Network health automatic diagnosis and closed-loop repair method and related products

Abstract

The invention relates to the technical field of network operation and maintenance, in particular to a network health automatic diagnosis and closed-loop repair method and related products, and the method comprises the steps: establishing a dynamic health baseline; abnormal deviation of the real-time operation data is recognized; predicting the risk probability that the network equipment has an operation fault in the future; selecting and executing a corresponding repairing action; verifying whether the abnormal deviation is eliminated; if the abnormal deviation is not eliminated, continuing to execute repair until the abnormal deviation is eliminated or the maximum repair frequency is reached; according to the method, the accuracy and the foresight of network fault diagnosis are improved by deeply fusing the artificial intelligence algorithm into a network operation and maintenance scene, and the intelligent and autonomous management of the network is realized by introducing a closed-loop repair mechanism with autonomous learning and decision-making capabilities. And the reliability, the stability and the self-repairing capability of the whole network infrastructure are enhanced.

Description

Technical Field

[0001] This invention relates to the field of network operation and maintenance technology, specifically to a method for automatic network health diagnosis and closed-loop repair, and related products. Background Technology

[0002] Currently, the configuration, backup, and inspection of network devices (such as routers and switches) typically rely on manual operation or distributed tools. Network administrators mainly depend on command-line interfaces (CLI) or graphical user interfaces (GUIs) to manually configure, back up data, and check the status of network devices one by one. This approach is not only inefficient but also highly dependent on the administrator's personal experience, making it prone to configuration errors due to human error, which can affect network stability. It has the following drawbacks:

[0003] Low operational efficiency: Manual configuration and backup are time-consuming and cannot achieve batch processing;

[0004] Error-prone: Manual operation can easily introduce configuration errors, leading to network failures;

[0005] Functionality is fragmented: configuration, backup, and inspection require different tools, lacking an integrated solution;

[0006] Poor real-time performance: It cannot respond quickly to changes in network status, and inspection results cannot be summarized in a timely manner.

[0007] To address the drawbacks of manual operation, automation technology has emerged. By using automation scripts or platforms, administrators can achieve batch and process-oriented management of a large number of network devices, such as uniformly distributing configurations, scheduling backup tasks, or automatically collecting device status information based on a pre-set inspection list. This improves the efficiency and accuracy of network operation and maintenance to a certain extent.

[0008] However, existing automation technologies still have limitations when dealing with complex network environments. On the one hand, most of these automation tools operate based on pre-set rules and static thresholds, essentially performing passive execution. They can effectively handle known, repetitive tasks, but struggle to proactively discover and predict potential faults that evolve slowly over time due to the combined effects of multiple factors. On the other hand, data sources from different dimensions, such as device performance logs, configuration change records, and security alerts, are often isolated in existing technologies. There is a lack of effective means to conduct in-depth correlation analysis of this heterogeneous data, making it difficult to gain a macro-level understanding of the overall state and root causes of network health.

[0009] Therefore, when unknown or complex anomalies occur, the final diagnosis and decision-making process still requires the deep involvement of experienced network experts, which limits the network's self-management and self-repair capabilities. Summary of the Invention

[0010] In order to solve the above-mentioned technical problems, this invention provides a method and related products for automatic network health diagnosis and closed-loop repair, which realizes intelligent and autonomous network management.

[0011] This invention is achieved through the following technical solution:

[0012] A method for automatic network health diagnosis and closed-loop repair includes:

[0013] a. Obtain historical operating data of network devices, wherein the historical operating data includes at least configuration change data and performance indicator data;

[0014] b. Train the historical operating data using a machine learning model to establish a dynamic health baseline that characterizes the normal operating mode of the network device;

[0015] c. Continuously monitor the real-time operating data of the network devices and identify abnormal deviations in the real-time operating data based on the dynamic health baseline;

[0016] d. Based on the aforementioned abnormal deviation and the pre-trained fault prediction model, predict the probability of future operational failures of the network device;

[0017] e. When the risk probability exceeds a preset threshold, select and execute the corresponding repair action from the repair strategy library;

[0018] f. After the repair action is completed, acquire and analyze the real-time operating data of the network device to verify whether the abnormal deviation has been eliminated; if it has not been eliminated, continue to perform the repair until the abnormal deviation is eliminated or the maximum number of repairs is reached.

[0019] Optionally, methods for establishing a dynamic health baseline include:

[0020] b1. Align and quantify the performance index data and configuration change data in the historical operation data according to time series to construct a multi-dimensional time series state vector;

[0021] b2. The machine learning model based on the autoencoder architecture is used to train the multidimensional time series state vector, wherein the encoder and decoder of the autoencoder are both composed of gated recurrent unit networks. The training objective is to minimize the reconstruction error, which is the error between the multidimensional time series state vector output by the encoder after reconstruction and the multidimensional time series state vector input before reconstruction.

[0022] b3. Calculate the reconstruction error based on historical operating data of network devices in a healthy state, set an error threshold according to the statistical distribution of the reconstruction error, and use the error threshold as a dynamic health baseline.

[0023] Alternatively, the backpropagation algorithm can be used to minimize the loss function. The defined reconstruction error;

[0024] ,in, In order to be in The first moment A multidimensional time-series state vector, with multiple dimensions, is input to the autoencoder. In order to be in The first moment A multidimensional time-series state vector output by an autoencoder. The length of the time series. The dimension of the state vector;

[0025] The weight matrix and bias vector of the gated recurrent unit network are adjusted to minimize the loss function; the reconstruction error is defined by the mean square error.

[0026] Calculate the mean of all reconstruction errors within each time window. with standard deviation ; Calculate and obtain the error threshold ,in, These are adjustable hyperparameters.

[0027] Alternatively, methods for identifying anomalous deviations include:

[0028] c1. Construct a real-time multidimensional time series state vector from the real-time operational data obtained by monitoring;

[0029] c2. Input the real-time multidimensional time series state vector into the trained machine learning model and obtain the reconstructed real-time multidimensional time series state vector.

[0030] c3. Calculate the real-time reconstruction error between the input real-time multidimensional time series state vector and the reconstructed output real-time multidimensional time series state vector;

[0031] c4. When the real-time reconstruction error is greater than the dynamic health baseline, it is identified as an abnormal deviation.

[0032] Optionally, methods for predicting the probability of network equipment failing in the future include:

[0033] d1. Calculate the partial error of the real-time running data in each data dimension, and construct an anomaly signature vector, which is used to characterize the specific data dimension that caused the anomaly deviation;

[0034] d2. Concatenate the state vector of the real-time running data with the anomaly signature vector to construct an enhanced state vector sequence;

[0035] d3. Input the enhanced state vector sequence into a pre-trained fault prediction model; the fault prediction model predicts the predicted value sequence of key performance indicators within a future period based on the input enhanced state vector sequence; the same enhanced state vector sequence is repeatedly predicted to obtain multiple different predicted value sequences of the key performance indicators.

[0036] d4. By using the predicted value sequence of multiple key performance indicators and preset fault thresholds, determine the probability of future operational failures of the network device.

[0037] Optionally, the methods for selecting and performing the corresponding repair action include:

[0038] e1. The network device repair process is modeled as a Markov decision process, wherein the real-time operating data and abnormal deviations of the network device are defined as the current state, and the repair actions in the repair strategy library are defined as the action space.

[0039] e2. Based on a pre-trained deep Q-network model, calculate the action value function Q value of each repair action in the action space for the current state;

[0040] e3. Select and execute the repair action with the maximum value of the action value function Q, as the corresponding repair action.

[0041] Optionally, the process of verifying whether the abnormal deviation has been eliminated and continuing the repair process specifically includes:

[0042] f1. After the repair action with the maximum action value function Q is completed, determine the new state to which the network device has transitioned based on the real-time operating data of the network device.

[0043] f2. Based on whether the abnormal deviation in the new state is eliminated, and in combination with the preset cost of performing the repair action, calculate the immediate reward value used to evaluate the effect of this repair action;

[0044] f3. Store the experience tuple containing the current state before the repair action, the repair action performed, the instant reward value, and the new state into the experience replay pool for continuous online training of the deep Q-network model.

[0045] f4. If the abnormal deviation in the new state is not eliminated and the maximum number of repairs has not been reached, then the new state will be used as the current state for the next repair decision, and the repair steps will be repeated.

[0046] An automatic network health diagnosis and closed-loop repair device, comprising:

[0047] The communication module is used to acquire historical and real-time operating data of network devices;

[0048] The storage module is used to store the historical operating data, the real-time operating data, the machine learning model, the fault prediction model, and the repair strategy library;

[0049] The main control module, connected to the communication module and the storage module, is configured to perform the following operations:

[0050] The historical operating data is trained using the machine learning model to establish a dynamic health baseline that characterizes the normal operating mode of the network device.

[0051] Continuously monitor the real-time operating data and identify abnormal deviations in the real-time operating data based on the dynamic health baseline;

[0052] Based on the aforementioned abnormal deviation and the aforementioned fault prediction model, the probability of future operational failures of the network device is predicted.

[0053] When the risk probability exceeds a preset threshold, a corresponding repair action is selected and executed from the repair strategy library;

[0054] After the repair action is completed, the real-time operating data of the network device is acquired and analyzed to verify whether the abnormal deviation has been eliminated. If it has not been eliminated, the repair continues until the abnormal deviation is eliminated or the maximum number of repairs is reached.

[0055] A computer-readable storage medium storing a computer program, characterized in that, when executed by a processor, the computer program implements the network health automatic diagnosis and closed-loop repair method as described above.

[0056] A computer program product includes a computer program / instructions that, when executed by a processor, implement the network health automatic diagnosis and closed-loop repair method as described above.

[0057] Compared with the prior art, the present invention has the following features and beneficial effects:

[0058] This invention establishes a dynamic health baseline by performing deep learning on historical data, then predicts the probability of potential future failure risks by constructing a fault prediction model, and finally makes the optimal repair action based on the current equipment status.

[0059] This invention improves the accuracy and foresight of network fault diagnosis by deeply integrating artificial intelligence algorithms into network operation and maintenance scenarios. By introducing a closed-loop repair mechanism with autonomous learning and decision-making capabilities, it achieves intelligent and autonomous network management, enhancing the reliability, stability, and self-repair capabilities of the entire network infrastructure. Attached Figure Description

[0060] The accompanying drawings illustrate exemplary embodiments of the present invention and, together with the description thereof, serve to explain the principles of the invention. These drawings are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, but do not constitute a limitation on the embodiments of the present invention.

[0061] Figure 1 This is a flowchart illustrating an automatic network health diagnosis and closed-loop repair method according to the present invention.

[0062] Figure 2 This is a detailed flowchart illustrating a method for automatic network health diagnosis and closed-loop repair according to the present invention.

[0063] Figure 3 This is a structural block diagram of a network health automatic diagnosis and closed-loop repair device according to the present invention. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0065] It should also be noted that, for ease of description, only the parts relevant to the present invention are shown in the accompanying drawings.

[0066] Where there is no conflict, the embodiments and features described in the present invention can be combined with each other. Reference will be made below to the appendix. Figure 1 and Figure 2 The present invention will be described in detail with reference to the embodiments.

[0067] Example 1

[0068] This embodiment provides a method for automatic network health diagnosis and closed-loop repair, constructing a complete processing flow from data learning, status monitoring, risk prediction to automatic repair and verification, such as... Figure 1 and Figure 2 As shown, the key steps of this method specifically include:

[0069] a. Obtain historical operating data of network devices, which should include at least configuration change data and performance indicator data;

[0070] The system first collects and integrates a large amount of historical operational data from the target network devices. The data collected in this step is multi-source and heterogeneous, and its core lies in containing at least two types of key information: first, performance indicator data that reflects the device's operating status, such as time-series data such as CPU utilization, memory usage, and port traffic; second, configuration change data that records human or system operations that directly affect device behavior, such as event-based data such as firewall rule modifications and routing protocol adjustments.

[0071] b. Train historical operating data using machine learning models to establish a dynamic health baseline that represents the normal operating mode of network devices;

[0072] After acquiring sufficient historical data, the system will train this data using a pre-defined machine learning model. The goal of the machine learning model is to learn the normal behavior patterns of the device under various historical operating conditions, thereby establishing a dynamic health baseline. The dynamic health baseline is not a fixed threshold (e.g., CPU utilization should not exceed 80%), but rather a model that understands dynamics. For example, a CPU utilization of 75% is normal during peak network traffic on Monday mornings, but reaching 60% in the early hours of Sunday mornings might be abnormal.

[0073] c. Continuously monitor the real-time operating data of network devices and identify abnormal deviations in the real-time operating data based on the dynamic health baseline;

[0074] After the dynamic health baseline is established, the system enters a continuous online monitoring phase. The system continuously acquires the latest real-time operational data of the network devices and compares it in real-time with the dynamic health baseline established in step b. When the operational pattern exhibited by the real-time data deviates from the "normal" range defined by the baseline, the system identifies it as an abnormal deviation.

[0075] d. Based on anomaly deviation and pre-trained fault prediction models, predict the probability of future operational failures of network devices;

[0076] Because not all anomalies escalate into serious failures, simply identifying current deviations is insufficient. This step performs in-depth analysis of identified anomalies to determine their future trends. The system utilizes a fault prediction model pre-learned from a large number of historical failure cases to match current deviations with patterns in the database. Based on this matching, the system can predict the probability of the network device experiencing an actual operational failure at a future point in time, expressed as a risk probability.

[0077] e. When the risk probability exceeds the preset threshold, select and execute the corresponding repair action from the repair strategy library;

[0078] When the predicted risk probability in step d exceeds a pre-set safety threshold, the system will initiate an active intervention mechanism. This involves accessing a built-in remediation strategy library, which stores proven remediation plans for different failure evolution patterns. The system will automatically select the most suitable remediation action from the library based on the specific pattern leading to the current high-risk prediction and execute it immediately. For example, if a configuration change is predicted to be the root cause of a memory leak, the system might automatically perform a "rollback to the previous stable configuration" action.

[0079] f. After the repair action is completed, acquire and analyze the real-time operating data of the network device to verify whether the abnormal deviation has been eliminated; if it has not been eliminated, continue to perform the repair until the abnormal deviation is eliminated or the maximum number of repairs is reached.

[0080] After the repair actions are completed, to ensure the problem is truly resolved, the system will re-enter monitoring mode, continuously acquiring and analyzing the device's real-time operating data to determine if the previously identified "abnormal deviation" has been eliminated. If the verification is successful, the entire repair process forms a closed loop and ends. If the verification finds that the abnormality still exists, the system will consider the single repair unsuccessful and will continue to try other repair actions according to preset logic until the abnormal deviation is eliminated, or until the preset maximum number of attempts is reached, at which point it will escalate to a manual alarm.

[0081] Example 2

[0082] This embodiment provides a detailed description of the key technical steps in steps b and c, including:

[0083] b1. Align and quantify the performance metrics data and configuration change data in historical operation data to construct a multi-dimensional time series state vector;

[0084] Performance metrics data, also known as inspection data, are high-frequency data. Define a set of metrics. ,Include Performance metrics, such as ,in Represents CPU utilization. Represents memory usage. This represents inbound traffic to the port, etc. This data is displayed at fixed time intervals. (For example, 5 minutes) is collected.

[0085] Configuration change data, also known as configuration data, is low-frequency data driven by events. When a configuration change occurs, the change event is recorded. The event includes a change timestamp, change type (such as "add ACL rule" or "modify routing protocol"), and a summary of the change details.

[0086] Additionally, extra data can be added to the device, and backup events can be recorded. This includes the backup timestamp and the checksum or version number of the backup file.

[0087] Assign a UTC timestamp accurate to the second to all collected data points. Then create a unified timeline at each time point. Construct a comprehensive data vector. For event-based data (configuration) and backup If within a time window If no event occurs, it is marked as "no change" or represented by 0.

[0088] Then, feature extraction needs to be performed on the data to construct the state vector.

[0089] Normalize the inspection data, for example, by using min-max normalization to scale it to... Intervals are used to eliminate the influence of dimensions.

[0090] event-type data and Numerical encoding can be used. For example, one-hot encoding can be used to represent different configuration change types.

[0091] At each time point To merge all features into one Multidimensional time series state vector : ,in: At a certain point in time The state vector; It is the first Performance metrics at a given time point The value after normalization; It is the first Each configuration change type at a specific time point The one-hot encoded value; It is a backup event at a specific time point. The quantized value.

[0092] b2. A machine learning model based on an autoencoder architecture is used to train the multidimensional time series state vector. The encoder and decoder of the autoencoder are both composed of gated recurrent unit networks. The training objective is to minimize the reconstruction error, which is the error between the multidimensional time series state vector output by the encoder after reconstruction and the multidimensional time series state vector input before reconstruction.

[0093] The machine learning model consists of an encoder and a decoder, both of which employ a gated recurrent unit network structure.

[0094] Encoder: Reads a sequence of state vectors within a time window. And compress it into a fixed-length context vector. .

[0095] Decoder: Receives context vector And attempt to reconstruct the original input sequence. .

[0096] At each time step of the encoder or decoder The calculation process of the gated loop unit is as follows:

[0097] Reset door : ;

[0098] Update Gate : ;

[0099] Candidate hidden state : ;

[0100] Final hidden state : ;

[0101] Among them This is the input vector for the current time step; This is the hidden state from the previous time step; Here are the weight matrices for the reset gate, update gate, and candidate hidden state, respectively. This is the corresponding bias vector; Use the Sigmoid activation function; It is the hyperbolic tangent activation function; This represents the concatenation of vectors; To represent element-wise multiplication;

[0102] Then, model training is performed.

[0103] Input: Use long-term series data of devices that have been identified as healthy in historical data as the training set.

[0104] Objective: The goal of the model is to minimize the input sequence. With reconstruction sequence The difference between these values ​​is called the reconstruction error. Loss Function Mean square error is used. ,in, In order to be in The first moment A multidimensional time-series state vector, with multiple dimensions, is input to the autoencoder. In order to be in The first moment A multidimensional time-series state vector output by an autoencoder. The length of the time series. The dimension of the state vector;

[0105] b3. Calculate the reconstruction error based on historical operating data of network devices in a healthy state, set an error threshold according to the statistical distribution of the reconstruction error, and use the error threshold as a dynamic health baseline;

[0106] A subset of validation datasets, also labeled "healthy" but not used for training, is input into the trained model. The reconstruction error for each time window is calculated, resulting in a distribution of reconstruction errors. The mean of this error distribution is then calculated. and standard deviation .

[0107] Define the dynamic health baseline as an acceptable reconstruction error threshold. , ,in, These are adjustable hyperparameters. A larger value indicates a more lenient threshold, meaning the model is more tolerant of fluctuations, but it may also miss some subtle anomalies. Typically... The value ranges from 2 to 4 (corresponding to approximately 95% to 99.9% confidence level).

[0108] In actual operation, methods for identifying abnormal deviations include:

[0109] c1. Construct a real-time multidimensional time series state vector from the real-time operational data obtained by monitoring;

[0110] c2. Input the real-time multidimensional time series state vector into the trained machine learning model and obtain the reconstructed real-time multidimensional time series state vector.

[0111] c3. Calculate the real-time reconstruction error between the input real-time multidimensional time series state vector and the reconstructed output real-time multidimensional time series state vector;

[0112] c4. When the real-time reconstruction error is greater than the dynamic health baseline, it is identified as an abnormal deviation.

[0113] The state vector sequence of the device is acquired in real time and input into the model to calculate the current reconstruction error. .

[0114] if If the device is in good working order, it is considered to be in a healthy state.

[0115] if If the device deviates from the normal baseline, an abnormal alarm will be triggered, and subsequent diagnostic and repair procedures will be initiated.

[0116] Example 3

[0117] This embodiment provides a detailed description of the key technical steps in step d, including:

[0118] d1. Calculate the partial error of the real-time running data in each data dimension and construct the anomaly signature vector. The anomaly signature vector is used to characterize the specific data dimension that caused the abnormal deviation.

[0119] When an anomaly is detected (i.e., reconstruction error) After that, the outlier scores are transformed into feature attribution vectors, and the reconstruction error within a time window is considered. When the threshold is exceeded, the error is calculated in the input vector. The distribution across each dimension, i.e., calculating the partial mean square error for each feature dimension. : Combine the partial errors of all dimensions into a single vector with the state vector. Same-dimensional anomaly signature vector : It indicates which specific metrics (such as CPU, memory) or events (such as a certain type of configuration change) deviate from the normal pattern when an anomaly occurs.

[0120] d2. Concatenate the state vector of the real-time running data with the anomaly signature vector to construct an enhanced state vector sequence;

[0121] The original state vector Its corresponding anomaly signature vector The vectors are concatenated to form an enhanced state vector. : Then, a sliding window method is used to extract training samples from the historical augmented state sequence. Each sample contains two parts:

[0122] Input sequence: An enhanced state sequence over the past L time steps, denoted as .

[0123] Target sequence: A sequence of key performance indicators for the next P time steps, denoted as... , These are key performance indicators.

[0124] d3. Input the enhanced state vector sequence into the pre-trained fault prediction model; the fault prediction model predicts the sequence of key performance indicators over a future period based on the input enhanced state vector sequence.

[0125] Establish a fault prediction model and input... ,predict It has a temporal convolutional network layer, an attention mechanism layer, and a prediction layer.

[0126] Temporal Convolutional Network Layers: TCNs efficiently process time series data through causal convolution and dilated convolution. For an input sequence... and a convolution kernel In sequence elements dilated convolution operation at the location Defined as: ;in, It is a void factor. It refers to the size of the convolutional kernel. The temporal convolutional network layer outputs a sequence of hidden states after deep temporal feature extraction. .

[0127] Attention mechanism layer: After obtaining the hidden state sequence H, the attention mechanism is used to calculate the importance of each time step in the input sequence for the final prediction.

[0128] Calculate attention score: ;

[0129] Calculate attention weights: A value between 0 and 1; the larger the value, the more likely the model is to make a prediction about the first... The more important the historical information at each time step.

[0130] Generate context vectors: ;in, It is a learnable weight matrix. These are learnable weight vectors and biases.

[0131] Prediction layer: Context vectors The input is fed into a fully connected neural network to generate a target sequence for P future time steps. Prediction .

[0132] Fault prediction models can learn the evolution pattern from the current state to future failures based on an input sequence of augmented state vectors, and output a sequence of predicted values ​​for one or more key performance indicators over a future period. For example, the model can predict the trend of memory usage over the next 24 hours based on the state and anomaly data from the past 7 days.

[0133] d4. By maintaining a random prediction pattern in the fault prediction model, the same enhanced state vector sequence is repeatedly predicted multiple times to obtain multiple different predicted value sequences of key performance indicators.

[0134] The proportion of sequences in which at least one value exceeds a preset fault threshold is statistically analyzed among multiple different predicted value sequences of key performance indicators, and this proportion is determined as the probability of future operational failure of network equipment.

[0135] The Monte Carlo dropout technique is used to obtain specific risk probability values, and the process is as follows:

[0136] When the same "enhanced state vector sequence" constructed in step d2 is input into the pre-trained fault prediction model, the prediction is not performed only once, but repeatedly while keeping the dropout layer activated within the model. Sub-independent predictions (e.g., Due to the randomness of "dropping," each prediction will produce a slightly different "predicted sequence of key performance indicators" because of the random deactivation of neurons within the model. This ultimately results in... A possible sequence of future trajectories.

[0137] Check each one Given a sequence of predicted values, for each sequence, determine whether there exists at least one time point within a future prediction time window where the value exceeds a preset fault threshold. Record the total number of sequences that exceed the preset threshold. .

[0138] Calculate the probability of future operational failures of network devices. , .

[0139] When the model makes a prediction that "a failure is about to occur" for a real input sequence, backtrack and examine the attention weight vector corresponding to that prediction. Find the weight values. The highest weighted time points are identified, and the augmented state vectors corresponding to these high-weighted time points are examined. .

[0140] By analyzing these high-weighted Vectors can be used to construct fault mode rules that are understandable to humans. For example, if it is found that in multiple successful fault predictions, the highest attention weight always falls on the event of "configuration change type 'modify firewall policy'", accompanied by an abnormal signature of the "outbound traffic" metric, and the model then predicts that "CPU utilization" will continue to climb in the next 24 hours, a predictive fault mode can be extracted: when the "modify firewall policy" operation is performed and causes anomalies in "outbound traffic", the device has a high probability of failing due to CPU overload within 24 hours.

[0141] Example 4

[0142] This embodiment provides a detailed description of the key technical steps in step e, including:

[0143] e1. Model the network device repair process as a Markov decision process, where the real-time operating data and abnormal deviations of the network device are defined as the current state, and the repair actions in the repair strategy library are defined as the action space.

[0144] Abstracting the real-world network repair problem into a mathematical model, a Markov decision process is defined by elements such as state space, action space, and reward function.

[0145] state space :state It is a complete description of the current state of the equipment. A state At the point of time Defined as a vector It includes: the current device state vector Current anomaly signature vector Vector of history (Including the past) This repair operation is used to avoid repeatedly performing invalid operations.

[0146] Action space This refers to repairing the strategy database, and the corresponding action. This is a specific repair operation that the repair engine can perform. For example: rollback to the previous stable configuration. Restart specific network service processes Clear device cache wait.

[0147] reward function The reward function is based on the state. Execute action And transition to the new state Subsequently, the environment provides an immediate reward to the repair engine: ,in, Used to determine the new state Whether or not they have recovered their health; The time spent completing the repair work; To perform the action The estimated costs or risks (e.g., the cost of restarting core services is higher than clearing the cache). , where is a weighting coefficient used to balance repair success, efficiency, and cost, and is an adjustable hyperparameter.

[0148] e2. Based on a pre-trained deep Q-network model, calculate the action value function Q value of each repair action in the action space for the current state;

[0149] Since the state space of network devices can be very large and continuous, this embodiment uses a deep Q-network model to approximate the optimal action value function using a deep neural network. . Indicates the state Next action Then, the expected cumulative discount reward that can be obtained by following the optimal strategy.

[0150] Construct a deep neural network whose input is the state. The output is the action space. Each action Q-value prediction.

[0151] The goal is to learn a function. To make it as close as possible to the optimal value. , .

[0152] Minimize loss function : .

[0153] in: These are the parameters of the current Q network.

[0154] The parameters of a standalone "target network" are periodic copies of the parameters of the main network, used to stabilize the training process.

[0155] This is an experience replay pool, storing past conversion samples. Random sampling is used to break the correlation between data.

[0156] The engine collects data and trains the network by interacting with its environment (i.e., real network devices). When selecting actions, it employs... - A greedy strategy is used to balance exploration and exploitation:

[0157] by The probability is randomly selected to perform an "exploration".

[0158] by The probability of selecting the action with the highest current Q value for "exploitation" is: .

[0159] final, The value of will gradually decrease as training progresses, allowing the model to transition from extensive exploration in the early stages to stable utilization in the later stages.

[0160] e3. Select and execute the repair action with the maximum action value function Q value as the corresponding repair action.

[0161] After being pre-trained, the deep Q-network model has the ability to evaluate the long-term value of all possible repair actions under any given state.

[0162] During the actual repair process, the system will display the current device status. The input is fed into a pre-trained deep Q-network model. The model will instantly calculate the action value function Q-value corresponding to each repair action in the action space.

[0163] Finally, the repair engine selects and executes the repair action with the highest Q value, and uses it as the "corresponding repair action" for the current state. This decision-making process is dynamic and data-driven, rather than relying on static, pre-written rules.

[0164] Example 5

[0165] This embodiment provides a detailed description of the key technical steps in step f, including:

[0166] f1. After the repair action with the maximum action value function Q is completed, determine the new state that the network device has transitioned to based on the real-time operating data of the network device.

[0167] After the repair action with the maximum action value function Q value in Example 4 is completed, the system enters a brief "observation period." During this period, the "inspection engine" is instructed to perform high-frequency monitoring of key indicators related to this repair. Based on the latest monitoring results, the system can determine the new state that the network device has transitioned to after the repair action was performed. .

[0168] f2. Based on whether the abnormal deviation in the new state has been eliminated, and combined with the preset cost of performing the repair action, calculate the immediate reward value used to evaluate the effect of this repair action;

[0169] The system will use a predefined reward function. : Calculate an instant reward value .

[0170] The calculation of this reward value takes into account multiple factors, such as the new state. The following factors are considered: whether the original abnormal deviations have been eliminated (positive reward factor), and the time and preset cost of performing this repair action (negative reward factor).

[0171] f3. Store the experience tuple containing the current state before the repair action, the repair action performed, the immediate reward value, and the new state into the experience replay pool for continuous online training of the deep Q-network model.

[0172] To enable the deep Q-network model to learn from experience, the system packages the entire repair process into an experience tuple. These represent the current state before the repair action is performed, the repair action being performed, the immediate reward value obtained after the action is performed, and the new state to which the device is transferred, respectively.

[0173] By storing experience tuples in an experience replay pool, and randomly sampling historical experience tuples from this pool, the deep Q-network model can be continuously trained and optimized.

[0174] f4. If the abnormal deviation in the new state is not eliminated and the maximum number of repairs has not been reached, then the new state will be used as the current state for the next repair decision, and the repair steps will be repeated.

[0175] If the new status If the condition is determined to be healthy and remains stable within the subsequent observation window, then the closed-loop repair is successfully completed.

[0176] If the new status If the system remains in a fault state, it will initiate another round of decision-making and repair based on this new state until the problem is resolved or the maximum number of attempts is reached (at which point it will be upgraded to a manual alert).

[0177] Example 6

[0178] This embodiment provides a network health automatic diagnosis and closed-loop repair device for implementing the methods in the foregoing embodiments. The device can be a dedicated hardware device, such as a server or industrial control computer deployed in a network cabinet, or a set of functional modules implemented by software on a general server, or a virtualization device.

[0179] like Figure 3 As shown, this device mainly includes the following core modules in terms of both physical and logical aspects:

[0180] The communication module is used to acquire historical and real-time operating data of network devices. It serves as the interface for data interaction between the device and external network devices. It establishes a connection with the monitored network devices through one or more network protocols (e.g., SSH, Telnet, SNMP, Netconf, etc.) and is responsible for performing data acquisition tasks.

[0181] The storage module is used to store historical operating data, real-time operating data, machine learning models, fault prediction models, and repair strategy libraries. The storage module is the data center of the device, and is usually composed of one or more persistent storage media (such as hard disks, solid-state drives, in-memory databases, etc.). The stored content includes, but is not limited to: historical operating data, real-time operating data, machine learning models, fault prediction models, and repair strategy libraries.

[0182] The main control module, connected to the communication and storage modules, is typically implemented by a computing unit such as a central processing unit (CPU), microprocessor, or application-specific integrated circuit (ASIC / FPGA). It connects to the communication and storage modules via an internal bus and performs the following operations:

[0183] By training historical operational data with machine learning models, a dynamic health baseline representing the normal operation mode of network devices is established.

[0184] Continuously monitor real-time operational data and identify abnormal deviations from the real-time operational data based on a dynamic health baseline;

[0185] Based on the abnormal deviation and fault prediction model, the probability of future operational failures of network devices is predicted.

[0186] When the risk probability exceeds a preset threshold, select and execute the corresponding repair action from the repair strategy library;

[0187] After the repair action is completed, the real-time operating data of the network device is acquired and analyzed to verify whether the abnormal deviation has been eliminated. If it has not been eliminated, the repair continues until the abnormal deviation is eliminated or the maximum number of repairs is reached.

[0188] Example 7

[0189] A computer-readable storage medium storing a computer program, characterized in that, when executed by a processor, the computer program implements the above-described automatic network health diagnosis and closed-loop repair method.

[0190] Without loss of generality, computer-readable media can include computer storage media and communication media. Computer storage media includes volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer-readable instruction data structures, program modules, or other data. Computer storage media includes RAM, ROM, EPROM, EEPROM, flash memory or other solid-state storage technologies, CD-ROM, DVD or other optical storage, magnetic tape cassettes, magnetic tape, disk storage, or other magnetic storage devices. Of course, those skilled in the art will recognize that computer storage media are not limited to the above-mentioned types. The aforementioned system memories and mass storage devices can be collectively referred to as memory.

[0191] A computer program product includes a computer program / instructions that, when executed by a processor, implement the above-described automatic network health diagnosis and closed-loop repair method.

[0192] Computer program products include computer programs or instruction sets used to perform specific tasks or achieve specific functions. These programs or instructions are designed to be executed by a processor to implement a series of predefined steps or operations. The program product may be stored in various forms of computer storage media, such as memory, hard disks, solid-state drives, optical discs, or other forms of digital storage devices. It may exist in the form of compiled binary code or in the form of scripts or bytecode that can be executed by an interpreter. Through carefully designed algorithms and logical instructions, the program product enables the processor to process data in a specific order and manner, performing various functions such as data analysis, user interaction, and device control.

[0193] Those skilled in the art should understand that the above embodiments are merely for illustrating the present invention and are not intended to limit the scope of the invention. Those skilled in the art can make other changes or modifications based on the above invention, and these changes or modifications still fall within the scope of the present invention.

Claims

1. A method for automatic network health diagnosis and closed-loop repair, characterized in that, include: a. Obtain historical operating data of network devices, wherein the historical operating data includes at least configuration change data and performance indicator data; b. Train the historical operating data using a machine learning model to establish a dynamic health baseline that characterizes the normal operating mode of the network device; c. Continuously monitor the real-time operating data of the network devices and identify abnormal deviations in the real-time operating data based on the dynamic health baseline; d. Based on the aforementioned abnormal deviation and the pre-trained fault prediction model, predict the probability of future operational failures of the network device; e. When the risk probability exceeds a preset threshold, select and execute the corresponding repair action from the repair strategy library; f. After the repair action is completed, acquire and analyze the real-time operating data of the network device to verify whether the abnormal deviation has been eliminated; if it has not been eliminated, continue to perform the repair until the abnormal deviation is eliminated or the maximum number of repairs is reached.

2. The method for automatic network health diagnosis and closed-loop repair according to claim 1, characterized in that, Methods for establishing dynamic health baselines include: b1. Align and quantify the performance index data and configuration change data in the historical operation data according to time series to construct a multi-dimensional time series state vector; b2. The machine learning model based on the autoencoder architecture is used to train the multidimensional time series state vector. The encoder and decoder of the autoencoder are both composed of gated recurrent unit networks. The training objective is to minimize the reconstruction error, which is the error between the multidimensional time series state vector output by the encoder after reconstruction and the multidimensional time series state vector input before reconstruction. b3. Calculate the reconstruction error based on historical operating data of network devices in a healthy state, set an error threshold according to the statistical distribution of the reconstruction error, and use the error threshold as a dynamic health baseline.

3. The method for automatic network health diagnosis and closed-loop repair according to claim 2, characterized in that, By using the backpropagation algorithm, the loss function is minimized. The defined reconstruction error; ,in, In order to be in The first moment A multidimensional time-series state vector, with multiple dimensions, is input to the autoencoder. In order to be in The first moment A multidimensional time-series state vector output by an autoencoder. The length of the time series. The dimension of the state vector; The weight matrix and bias vector of the gated recurrent unit network are adjusted to minimize the loss function; the reconstruction error is defined by the mean square error. Calculate the mean of all reconstruction errors within each time window. with standard deviation ; Calculate and obtain the error threshold ,in, These are adjustable hyperparameters.

4. The method for automatic network health diagnosis and closed-loop repair according to claim 1, characterized in that, Methods for identifying anomalous deviations include: c1. Construct a real-time multidimensional time series state vector from the real-time operational data obtained by monitoring; c2. Input the real-time multidimensional time series state vector into the trained machine learning model and obtain the reconstructed real-time multidimensional time series state vector. c3. Calculate the real-time reconstruction error between the input real-time multidimensional time series state vector and the reconstructed output real-time multidimensional time series state vector; c4. When the real-time reconstruction error is greater than the dynamic health baseline, it is identified as an abnormal deviation.

5. The method for automatic network health diagnosis and closed-loop repair according to claim 1, characterized in that, Methods for predicting the probability of future operational failures in network devices include: d1. Calculate the partial error of the real-time running data in each data dimension, and construct an anomaly signature vector, which is used to characterize the specific data dimension that caused the anomaly deviation; d2. Concatenate the state vector of the real-time running data with the anomaly signature vector to construct an enhanced state vector sequence; d3. Input the enhanced state vector sequence into a pre-trained fault prediction model; the fault prediction model predicts the predicted value sequence of key performance indicators within a future period based on the input enhanced state vector sequence; the same enhanced state vector sequence is repeatedly predicted to obtain multiple different predicted value sequences of the key performance indicators. d4. By using the predicted value sequence of multiple key performance indicators and preset fault thresholds, determine the probability of future operational failures of the network device.

6. The method for automatic network health diagnosis and closed-loop repair according to claim 1, characterized in that, The methods for selecting and performing the corresponding repair actions include: e1. The network device repair process is modeled as a Markov decision process, wherein the real-time operating data and abnormal deviations of the network device are defined as the current state, and the repair actions in the repair strategy library are defined as the action space. e2. Based on a pre-trained deep Q-network model, calculate the action value function Q value of each repair action in the action space for the current state; e3. Select and execute the repair action with the maximum value of the action value function Q, as the corresponding repair action.

7. The automatic network health diagnosis and closed-loop repair method according to claim 6, characterized in that, The process of verifying whether the abnormal deviation has been eliminated and continuing the repair includes: f1. After the repair action with the maximum action value function Q is completed, determine the new state to which the network device has transitioned based on the real-time operating data of the network device. f2. Based on whether the abnormal deviation in the new state is eliminated, and in combination with the preset cost of performing the repair action, calculate the immediate reward value used to evaluate the effect of this repair action; f3. Store the experience tuple containing the current state before the repair action, the repair action performed, the instant reward value, and the new state into the experience replay pool for continuous online training of the deep Q-network model. f4. If the abnormal deviation in the new state is not eliminated and the maximum number of repairs has not been reached, then the new state will be used as the current state for the next repair decision, and the repair steps will be repeated.

8. A network health automatic diagnosis and closed-loop repair device, characterized in that, include: The communication module is used to acquire historical and real-time operating data of network devices; The storage module is used to store the historical operating data, the real-time operating data, the machine learning model, the fault prediction model, and the repair strategy library; The main control module, connected to the communication module and the storage module, is configured to perform the following operations: The historical operating data is trained using the machine learning model to establish a dynamic health baseline that characterizes the normal operating mode of the network device. Continuously monitor the real-time operating data and identify abnormal deviations in the real-time operating data based on the dynamic health baseline; Based on the aforementioned abnormal deviation and the aforementioned fault prediction model, the probability of future operational failures of the network device is predicted. When the risk probability exceeds a preset threshold, a corresponding repair action is selected and executed from the repair strategy library; After the repair action is completed, the real-time operating data of the network device is acquired and analyzed to verify whether the abnormal deviation has been eliminated. If it has not been eliminated, the repair continues until the abnormal deviation is eliminated or the maximum number of repairs is reached.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the network health automatic diagnosis and closed-loop repair method as described in any one of claims 1-8.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the automatic network health diagnosis and closed-loop repair method as described in any one of claims 1-8.

Images