Abnormal positioning method and device for long-distance transmission network, storage medium and product
By combining a multi-dimensional network evaluation model with Merkle trees, the problem of low efficiency in network anomaly localization in long-distance data transmission networks is solved, enabling fast and accurate anomaly detection and response.
Patent Information
- Application Number
- CN202511467127.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-14
- Publication Date
- 2026-02-13
AI Technical Summary
Network anomalies occur frequently in long-distance data transmission networks. Existing positioning methods rely on manual, black-box, trial-and-error troubleshooting, which is inefficient and difficult to respond quickly.
A multi-dimensional network evaluation model is adopted to determine the baseline traffic range by generating sub-networks and judging the authenticity of network device samples. Merkle trees are used for real-time anomaly localization, and maintenance strategies are recommended in combination with historical knowledge base.
It improves the efficiency of network anomaly location, enables rapid response to network anomalies, and ensures the continuity and integrity of data transmission.
Smart Images
Figure CN121530833A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of cloud computing technology, and in particular to a method, device, storage medium, and product for anomaly localization in long-distance transmission networks. Background Technology
[0002] Long-distance data transmission networks are characterized by complex network paths and numerous device nodes compared to ordinary networks. Network anomalies (such as transmission delays and data packet loss) occur frequently during data transmission, which seriously affect data transmission efficiency and data integrity.
[0003] Existing methods for locating network anomalies mainly rely on manual, black-box, trial-and-error troubleshooting, adjusting device configurations one by one to pinpoint the problem. This method is time-consuming, labor-intensive, inefficient, and unable to respond quickly to network anomalies. Summary of the Invention
[0004] To address the aforementioned issues, this disclosure provides a method, device, storage medium, and product for anomaly localization in long-distance transmission networks.
[0005] According to a first aspect of the present disclosure, an anomaly localization method for a long-distance transmission network is provided, the method comprising: The first sample corresponding to each network device in the long-distance transmission network is input into the generation subnetwork in the multi-dimensional network evaluation model to generate the second sample corresponding to each network device. The authenticity of the second sample is determined based on the discrimination subnetwork. The first sample includes device features determined by the device information of the network device and network configuration features determined by the network configuration information of the network device. The second sample includes the traffic features of the network device. The multi-dimensional network evaluation model is trained based on the device information, network configuration information and traffic information of each network device collected from the long-distance transmission network. Based on the set of second samples that are determined to be true by each network device, the baseline traffic range corresponding to each network device is determined respectively; Based on the real-time traffic information collected by each network device in the long-distance transmission network, and the baseline traffic range corresponding to each network device, abnormal network devices are identified.
[0006] In one embodiment, the device features include at least one of the following: device ID, device IP address, service port, device type, device hardware configuration, and device software configuration; The network configuration features include at least one of the following: detection type, associated device, and associated device anomaly type, wherein the detection type includes: driver detection, network card detection, protocol detection, and network latency detection.
[0007] In one implementation, the generating subnetwork includes an autoencoder and a decoder; The autoencoder is used to transform the sample vector of the first sample into a latent space vector; The decoder is used to reverse map the latent spatial vector back to the original spatial vector to generate the second sample, which includes network device features, network configuration features, and traffic range features of each network device. The generated subnetwork is trained and converged using the mean squared error loss function.
[0008] In one implementation, the discriminant subnetwork includes a binary classification neural network; The binary classification neural network is used to determine the authenticity of the second sample based on the device configuration data and device traffic data of the real network. The discriminant subnetwork uses a binary cross-entropy loss function to measure the discrimination accuracy.
[0009] In one implementation, the multidimensional network evaluation model is trained by an adversarial network based on the generative subnetwork and the discriminative subnetwork.
[0010] In one implementation, determining the baseline traffic range corresponding to each network device based on the set of second samples determined to be true by each network device includes: The feature distribution of the traffic range characteristics of each network device in the set of the second samples that are judged as true is statistically analyzed, and the mean and standard deviation of the traffic range characteristics of each network device are obtained. Based on the mean and the standard deviation, the baseline traffic range corresponding to each network device is determined.
[0011] In one implementation, determining abnormal network devices based on real-time traffic information collected by each network device in the long-distance transmission network and the corresponding baseline traffic range of each network device includes: A Merkle tree is constructed based on the information set of the baseline traffic range corresponding to each network device. The Merkle tree is then used to locate anomalies based on the real-time traffic information collected by each network device in the long-distance transmission network, thereby identifying the abnormal network device. In this Merkle tree, the nodes represent the baseline traffic range corresponding to each segment of network devices, and the connection relationship between the nodes represents the hierarchical structure relationship between the parent node and the child node. The child node is the baseline traffic range corresponding to the child segment network devices of the parent node.
[0012] In one embodiment, the method further includes: The location results of the abnormal network devices are verified, and the verification results are fed back to the multi-dimensional network evaluation model to achieve continuous optimization of the multi-dimensional network evaluation model.
[0013] In one embodiment, the method further includes: Network maintenance strategies are recommended based on historical knowledge bases, and these strategies include at least one of the following: driver upgrade, network card replacement, protocol adjustment, or routing optimization.
[0014] According to a second aspect of the present disclosure, an anomaly location device for a long-distance transmission network is provided, the device comprising: The generation module is used to input the first sample corresponding to each network device in the long-distance transmission network into the generation sub-network of the multi-dimensional network evaluation model to generate the second sample corresponding to each network device, and to determine the authenticity of the second sample based on the discrimination sub-network. The first sample includes device features determined by the device information of the network device and network configuration features determined by the network configuration information of the network device. The second sample includes the traffic features of the network device. The multi-dimensional network evaluation model is trained based on the device information, network configuration information and traffic information of each network device collected from the long-distance transmission network. The first determining module is used to determine the baseline traffic range corresponding to each network device based on the set of second samples that are determined to be true for each network device. The second determining module is used to determine abnormal network devices based on the real-time traffic information collected by each network device in the long-distance transmission network and the baseline traffic range corresponding to each network device.
[0015] According to a third aspect of the present disclosure, an electronic device is provided, comprising: A memory on which computer programs are stored; A processor for executing the computer program in the memory to implement the steps of the method of any one of the first aspects.
[0016] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the method described in any of the first aspects.
[0017] According to a fifth aspect of the present disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the method described in any one of the first aspects.
[0018] The embodiments disclosed herein achieve the following beneficial effects: by inputting the first sample corresponding to each network device in the long-distance transmission network into the generating subnetwork of the multi-dimensional network evaluation model, a second sample corresponding to each network device is generated, and the authenticity of the second sample is determined based on the discriminant subnetwork; then, based on the set of second samples determined to be true for each network device, the baseline traffic range corresponding to each network device is determined; finally, the traffic information collected in real time by each network device in the long-distance transmission network is compared with the baseline traffic range corresponding to each network device to identify abnormal network devices. Compared with existing network anomaly localization methods that mainly rely on manual black-box trial-and-error troubleshooting and locate problems by adjusting device configurations one by one, this method greatly improves the efficiency of network anomaly localization and makes rapid response to network anomalies possible.
[0019] Other features and advantages of this disclosure will be described in detail in the following detailed description section. Attached Figure Description
[0020] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a flowchart of an anomaly localization method for a long-distance transmission network provided in one embodiment of this disclosure.
[0021] Figure 2 This is a flowchart of an anomaly localization method for a long-distance transmission network provided in one embodiment of this disclosure.
[0022] Figure 3a This is a flowchart of an anomaly localization method for a long-distance transmission network provided in one embodiment of this disclosure.
[0023] Figure 3b This is a schematic diagram of a vector data structure of a network vector library provided in one embodiment of this disclosure.
[0024] Figure 3c This is a schematic diagram of a Merkle tree provided in one embodiment of the present disclosure.
[0025] Figure 4 This is a flowchart of an anomaly localization method for a long-distance transmission network provided in one embodiment of this disclosure.
[0026] Figure 5 This is a flowchart of an anomaly localization method for a long-distance transmission network provided in one embodiment of this disclosure.
[0027] Figure 6 This is a block diagram of an anomaly location device for a long-distance transmission network provided in one embodiment of the present disclosure.
[0028] Figure 7 This is a block diagram of an electronic device provided in one embodiment of the present disclosure. Detailed Implementation
[0029] The specific embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit this disclosure.
[0030] It should be understood that the term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the following description.
[0031] It should be noted that the concepts of "first," "second," etc., mentioned in this disclosure are used only to distinguish different devices, modules, or units, and are not used to limit the order of functions performed by these devices, modules, or units or their interdependencies. The modifiers "a" and "a plurality of" mentioned in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless explicitly stated in the context, they should be understood as "one or more." In the description of this disclosure, unless otherwise stated, "a plurality of" means two or more, and other quantifiers are similar; "at least one," "one or more," or similar expressions refer to any combination of these items, including any combination of single or multiple items.
[0032] Although operations or steps are described in a specific order in the accompanying drawings in the embodiments of this disclosure, it should not be construed as requiring these operations or steps to be performed in the specific order or serial order shown, or requiring all of the shown operations or steps to be performed to obtain the desired result. In the embodiments of this disclosure, these operations or steps may be performed serially; they may be performed in parallel; or a portion of these operations or steps may be performed.
[0033] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of these messages or information. It is understood that before using the technical solutions disclosed in the embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.
[0034] First, the application scenario of this disclosure will be explained. The applicant has found that when network anomalies occur, existing technologies mainly use a black-box trial-and-error troubleshooting method. Technicians will check and adjust potentially problematic hardware devices, such as network cards, switches, and routers, one by one according to experience or a pre-set troubleshooting sequence. This method is based on the assumption that a certain device failure may be the cause of the network anomaly. After each device adjustment, technicians will observe network behavior to verify whether the anomaly has been resolved. If the problem persists, they will continue to try other possible hardware or network configuration adjustments. Such a method is inefficient and inaccurate in fault location.
[0035] In view of this, the present disclosure provides an anomaly location method, device, storage medium, and product for long-distance transmission networks, aiming to at least partially solve the above-mentioned problems. The present disclosure will now be described in conjunction with specific embodiments.
[0036] Figure 1 This is a flowchart illustrating an anomaly localization method for a long-distance transmission network according to an embodiment of this disclosure. Figure 1 As shown in the figure, this disclosure provides an anomaly localization method for long-distance transmission networks, which may include the following steps: In step S10, the first sample corresponding to each network device in the long-distance transmission network is input into the generation sub-network of the multi-dimensional network evaluation model to generate the second sample corresponding to each network device, and the authenticity of the second sample is determined based on the discrimination sub-network. The first sample includes device features determined by the device information of the network device and network configuration features determined by the network configuration information of the network device. The second sample includes the traffic features of the network device. The multi-dimensional network evaluation model is trained based on the device information, network configuration information and traffic information of each network device collected from the long-distance transmission network.
[0037] In this step, the first sample corresponding to each network device in the long-distance transmission network is input into the generation sub-network of the multi-dimensional network evaluation model to generate the second sample corresponding to each network device. The authenticity of the second sample is determined based on the discrimination sub-network. The first sample includes device features determined by the device information of the network device and network configuration features determined by the network configuration information of the network device. The second sample includes the traffic features of the network device. The multi-dimensional network evaluation model is trained based on the device information, network configuration information and traffic information of each network device collected from the long-distance transmission network.
[0038] In one possible implementation, the device features include at least one of the following: device ID, device IP address, service port, device type, device hardware configuration, and device software configuration.
[0039] The network configuration features include at least one of the following: detection type, associated device, and associated device anomaly type, wherein the detection type includes: driver detection, network card detection, protocol detection, and network latency detection.
[0040] For example, the device characteristics and network configuration characteristics included in the first sample can be shown in Tables 1 and 2 below: Table 1:
[0041] Table 2:
[0042] For example, the data after the above feature encoding is normalized by Min-Max and mapped to the [0,1] interval. Then, all the normalized feature values are concatenated to obtain the sample vector of the first sample.
[0043] The generating subnetwork can be an autoencoder and a decoder, the discriminator subnetwork can be a binary classification neural network, and the second sample can include network device features, network configuration features, and traffic range features of each network device.
[0044] In step S20, based on the set of second samples that are determined to be true by each network device, the baseline traffic range corresponding to each network device is determined.
[0045] In this step, based on the set of second samples where each network device is deemed to be true, the baseline traffic range corresponding to each network device is determined. For example, the characteristic distribution of the traffic range features of each network device in the set of second samples where the data is deemed to be true can be statistically analyzed first to obtain the mean and standard deviation of the traffic range features of each network device. Then, based on the mean and standard deviation, the baseline traffic range corresponding to each network device is determined.
[0046] In step S30, based on the real-time traffic information collected by each network device in the long-distance transmission network and the baseline traffic range corresponding to each network device, abnormal network devices are identified.
[0047] In this step, abnormal network devices are identified based on the real-time traffic information collected by each network device in the long-distance transmission network and the corresponding baseline traffic range for each network device. For example, a Merkle tree can be constructed based on the information set of the baseline traffic range corresponding to each network device, and the Merkle tree can be used to locate anomalies based on the real-time traffic information collected by each network device in the long-distance transmission network, thereby identifying the abnormal network devices.
[0048] This embodiment of the disclosure generates second samples corresponding to each network device in a long-distance transmission network by inputting first samples into the generation subnetwork of a multi-dimensional network evaluation model. The authenticity of the second samples is then determined based on a discrimination subnetwork. Next, a baseline traffic range for each network device is determined based on the set of second samples deemed genuine. Finally, the real-time traffic information collected by each network device in the long-distance transmission network is compared with the baseline traffic range for each network device to identify abnormal network devices. Compared to existing network anomaly localization methods that primarily rely on manual, black-box, trial-and-error troubleshooting by adjusting device configurations one by one, this method significantly improves the efficiency of network anomaly localization, making rapid response to network anomalies possible.
[0049] In one possible implementation, the generating subnetwork may include an autoencoder and a decoder.
[0050] The autoencoder transforms the sample vector of the first sample into a latent space vector. The decoder reverse-maps the latent space vector back to the original space vector to generate the second sample, which includes network device features, network configuration features, and traffic range features of each network device. The generated sub-network is trained and converged using a mean squared error loss function.
[0051] For example, transforming the sample vector x of the first sample into the latent space vector z can be achieved by the following formula: Formula 1 Where W and b are the encoder's weight matrix and bias term, respectively. For activation function, Here, θ is the encoding function, and θ is the encoder parameter.
[0052] The latent space vector z is reverse-mapped back to the original space vector to generate the second sample. This can be achieved using the following formula: Formula 2 in, and These are the weight matrix and bias terms of the decoder. For activation function, This is the decoding function.
[0053] The mean squared error loss function used to generate subnetworks It can be as follows: Formula 3 Where N is the number of training samples (first samples), It is the i-th training sample. It is the corresponding reconstructed sample (second sample). This indicates a search for the norm.
[0054] In one possible implementation, the discriminant subnetwork includes a binary classification neural network. The binary classification neural network is used to determine the authenticity of the second sample based on real network device configuration data and device traffic data. The discriminant subnetwork uses a binary cross-entropy loss function to measure the discrimination accuracy.
[0055] For example, the binary classification cross-entropy loss function used by the discriminant subnetwork. It can be as follows: Formula 4 in, It is the output probability of the discriminant subnetwork for the real sample. These are samples generated by the generative subnetwork. is the label, where the label of the real sample is 1, the label of the pseudo sample generated by the generator subnetwork is 0, and N is the number of samples.
[0056] When the binary classification cross-entropy loss function When the accuracy is less than the set threshold, the discrimination accuracy of the sub-network can be considered to meet the standard.
[0057] In one possible implementation, the multidimensional network evaluation model is trained by an adversarial network based on the generative subnetwork and the discriminative subnetwork.
[0058] For example, the method of forming an adversarial network by combining the generative subnetwork and the discriminative subnetwork and training it can be as follows: Step 1: Alternating training: First, fix the parameters of the generator subnetwork and train the discriminator subnetwork; then fix the parameters of the discriminator subnetwork and train the generator subnetwork.
[0059] Step 2: Update the generating subnetwork: Use the feedback from the discriminant subnetwork to generate samples to update the generating subnetwork, so that the generating subnetwork gradually generates samples that are closer to the real ones.
[0060] Step 3: Loss function balancing: Maintain a loss balance between the generator and discriminator subnetworks to prevent either the generator or discriminator subnetwork from becoming too strong, which could affect the effectiveness of adversarial training.
[0061] By training the discriminator subnetwork and the generator subnetwork adversarially, the generator subnetwork can continuously optimize the quality of the generated samples, making them closer to real data, while improving the discriminator subnetwork's discrimination ability.
[0062] Figure 2This is a flowchart illustrating an anomaly localization method for a long-distance transmission network according to an embodiment of this disclosure. Figure 2 As shown, determining the baseline traffic range for each network device based on the set of second samples deemed true by each network device may include the following steps: In step S201, the feature distribution of the traffic range characteristics of each network device in the set of the second samples that are judged to be true is statistically analyzed, and the mean and standard deviation of the traffic range characteristics of each network device are obtained.
[0063] In this step, the characteristic distribution of traffic range features of each network device in the set of second samples judged as true is statistically analyzed, and the mean of the traffic range features of each network device is obtained. with standard deviation For example, the average traffic range characteristics of each network device. It can be obtained from the following formula: Formula 5 in, Let represent the j-th feature of the i-th sample, and M be the number of second samples that are judged as true.
[0064] Standard deviation of traffic range characteristics of each network device It can be obtained from the following formula: Formula 6 In step S202, the baseline traffic range corresponding to each network device is determined based on the mean and the standard deviation.
[0065] In this step, based on the mean with standard deviation Each network device's baseline traffic range is then determined. For example, the traffic range characteristics can be defined as falling within... The traffic range within the range is determined as the baseline traffic range corresponding to each network device, where k is the confidence level (for example, it can be 1.96, corresponding to a 95% confidence interval).
[0066] Figure 3a This is a flowchart illustrating an anomaly localization method for a long-distance transmission network according to an embodiment of this disclosure. Figure 3a As shown, determining abnormal network devices based on real-time traffic information collected by each network device in the long-distance transmission network and the corresponding baseline traffic range of each network device may include the following steps: In step S301, a Merkle tree is constructed based on the information set of the reference traffic range corresponding to each network device. The Merkle tree is then used to locate anomalies based on the real-time traffic information collected by each network device in the long-distance transmission network, and the abnormal network device is identified. The nodes of the Merkle tree represent the reference traffic range corresponding to each segment of network devices, and the connection relationship between the nodes represents the hierarchical structure relationship between the parent node and the child node. The child node is the reference traffic range corresponding to the child segment network devices of the parent node.
[0067] In this step, a network vector library can first be constructed based on the information set of the baseline traffic range corresponding to each network device. Then, a Merkle tree is constructed based on the network vector library. Next, the real-time traffic information collected by each network device in the long-distance transmission network is compared with the Merkle tree. Finally, abnormal network devices are identified based on the comparison results. The network vector library describes the basic information of each network device, its associated device information, and the baseline traffic range under different states. An exemplary vector data structure of the network vector library can be found by referring to... Figure 3b As shown.
[0068] The data structure example of source device and associated device information in the network vector library can be shown below: Device ID: dev001 Information about the source device: IP address: 192.168.1.10 Device type: Router Associated device information: Associated device ID: dev002 Normal flow rate range: 10M-100M Exception type: Driver error: Flow range: 0M-1M Network card failure: Flow range: 0M Protocol configuration error: Flow range: 0M-10M Packet loss delay: Flow range: 5M-8M Information about associated devices: Device ID: dev002 IP address: 192.168.1.11 Service port: 8080 Device type: Data storage node Normal flow rate range: 10M-100M Exception type: No abnormalities Fault details of associated devices: Driver error: Flow range: 0M-1M Network card failure: Flow range: 0M Protocol configuration error: Flow range: 0M-10M Packet loss delay: Flow range: 5M-8M First, hash values for nodes at each layer can be generated based on the devices and traffic ranges in the network vector library. Then, a tree structure is built from bottom to top to obtain a Merkle tree. In this Merkle tree, nodes represent the baseline traffic range between network devices in each segment, and the connections between nodes represent the hierarchical structure between parent and child nodes. Child nodes represent the baseline traffic range between child network devices of their parent nodes. When new traffic data is detected in real time, the hash value of the corresponding data block can be calculated and compared with the nodes in the Merkle tree. If the hash values are inconsistent or the traffic exceeds the baseline range recorded by the node, the anomaly can be quickly located on which device link the anomaly occurred, and traced back to the upper-level nodes, thus pinpointing the problematic device and the anomaly range in the shortest possible time. Simultaneously, this structure can also be used for backtracking and auditing, ensuring the integrity and consistency of network data during transmission and storage, truly achieving the function of "rapid detection + traceability."
[0069] An exemplary Merkle tree structure can be referenced. Figure 3c As shown, taking the normal (baseline) traffic range between devices A and Z as an example, this range is 10M to 1000M, providing a benchmark to evaluate the traffic performance between devices. By constructing a Merkle tree, the traffic relationships between devices can be managed hierarchically. For example, the traffic range between devices A and M is 100M to 500M, while the traffic range between devices N and Z is 100M to 600M. This structure not only helps to visualize the traffic relationships between devices, but also ensures the integrity and consistency of data through hash value verification, quickly locates abnormal devices, and allows the system to provide real-time feedback and trigger alarms when a device malfunctions, thereby ensuring the efficient and secure operation of the network.
[0070] Figure 4 This is a flowchart illustrating an anomaly localization method for a long-distance transmission network according to an embodiment of this disclosure. Figure 4 As shown, the method may further include the following steps: In step S40, the location results of the abnormal network device are verified, and the verification results are fed back to the multi-dimensional network evaluation model to achieve continuous optimization of the multi-dimensional network evaluation model.
[0071] In this step, the location results of abnormal network devices are verified, and the verification results are fed back to the multi-dimensional network evaluation model to achieve continuous optimization of the multi-dimensional network evaluation model.
[0072] Figure 5 This is a flowchart illustrating an anomaly localization method for a long-distance transmission network according to an embodiment of this disclosure. Figure 5 As shown, the method may further include the following steps: In step S50, a network maintenance strategy is recommended based on the historical knowledge base. The network maintenance strategy includes at least one of the following: driver upgrade, network card replacement, protocol adjustment, or routing optimization.
[0073] In this step, a network maintenance strategy is recommended based on the historical knowledge base. This strategy can include at least one of the following: driver upgrade, network card replacement, protocol adjustment, or routing optimization. For example, depending on the severity of the problem, corresponding emergency response mechanisms, such as data retransmission and link switching, can be automatically triggered to ensure the continuity and integrity of network data transmission.
[0074] Figure 6 This is a block diagram of an anomaly location device for a long-distance transmission network provided in one embodiment of this disclosure. Figure 6 As shown in the figure, this disclosure provides an anomaly location device 600 for long-distance transmission networks. The device 600 may include the following modules: The generation module 610 is used to input the first sample corresponding to each network device in the long-distance transmission network into the generation sub-network of the multi-dimensional network evaluation model to generate the second sample corresponding to each network device, and to determine the authenticity of the second sample based on the discrimination sub-network. The first sample includes device features determined by the device information of the network device and network configuration features determined by the network configuration information of the network device. The second sample includes the traffic features of the network device. The multi-dimensional network evaluation model is trained based on the device information, network configuration information and traffic information of each network device collected from the long-distance transmission network.
[0075] The first determining module 620 is used to determine the baseline traffic range corresponding to each network device based on the set of second samples that are determined to be true by each network device.
[0076] The second determining module 630 is used to determine abnormal network devices based on the real-time traffic information collected by each network device in the long-distance transmission network and the baseline traffic range corresponding to each network device.
[0077] In one possible implementation, the device features include at least one of the following: device ID, device IP address, service port, device type, device hardware configuration, and device software configuration. The network configuration features include at least one of the following: detection type, associated device, and associated device anomaly type, wherein the detection type includes: driver detection, network card detection, protocol detection, and network latency detection.
[0078] In one possible implementation, the generating subnetwork includes an autoencoder and a decoder; The autoencoder is used to transform the sample vector of the first sample into a latent space vector; The decoder is used to reverse map the latent spatial vector back to the original spatial vector to generate the second sample, which includes network device features, network configuration features, and traffic range features of each network device. The generated subnetwork is trained and converged using the mean squared error loss function.
[0079] In one possible implementation, the discriminant subnetwork includes a binary classification neural network; The binary classification neural network is used to determine the authenticity of the second sample based on the device configuration data and device traffic data of the real network. The discriminant subnetwork uses a binary cross-entropy loss function to measure the discrimination accuracy.
[0080] In one possible implementation, the multidimensional network evaluation model is trained by an adversarial network based on the generative subnetwork and the discriminative subnetwork.
[0081] In one possible implementation, the first determining module 620 is further configured to: The feature distribution of the traffic range characteristics of each network device in the set of the second samples that are judged as true is statistically analyzed, and the mean and standard deviation of the traffic range characteristics of each network device are obtained. Based on the mean and the standard deviation, the baseline traffic range corresponding to each network device is determined.
[0082] In one possible implementation, the second determining module 630 is further configured to: A Merkle tree is constructed based on the information set of the baseline traffic range corresponding to each network device. The Merkle tree is then used to locate anomalies based on the real-time traffic information collected by each network device in the long-distance transmission network, thereby identifying the abnormal network device. In this Merkle tree, the nodes represent the baseline traffic range corresponding to each segment of network devices, and the connection relationship between the nodes represents the hierarchical structure relationship between the parent node and the child node. The child node is the baseline traffic range corresponding to the child segment network devices of the parent node.
[0083] In one possible implementation, the device 600 further includes a feedback module for: The location results of the abnormal network devices are verified, and the verification results are fed back to the multi-dimensional network evaluation model to achieve continuous optimization of the multi-dimensional network evaluation model.
[0084] In one possible implementation, the device 600 further includes a strategy recommendation module for: Network maintenance strategies are recommended based on historical knowledge bases, and these strategies include at least one of the following: driver upgrade, network card replacement, protocol adjustment, or routing optimization.
[0085] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.
[0086] The generation module inputs the first sample corresponding to each network device in the long-distance transmission network into the generation subnetwork of the multi-dimensional network evaluation model to generate the second sample corresponding to each network device. The discriminant subnetwork then determines the authenticity of the second sample. Next, the first determination module determines the baseline traffic range for each network device based on the set of second samples deemed true. Finally, the second determination module compares the real-time traffic information collected by each network device in the long-distance transmission network with the baseline traffic range to identify abnormal network devices. Compared to existing network anomaly localization methods that mainly rely on manual, black-box, trial-and-error troubleshooting and adjusting device configurations one by one to locate problems, this method greatly improves the efficiency of network anomaly localization, making rapid response to network anomalies possible.
[0087] Figure 7 This is a block diagram of an electronic device provided in one embodiment of this disclosure. For example... Figure 7 As shown, the electronic device 700 may include a processor 701 and a memory 702. The electronic device 700 may also include one or more of a multimedia component 703, an input / output (I / O) interface 704, and a communication component 705.
[0088] The processor 701 controls the overall operation of the electronic device 700 to complete all or part of the steps in the above-described method for anomaly localization in long-distance transmission networks. The memory 702 stores various types of data to support the operation of the electronic device 700. This data may include, for example, instructions for any application or method operating on the electronic device 700, and application-related data such as contact data, sent and received messages, pictures, audio, video, etc. The memory 702 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. Multimedia component 703 may include a screen and an audio component. The screen may be, for example, a touchscreen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signals may be further stored in memory 702 or transmitted via communication component 705. The audio component also includes at least one speaker for outputting audio signals. I / O interface 704 provides an interface between processor 701 and other interface modules, such as a keyboard, mouse, buttons, etc. These buttons may be virtual or physical buttons. Communication component 705 is used for wired or wireless communication between the electronic device 700 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, 4G, NB-IoT, eMTC, or other 5G technologies, or combinations thereof, is not limited here. Therefore, the corresponding communication component 705 may include: a Wi-Fi module, a Bluetooth module, an NFC module, etc.
[0089] In an exemplary embodiment, the electronic device 700 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above-described anomaly localization method for long-distance transmission networks.
[0090] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, which, when executed by a processor, implement the steps of the above-described anomaly localization method for long-distance transmission networks. For example, the computer-readable storage medium may be the memory 702 including program instructions, which may be executed by the processor 701 of the electronic device 700 to complete the above-described anomaly localization method for long-distance transmission networks.
[0091] In another exemplary embodiment, a computer program product is also provided, comprising a computer program executable by a programmable device, the computer program having a code portion for performing the above-described anomaly location method for long-distance transmission networks when executed by the programmable device.
[0092] The preferred embodiments of this disclosure have been described in detail above with reference to the accompanying drawings. However, this disclosure is not limited to the specific details of the above embodiments. Within the scope of the technical concept of this disclosure, various simple modifications can be made to the technical solutions of this disclosure, and these simple modifications all fall within the protection scope of this disclosure.
[0093] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, this disclosure will not describe the various possible combinations separately.
[0094] Furthermore, various different embodiments of this disclosure can be combined in any way, as long as they do not violate the spirit of this disclosure, they should also be regarded as the content disclosed in this disclosure.
Claims
1. A method for anomaly localization in a long-distance transmission network, characterized in that, The method includes: The first sample corresponding to each network device in the long-distance transmission network is input into the generation subnetwork in the multi-dimensional network evaluation model to generate the second sample corresponding to each network device. The authenticity of the second sample is determined based on the discrimination subnetwork. The first sample includes device features determined by the device information of the network device and network configuration features determined by the network configuration information of the network device. The second sample includes the traffic features of the network device. The multi-dimensional network evaluation model is trained based on the device information, network configuration information and traffic information of each network device collected from the long-distance transmission network. Based on the set of second samples that are determined to be true by each network device, the baseline traffic range corresponding to each network device is determined respectively; Based on the real-time traffic information collected by each network device in the long-distance transmission network, and the baseline traffic range corresponding to each network device, abnormal network devices are identified.
2. The method according to claim 1, characterized in that, The device characteristics include at least one of the following: device ID, device IP address, service port, device type, device hardware configuration, and device software configuration; The network configuration features include at least one of the following: detection type, associated device, and associated device anomaly type, wherein the detection type includes: driver detection, network card detection, protocol detection, and network latency detection.
3. The method according to claim 1, characterized in that, The generating subnetwork includes an autoencoder and a decoder; The autoencoder is used to transform the sample vector of the first sample into a latent space vector; The decoder is used to reverse map the latent spatial vector back to the original spatial vector to generate the second sample, which includes network device features, network configuration features, and traffic range features of each network device. The generated subnetwork is trained and converged using the mean squared error loss function.
4. The method according to claim 1, characterized in that, The discriminant subnetwork includes a binary classification neural network; The binary classification neural network is used to determine the authenticity of the second sample based on the device configuration data and device traffic data of the real network. The discriminant subnetwork uses a binary cross-entropy loss function to measure the discrimination accuracy.
5. The method according to claim 1, characterized in that, The set of second samples determined as true by each network device is used to determine the baseline traffic range corresponding to each network device, including: The feature distribution of the traffic range characteristics of each network device in the set of the second samples that are judged as true is statistically analyzed, and the mean and standard deviation of the traffic range characteristics of each network device are obtained. Based on the mean and the standard deviation, the baseline traffic range corresponding to each network device is determined.
6. The method according to claim 1, characterized in that, The process of identifying abnormal network devices based on real-time traffic information collected by each network device in the long-distance transmission network and the corresponding baseline traffic range of each network device includes: A Merkle tree is constructed based on the information set of the baseline traffic range corresponding to each network device. The Merkle tree is then used to locate anomalies based on the real-time traffic information collected by each network device in the long-distance transmission network, thereby identifying the abnormal network device. In this Merkle tree, the nodes represent the baseline traffic range corresponding to each segment of network devices, and the connection relationship between the nodes represents the hierarchical structure relationship between the parent node and the child node. The child node is the baseline traffic range corresponding to the child segment network devices of the parent node.
7. The method according to claim 1, characterized in that, The method further includes: The location results of the abnormal network devices are verified, and the verification results are fed back to the multi-dimensional network evaluation model to achieve continuous optimization of the multi-dimensional network evaluation model.
8. An electronic device, characterized in that, include: A memory on which computer programs are stored; A processor for executing the computer program in the memory to implement the steps of the method according to any one of claims 1-7.
9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the steps of the method described in any one of claims 1-7.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-7.