormal alarm information, and using the root cause analysis algorithm, obtain information about the cause of the network abnormality; The root cause analysis algorithm scores different combinations of causes and, based on Monte Carlo tree search and a fast action value estimation strategy, determines the combination of causes most likely to cause network anomalies.

[0029] By acquiring network quality data including current and historical parameters, a predictive model is used to predict future network quality parameters, thus obtaining predictive information. This predicted information is compared with threshold ranges dynamically determined by the network quality data itself to determine whether future network quality changes are within normal limits, thereby identifying potential network anomalies. When the predicted information exceeds the threshold range, an anomaly alarm is generated. Based on the anomaly alarm, a root cause analysis algorithm is used. This algorithm utilizes Monte Carlo tree search and a fast action value estimation strategy. By scoring different combinations of causes, the most likely combination of causes leading to the network anomaly is determined, generating network anomaly cause information characterizing the root cause of the network anomaly.

[0030] In this way, by predicting whether the network quality exceeds the threshold range, the network anomaly can be detected in a timely manner. At the same time, by using Monte Carlo tree search combined with a fast action value estimation strategy, a scoring mechanism is used to determine the combination of causes most likely to cause the network anomaly, thereby automatically locating the root cause of the network anomaly and improving the efficiency of network anomaly analysis.

[0031] In some embodiments of this application, network quality data may include key indicator parameters (such as network request success rate, signal strength), network congestion parameters, location parameters, QoS policy parameters, backhaul link capacity parameters, etc.

[0032] It should be noted that the prediction information is used to predict various parameters in network quality data, and the threshold range varies for different parameters. If the prediction information exceeds the threshold range, it could be one or more parameters exceeding the threshold range. Anomaly alarm information is generated based on the parameters that exceed the threshold range, so as to facilitate subsequent acquisition of corresponding multi-dimensional data for analysis.

[0033] In some embodiments of this application, the prediction model is formed by training a Bidirectional Long Short-Term Memory (Bi-LSTM) model using historical data of key indicators. The specific model training process can be as follows: The key network quality indicator data is standardized and divided into training, validation, and test sets in a 7:2:1 ratio. Based on the typical collection period of the key indicator data, the sequence length of the input data is set, for example, to 30, representing data from the past 30 collection periods. The prediction sequence length is set, for example, to 2, representing the prediction of changes in the next two periods. The loss function, optimizer and its parameters, batch size, and training epochs are configured, and the model is trained. The model checkpoint mechanism is as follows: if the validation set loss decreases after each epoch, the current model weights are saved. After reaching the required number of training epochs, the trained Bi-LSTM model is used as the prediction model. Based on the trained prediction model, network quality data is predicted. The 30 most recently collected sequence values ​​from the current and historical sequences are standardized and then input into the prediction model to obtain the predicted values ​​of key network quality indicators for the next two time points. Based on the standardization process, the predicted values ​​for the two time points are inversely converted into values ​​at the original data scale to form prediction information.

[0034] In some embodiments of a network anomaly analysis method of this application, step S500 includes: Based on the abnormal alarm information, determine the abnormal time and obtain the corresponding multi-dimensional data, which includes various data related to network quality. Based on the multi-dimensional data and the root cause analysis algorithm, the combination of causes most likely to cause network anomalies is determined, and the network anomaly cause information is generated.

[0035] Based on the anomaly alarm information, after determining the time of the network anomaly, multi-dimensional data corresponding to that time is acquired. This multi-dimensional data includes data related to network quality across multiple dimensions, such as network parameters, geographical location, equipment manufacturer, equipment parameters, and carrier information. Then, root cause analysis algorithms are used to process this multi-dimensional data to determine the final combination of causes for the network anomaly. In this way, by acquiring multi-dimensional data associated with the network anomaly based on the anomaly alarm information, a sufficient data foundation is provided for root cause analysis, which helps improve the accuracy and targeting of locating the root cause of network anomalies.

[0036] It should be noted that the dimensional data included in the multi-dimensional data can be dynamic. Based on the abnormal alarm information, the corresponding dimensional data is obtained for different network anomaly types. That is, the multi-dimensional data obtained for different abnormal alarm information may include data of different dimensions.

[0037] In some embodiments of a network anomaly analysis method according to this application, the root cause analysis algorithm includes: Based on the multi-dimensional data, a hierarchical dataset is constructed, which includes multiple data groups. Each data group includes at least one data cube. The data cube includes an element with one dimension or a combination of elements with at least two dimensions. The number of dimensions of the combination elements in the upper layer is greater than the number of dimensions of the combination elements in the lower layer. Using the data group in the first layer as the current processing group, for each data cube in the current processing group, the potential score of the element or the combination of elements is evaluated based on Monte Carlo tree search and a fast action value estimation strategy. Based on the potential score, prune the data group in the layer above the current processing group to remove the elements or the combination elements whose potential scores are lower than the lower threshold, and take the data group in the layer above as the current processing group until there is a potential score greater than the end scoring threshold or the data groups of all layers are traversed. Based on the element or combination of elements corresponding to the maximum potential score, determine the combination of causes most likely to cause network anomalies, and generate the network anomaly cause information.

[0038] This application is based on the fundamental concept that the root cause of network anomalies exists in a combination of elements, and determines the root cause. For example, the root cause of network anomalies can be represented by a combination of geographical location A, license holder (operator) B, equipment manufacturer C, and equipment parameter D. Based on this, it can be considered that the equipment of equipment manufacturer C under operator B at location A causes network anomalies due to equipment parameter D.

[0039] Construct hierarchical datasets based on multi-dimensional data, such as Figure 3 As shown, each data group includes at least one data cube, and the number of dimensions in the upper data group is greater than the number of dimensions in the lower data group. That is, the upper combination element can be regarded as a new combination formed by adding elements on the basis of the lower combination element. In other words, the upper combination element can also be regarded as a subset of the lower combination element.

[0040] To more intuitively understand the hierarchical dataset of this invention, based on Figure 3 To illustrate, in the first-level data group, there are four data cubes, each representing the B element of the corresponding license plate dimension. cp (n1), B corresponding to the equipment manufacturer dimension element ma (n2), B corresponding to the geographical location dimension element area (n3), B corresponding to the device parameter dimension element rom(n4), where n1, n2, n3, and n4 represent the number of elements; the second layer of data groups includes six data cubes, which are formed by combining the elements of the first layer in pairs, that is, by adding one element to the elements of the first layer; the third layer of data groups includes four data cubes, which are formed by combining the combined elements of the second layer with one more element; the fourth layer of data groups includes one data cube, which is formed by combining the combined elements of the third layer with one more element, and in this example, it is also formed by combining the elements of all four dimensions.

[0041] It is understood that in some embodiments of this application, the number of data cubes in the first-layer data group corresponds to the number of dimensions included in the multi-dimensional data, and is not limited to four data cubes, i.e., not limited to four-dimensional data. In some implementations, the first-layer data group may include data cubes formed by combining elements of a preset number of dimensions, i.e., it is not built starting from a single dimension, but from a combination of elements of a preset number of dimensions.

[0042] After constructing the hierarchical dataset, starting with the first-level dataset (assuming a single dimension), a Monte Carlo tree search and fast-action value estimation strategy are used to evaluate the potential score of each element. Then, based on the potential scores, the datasets of the next higher level are pruned, removing combination elements unlikely to be the root cause. The potential score of each combination element in the next higher level is then evaluated again, and this process is repeated iteratively until a combination element with a sufficiently high potential score is found or all levels of datasets have been traversed. The combination element with the highest potential score is identified as the most likely cause combination leading to network anomalies, thus generating network anomaly cause information.

[0043] Therefore, by constructing a hierarchical dataset, pruning is performed on the potential scores of elements or combinations of elements at each level. Potential scores are evaluated starting with single-dimensional elements or low-dimensional combinations to filter out more complex combinations, thus preemptively identifying elements or combinations with low probability of causing network anomalies. This reduces the computational burden of calculating potential scores for complex, high-dimensional combinations and improves analysis efficiency. When a combination with a sufficiently high potential score is found, it means a sufficiently significant root cause has been found, and further analysis is unnecessary. The combination with the highest potential score is identified as the most likely cause of the network anomaly, and the analysis process ends. Alternatively, after traversing all levels of the dataset, no combination with a potential score greater than the end-of-search threshold is found, but the search is complete. The combination with the highest potential score is identified as the most likely cause of the network anomaly.

[0044] It should be emphasized that this application, targeting the characteristic of determining the root cause of network anomalies by searching for combined elements, starts the analysis from a single dimension or low dimension and provides guidance for high-dimensional combined elements to remove elements or combinations with low probability. This can significantly and effectively narrow the search space, improve the analysis efficiency of root cause localization, and avoid the problem of excessive computation caused by comprehensively searching all possible high-dimensional combined elements.

[0045] After constructing the hierarchical dataset, the subsequent analysis steps are described in more detail below: Each data cube in the data group of the first layer is taken as the target data cube; Calculate the potential score of each element or combination of elements within each target data cube; The element or combination of elements with the highest potential score is selected as the candidate cause element; When it is determined that the potential score of the candidate cause element is less than the end scoring threshold and the target data cube does not belong to the top layer, the data cube of the upper layer is pruned according to the potential scores of each element or the combination element to remove some of the combination elements, and the data cube of the upper layer is used as the new target data cube. When the potential score of the candidate cause element is greater than or equal to the end scoring threshold, or when the target data cube is at the top layer, the candidate cause element is taken as the cause with the highest probability of network anomaly, the network anomaly cause information is generated, and the algorithm process ends. The end scoring threshold is determined by algorithm parameters.

[0046] During the scoring search process, the element or combination of elements with the highest potential score is continuously updated as a candidate cause element. At the end, the candidate cause element is the combination of causes that is most likely to cause network anomalies, and network anomaly cause information is generated accordingly.

[0047] It should be noted that the end-of-scoring threshold can be preset and fixed, or it can be dynamically adjusted according to the decision adjustment rules. The decision adjustment rules refer to the corresponding adjustment of the algorithm parameters of the root cause analysis algorithm for the features of different multi-dimensional data, such as the number of layers in the hierarchical dataset, the end-of-scoring threshold, the number of iterations of the Monte Carlo tree search, and other algorithm parameters.

[0048] In some embodiments of a network anomaly analysis method of this application, the step of evaluating the potential score of each data cube in the current processing group based on Monte Carlo tree search and a fast-action value estimation strategy includes: Based on the data cube, using the elements or combinations of elements therein as nodes and combining newly added elements as an action, a Monte Carlo tree search is performed to determine the potential score of the node. The potential score is obtained based on the Euclidean distance between the feature vector corresponding to the element or the combination of elements and the abnormal feature vector. In the Monte Carlo tree search process, the reward value corresponding to the action is determined by the mean path score and the mean element score. The mean path score represents the average score of each child node in the subsequent path of the action, and the mean element score represents the average score of the newly added element in each node.

[0049] Monte Carlo tree search is a process that gradually builds a search tree and approaches the optimal solution through a "simulation-evaluation-backtracking" loop. Starting from a root node representing the current state, it repeatedly executes four steps: selection, expansion, simulation, and backtracking. Selection: Choose a path from the constructed search tree based on the principle of "balancing experience and exploration"; Expansion: Add a new possible state node to the leaf nodes of the selected path; Simulation: Simulate the new node to obtain its value evaluation; Backtracking: Based on the obtained value evaluation, backpropagate to update the frequency, value, and other information of the nodes on the path. Iteratively repeating this process allows for the evaluation of the most valuable action at the root node, facilitating decision-making.

[0050] Based on the aforementioned Monte Carlo tree search and combined with the characteristics of network anomaly analysis, this application uses elements or combinations of elements in the data cube as nodes and takes the combination of new elements as an action to perform Monte Carlo tree search processing, determine potential scores, and evaluate the potential ability of each element or combination of elements in the data cube to form a combination of causes leading to network anomalies. At the same time, it can also evaluate which combination with a new element is more likely to be a combination of causes leading to network anomalies.

[0051] In Monte Carlo tree search, the selection process—that is, selecting nodes and actions to form a search path to explore new nodes—determines the action path based on the reward value corresponding to the action. This application, based on a rapid action value estimation strategy, determines the reward value when selecting a search path by combining the mean path score and the mean element score. It is important to emphasize that the mean element score is determined by the average score of the newly added element across all nodes. When evaluating the value of an action, it is not limited to the local value of the newly added element in the current path, but comprehensively considers both the local value of the added element within the path (i.e., the mean path score) and the global value of the added element (i.e., the mean element score). This improves the quality and efficiency of the search and fully utilizes the global value provided by the potential score of each node simulation.

[0052] Therefore, based on the idea of ​​a rapid action value estimation strategy, this application introduces the mean of element scores as part of the action reward value. This allows the evaluation of an action, i.e., adding a new dimension of elements for combination, during the Monte Carlo tree search process, to consider not only the performance of the element under the current path, but also the historical comprehensive performance of the element under other different paths, thereby improving search efficiency and quality.

[0053] To better understand the role of the mean element score, let's illustrate with an example: When performing a Monte Carlo search on individual elements or combinations of elements in a data cube, after adding element X and combining them, the simulated potential scores are all high, that is, the mean element score is high. This means that element X is more likely to be one of the combinations that cause network anomalies. Therefore, when selecting a search path, we should prioritize the search path corresponding to the action that adds element X, as this is more likely to obtain nodes with higher potential scores, thereby improving search efficiency and quality.

[0054] In the simulation steps of the Monte Carlo tree search process, the value evaluation of a node, i.e., the potential score of the node, is determined based on the Euclidean distance between the feature vectors corresponding to the combined elements of the node and the abnormal feature vectors. Furthermore, the potential scores of the elements or combinations of elements that serve as the root node are also determined based on the Euclidean distance.

[0055] In some embodiments of this application, the potential score of each node simulation is determined by the following expression: Potential Score is the potential score. The feature vector corresponding to the node combination element is determined by the corresponding data in the acquired multi-dimensional data. The feature vector of the abnormal network state can be determined by prediction information or data obtained under the actual abnormal network state; The feature vectors of a normal network state can be determined from normal network quality data.

[0056] In the above expression, The smaller the value, the closer the combined elements are to the combination of causes leading to network anomalies, and correspondingly, the higher the potential score. The smaller the value, the closer the combined elements are to a normal network, and the lower the potential score will be.

[0057] It is understandable that the above expression, based on the feature vectors of the abnormal network state, also introduces the feature vectors of the normal network state to calculate the Euclidean distance between them and the combined elements, thereby evaluating the potential score and facilitating a more accurate evaluation of the combined elements. In some embodiments, the potential score can also be determined solely based on the Euclidean distance between the feature vectors of the combined elements and the feature vectors of the abnormal network state.

[0058] It is important to emphasize that the expression for calculating the potential score mentioned above is the initial potential score of the node. During the Monte Carlo tree search process, after expanding new nodes for simulation, backtracking is performed to update the value assessment of the node. That is, the potential score of the parent node is updated based on the child node. When the Monte Carlo tree search iteration reaches the preset number of iterations, the final potential score is the benchmark for judgment. In other words, the final potential score of the element or combination of elements in the original data cube as the root node after the Monte Carlo tree search ends is the benchmark for judgment.

[0059] In some implementations of this application, the potential score can be determined not only based on Euclidean distance, but also based on cosine similarity, Manhattan distance, etc.

[0060] In some embodiments of the network anomaly analysis method of this application, the reward value is determined by an expression: in, The reward value for performing action a on node s; The average score of the elements; The mean of the path scores; As a weighting factor; This represents the number of times action a is selected from state s during the Monte Carlo tree search process; This is an adjustable parameter.

[0061] When determining the reward value of an action, a weighting factor is used to balance the local value of the new element corresponding to the action (i.e., the mean path score) with the global value of the new element (i.e., the mean element score). When an action is explored infrequently, the weighting factor tends to favor the global mean element score, using prior knowledge for guidance. As the number of explorations increases, the weighting factor gradually shifts towards the more accurate local mean path score. This dynamic balancing mechanism of the weighting factor allows for better decision-making in both the early and later stages of the search, improving search accuracy and efficiency.

[0062] This application, based on the introduction of the element score mean to represent the global value of an element, further dynamically adjusts the importance of the element score mean and the path score mean according to the search progress through weight factors. Compared with simply adding the two scores or using fixed weights, it can adaptively adjust according to the search progress, avoiding excessive searching for elements with high global value but low local value due to the influence of global value, which is conducive to further improving search efficiency and quality.

[0063] In some embodiments of the network anomaly analysis method of this application, during the Monte Carlo tree search process, the action selected for the search is determined based on the action score, which is determined by the expression: Among them, the The action selected for the search; state The set of all legal and selectable actions; argmax indicates selecting the action with the maximum value. The reward value for the action; For nodes Number of selections; It is an action From state The number of times it was selected; As an adaptive exploration factor, following It decreases as it increases.

[0064] In the Monte Carlo tree search process, when selecting a search path, the action selection considers not only the reward value but also the number of times the node and action have been selected, to avoid overlooking unexplored paths. Based on the above formula, and combining the reward value and selection count of each action, an action score is determined, and the action with the highest score is selected to form the search path. The adaptive exploration factor decreases as the number of times a node is selected increases, weakening actions with excessive selection counts to avoid overexploration. A larger exploration factor for nodes with fewer selection counts encourages deeper and more comprehensive searches. This makes the search process more intelligent, avoiding oversearching in already fully searched areas and improving overall search efficiency.

[0065] In some embodiments of this application, the adaptive exploration factor can decrease linearly as the number of node selections increases, or the adaptive exploration factor can decrease based on the curve corresponding to the preset change function as the number of node selections increases.

[0066] It should be noted that, compared to fixed exploration factors, adaptive exploration factors can make the search process more flexible and efficient, automatically balancing the ratio of exploration to utilization based on the amount of information already obtained.

[0067] In some embodiments of a network anomaly analysis method of this application, step S300 includes: Based on the network quality data, a network quality sequence is determined based on time variations, and the mean and standard deviation of the network quality sequence are calculated. The threshold range is determined based on the mean and the standard deviation. By comparing the predicted information with the threshold range, it is determined whether the predicted information exceeds the threshold range.

[0068] Based on historical and current network quality parameters, a time series, or network quality sequence, is generated, and its mean and standard deviation are calculated. The mean reflects the parameter values ​​under normal network conditions, while the standard deviation reflects the normal fluctuation range of these values. Using the mean as a benchmark and the standard deviation as a reference, a threshold range based on the actual network conditions is determined. Because the threshold range is dynamically determined based on its current and historical normal fluctuation range, it can adapt to normal fluctuations in different time periods and for different indicators, thereby effectively reducing false alarms caused by fixed thresholds and improving accuracy.

[0069] In some embodiments of this application, the threshold range can be determined based on the mean combined with three times the standard deviation fluctuation, assuming the mean is... The standard deviation is The lower threshold of the threshold range is The upper threshold of the threshold range is .

[0070] refer to Figure 2 In some embodiments of a network anomaly analysis method of this application, after S500, the method further includes: S600: Obtain the actual solution information corresponding to the network anomaly cause information; S610: When it is determined that the network anomaly cause information is incorrect based on the actual solution information, the actual cause information, the network anomaly cause information, and the corresponding processing parameter information are recorded to form an error sample dataset. S620: Based on the error sample dataset, obtain decision adjustment rule information, which is used to adjust the algorithm parameters of the root cause analysis algorithm according to the characteristics of the multi-dimensional data; The actual cause information is determined by the actual solution information, and the processing parameter information is determined by the parameters of the root cause analysis algorithm.

[0071] Considering that root cause analysis algorithms cannot pinpoint the exact cause of network anomalies, this application introduces a self-optimizing feedback adjustment process to improve the accuracy of cause localization. When the given network anomaly cause information is proven incorrect by subsequent actual solution information, the analysis result of this error, the corresponding processing parameters used, and the actual cause information determined based on the actual solution information are recorded as an error sample. This error sample dataset is formed by accumulating these error samples. Based on the error sample dataset, decision adjustment rules are obtained to automatically adjust the parameters of the root cause analysis algorithm according to the characteristics of the input multi-dimensional data during subsequent root cause analysis, thereby improving the accuracy of root cause analysis.

[0072] Thus, through self-optimizing feedback adjustment, the parameters of the root cause analysis algorithm are not fixed, but can be dynamically optimized according to the characteristics of the acquired multi-dimensional data, thereby continuously improving its accuracy and robustness in locating the causes of network anomalies in various complex scenarios.

[0073] In some embodiments of this application, the processing parameters may include adjustable parameters. Adaptive exploration factor Based on the error sample dataset, analysis is performed on the combined elements corresponding to the actual causes. Referring to the characteristics of multi-dimensional data, the appropriate parameter adjustment strategy is determined, such as "enhanced exploration," "deepened search," or "adjustment of adjustable parameters." "Emphasis" allows the root cause analysis algorithm to obtain the combination elements corresponding to the actual causes, thereby determining the adjustment strategy. Then, based on the characteristics of the multi-dimensional data and the corresponding adjustment strategy, error samples are assigned category labels. A decision tree model is trained based on the error sample dataset, with each training sample in the format: {feature vector of multi-dimensional data, corresponding adjustment strategy}. In some embodiments, the decision tree algorithm can choose the ID3 algorithm. During training, pruning operations are used to prevent overfitting and improve the model's generalization ability. The trained decision tree model can reflect the adjustment of the algorithm parameters of the root cause analysis algorithm based on the characteristics of the multi-dimensional data. Based on the path formation conditions of the nodes in the decision tree, the child nodes reached by the path are used as conditional results. The decision tree model is converted into conditional judgment rules, such as the IF-THEN rule. Before executing the root cause analysis algorithm, the conditional judgment rules are executed to determine the algorithm parameters. For example, if (IF) the number of elements in the data cube exceeds 3, then (THEN) sets the maximum number of search iterations to 1.5 times the default parameter value.

[0074] refer to Figure 2 In some embodiments of the network anomaly analysis method of this application, it further includes: S700: Construct a network anomaly knowledge base based on the anomaly alarm information, the network anomaly cause information, and the actual solution information; S710: Generate causal relationship graph information based on the network anomaly knowledge base, wherein the causal relationship graph information represents the causal relationship between fault records, anomaly indicators, anomaly causes, and solutions; S720: In response to user query information, determine a query feature vector based on the user query information; S730: Based on the query feature vector, retrieve the causal relationship graph information and obtain matching node information; S740: Generate reply text information based on the matching node information.

[0075] A network anomaly knowledge base is constructed using historical anomaly alerts, network anomaly cause information, and actual solution information. From this knowledge base, a causal relationship graph representing the relationships between fault records, anomaly indicators, anomaly causes, and solutions is extracted. When a user queries a network anomaly, the system responds by converting the query content into a query feature vector. This vector is then searched within the causal relationship graph to find matching nodes, and a natural language response text is generated based on this node information. In this way, network anomaly analysis data and experience are transformed into a structured anomaly knowledge base, and further, a causal relationship graph is generated to reflect the causal relationships between fault records, anomaly indicators, anomaly causes, and solutions. This allows for matching corresponding causal chains based on query feature vectors. Compared to simply comparing historical faults with similar symptoms, this effectively filters out interfering cases where network anomalies appear similar but have different underlying causes. Finally, based on the solutions matched to the causal relationships, a response text is generated, providing users with more accurate solutions that pinpoint the root cause of network anomaly problems.

[0076] In some implementations of this application, domain expert knowledge data can be incorporated into the construction of the network anomaly knowledge base, i.e., domain expert knowledge data can be added to the network anomaly knowledge base.

[0077] refer to Figure 4In some embodiments of this application, causal knowledge defined by domain experts can be incorporated into the construction of the causal relationship graph to determine more reliable and accurate causal relationships. In some embodiments, data mining can also be used to collect time-series data of a batch of abnormal indicators, analyze the pairwise relationships between sequences, establish a vector autoregression (VAR) model, construct a Granger causality test, and thus discover causal relationships between key network indicators. Wherein, if the expert's judgment contradicts the results of data mining analysis, the expert's judgment prevails; if both analyses support the same causal relationship, a weighted average is used to fuse their confidence levels. Based on the causal relationships obtained above, causal relationship edges connecting related entity nodes are established in the causal relationship graph.

[0078] In some embodiments of this application, graph index vectors can be embedded in the causal relationship graph to improve retrieval efficiency.

[0079] refer to Figure 5 In some embodiments of this application, the query feature vector is determined based on the user query information. This can be achieved by analyzing the user query information, typically in natural language, using a Large Language Model (LLM) model to extract key entities (i.e., network indicator anomalies) and query intent (generally seeking the cause of similar historical network anomalies). The embedding vector of the user query text is calculated, and then a similarity search is performed in the text embedding index to find seed nodes. The k-hop Neighbors algorithm is applied to explore and expand the causal relationship graph to collect richer contextual information. For the currently occurring network anomaly queried by the user, the nodes and edges in the causal relationship graph that correspond to the anomaly are checked to form a candidate set. A simple causal relationship score is given based on the number of matched causal factors, and the score can use the following weighted formula: in, This represents the final weighted causal relationship score. and These represent the weights of the similarity score and the causal relationship score, respectively.

[0080] Based on causal relationship scoring, the candidate set is reordered and deduplicated, selecting the top 5 historical network anomaly failures and related texts as target information. Combining the enriched contextual information and target information with the original user query information, a large language model is used to generate response text, providing a hypothetical cause of the network anomaly and offering corresponding solutions.

[0081] In some embodiments of this application, as new faults are processed and recorded in the network anomaly knowledge base, the embedding of the causal relationship graph and graph index vector is updated periodically or in real time, and iterative optimization is performed using feedback data and new data.

[0082] The following describes a network anomaly analysis device provided in this application. The network anomaly analysis device described below can be referred to in correspondence with the network anomaly analysis method described above.

[0083] This application also provides a network anomaly analysis device, comprising: The acquisition module is used to acquire network quality data, which includes current network quality parameters and historical network quality parameters. The prediction module is used to input the network quality data into the prediction model and obtain the output prediction information. The prediction model is used to predict future network quality parameters. An anomaly detection module is used to determine whether the prediction information exceeds a threshold range based on the network quality data and the prediction information. The threshold range is determined by the network quality data. When it is determined that the prediction information exceeds the threshold range, an anomaly alarm message is generated. The anomaly analysis module is used to obtain network anomaly cause information based on the anomaly alarm information and the root cause analysis algorithm. The root cause analysis algorithm scores different combinations of causes and, based on Monte Carlo tree search and fast action value estimation strategies, determines the combination of causes most likely to cause network anomalies.

[0084] The acquisition module gathers network quality data, including current and historical parameters. The prediction module uses a prediction model to predict future network quality parameters, obtaining prediction information. The anomaly detection module compares the predicted information with a threshold range dynamically determined by the network quality data itself to determine whether future network quality changes are within the normal range, thus identifying any network anomalies. When the predicted information exceeds the threshold range, the anomaly detection module generates an anomaly alarm. The anomaly analysis module processes the anomaly alarm information using a root cause analysis algorithm. This algorithm employs Monte Carlo tree search and a fast action value estimation strategy, scoring different combinations of causes to determine the most likely combination leading to the network anomaly, thereby generating network anomaly cause information to characterize the root cause of the network anomaly.

[0085] In this way, by predicting whether the network quality exceeds the threshold range, the network anomaly can be detected in a timely manner. At the same time, by using Monte Carlo tree search combined with a fast action value estimation strategy, a scoring mechanism is used to determine the combination of causes most likely to cause the network anomaly, thereby automatically locating the root cause of the network anomaly and improving the efficiency of network anomaly analysis.

[0086] In some embodiments of the network anomaly analysis device of this application, it further includes: An adaptive optimization module is used to obtain decision adjustment rule information based on the error sample dataset. The decision adjustment rule information is used to adjust the algorithm parameters of the root cause analysis algorithm according to the characteristics of the multi-dimensional data. The information maintenance module is used to build a network anomaly knowledge base based on the anomaly alarm information, the network anomaly cause information, and the actual solution information; The question-and-answer module is used to determine the query feature vector based on the user's query information, retrieve causal relationship graph information based on the query feature vector, obtain matching node information, and generate reply text information based on the matching node information.

[0087] Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6 As shown, the electronic device may include a processor 810, a communications interface 820, a memory 830, and a communication bus 840. The processor 810, communications interface 820, and memory 830 communicate with each other via the communication bus 840. The processor 810 can call logical instructions stored in the memory 830 to execute the aforementioned network anomaly analysis method.

[0088] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0089] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute a network anomaly analysis method provided by the above methods.

[0090] In another aspect, this application also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, is implemented to perform a network anomaly analysis method provided by the methods described above.

[0091] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0092] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0093] In the description of this application, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0094] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0095] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A network anomaly analysis method, characterized in that, include: Obtain network quality data, which includes current network quality parameters and historical network quality parameters; The network quality data is input into the prediction model to obtain the output prediction information. The prediction model is used to predict future network quality parameters. Based on the network quality data and the prediction information, it is determined whether the prediction information exceeds a threshold range, wherein the threshold range is determined by the network quality data; When the predicted information exceeds the threshold range, an abnormal alarm message is generated; Based on the abnormal alarm information, the root cause analysis algorithm is used to obtain information about the cause of the network abnormality. The root cause analysis algorithm scores different combinations of causes and, based on Monte Carlo tree search and a fast action value estimation strategy, determines the combination of causes most likely to cause network anomalies.

2. The network anomaly analysis method according to claim 1, characterized in that, The step of obtaining network anomaly cause information based on the abnormal alarm information and root cause analysis algorithm includes: Based on the abnormal alarm information, determine the abnormal time and obtain the corresponding multi-dimensional data, which includes various data related to network quality. Based on the multi-dimensional data and the root cause analysis algorithm, the combination of causes most likely to cause network anomalies is determined, and the network anomaly cause information is generated.

3. The network anomaly analysis method according to claim 2, characterized in that, The root cause analysis algorithm includes: Based on the multi-dimensional data, a hierarchical dataset is constructed, which includes multiple data groups. Each data group includes at least one data cube. The data cube includes an element with one dimension or a combination of elements with at least two dimensions. The number of dimensions of the combination elements in the upper layer is greater than the number of dimensions of the combination elements in the lower layer. Using the data group in the first layer as the current processing group, for each data cube in the current processing group, the potential score of the element or the combination of elements is evaluated based on Monte Carlo tree search and a fast action value estimation strategy. Based on the potential score, prune the data group in the layer above the current processing group to remove the elements or the combination elements whose potential scores are lower than the lower threshold, and take the data group in the layer above as the current processing group until there is a potential score greater than the end scoring threshold or the data groups of all layers are traversed. Based on the element or combination of elements corresponding to the maximum potential score, determine the combination of causes most likely to cause network anomalies, and generate the network anomaly cause information.

4. The network anomaly analysis method according to claim 3, characterized in that, For each data cube in the current processing group, the potential score of the element or the combination of elements is evaluated based on Monte Carlo tree search and a fast-action value estimation strategy, including: Based on the data cube, using the elements or combinations of elements therein as nodes and combining newly added elements as an action, a Monte Carlo tree search is performed to determine the potential score of the node. The potential score is obtained based on the Euclidean distance between the feature vector corresponding to the element or the combination of elements and the abnormal feature vector. In the Monte Carlo tree search process, the reward value corresponding to the action is determined by the mean path score and the mean element score. The mean path score represents the average score of each child node in the subsequent path of the action, and the mean element score represents the average score of the newly added element in each node.

5. The network anomaly analysis method according to claim 4, characterized in that, The reward value is determined by the expression: in, The reward value; The average score of the elements; The mean of the path scores; As a weighting factor; This represents the number of times action a is selected from state s during the Monte Carlo tree search process; This is an adjustable parameter.

6. The network anomaly analysis method according to claim 4, characterized in that, In the Monte Carlo tree search process, the action selected for the search is determined based on the action score, which is determined by the expression: Among them, the The action selected for the search; state The set of all legal and selectable actions; argmax indicates selecting the action with the maximum value. The reward value for the action; For nodes Number of selections; It is an action From state The number of times it was selected; As an adaptive exploration factor, following It decreases as it increases.

7. The network anomaly analysis method according to claim 1, characterized in that, The step of determining whether the prediction information exceeds a threshold range based on the network quality data and the prediction information includes: Based on the network quality data, a network quality sequence is determined based on time variations, and the mean and standard deviation of the network quality sequence are calculated. The threshold range is determined based on the mean and the standard deviation. By comparing the predicted information with the threshold range, it is determined whether the predicted information exceeds the threshold range.

8. The network anomaly analysis method according to claim 2, characterized in that, After obtaining the network anomaly cause information, the process also includes: Obtain the actual solution information corresponding to the network anomaly cause information; When it is determined that the network anomaly cause information is incorrect based on the actual solution information, the actual cause information, the network anomaly cause information, and the corresponding processing parameter information are recorded to form an error sample dataset. Based on the error sample dataset, decision adjustment rule information is obtained, which is used to adjust the algorithm parameters of the root cause analysis algorithm according to the characteristics of the multi-dimensional data. The actual cause information is determined by the actual solution information, and the processing parameter information is determined by the parameters of the root cause analysis algorithm.

9. A network anomaly analysis method according to claim 8, characterized in that, Also includes: A network anomaly knowledge base is constructed based on the anomaly alarm information, the network anomaly cause information, and the actual solution information. Based on the network anomaly knowledge base, a causal relationship graph is generated, which represents the causal relationship between fault records, anomaly indicators, anomaly causes, and solutions. In response to user query information, a query feature vector is determined based on the user query information; Based on the query feature vector, retrieve the causal relationship graph information and obtain matching node information; Based on the matching node information, a reply text message is generated.

10. A network anomaly analysis device, characterized in that, include: The acquisition module is used to acquire network quality data, which includes current network quality parameters and historical network quality parameters. The prediction module is used to input the network quality data into the prediction model and obtain the output prediction information. The prediction model is used to predict future network quality parameters. An anomaly detection module is used to determine whether the prediction information exceeds a threshold range based on the network quality data and the prediction information. The threshold range is determined by the network quality data. When it is determined that the prediction information exceeds the threshold range, an anomaly alarm message is generated. The anomaly analysis module is used to obtain network anomaly cause information based on the anomaly alarm information and the root cause analysis algorithm. The root cause analysis algorithm scores different combinations of causes and, based on Monte Carlo tree search and fast action value estimation strategies, determines the combination of causes most likely to cause network anomalies.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a network anomaly analysis method as described in any one of claims 1 to 9.

12. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements a network anomaly analysis method as described in any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements a network anomaly analysis method as described in any one of claims 1 to 9.

Images