Distributed network operation and maintenance monitoring method and system based on edge computing architecture
By using edge computing architecture and graph neural networks, the dependencies between nodes can be obtained in real time, which solves the problems of slow response and poor scalability of traditional network operation and maintenance monitoring methods. It achieves efficient and real-time fault detection and accurate location, improving the response speed and accuracy of network operation and maintenance.
Patent Information
- Application Number
- CN202511822131.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-05
- Publication Date
- 2026-02-24
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Existing network operation and maintenance monitoring methods suffer from slow response and low processing efficiency when facing complex distributed networks. They cannot adapt to network changes in real time, resulting in long fault recovery times. Furthermore, their reliance on central node management leads to excessive computational burden and data transmission delays, failing to meet the requirements for efficient and real-time monitoring.
A distributed network operation and maintenance monitoring method based on edge computing architecture is adopted. By using graph neural networks and dynamic pooling operations, the dependency relationships between nodes are obtained in real time. Through graph pooling technology and dynamic parameter adjustment, intelligent network operation and maintenance management is achieved, including steps such as data collection, timestamp alignment, multi-view adjacency matrix generation, node embedding representation, anomaly scoring, and control command generation.
It improves the real-time performance and response speed of network operation and maintenance, optimizes the accuracy of fault diagnosis and anomaly location, enhances the scalability and adaptability of the system, and enables efficient operation and maintenance in a large-scale distributed network environment.
Smart Images
Figure CN121567553A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network operation and maintenance monitoring technology, and in particular to a distributed network operation and maintenance monitoring method and system based on edge computing architecture. Background Technology
[0002] With the rapid development of information technology, modern networks are becoming increasingly complex, especially in distributed systems. The status information of various devices and nodes is interdependent, and the reliability and stability of the network directly affect the overall system performance. Current network operation and maintenance mainly rely on traditional monitoring systems. These systems typically employ static rule-based fault detection methods, identifying faults by monitoring device operating status and traffic data. However, traditional monitoring systems suffer from problems such as slow response times, low processing efficiency, and inability to adapt to real-time network changes. Traditional methods largely rely on preset rules, which cannot effectively cope with complex and ever-changing network environments. Especially in the event of emergencies, they often fail to identify and respond quickly enough, leading to long fault recovery times and impacting business continuity.
[0003] Current network operation and maintenance monitoring methods still rely on static network topology structures and manually set monitoring rules and thresholds for operation and maintenance management. This approach has limitations for complex distributed networks. Especially when the relationships between nodes in the network are complex and highly dependent, static topology diagrams and rules cannot fully uncover potential risks and fault sources in the network, leading to delays in the discovery of anomalies and making it easy to miss some key nodes or relationships between nodes, thus failing to make accurate fault location and diagnosis.
[0004] Furthermore, existing network operation and maintenance monitoring methods generally rely solely on a central node for centralized management and decision-making. This leads to problems such as excessive computational burden and data transmission latency when facing large-scale distributed networks, failing to meet the requirements for efficient and real-time monitoring. As network size and complexity increase, existing methods exhibit poor scalability and struggle to cope with large-scale, dynamically changing network environments.
[0005] This invention addresses the shortcomings of existing technologies by proposing a distributed network operation and maintenance monitoring method based on an edge computing architecture. Through graph neural networks and dynamically adjusted pooling operations, it can acquire complex dependencies between nodes in the network in real time, automatically optimize monitoring and operation and maintenance decisions based on network status, overcome the limitations of traditional monitoring systems, and achieve efficient and real-time monitoring and operation and maintenance of distributed networks.
[0006] Therefore, how to provide a distributed network operation and maintenance monitoring method and system based on edge computing architecture is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention
[0007] One objective of this invention is to propose a distributed network operation and maintenance monitoring method and system based on an edge computing architecture. This invention fully utilizes graph neural networks, graph pooling technology, and dynamic parameter adjustment mechanisms, and describes in detail how to achieve intelligent network operation and maintenance management by analyzing the dependencies and state changes between nodes in real time. This method has the advantages of efficient real-time monitoring, automated adjustment, and accurate fault location, and can effectively improve the response speed and accuracy of network operation and maintenance.
[0008] A distributed network operation and maintenance monitoring method based on an edge computing architecture according to an embodiment of the present invention includes the following steps:
[0009] Collect device data, perform timestamp alignment and normalization processing to obtain a standardized time series input tensor and a log event sequence;
[0010] Construct link adjacency matrices and dependency adjacency matrices, and generate multi-view adjacency matrices through weighted fusion;
[0011] The time series input tensor and the multi-view adjacency matrix are input into the graph temporal coding structure to obtain the node embedding representation;
[0012] Compute the anomaly score of the node embedding representation and generate a gating vector based on the anomaly score;
[0013] The node embedding representation input is used to improve the DiffPool structure, predict the initial allocation matrix, and then the allocation matrix is reweighted by the gating vector to obtain the reweighted allocation matrix.
[0014] Pooling operations are performed using a reweighted allocation matrix and node embedding representations to generate pooled embedding representations, and a coarsened adjacency matrix is generated through a reconstruction operation.
[0015] The pooled embedding representation is fused with the log event sequence to generate a candidate alarm set. Path reachability analysis is performed on the coarsened adjacency matrix to output a set of operation and maintenance event triples.
[0016] Control commands are generated and executed based on the event triple set, and feedback data is collected. Alarms, event triples, and feedback data are reported to the central coordination node, which adjusts and updates parameters based on the feedback.
[0017] Optionally, the data collected by the acquisition device includes data on the device's operating indicators, link detection data, and log event data, and the preprocessing steps include timestamp alignment and normalization.
[0018] Optionally, the process of generating the multi-view adjacency matrix includes:
[0019] Construct a link adjacency matrix based on equipment operation index data;
[0020] Construct a dependency adjacency matrix based on link detection data;
[0021] A multi-view adjacency matrix is obtained by weighted fusion of the link adjacency matrix and the dependency adjacency matrix, wherein the weight coefficients of the weighted fusion are dynamically adjusted based on the connection strength and dependency between nodes in the network.
[0022] In the weighted fusion process, graph convolution operations are used to optimize the fusion weight coefficients;
[0023] Normalize the adjacency matrix of the multi-view.
[0024] Optionally, the graph temporal coding structure includes: inputting a standardized time series input tensor and a multi-view adjacency matrix into a graph neural network to update the node embedding representation; the graph neural network recursively updates the features of the nodes through graph convolution operations; combining the feature information of adjacent nodes; performing feature propagation according to the changes in the time series at each time step; using a temporal self-attention mechanism to perform weighted adjustment of the node features; and outputting the node embedding representation.
[0025] Optionally, the process of generating the gated vector includes the following steps:
[0026] The anomaly score vector of a node is calculated based on node embedding representation. The anomaly score vector reflects the degree of difference between the node's current state and its historical state.
[0027] The anomaly scoring vector is standardized and converted into an input signal that can be used to generate the gating vector;
[0028] The standardized anomaly scoring vector is further processed using a fully connected neural network, and a gating vector is generated by an activation function. The gating vector controls the weight of each node in the assignment matrix.
[0029] When generating the gating vector, historical data within the time window and node status information at the current moment are combined.
[0030] Optionally, the process of generating the reweighted allocation matrix includes the following steps:
[0031] Calculate the initial allocation matrix based on node embedding representation and gating vector;
[0032] Each element of the initial allocation matrix is weighted and adjusted to generate an initial reweighted allocation matrix;
[0033] Applying a nonlinear activation function to the reweighted allocation matrix yields the final reweighted allocation matrix;
[0034] Based on the abnormal score vector of the node, the weight coefficients in the final reweighted allocation matrix are further adjusted;
[0035] The adjusted reweighted allocation matrix is then normalized.
[0036] The normalized reweighted allocation matrix is applied to the aggregation operation of node features to obtain the optimized pooling embedding representation.
[0037] Optionally, the process of generating the coarsened adjacency matrix through the reconstruction operation includes the following steps:
[0038] Based on the normalized reweighted allocation matrix, the connection relationships between nodes are weighted and calculated to obtain the weighted connection values between nodes.
[0039] The relationships between nodes are aggregated using a normalized reweighted assignment matrix and a multi-view adjacency matrix to form a preliminary graph structure representation.
[0040] The node features in the preliminary graph structure representation are weighted and reconstructed to generate a coarsened adjacency matrix;
[0041] During the reconstruction process, the connection structure of the adjacency matrix is optimized by weighting the adjacency relationship, while retaining the key node relationships related to the pooling operation;
[0042] The generated coarsened adjacency matrix is then sparsified.
[0043] By combining coarsened adjacency matrices with pooling embedding representations, the feature representation of the graph is optimized.
[0044] Optionally, the process of performing path reachability analysis on the coarsened adjacency matrix includes the following steps:
[0045] By coarsening the adjacency matrix, the path reachability between nodes in the graph is calculated, and a path matrix is generated based on the connection weight of each edge in the adjacency matrix.
[0046] Using breadth-first search or depth-first search algorithms, traverse the nodes in the graph, determine whether there is a reachable path between each node and other nodes, and record the length of each path and the connection weight of each edge in the path.
[0047] For each pair of nodes, calculate the shortest path length, which is the path length with the smallest sum of edge weights among all possible paths; at the same time, calculate the connection strength of the path, which is the sum of the connection weights of all edges on the path.
[0048] Generate a node pair weight matrix for each pair of nodes. The weights in the node pair weight matrix are calculated based on the shortest path length and connection strength between the node pairs.
[0049] Based on the node pair weight matrix, update the connection relationships between nodes in the coarse adjacency matrix, retain node pairs with shortest path lengths below a preset threshold and connection strengths above a preset threshold, and remove connections that do not meet the conditions.
[0050] A distributed network operation and maintenance monitoring system based on an edge computing architecture according to an embodiment of the present invention includes the following modules:
[0051] Data acquisition module: used to collect device data, perform timestamp alignment and normalization processing, and obtain standardized time series input tensors and log event sequences;
[0052] The adjacency matrix construction module constructs the link adjacency matrix and the dependency adjacency matrix, and generates a multi-view adjacency matrix through weighted fusion.
[0053] Graph temporal coding module: Inputs the standardized time series input tensor and the multi-view adjacency matrix into the graph temporal coding structure to obtain the node embedding representation;
[0054] Anomaly score calculation module: calculates the anomaly score of the node embedding representation and generates a gating vector based on the anomaly score;
[0055] Improved DiffPool module: Embedded nodes represent the input improved DiffPool structure, predict the initial allocation matrix, and reweight the allocation matrix through gating vectors to obtain the reweighted allocation matrix;
[0056] Pooling and Reconstruction Module: Performs pooling operations using a reweighted allocation matrix and node embedding representations to generate pooled embedding representations, and generates a coarse adjacency matrix through reconstruction operations;
[0057] Alarm generation and path analysis module: It merges pooled embedding representation with log event sequence to generate candidate alarm set, performs path reachability analysis on coarsened adjacency matrix, and outputs operation and maintenance event triplet set;
[0058] Control command generation and feedback module: Generates and executes control commands based on the set of operation and maintenance event triples, collects feedback data, and reports alarms, event triples and feedback data to the central collaborative node. The central collaborative node adjusts and updates parameters based on the feedback.
[0059] The beneficial effects of this invention are:
[0060] (1) Improve the real-time performance and response speed of network operation and maintenance: This invention uses an edge computing architecture to transfer operation and maintenance monitoring and processing from the central node to the edge node, reduce the latency of data transmission, capture the status changes of nodes in the network in real time, and improve the response speed of fault detection and processing.
[0061] (2) Optimize the accuracy of fault diagnosis and anomaly location: Through graph neural network and dynamic pooling operation, the present invention can accurately capture the complex dependencies and topology between nodes in the network, and automatically optimize the monitoring strategy based on real-time data, thereby accurately locating the fault source and abnormal node and improving the accuracy of fault diagnosis.
[0062] (3) Improve the scalability and adaptability of the system: By automatically adjusting network parameters, such as the adjacency matrix weight and the number of pooled clusters, the present invention can dynamically adjust the monitoring strategy according to the network scale and changes, ensuring efficient operation and maintenance in a large-scale distributed network environment, and has good scalability and adaptability. Attached Figure Description
[0063] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:
[0064] Figure 1 This is an overall flowchart of a distributed network operation and maintenance monitoring method based on edge computing architecture proposed in this invention;
[0065] Figure 2 This is a flowchart illustrating the coarsened adjacency matrix execution path reachability analysis of a distributed network operation and maintenance monitoring method based on edge computing architecture proposed in this invention.
[0066] Figure 3 This is a module structure diagram of a distributed network operation and maintenance monitoring system based on edge computing architecture proposed in this invention. Detailed Implementation
[0067] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.
[0068] refer to Figure 1-3 A distributed network operation and maintenance monitoring method and system based on edge computing architecture includes the following steps:
[0069] Collect device data, perform timestamp alignment and normalization processing to obtain a standardized time series input tensor and a log event sequence;
[0070] Construct link adjacency matrices and dependency adjacency matrices, and generate multi-view adjacency matrices through weighted fusion;
[0071] The time series input tensor and the multi-view adjacency matrix are input into the graph temporal coding structure to obtain the node embedding representation;
[0072] Compute the anomaly score of the node embedding representation and generate a gating vector based on the anomaly score;
[0073] The node embedding representation input is used to improve the DiffPool structure, predict the initial allocation matrix, and then the allocation matrix is reweighted by the gating vector to obtain the reweighted allocation matrix.
[0074] Pooling operations are performed using a reweighted allocation matrix and node embedding representations to generate pooled embedding representations, and a coarsened adjacency matrix is generated through a reconstruction operation.
[0075] The pooled embedding representation is fused with the log event sequence to generate a candidate alarm set. Path reachability analysis is performed on the coarsened adjacency matrix to output a set of operation and maintenance event triples.
[0076] The O&M event triplet set is a data set used in this invention to structurally represent critical network O&M events. Each O&M event triplet consists of three elements: root cause node, scope, and priority. The root cause node represents the critical node that triggered the current O&M event, typically a fault source or performance bottleneck. The scope defines the range of nodes affected by the event, usually involving a subgraph of the fault propagation or affected devices. The priority indicates the urgency of the event, determined based on its impact on the network system, its frequency of occurrence, or its importance. Through the O&M event triplet set, abnormal events in the network can be clearly identified and classified, helping O&M personnel prioritize handling based on the importance of nodes and the scope of impact, thereby improving the efficiency and accuracy of network fault response.
[0077] Control commands are generated and executed based on the event triple set, and feedback data is collected. Alarms, event triples, and feedback data are reported to the central coordination node, which adjusts and updates parameters based on the feedback.
[0078] Control commands are generated based on a set of operational event triplets. They guide network devices or systems to take appropriate actions when abnormal events occur. Each control command is generated based on root cause node, scope, and priority information, aiming to optimize operational response and remediation processes. Specifically, control commands locate the source of the fault or bottleneck based on the root cause node and identify the devices or nodes that need adjustment; the scope defines which nodes or devices need to be involved in the process, ensuring effective management of the entire impact range; and the priority determines which events require priority response, ensuring that the most urgent faults are handled promptly. These control commands can include operations such as device restart, load balancing, path switching, and traffic redirection, helping to restore normal network operation and prevent fault escalation.
[0079] Assume a large distributed network with multiple devices and links transmitting data in real time. Through continuous monitoring and analysis of network operation data, the system detected the following operational events:
[0080] Root cause: A performance bottleneck in a device (device A) leads to increased communication latency between it and other devices (device B and device C);
[0081] Scope: The latency issue of device A affects the normal data transmission between devices B and C, thereby affecting the normal operation of the entire subnet;
[0082] Priority: This issue is classified as a high-priority event because it has a wide-ranging impact and could potentially cause system crashes.
[0083] Based on the triplet of this maintenance event, the system generates the following control commands:
[0084] The root cause node (device A) needs to be restarted to clear its cache and restore normal performance;
[0085] The scope (device B and device C) needs to be load balanced, and traffic between device B and device C should be temporarily rerouted to other backup devices to avoid the continued impact of data transmission delays;
[0086] The priority (high priority) requires these operations to be completed within 5 minutes and generate an alarm for operation and maintenance personnel to monitor.
[0087] The control commands are as follows:
[0088] Send a restart command to device A and set its reinitialization time window;
[0089] Send traffic redirection instructions to devices B and C, instructing them to forward traffic to backup nodes D and E;
[0090] At the same time, send high-priority alerts to the operations and maintenance personnel to remind them of the urgency of the problem and the follow-up actions required.
[0091] During execution, the system monitors the implementation of these commands to ensure that control commands are executed in a timely manner and that the fault recovery process proceeds as expected. If the problem is not resolved after device A is restarted, the system will generate new control commands based on the maintenance event triplet and adjust the handling strategy accordingly.
[0092] The process by which the central collaborative node adjusts and updates parameters based on feedback includes the following steps:
[0093] Receive execution receipt data from the edge node. This receipt data includes the result of the control command execution, node status change information, and a set of operation and maintenance event triples.
[0094] Based on the execution status of control commands and node status feedback in the receipt data, calculate the success rate of operation and maintenance event handling and evaluate the effectiveness of the current operation and maintenance strategy.
[0095] Based on the abnormal rating vectors and node health status in the receipt data, the weights of the multi-view adjacency matrix are adjusted to optimize the connection relationships between nodes in the graph, especially to enhance the influence of key nodes in the graph.
[0096] Based on the abnormal score vectors in the receipt data, update the number of pooling clusters and adjust the degree of node feature processing during the aggregation process to ensure that the features of abnormal nodes can be fully reflected in the pooling operation.
[0097] Based on the priority information in the operation and maintenance event triplet, adjust the anomaly threshold to ensure that the system can promptly identify and respond to new anomaly patterns in future operation and maintenance cycles.
[0098] The updated parameters (including adjacency matrix weights, number of pooling clusters, and anomaly thresholds) are fed back to the edge nodes and applied in the next operation and maintenance cycle to optimize subsequent control command execution and node feature aggregation.
[0099] In this embodiment, the data collected by the acquisition device includes data on the operation indicators of the acquisition device, data on link detection, and log event data. The preprocessing steps include timestamp alignment and normalization.
[0100] In this embodiment, the process of generating the multi-view adjacency matrix includes:
[0101] A link adjacency matrix is constructed based on equipment operation index data, and the link adjacency matrix represents the connection relationship between devices in the network;
[0102] A dependency adjacency matrix is constructed based on the link detection data. The dependency adjacency matrix represents the dependency relationship between devices and reflects the business dependency of the devices during operation.
[0103] A multi-view adjacency matrix is obtained by weighted fusion of the link adjacency matrix and the dependency adjacency matrix, wherein the weight coefficients of the weighted fusion are dynamically adjusted based on the connection strength and dependency between nodes in the network.
[0104] In this invention, the generation of the multi-view adjacency matrix does not rely solely on the simple superposition of the link adjacency matrix and the dependency adjacency matrix, but rather on the fusion of the two types of adjacency matrices through the introduction of a dynamic weighting mechanism. The weighting coefficients of this weighted fusion are not fixed values, but are dynamically calculated based on the connection strength and dependency levels between nodes in the network. Connection strength can be measured by parameters such as link bandwidth, latency stability, or historical communication frequency, reflecting the direct physical connection between nodes; dependency levels are measured by parameters such as service request traffic, log call relationships, or task execution order, characterizing the node's dependency at the business logic level. By combining these two types of metrics, the system can adaptively adjust the weighting coefficients under different operating scenarios. For example, when there is high connection strength but low dependency between nodes, the link adjacency matrix has a higher weight in the fusion; when the dependency between nodes is significant, the weight of the dependency adjacency matrix increases. This dynamic weighting method effectively improves the ability of the fused adjacency matrix to express the actual network topology and business relationships, enabling it to more accurately convey the structural information and dependency relationships between nodes in subsequent graph timing encoding and pooling processes, thereby enhancing the accuracy and stability of operation and maintenance monitoring.
[0105] In the weighted fusion process, graph convolution operation is used to optimize the fusion weight coefficients, so that the adjacency matrix can better express the relationship between nodes in the network and enhance the structural information of the graph;
[0106] The adjacency matrix of the multi-view is normalized to ensure its stability and enable more effective information propagation in subsequent graph temporal coding processes.
[0107] In this embodiment, the graph temporal coding structure includes: inputting a standardized time series input tensor and a multi-view adjacency matrix into a graph neural network to update the node embedding representation; the graph neural network recursively updates the features of the nodes through graph convolution operations; combining the feature information of adjacent nodes; at each time step, performing feature propagation according to the changes in the time series; using a temporal self-attention mechanism to perform weighted adjustment of the node features; and outputting the node embedding representation.
[0108] In this invention, the graph temporal coding structure employs a temporal self-attention mechanism to weight and adjust the features of each node. Specifically, the temporal self-attention mechanism dynamically weights node features by calculating the weights of nodes at different time steps. At each time step, the features of a node are influenced not only by the information of its neighboring nodes but also by the context information of the current time step. The temporal self-attention mechanism can adaptively adjust the feature weights of each node based on the features of historical time steps and the node state at the current time step, thereby effectively capturing long-term dependencies in the time series. In this way, the feature representation of nodes can more accurately reflect the changing trends in the time series, improving the accuracy of subsequent pooling and anomaly detection stages.
[0109] In this embodiment, the process of generating the gated vector includes the following steps:
[0110] The anomaly score vector of a node is calculated based on node embedding representation. The anomaly score vector reflects the degree of difference between the node's current state and its historical state.
[0111] The anomaly scoring vector is standardized and converted into an input signal that can be used to generate the gating vector;
[0112] The standardized anomaly scoring vector is further processed using a fully connected neural network, and a gating vector is generated by an activation function. The gating vector controls the weight of each node in the assignment matrix.
[0113] When generating the gating vector, historical data within the time window and the node state information at the current moment are combined to ensure that the gating vector can be adaptively adjusted according to changes in node characteristics. The gating vector is applied to the allocation matrix through weighting, which adds or removes weights to the nodes, thereby affecting the pooling effect of the nodes.
[0114] In this embodiment, the process of generating the reweighted allocation matrix includes the following steps:
[0115] Calculate the initial allocation matrix based on node embedding representation and gating vector;
[0116] Each element of the initial allocation matrix is weighted and adjusted to generate an initial reweighted allocation matrix;
[0117] Applying a nonlinear activation function to the reweighted allocation matrix yields the final reweighted allocation matrix;
[0118] Based on the abnormal score vector of the node, the weight coefficients in the final reweighted allocation matrix are further adjusted;
[0119] In this invention, the generated reweighted allocation matrix is further adjusted based on the node's anomaly score vector. First, the node's anomaly score vector reflects the degree of anomaly by measuring the difference between the node's current state and its historical state. Then, based on this anomaly score vector, the weight coefficient of each node in the reweighted allocation matrix is adjusted. Specifically, the higher the node's anomaly score, the amplified its corresponding weight coefficient, allowing these nodes to occupy a more important position in subsequent pooling operations, thereby effectively highlighting the feature information of the anomaly nodes. In this way, anomaly nodes receive more attention and weighting during graph pooling, ensuring a more accurate feature representation in the final pooling embedding representation. This adjustment process enables the system to handle anomaly nodes more flexibly and accurately, improving the anomaly detection capability in network operation and maintenance monitoring.
[0120] The adjusted reweighted allocation matrix is then normalized.
[0121] The normalized reweighted allocation matrix is applied to the aggregation operation of node features to obtain the optimized pooling embedding representation.
[0122] In this embodiment, the process of generating the coarsened adjacency matrix through reconstruction operation includes the following steps:
[0123] Based on the normalized reweighted allocation matrix, the connection relationships between nodes are weighted and calculated to obtain the weighted connection values between nodes.
[0124] The relationships between nodes are aggregated using a normalized reweighted assignment matrix and a multi-view adjacency matrix to form a preliminary graph structure representation.
[0125] The node features in the preliminary graph structure representation are weighted and reconstructed to generate a coarsened adjacency matrix;
[0126] During the reconstruction process, the connection structure of the adjacency matrix is optimized by weighting the adjacency relationship, while retaining the key node relationships related to the pooling operation;
[0127] The generated coarsened adjacency matrix is then sparsified.
[0128] In this invention, during the generation of the coarsened adjacency matrix, the connection structure between nodes in the graph is optimized by weighting the adjacency relationships. Specifically, based on the reweighted allocation matrix, the connections between nodes are weighted, retaining key node relationships related to the pooling embedding representation and ensuring that these relationships are effectively preserved in subsequent pooling operations. At the same time, connections with low correlation to the pooling embedding representation are removed, ensuring that only the most representative node relationships are retained in the matrix. This weighting and removal process ensures that the connection structure of the graph can more accurately reflect the actual topology of the network, and improves computational efficiency and the accuracy of information transmission by reducing unnecessary connections. Finally, the generated coarsened adjacency matrix provides more efficient and accurate input for subsequent pooling operations, enhancing the aggregation effect of node features.
[0129] By combining coarsened adjacency matrices with pooling embedding representations, the feature representation of the graph is optimized.
[0130] In this invention, the generated coarse adjacency matrix is combined with pooling embedding representation to further optimize the feature representation of the graph. Specifically, the coarse adjacency matrix reconstructs the connection relationships between nodes through weighted reconstruction, highlighting the influence of key nodes and their adjacent nodes. Based on this, the pooling embedding representation extracts the core information of nodes in the graph by aggregating node features. Combining the two, the coarse adjacency matrix provides structured connection information of the graph, while the pooling embedding representation retains the local features of each node. Through this combination, the feature representation of the graph is comprehensively optimized, enhancing the expressiveness of important structures in the graph. In subsequent calculations, this optimized graph feature representation can more accurately capture the dependencies and topological structure between nodes, thereby improving the overall performance of graph processing tasks such as anomaly detection, path analysis, and decision optimization.
[0131] In this embodiment, the process of performing path reachability analysis on the coarsened adjacency matrix includes the following steps:
[0132] By coarsening the adjacency matrix, the path reachability between nodes in the graph is calculated, and a path matrix is generated based on the connection weight of each edge in the adjacency matrix.
[0133] Using breadth-first search or depth-first search algorithms, traverse the nodes in the graph, determine whether there is a reachable path between each node and other nodes, and record the length of each path and the connection weight of each edge in the path.
[0134] For each pair of nodes, calculate the shortest path length, which is the path length with the smallest sum of edge weights among all possible paths; at the same time, calculate the connection strength of the path, which is the sum of the connection weights of all edges on the path.
[0135] Generate a node pair weight matrix for each pair of nodes. The node pair weight matrix calculates the weights based on the shortest path length and connection strength between the node pairs. Specifically, it prioritizes retaining node pairs whose shortest path length is lower than a preset threshold and whose connection strength is higher than a preset value.
[0136] Based on the node pair weight matrix, update the connection relationship between nodes in the coarse adjacency matrix, retain node pairs with shortest path lengths below a preset threshold and connection strengths above a preset threshold, and remove connections that do not meet the conditions.
[0137] The updated coarsened adjacency matrix is combined with the pooling embedding representation to perform anomaly detection and feature aggregation based on the optimized graph structure.
[0138] A distributed network operation and maintenance monitoring system based on an edge computing architecture according to an embodiment of the present invention includes the following modules:
[0139] Data acquisition module: used to collect device data, perform timestamp alignment and normalization processing, and obtain standardized time series input tensors and log event sequences;
[0140] The adjacency matrix construction module constructs the link adjacency matrix and the dependency adjacency matrix, and generates a multi-view adjacency matrix through weighted fusion.
[0141] Graph temporal coding module: Inputs the standardized time series input tensor and the multi-view adjacency matrix into the graph temporal coding structure to obtain the node embedding representation;
[0142] Anomaly score calculation module: calculates the anomaly score of the node embedding representation and generates a gating vector based on the anomaly score;
[0143] Improved DiffPool module: Embedded nodes represent the input improved DiffPool structure, predict the initial allocation matrix, and reweight the allocation matrix through gating vectors to obtain the reweighted allocation matrix;
[0144] Pooling and Reconstruction Module: Performs pooling operations using a reweighted allocation matrix and node embedding representations to generate pooled embedding representations, and generates a coarse adjacency matrix through reconstruction operations;
[0145] Alarm generation and path analysis module: It merges pooled embedding representation with log event sequence to generate candidate alarm set, performs path reachability analysis on coarsened adjacency matrix, and outputs operation and maintenance event triplet set;
[0146] Control command generation and feedback module: Generates and executes control commands based on the set of operation and maintenance event triples, collects feedback data, and reports alarms, event triples and feedback data to the central collaborative node. The central collaborative node adjusts and updates parameters based on the feedback.
[0147] Example 1:
[0148] To verify the feasibility of this invention in practice, it was applied to a large-scale distributed network environment containing multiple interconnected devices and nodes that collectively support complex business processes. As the number of network devices and the scale of business operations increase, network stability and security become increasingly important. Traditional network operation and maintenance monitoring methods rely on static rules and manual intervention, resulting in long response times, insufficient accuracy in fault diagnosis, and an inability to adapt to rapidly changing network environments.
[0149] The network operation and maintenance monitoring method of this invention, through a combination of edge computing architecture and graph neural networks, can acquire and analyze the status information of nodes in the network in real time and automatically optimize monitoring strategies. In this embodiment, the network environment includes 1000 devices, each with multiple sensors to collect device status information (such as CPU utilization, memory utilization, network traffic, etc.), and the data is initially processed through edge nodes. After timestamp alignment and normalization, the data of each device node generates a standardized time-series input tensor and log event sequence. Then, the system generates a multi-view adjacency matrix based on the link adjacency matrix and dependency adjacency matrix to represent the connection relationships and dependencies between devices. Through the graph temporal coding structure, the system can extract the embedded representation of each node and calculate anomaly scores, providing a basis for subsequent anomaly detection and control command generation.
[0150] In practical applications, through an improved DiffPool structure and path reachability analysis, the system can automatically identify critical nodes and fault sources, and generate control commands based on the triplet set of operational events. These control commands include operations such as device restart and traffic redirection to reduce the impact of faults on the network. Simultaneously, through edge computing, the system can complete data processing and monitoring decisions closer to the devices, thereby reducing data transmission latency and significantly improving operational response speed.
[0151] Compared with traditional operation and maintenance monitoring methods, the system using the method of this invention achieves significant improvements in both network fault response time and fault location accuracy. For example, when a network fault occurs, the average response time of the traditional method is 30 minutes, while the system using the method of this invention reduces the response time to 5 minutes. Furthermore, the accuracy of fault location is increased from 75% to 95% of the traditional method, greatly improving the efficiency of fault recovery.
[0152] The table below presents comparative data between the method of this invention and conventional methods during a specific failure, including indicators such as failure response time, failure location accuracy, and system processing speed. This data table demonstrates the superiority of the method of this invention in practical applications.
[0153] Table 1: Performance Comparison of Network Operation and Maintenance Monitoring Methods
[0154] index Traditional methods Method of the present invention Fault response time (minutes) 30 5 Fault location accuracy (%) 75 95 System processing speed (number of devices processed per second) 50 150 Fault recovery time (minutes) 60 15 Operation and maintenance monitoring coverage (%) 80 98
[0155] Based on the data in Table 1, we can clearly see the differences between the method of this invention and the traditional method in several key indicators, especially in terms of fault response time, fault location accuracy, and system processing speed, where the method shows significant advantages.
[0156] First, fault response time is a crucial indicator of the responsiveness of an operations and maintenance system. Traditional methods have an average response time of 30 minutes, while the method described in this invention reduces the response time to 5 minutes, significantly improving the system's ability to respond to faults. This improvement allows operations and maintenance personnel to locate and repair faults in a shorter time, reducing the impact of faults on business operations.
[0157] Secondly, the fault location accuracy rate has been improved by 20%, from 75% in the traditional method to 95%. This indicates that the present invention can more accurately identify the fault source in network fault diagnosis, avoiding the problems of missed or false alarms that may exist in the traditional method, and significantly improving the accuracy and effectiveness of fault handling.
[0158] System processing speed is also a significant advantage of this invention, increasing processing capacity from 50 devices per second in traditional methods to 150 devices per second. This improvement enables the system to operate efficiently in large-scale distributed networks, ensuring that the status of devices in the network can be monitored and managed in real time, thus improving the overall network operation and maintenance efficiency.
[0159] Regarding fault recovery time, this invention reduces recovery time from 60 minutes to 15 minutes, making fault handling more efficient and reducing the impact of fault recovery delays on business continuity.
[0160] Finally, the operation and maintenance monitoring coverage increased from 80% to 98%, demonstrating that the method of the present invention can cover more devices and nodes, further improving the comprehensiveness and reliability of network operation and maintenance.
[0161] Overall, the method of this invention demonstrates significant improvements over traditional methods in multiple aspects, including fault response speed, fault diagnosis accuracy, processing capacity, recovery time, and monitoring coverage, fully proving the feasibility and superiority of this method in practical applications.
[0162] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.
Claims
1. A distributed network operation and maintenance monitoring method based on edge computing architecture, characterized in that, Includes the following steps: Collect device data, perform timestamp alignment and normalization processing to obtain a standardized time series input tensor and a log event sequence; Construct link adjacency matrices and dependency adjacency matrices, and generate multi-view adjacency matrices through weighted fusion; The time series input tensor and the multi-view adjacency matrix are input into the graph temporal coding structure to obtain the node embedding representation; Compute the anomaly score of the node embedding representation and generate a gating vector based on the anomaly score; The node embedding representation input is used to improve the DiffPool structure, predict the initial allocation matrix, and then the allocation matrix is reweighted by the gating vector to obtain the reweighted allocation matrix. Pooling operations are performed using a reweighted allocation matrix and node embedding representations to generate pooled embedding representations, and a coarsened adjacency matrix is generated through a reconstruction operation. The pooled embedding representation is fused with the log event sequence to generate a candidate alarm set. Path reachability analysis is performed on the coarsened adjacency matrix to output a set of operation and maintenance event triples. Control commands are generated and executed based on the event triple set, and feedback data is collected. Alarms, event triples, and feedback data are reported to the central collaborative node, which adjusts and updates parameters based on the feedback.
2. The distributed network operation and maintenance monitoring method and system based on edge computing architecture according to claim 1, characterized in that, The data collected by the acquisition device includes data on the device's operating indicators, link detection data, and log event data. The preprocessing steps include timestamp alignment and normalization.
3. The distributed network operation and maintenance monitoring method based on edge computing architecture according to claim 2, characterized in that, The process of generating the multi-view adjacency matrix includes: Construct a link adjacency matrix based on equipment operation index data; Construct a dependency adjacency matrix based on link detection data; A multi-view adjacency matrix is obtained by weighted fusion of the link adjacency matrix and the dependency adjacency matrix, wherein the weight coefficients of the weighted fusion are dynamically adjusted based on the connection strength and dependency between nodes in the network. In the weighted fusion process, graph convolution operations are used to optimize the fusion weight coefficients; Normalize the adjacency matrix of the multi-view.
4. The distributed network operation and maintenance monitoring method based on edge computing architecture according to claim 3, characterized in that, The graph temporal coding structure includes: inputting a standardized time series input tensor and a multi-view adjacency matrix into a graph neural network to update the node embedding representation; the graph neural network recursively updates the features of the nodes through graph convolution operations; combining the feature information of adjacent nodes; performing feature propagation according to the changes in the time series at each time step; and using a temporal self-attention mechanism to perform weighted adjustment of the node features to output the node embedding representation.
5. A distributed network operation and maintenance monitoring method based on an edge computing architecture according to claim 4, characterized in that, The process of generating the gated vector includes the following steps: The anomaly score vector of a node is calculated based on node embedding representation. The anomaly score vector reflects the degree of difference between the node's current state and its historical state. The anomaly scoring vector is standardized and converted into an input signal that can be used to generate the gating vector; The standardized anomaly scoring vector is further processed using a fully connected neural network, and a gating vector is generated by an activation function. The gating vector controls the weight of each node in the assignment matrix. When generating the gating vector, historical data within the time window and node status information at the current moment are combined.
6. The distributed network operation and maintenance monitoring method based on edge computing architecture according to claim 5, characterized in that, The process of generating the reweighted allocation matrix includes the following steps: Calculate the initial allocation matrix based on node embedding representation and gating vector; Each element of the initial allocation matrix is weighted and adjusted to generate an initial reweighted allocation matrix; Applying a nonlinear activation function to the reweighted allocation matrix yields the final reweighted allocation matrix; Based on the abnormal score vector of the node, the weight coefficients in the final reweighted allocation matrix are further adjusted; The adjusted reweighted allocation matrix is then normalized. The normalized reweighted allocation matrix is applied to the aggregation operation of node features to obtain the optimized pooling embedding representation.
7. A distributed network operation and maintenance monitoring method based on an edge computing architecture according to claim 6, characterized in that, The process of generating a coarsened adjacency matrix through reconstruction operations includes the following steps: Based on the normalized weighted allocation matrix, the connection relationships between nodes are weighted and calculated to obtain the weighted connection values between nodes. The relationships between nodes are aggregated using a normalized reweighted assignment matrix and a multi-view adjacency matrix to form a preliminary graph structure representation. The node features in the preliminary graph structure representation are weighted and reconstructed to generate a coarsened adjacency matrix; During the reconstruction process, the connection structure of the adjacency matrix is optimized by weighting the adjacency relationship, while retaining the key node relationships related to the pooling operation; The generated coarsened adjacency matrix is then sparsified. By combining coarsened adjacency matrices with pooling embedding representations, the feature representation of the graph is optimized.
8. A distributed network operation and maintenance monitoring method based on an edge computing architecture according to claim 7, characterized in that, The process of performing path reachability analysis on the coarsened adjacency matrix includes the following steps: By coarsening the adjacency matrix, the path reachability between nodes in the graph is calculated, and a path matrix is generated based on the connection weight of each edge in the adjacency matrix. Using breadth-first search or depth-first search algorithms, traverse the nodes in the graph, determine whether there is a reachable path between each node and other nodes, and record the length of each path and the connection weight of each edge in the path. For each pair of nodes, calculate the shortest path length, which is the path length with the smallest sum of edge weights among all possible paths; at the same time, calculate the connection strength of the path, which is the sum of the connection weights of all edges on the path. Generate a node pair weight matrix for each pair of nodes. The weights of the node pair weight matrix are calculated based on the shortest path length and connection strength between the node pairs. Based on the node pair weight matrix, update the connection relationships between nodes in the coarse adjacency matrix, retain node pairs with shortest path lengths below a preset threshold and connection strengths above a preset threshold, and remove connections that do not meet the conditions.
9. A distributed network operation and maintenance monitoring system based on an edge computing architecture, applied to the distributed network operation and maintenance monitoring method based on an edge computing architecture as described in any one of claims 1 to 8, characterized in that, Includes the following modules: Data acquisition module: used to collect device data, perform timestamp alignment and normalization processing, and obtain standardized time series input tensors and log event sequences; The adjacency matrix construction module constructs the link adjacency matrix and the dependency adjacency matrix, and generates a multi-view adjacency matrix through weighted fusion. Graph temporal coding module: Inputs the standardized time series input tensor and the multi-view adjacency matrix into the graph temporal coding structure to obtain the node embedding representation; Anomaly score calculation module: calculates the anomaly score of the node embedding representation and generates a gating vector based on the anomaly score; Improved DiffPool module: Embedded nodes represent the input improved DiffPool structure, predict the initial allocation matrix, and reweight the allocation matrix through gating vectors to obtain the reweighted allocation matrix; Pooling and Reconstruction Module: Performs pooling operations using a reweighted allocation matrix and node embedding representations to generate pooled embedding representations, and generates a coarse adjacency matrix through reconstruction operations; Alarm generation and path analysis module: It integrates pooled embedding representation with log event sequence to generate candidate alarm set, performs path reachability analysis on coarsened adjacency matrix, and outputs operation and maintenance event triplet set; Control command generation and feedback module: Generates and executes control commands based on the set of operation and maintenance event triples, collects feedback data, and reports alarms, event triples and feedback data to the central collaborative node. The central collaborative node adjusts and updates parameters based on the feedback.