A monitoring device communication anomaly detection method and system

Abstract

The application discloses a kind of monitoring equipment communication anomaly detection method and system, it is related to data transmission technical field.The method comprises the following steps: generating packet sequence data according to the continuous data packet sent by monitoring equipment and extracting corresponding micro-envelope parameters;According to the micro-envelope parameters, link fingerprint parameters are generated within a fixed time period, and the link fingerprint parameters record the offset position and offset amplitude;Based on the link fingerprint parameters, the packet concatenation movement comparison of the packet sequence data fed back by multiple receiving nodes is carried out, and sequence linkage deviation information is generated as an abnormality judgment basis;The current link state is calibrated in combination with the sequence linkage deviation information, and the abnormal link position is output.The present application can accurately output the abnormal node position, realize the quantitative labeling of the link abnormal range, thereby greatly improving the precision and efficiency of monitoring network fault diagnosis.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, and in particular to a method and system for detecting communication anomalies in monitoring equipment. Background Technology

[0002] With the widespread deployment of video surveillance systems in security, transportation, and industrial monitoring scenarios, the communication links between front-end monitoring equipment and monitoring platforms are increasingly characterized by high frequency, strong real-time performance, and high concurrency. To ensure the stability of monitoring services, the industry has gradually evolved from traditional link connectivity detection to deep link status analysis methods based on packet behavior characteristics. For example, in recent years, researchers have proposed various models based on parameters such as packet retransmission, timing changes, and traffic disturbances to judge link stability. However, most technologies still remain at the level of detecting single data packets or specific message fields, and cannot extract dynamic features reflecting the health of the link from the micro-rhythmic evolution of continuous data packets. In addition, the analysis of the linkage and spatial consistency of link status in multi-receiving node environments is still insufficient, making it difficult to accurately locate the scope or location of link anomalies.

[0003] CN113645103B discloses a method and apparatus for detecting communication link anomalies between a video surveillance platform and front-end devices. It primarily determines whether the communication link is abnormal by monitoring uplink data packets and identifying whether heartbeat packets or registration packets are in a "retransmission" state. This scheme relies on preset characteristic parameters of heartbeat or registration data packets and makes anomaly judgments by comparing packet header fields, parameter differences, or protocol definitions. While this method can detect anomalies in specific message repetition, the detection logic is highly dependent on protocol fields and lacks universality for all data packets. Furthermore, inferring link anomalies solely from the repetition characteristics of a single data packet lacks characterization of the temporal patterns of continuous data packets, making it impossible to establish a statistical model reflecting micro-level disturbances in the link. Simultaneously, it does not involve cross-node link consistency analysis, therefore it cannot identify the spatial distribution of link anomalies or support precise location of anomalies.

[0004] CN112616012A discloses a control method and monitoring equipment for a monitoring device. This method focuses on anomaly detection and control strategy switching within the monitoring equipment itself. By monitoring the device's internal power status, network connection status, and processor hang-ups, different control strategies are selected to maintain the device's basic functions. Essentially, this solution belongs to the category of device-side self-diagnosis and operating mode management. Its detection object is mainly the device's physical state, and it does not process the structural characteristics of continuous data packets. Therefore, it cannot solve the problem of detecting link quality fluctuations based on changes in data packet sequence behavior, nor can it form link fingerprints for anomaly localization, and it cannot achieve spatial analysis and judgment of multi-node linkage deviations. Summary of the Invention

[0005] In view of the problems existing in the current communication link monitoring technology, this invention is proposed.

[0006] Therefore, the problem to be solved by this invention is how to accurately calibrate the location of abnormal links.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0008] In a first aspect, the present invention provides a method for detecting communication anomalies in monitoring equipment, comprising: generating packet sequence data based on continuous data packets sent by the monitoring equipment and extracting corresponding micro-envelope parameters; generating link fingerprint parameters within a fixed time period based on the micro-envelope parameters, wherein the link fingerprint parameters record the offset position and offset magnitude; performing packet-level linkage comparison on packet sequence data fed back by multiple receiving nodes based on the link fingerprint parameters, and generating sequence linkage deviation information as a basis for anomaly judgment; and calibrating the current link status and outputting the location of the abnormal link in conjunction with the sequence linkage deviation information.

[0009] As a preferred embodiment of the communication anomaly detection method for monitoring equipment described in this invention, the extraction process of the micro-envelope parameters includes: constructing a packet sequence in the data packets continuously output by the monitoring equipment according to the actual arrival order of the data packets, and recording the link arrival rhythm parameter for each data packet; the link arrival rhythm parameter is the actual arrival time interval between adjacent data packets; dividing the packet sequence data into multiple micro-window periods according to a fixed time length, and performing the following steps within each micro-window period: calculating the statistics of all link arrival rhythm parameters within the micro-window period; the statistics include at least the average, maximum, minimum, and standard deviation; combining the calculated statistics into a multi-dimensional vector in a predetermined order and performing normalization processing, and the resulting value is used as the micro-envelope parameter of the micro-window period.

[0010] As a preferred embodiment of the communication anomaly detection method for monitoring equipment described in this invention, the generation of the link fingerprint parameters includes: setting a fixed time period consisting of N consecutive micro-window periods as the current analysis period; extracting N micro-envelope parameters arranged in chronological order within the current analysis period to form an N×D dimensional matrix, where D is the dimension of the micro-envelope parameters; comparing the N×D dimensional matrix element-by-element with a predefined benchmark matrix representing the normal link state; recording the position and difference value of matrix elements whose differences exceed a preset difference threshold in the comparison results; determining the micro-window period in which the offset occurs based on the position, and calculating the offset amplitude based on the difference value; combining the micro-window period number and corresponding offset amplitude value of each offset occurrence into a set of key-value pairs; and serializing all key-value pairs into a string as the link fingerprint parameters for the current analysis period.

[0011] As a preferred embodiment of the communication anomaly detection method for monitoring equipment described in this invention, the determination of the preset difference threshold includes: collecting multiple N×D dimensional matrix samples composed of N micro-envelope parameters during the same period as the current analysis cycle in historical normal communication periods to form a normal sample set; for each element position (i, j) in the N×D dimensional matrix, where i represents the micro-window cycle number (1≤i≤N) and j represents the micro-envelope parameter dimension number (1≤j≤D), performing the following steps: extracting the values ​​of all samples at position (i, j) from the normal sample set to form a normal value sequence at the position; calculating the statistical distribution index of the normal value sequence; the index includes at least the mean and standard deviation; based on the mean, adding the product of the standard deviation and a preset sensitivity coefficient, and using the result as the preset difference threshold at position (i, j); organizing the preset difference thresholds calculated for all positions into a threshold matrix with the same dimension as the N×D dimensional matrix for element-by-element comparison.

[0012] As a preferred embodiment of the communication anomaly detection method for monitoring equipment described in this invention, the packet-level linkage comparison includes: obtaining the link fingerprint parameters corresponding to the current fixed time period, decoding to obtain the first set of offset position and offset magnitude information as a comparison benchmark; within the same fixed time period, obtaining packet sequence data from multiple receiving nodes respectively; for each receiving node, independently extracting envelope parameters, generating N micro-envelope parameters under the same micro-window division, and using the same benchmark matrix and preset difference threshold to generate link fingerprint parameters, and decoding to obtain the second set of offset position and offset magnitude information of the receiving node; calculating the matching degree between the second set of offset position and offset magnitude information of each receiving node and the first set of offset position and offset magnitude information of the comparison benchmark; the matching degree calculation is: comparing the overlapping offset positions in the two sets of information, and performing a weighted summation of the offset magnitude differences at the overlapping offset positions, recording the calculation result as the sequence offset of the receiving node; summing the sequence offsets and node identifiers of all receiving nodes to form the node offset set for the current period.

[0013] As a preferred embodiment of the communication anomaly detection method for monitoring equipment described in this invention, the sequence linkage deviation information includes: calculating the average value and standard deviation of all sequence offsets in the node offset set; for each receiving node in the node offset set, determining whether the sequence offset is greater than the average value + X times the standard deviation, where X is a pre-set sensitivity coefficient; if it is greater, then the corresponding receiving node is marked as an abnormal candidate node, and the node identifier and the specific sequence offset are recorded; the information of all the above abnormal candidate nodes is sorted in descending order of sequence offset to form an ordered list, which is the sequence linkage deviation information.

[0014] As a preferred embodiment of the communication anomaly detection method for monitoring equipment described in this invention, the determination of the abnormal link location includes: determining the top K receiving nodes with the largest sequence offset as abnormal receiving nodes based on the ordered list in the sequence linkage deviation information, where K is a preset value or determined according to the inflection point of the ordered list; outputting the node identifier and corresponding sequence offset of the abnormal receiving node as the abnormal link location marking result.

[0015] Secondly, the present invention provides a monitoring equipment communication anomaly detection system, comprising:

[0016] The packet sequence generation module is used to generate packet sequence data based on the continuous data packets sent by the monitoring equipment and extract the corresponding micro-envelope parameters;

[0017] The fingerprint parameter generation module is used to generate link fingerprint parameters within a fixed time period based on the micro-envelope parameters, wherein the link fingerprint parameters record the offset position and offset magnitude.

[0018] The linkage comparison module is used to perform packet-level linkage comparison of packet sequence data fed back by multiple receiving nodes based on the link fingerprint parameters, and generate sequence linkage deviation information as a basis for anomaly judgment.

[0019] The link calibration module is used to calibrate the current link status and output the location of abnormal links by combining the sequence linkage deviation information.

[0020] Thirdly, the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program instructions are executed by the processor, they implement the steps of the monitoring device communication anomaly detection method as described in the first aspect of the present invention.

[0021] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program instructions are executed by a processor, they implement the steps of the monitoring device communication anomaly detection method as described in the first aspect of the present invention.

[0022] The beneficial effects of this invention are as follows: By micro-windowing the rhythmic characteristics of continuous data packets from monitoring equipment, this invention achieves fine-grained characterization of micro-perturbations in the link, enabling early detection of link quality changes and significantly improving the sensitivity and real-time performance of anomaly detection. By constructing link fingerprint parameters that reflect the offset position and magnitude, this invention achieves a structured expression of link timing anomalies, enhancing the interpretability and stability of anomaly features. Furthermore, by utilizing a packet-level linkage comparison mechanism among multiple receiving nodes, spatial correlation features of link anomalies can be identified from the offset consistency between nodes, improving the reliability and anti-interference capability of anomaly judgment. Through statistical screening of sequence linkage deviations, this invention can accurately distinguish between local and global anomalies in a multi-node environment, effectively reducing the false alarm rate.

[0023] Ultimately, by locating abnormal links based on offset sorting, this invention can accurately output the location of abnormal nodes and achieve quantitative labeling of the abnormal range of links, thereby significantly improving the accuracy and efficiency of fault diagnosis in monitoring networks. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a flowchart of a method for detecting communication anomalies in monitoring equipment.

[0026] Figure 2 This is a structural diagram of a communication anomaly detection system for monitoring equipment. Detailed Implementation

[0027] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0028] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0029] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0030] Figure 1 This is a flowchart of a monitoring device communication anomaly detection method according to an embodiment of the present invention. Figure 1 As shown, the method for detecting communication anomalies in monitoring equipment includes:

[0031] S1: Generate packet sequence data based on the continuous data packets sent by the monitoring equipment and extract the corresponding micro-envelope parameters.

[0032] S1.1: In the data packets continuously output by the monitoring device, construct a packet sequence according to the actual arrival order of the data packets, and record the link arrival rhythm parameters for each data packet.

[0033] Specifically, the receiving end records data packets one by one according to their actual arrival order. Each record includes at least: a reception timestamp, a data packet sequence number (or serial number), a source device identifier, and a packet length. The reception timestamp uses microsecond or millisecond precision, and the time base is uniformly the receiving end's system clock or a calibrated clock source. If the system is a distributed acquisition scenario, a synchronized time base (such as a network time protocol or a higher-precision clock synchronization scheme) is used to eliminate the impact of cross-node clock deviations on subsequent rhythm parameters.

[0034] Furthermore, the link arrival rhythm parameter is the actual arrival time interval between adjacent data packets. By continuously recording this parameter, the original time series reflecting the true time rhythm of the link can be obtained.

[0035] To address packet loss or out-of-order issues, a packet sequence number-based completion check is performed before generating the link arrival rhythm parameters. If a packet sequence number jump is detected, a missing packet is marked in the record, and a placeholder time interval is inserted according to the missing packet segment or an interpolation strategy based on adjacent intervals is adopted to maintain the continuity of the time series. If out-of-order packets are detected, the out-of-order packets are first reordered according to their sequence numbers before the adjacent interval is calculated, and the out-of-order flag is recorded synchronously in the data table.

[0036] The above-mentioned completion and reordering strategies are used to maintain the integrity of the link arrival rhythm parameter sequence and avoid false positive deviations caused by occasional packet loss or forwarding reordering.

[0037] S1.2: Divide the packet sequence data into multiple micro-window periods with a fixed time length. Within each micro-window period, perform the following steps:

[0038] Calculate the statistics of arrival rhythm parameters of all links within the micro-window period and the window boundary timestamps. The statistics include at least the mean, maximum, minimum and standard deviation. The median and interquartile range can be added as needed to enhance robustness to outliers.

[0039] The calculated statistics are combined into a multidimensional vector in a predetermined order (the order of vector fields is predefined in the system configuration to ensure that vectors from different periods can be directly compared and concatenated). To avoid comparison bias caused by differences in the original dimensions, normalization is performed, and the generated result is used as the micro-envelope parameter of the micro-window period.

[0040] The normalization methods include, but are not limited to: sliding interval minimum-maximum scaling based on historical observations or standard deviation normalization based on window groups. The normalization parameters (such as minimum, maximum or standard deviation benchmark) are continuously updated by the system according to the strategy during the initialization or operation phase and recorded in the feature configuration table.

[0041] The division of micro-window periods should balance temporal resolution and statistical stability. This invention adopts a hybrid division strategy based on packet count and time length: each micro-window period is defined by a fixed number of data packets and a maximum time limit. The recommended range for the fixed number of packets is 8 to 64 packets, and the recommended range for the time limit is 50 milliseconds to 2 seconds. Specific values ​​can be configured according to the frame rate of the monitoring device and the link latency level. This hybrid division strategy avoids insufficient samples within the window during low traffic or excessively fine windows leading to noise amplification during high traffic, thus maintaining feature stability in different transmission scenarios.

[0042] Furthermore, to ensure the continuity of cross-period features, a sliding or overlapping window strategy is adopted when dividing the window: for example, the window step size can be set to half of a fixed number of packets or half of a fixed time, so as to create overlapping areas between adjacent windows, thereby improving the ability to capture sudden shifts. For each micro-window period, the set of link arrival rhythm parameters within the window is extracted for subsequent statistical generation.

[0043] As can be seen, this invention, through a bottom-up microscale time series processing flow, starts with the link arrival rhythm parameter, and through micro-window partitioning, local statistical vector construction, and normalization, forms stable micro-envelope parameters rich in structural information. This overcomes the limitations of traditional macroscopic indicators in detecting short-term disturbances and distinguishing noise from real anomalies, significantly improving the detection sensitivity for minor, intermittent, and structural transmission anomalies.

[0044] S2: Generate link fingerprint parameters within a fixed time period based on the micro-envelope parameters, wherein the link fingerprint parameters record the offset position and offset magnitude.

[0045] S2.1: Set a fixed time period consisting of N (the value of N is determined by the deployment scenario, with a typical range of 8 to 128, taking into account factors such as monitoring frame rate, link latency level, and detection time sensitivity) consecutive micro-window periods as the current analysis period; extract N micro-envelope parameters arranged in chronological order within the current analysis period as a row of a matrix to form an N×D dimensional matrix, where D is the dimension of the micro-envelope parameters.

[0046] If a micro-window period is missing or a micro-envelope vector field is missing, it will be handled according to the preset completion strategy (the completion strategy includes using vector copying from adjacent windows, filling with the long-term mean of the same window position in history, or skipping the current period after marking the missing item and recording the missing rate), and the completion identifier will be recorded in the matrix metadata.

[0047] This verification and completion mechanism is used to ensure the basic consistency of subsequent element-by-element comparisons at the level of data comparability, and to provide weight or confidence information for difference judgment.

[0048] S2.2: Compare the N×D matrix element by element with a predefined baseline matrix that represents the normal link state.

[0049] This requires pre-collecting multiple N×D matrix samples with semantically identical meanings from historical normal communication periods and the current analysis period. The sample set should cover typical daily fluctuations to ensure the robustness of the baseline. The baseline matrix can be constructed from the element-wise mean matrix of the sample set, i.e., calculating the mean of the sample set at each position (i, j) as the baseline value. To improve robustness, outlier sample removal (e.g., based on box plots or quantile pruning) can be performed before calculation, and the sample size can be recorded. The baseline matrix is ​​generated from historical samples during the initial system deployment and is updated periodically according to a strategy or triggered by conditions (e.g., sudden changes in the link environment) during operation.

[0050] It should be noted that the element-wise threshold matrix enables the difference determination to have local adaptability, which can apply a more lenient threshold to features that are inherently more volatile at certain locations, thereby imposing strict determination on stable locations, thus significantly reducing noise false alarms while ensuring detection sensitivity.

[0051] S2.3: Record the position and difference value of the matrix element whose difference exceeds the preset difference threshold in the comparison results, determine the micro-window period of the offset based on the position, and calculate the offset amplitude based on the difference value.

[0052] Furthermore, determining the preset difference threshold includes the following steps: Collecting multiple N×D dimensional matrix samples composed of N micro-envelope parameters from the same historical normal communication period as the current analysis cycle, forming a normal sample set. For each element position (i, j) in the N×D dimensional matrix, where i represents the micro-window cycle number (1≤i≤N) and j represents the micro-envelope parameter dimension number (1≤j≤D), the following steps are performed: Extracting the values ​​of all samples at position (i, j) from the normal sample set, forming a normal value sequence at that position. Calculating the statistical distribution index of the normal value sequence; the index includes at least the mean and standard deviation. Based on the mean, adding the product of the standard deviation and a preset sensitivity coefficient, the result is used as the preset difference threshold for position (i, j). Organizing the preset difference thresholds calculated for all positions into a threshold matrix with the same dimension as the N×D dimensional matrix for element-wise comparison.

[0053] To facilitate subsequent serialization and comparison, it is recommended that the offset magnitude be represented in a standardized manner (e.g., normalized to 0–1 or represented as a threshold multiple), and the original difference value and the meaning of the dimension j should be recorded simultaneously. Each offset record is constructed as a key-value pair: the key is the micro-window period number i, and the value is the set of offset items (containing one or more dimension identifiers j and their corresponding magnitude values), and multiple offset dimensions within a single micro-window are aggregated to reduce redundancy.

[0054] It is evident that by comparing elements one by one and verifying short-term consistency, offset events with repeatability or structural significance can be identified, rather than single instantaneous noise. The standardization of offset amplitude and dimension labeling enable the link fingerprint to have clear semantic interpretation capabilities in the subsequent linkage comparison stage, thereby improving the positioning accuracy.

[0055] S2.4: Combine the micro-window period number and the corresponding offset amplitude value of each offset into a set of key-value pairs; and serialize all key-value pairs into a string as the link fingerprint parameter of the current analysis period.

[0056] To balance space compression and readability, the collection can be represented in a structured format using JSON, CBOR, or a custom binary format. Example fields include: fixed period identifier and an array of offset items (each item contains micro-window number, dimension index, magnitude value, original difference value, etc.).

[0057] S3: Based on the link fingerprint parameters, perform packet-level linkage comparison on the packet sequence data fed back by multiple receiving nodes, and generate sequence linkage deviation information as a basis for anomaly judgment.

[0058] S3.1: Packet-level linkage comparison includes the following steps:

[0059] S3.1.1: Obtain the link fingerprint parameters corresponding to the current fixed time period, decode to obtain the first set of offset position and offset magnitude information, and use it as a comparison benchmark.

[0060] First, the format decoding of the link fingerprint parameters associated with the current fixed time period is performed.

[0061] According to the agreed format, each group of micro-window period numbers—offset amplitudes—in the string is parsed into structured key-value pairs, maintaining their chronological order. Its main function is to restore the serialized data to structured data usable for matrix-style comparison, allowing subsequent offset alignment operations to be performed directly on the original micro-window period coordinate system. Without this structured transformation, the offset positions between different receiving nodes, and even between periods within the same node, will not correspond accurately.

[0062] For the decoded key-value pair set, an offset position array and an offset magnitude array are further constructed. This structured process ensures that the comparison benchmark can serve as a unified reference coordinate system for subsequent multi-node offset comparisons, enabling the offset points and offset values ​​generated by each node to be standardized and aligned.

[0063] S3.1.2: Within the same fixed time period, packet sequence data are acquired from multiple receiving nodes respectively. For each receiving node, envelope parameters are extracted independently, generating N micro-envelope parameters under the same micro-window division, ensuring that the multiple receiving nodes are completely identical in parameter dimension, window structure, and matrix arrangement. Using the same baseline matrix and preset difference threshold, element-wise difference judgment is performed on the N×D dimensional matrix of each node, and the matrix position and difference magnitude of the difference exceeding the threshold are recorded. Subsequently, these offset positions and offset magnitude values ​​are encoded into the link fingerprint parameter string of each receiving node, and decoded to obtain the second set of offset position and offset magnitude information of the receiving node.

[0064] S3.1.3: Calculate the matching degree between the second set of offset position and offset magnitude information of each receiving node and the first set of offset position and offset magnitude information of the comparison benchmark.

[0065] The matching degree is calculated by comparing the overlapping offset positions in the two sets of information, and then weighting and summing the differences in offset magnitude at the overlapping offset positions. The calculation result is recorded as the sequence offset of the receiving node.

[0066] Specifically, firstly, the intersection of the offset position array and the reference array is compared, and a set of all overlapping offset positions is counted. This intersection set reflects whether the node and the reference have the same link anomaly trigger point at the time sequence level. Subsequently, the offset magnitude difference is calculated for each overlapping position, and a weighted difference is calculated based on a preset weighting coefficient. The weighted differences of each overlapping position are accumulated to form the sequence offset of the receiving node.

[0067] The larger the sequence offset, the more significant the difference between the receiving node and the benchmark in terms of offset magnitude or offset position consistency. If the offset position of a receiving node does not coincide with the benchmark at all, the default sequence offset increases significantly and it can be regarded as a potential independent anomalous node, so that the sequence offset reflects not only the difference in offset magnitude but also the consistency of offset pattern.

[0068] S3.1.4: Summarize the sequence offsets and node identifiers of all receiving nodes to form the node offset set for the current period.

[0069] S3.2: Based on the node offset set of the current period, perform the following steps to generate sequence linkage deviation information:

[0070] S3.2.1: Calculate the average and standard deviation of all sequence offsets in the node offset set.

[0071] S3.2.2: For each receiving node in the node offset set, determine whether the sequence offset is greater than the average value + X times the standard deviation, where X is a pre-set sensitivity coefficient that can be determined through experience or model training; if it is greater, mark the corresponding receiving node as an abnormal candidate node and record the node identifier and the specific sequence offset.

[0072] S3.2.3: Sort the information of all the above-mentioned abnormal candidate nodes in descending order of sequence offset to form an ordered list, which is the sequence linkage deviation information. The sorted result has higher interpretability: the node with the larger offset is more likely to be a critical node or a damaged node on the abnormal propagation path of the link.

[0073] S4: Combine the sequence linkage deviation information to calibrate the current link status and output the location of the abnormal link.

[0074] Based on the ordered list in the sequence linkage deviation information, the top K receiving nodes with the largest sequence offsets are identified as abnormal receiving nodes, where K is a preset value or determined based on the inflection point of the ordered list.

[0075] If the inflection point method is used to dynamically determine K, it is necessary to detect points of significant slope change on the sequence offset sorting curve. Typically, the inflection point is determined by calculating the difference in the offsets of consecutive sequences and checking if the difference exceeds a preset mutation factor threshold. If the difference exceeds the preset mutation factor threshold, the corresponding i is considered the point where the number of abnormal nodes is determined, i.e., K = i. This operation effectively avoids misjudgments caused by fixing K, allowing the selection of the number of nodes to automatically adapt to different link state characteristics. When a concentrated anomaly occurs in the link, this method can automatically expand the range of abnormal nodes; while when only a small-scale local anomaly occurs in the link, this method can also automatically shrink the set of abnormal nodes, thereby maintaining the accuracy and adaptability of the system's judgment results.

[0076] Output the node identifier and corresponding sequence offset of the abnormal receiving node as the abnormal link location labeling result.

[0077] Although this invention does not rely on a complex dynamic path inference mechanism, it still uses the static position of the corresponding receiving node in the link topology as the calibration basis. This operation ensures that node offset anomalies can be mapped to real physical or logical locations in the link, including the link segment to which it belongs, adjacent nodes, routing path structure, etc., giving the link state calibration a clear spatial positioning function.

[0078] Furthermore, such as Figure 2 As shown, this embodiment also provides a monitoring equipment communication anomaly detection system, including corresponding micro-envelope parameters;

[0079] The fingerprint parameter generation module is used to generate link fingerprint parameters within a fixed time period based on the micro-envelope parameters, wherein the link fingerprint parameters record the offset position and offset magnitude.

[0080] The linkage comparison module is used to perform packet-level linkage comparison of packet sequence data fed back by multiple receiving nodes based on the link fingerprint parameters, and generate sequence linkage deviation information as a basis for anomaly judgment.

[0081] The link calibration module is used to calibrate the current link status and output the location of abnormal links by combining the sequence linkage deviation information.

[0082] This embodiment also provides a computer device applicable to the monitoring equipment communication anomaly detection method, including a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the monitoring equipment communication anomaly detection method proposed in the above embodiment.

[0083] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0084] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements the method for detecting communication anomalies in monitoring equipment as proposed in the above embodiments.

[0085] In summary, the beneficial effects of this invention are as follows: By micro-windowing the rhythmic characteristics of continuous data packets from monitoring equipment, this invention achieves fine-grained characterization of micro-perturbations in the link, enabling early detection of link quality changes and significantly improving the sensitivity and real-time performance of anomaly detection; by constructing link fingerprint parameters that reflect the offset position and magnitude, this invention achieves a structured expression of link timing anomalies, enhancing the interpretability and stability of anomaly features; furthermore, by utilizing a packet-level linkage comparison mechanism among multiple receiving nodes, spatial correlation features of link anomalies can be identified from the offset consistency between nodes, improving the reliability and anti-interference capability of anomaly judgment; through statistical screening of sequence linkage deviations, this invention can accurately distinguish between local and global anomalies in a multi-node environment, effectively reducing the false alarm rate.

[0086] Ultimately, by locating abnormal links based on offset sorting, this invention can accurately output the location of abnormal nodes and achieve quantitative labeling of the abnormal range of links, thereby significantly improving the accuracy and efficiency of fault diagnosis in monitoring networks.

[0087] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for monitoring device communication anomaly detection, the method comprising: The method comprises: ​ generating packet sequence data and extracting corresponding micro-envelope parameters according to continuous data packets sent by a monitoring device; generating link fingerprint parameters in a fixed time period according to the micro-envelope parameters, the link fingerprint parameters recording offset positions and offset amplitudes; performing packet concatenation comparison based on the link fingerprint parameters and packet sequence data fed back by multiple receiving nodes, and generating sequence concatenation deviation information as abnormality judgment basis; combining the sequence concatenation deviation information to calibrate a current link state and output an abnormal link position; the extraction process of the micro-envelope parameters comprises: constructing a packet sequence according to the actual arrival sequence of data packets continuously output by the monitoring device, and recording a link arrival rhythm parameter for each data packet; the link arrival rhythm parameter is the actual arrival time interval between adjacent data packets; dividing the packet sequence data into multiple micro-window periods according to a fixed time length, and performing the following steps in each micro-window period: calculating the statistical quantity of all link arrival rhythm parameters in the micro-window period; the statistical quantity at least includes mean, maximum, minimum and standard deviation; combining the calculated statistical quantity into a multi-dimensional vector according to a predetermined order, and performing normalization processing, the generated result being the micro-envelope parameter of the micro-window period; the generation of the link fingerprint parameters comprises: setting a fixed time period composed of N continuous micro-window periods as a current analysis period; extracting N micro-envelope parameters arranged in time sequence in the current analysis period to form an NxD matrix, wherein D is the dimension of the micro-envelope parameter; performing element-by-element comparison between the NxD matrix and a predefined reference matrix representing a normal link state; recording the positions and difference values of the matrix elements with differences exceeding a preset difference threshold in the comparison result; determining the micro-window period where the offset occurs according to the position, and calculating the offset amplitude according to the difference value; combining the micro-window period number where each offset occurs and the corresponding offset amplitude value into a key-value pair; combining all key-value pairs into a set and serializing it into a string as the link fingerprint parameter of the current analysis period.

2. The monitoring device communication anomaly detection method according to claim 1, wherein the determination of the preset difference threshold comprises: collecting multiple NxD matrix samples composed of N micro-envelope parameters in the same period as the current analysis period in the historical normal communication period to form a normal sample set; for each element position (i, j) in the NxD matrix, wherein i represents the micro-window period sequence number, 1≤i≤N, and j represents the micro-envelope parameter dimension sequence number, 1≤j≤D, perform the following steps: extracting the values of all samples at position (i, j) from the normal sample set to form a normal value sequence at the position; calculating the statistical distribution index of the normal value sequence; the index at least includes mean and standard deviation; adding the product of the standard deviation and a preset sensitivity coefficient to the mean as a result, which is used as the preset difference threshold of the position (i, j); organizing the preset difference thresholds calculated for all positions into a threshold matrix with the same dimensions as the NxD matrix for element-by-element comparison.

3. The monitoring device communication anomaly detection method according to claim 2, characterized by: The packet cascade linkage comparison includes: Obtain the link fingerprint parameters corresponding to the current fixed time period, decode to obtain the first group of offset positions and offset amplitude information as the comparison reference; In the same fixed time period, obtain the respective packet sequence data of each receiving node; for each receiving node, independently perform the extraction of the envelope parameters, generate N micro-envelope parameters under the same micro-window division, and generate the link fingerprint parameters using the same reference matrix and the preset difference threshold, and decode to obtain the second group of offset positions and offset amplitude information of the receiving node; Match the second group of offset positions and offset amplitude information of each receiving node with the first group of offset positions and offset amplitude information of the comparison reference to calculate the matching degree; The matching degree calculation is to compare the overlapping offset positions in the two groups of information, and to perform a weighted summation on the offset amplitude difference of the overlapping offset positions, and to record the calculation result as the sequence offset of the receiving node; Summarize the sequence offsets and node identifiers of all receiving nodes to form the node offset set of the current period.

4. The monitoring device communication anomaly detection method according to claim 3, characterized by: The sequence linkage deviation information includes: Calculate the average and standard deviation of all sequence offsets in the node offset set; For each receiving node in the node offset set, determine whether the sequence offset is greater than the average + X times the standard deviation, where X is a pre-set sensitivity coefficient; if it is greater, mark the corresponding receiving node as an abnormal candidate node, and record the node identifier and the specific sequence offset; Sort all abnormal candidate node information in descending order of sequence offset to form an ordered list, which is the sequence linkage deviation information.

5. The monitoring device communication anomaly detection method according to claim 4, characterized by: The determination of the abnormal link position includes: According to the ordered list in the sequence linkage deviation information, determine the first K receiving nodes with the largest sequence offset as abnormal receiving nodes, where K is a pre-set value or determined according to the inflection point of the ordered list; Output the node identifier and the corresponding sequence offset of the abnormal receiving node as the abnormal link position labeling result.

6. A monitoring device communication anomaly detection system based on any one of the monitoring device communication anomaly detection methods according to claims 1 to 5, characterized in that: Further comprising: A packet sequence generation module for generating packet sequence data and extracting corresponding micro-envelope parameters according to continuous data packets sent by the monitoring device; A fingerprint parameter generation module for generating link fingerprint parameters within a fixed time period according to the micro-envelope parameters, the link fingerprint parameters recording offset positions and offset amplitudes; A linkage comparison module for performing packet cascade linkage comparison on the packet sequence data fed back by multiple receiving nodes based on the link fingerprint parameters, and generating sequence linkage deviation information as an abnormality judgment basis; A link calibration module for calibrating the current link state in combination with the sequence linkage deviation information and outputting the abnormal link position. 7.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is characterized in that: The processor executes the computer program to realize the steps of the monitoring device communication anomaly detection method of any one of claims 1-5.

8. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program is executed by the processor to realize the steps of the monitoring device communication anomaly detection method of any one of claims 1-5.

Images