Network slice anomaly detection method and device, load balancing method and device, equipment and medium

Abstract

The invention provides a network slice anomaly detection method, a network slice load balancing method and device, electronic equipment and a computer readable storage medium, and relates to the technical field of network slices. The anomaly detection method comprises the steps that operation portraits of a plurality of network slices are acquired, and the operation portraits comprise multi-dimensional operation state data; according to the operation portrait, evaluating operation state indexes of the plurality of network slices, the operation state indexes including a comprehensive unbalance coefficient and a health load index; the network slice with the abnormal load is detected, and the network slice with the abnormal load refers to the network slice with the comprehensive unbalance coefficient and the health load index reaching a first preset value and a second preset value respectively. The invention aims to at least solve the problems that the real state of a complex operation condition of a network slice cannot be comprehensively and accurately identified and a potential abnormal condition is difficult to effectively detect in the related technology. The method is suitable for network slice anomaly detection and optimization scenes.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network slicing, and in particular to a network slice anomaly detection method, a network slice load balancing method, a device, an electronic device and a computer readable storage medium. BACKGROUND

[0002] With the emergence of 5G (5th Generation Mobile Communication Technology) and diversified new services in the cloud era, different industries, businesses or users have put forward various quality of service requirements for the network. For example, for mobile communication, smart home, environmental monitoring, smart agriculture and smart metering services, the network needs to support massive device connection and frequent small message transmission; network live broadcast, video backhaul and mobile medical services have higher requirements for transmission rate; vehicle networking, smart grid and industrial control services require millisecond-level latency and nearly 100% reliability. Therefore, 5G networks should have massive access, deterministic latency and ultra-high reliability capabilities, and need to build flexible and dynamic networks to meet the diverse business needs of users and vertical industries. Network slicing is a new network architecture that provides multiple logical networks on the same shared network infrastructure, each logical network serving a specific business type or industry user. Each network slice can define its own logical topology, SLA (Service Level Agreement) requirements, reliability and security levels to meet the differentiated needs of different businesses, industries or users. Operators can reduce the cost of building multiple dedicated networks through network slicing, and provide highly flexible on-demand network services according to business needs, thereby improving the network value and monetization ability of operators and helping the digital transformation of various industries.

[0003] However, although network slicing can meet the needs of each user, at a specific time, load will be generated between network slices, and the processing of information by the network slice will be affected to some extent, thereby bringing a poor experience to the user.

[0004] In summary, for the complex operation of network slicing in the related art, it can not be possible to comprehensively and accurately identify the true state thereof, and it is difficult to effectively detect potential abnormal situations, thereby making the load balancing effectiveness and efficiency of the network slice insufficient in the case that the network slice abnormal situation cannot be discovered and processed in a timely manner. SUMMARY

[0005] The technical problem to be solved by the present application is to provide a network slice anomaly detection method, a network slice load balancing method, a device, an electronic equipment and a computer readable storage medium to solve the above problems of the prior art, which can comprehensively and effectively detect network slice anomalies, and further realize rapid and effective load balancing of network slices.

[0006] In a first aspect, the present application provides a network slice anomaly detection method, comprising: obtaining running portraits of a plurality of network slices, wherein the running portrait comprises multi-dimensional running state data; evaluating running state indicators of the plurality of network slices according to the running portraits, wherein the running state indicators comprise a comprehensive imbalance coefficient and a healthy load index; and detecting a network slice with load anomaly, wherein the network slice with load anomaly refers to a network slice whose comprehensive imbalance coefficient and healthy load index respectively reach first and second preset values.

[0007] Preferably, obtaining the running portraits of the plurality of network slices specifically comprises: obtaining multi-dimensional running state data of the plurality of network slices, wherein the multi-dimensional running state data comprises central processing unit (CPU) utilization data, non-uniform memory access (NUMA) data, link data and service awareness data; and constructing the running portraits of the plurality of network slices by taking the network slices as nodes and the multi-dimensional running state data as node attributes.

[0008] Preferably, evaluating the running state indicators of the plurality of network slices according to the running portraits specifically comprises: evaluating the computational balance degree, the link balance degree and the service awareness degree of the plurality of network slices according to the multi-dimensional running state data; evaluating the comprehensive imbalance coefficient of the plurality of network slices according to the computational balance degree, the link balance degree and the service awareness degree; and evaluating the healthy load index of the plurality of network slices according to the comprehensive imbalance coefficient and a preset load index.

[0009] In a second aspect, the present application further provides a network slice load balancing method, comprising: obtaining a network slice with load anomaly and a preset expansion amplitude thereof, wherein the network slice with load anomaly is obtained by the network slice anomaly detection method provided in the first aspect; constructing a digital twin corresponding to the network slice with load anomaly; and updating the resource quota of the network slice with load anomaly according to the preset expansion amplitude and the digital twin to balance the load of the network slice with load anomaly.

[0010] Preferably, updating the resource quota of the network slice with load anomaly according to the preset expansion amplitude and the digital twin to balance the load of the network slice with load anomaly specifically comprises: determining a target expansion amplitude of the network slice with load anomaly according to the preset expansion amplitude and the digital twin; and updating the resource quota of the network slice with load anomaly according to the target expansion amplitude to balance the load of the network slice with load anomaly.

[0011] Preferably, the target expansion range of the network slice with abnormal load is determined according to the preset expansion range and the digital twin, specifically including: S1, setting i=1 and setting the first expansion range as the preset expansion range; S2, updating the resource quota of the digital twin according to the i-th expansion range to obtain the digital twin after the i-th expansion; S3, evaluating the balance index of the digital twin after the i-th expansion and determining the size of the balance index compared with the third preset value; in response to the balance index being equal to or greater than the third preset value, determining the i-th expansion range as the target expansion range of the network slice with abnormal load and ending the process; in response to the balance index being less than the third preset value, executing step S4; S4, adjusting the i-th expansion range according to the preset rules to obtain the (i+1)-th expansion range; S5, setting i=i+1 and repeating S2-S4 until the balance index is equal to or greater than the third preset value, and determining the i-th expansion range as the target expansion range of the network slice with abnormal load.

[0012] Thirdly, the present invention also provides an anomaly detection device for network slices, comprising a first acquisition module, an evaluation module, and a detection module. The first acquisition module is used to acquire operational profiles of several network slices, wherein the operational profiles include multi-dimensional operational status data. The evaluation module is connected to the first acquisition module and is used to evaluate the operational status indicators of several network slices based on the operational profiles, wherein the operational status indicators include a comprehensive imbalance coefficient and a health load index. The detection module is connected to the evaluation module and is used to detect network slices with abnormal loads, wherein a network slice with abnormal loads refers to a network slice whose comprehensive imbalance coefficient and health load index reach a first preset value and a second preset value, respectively.

[0013] Fourthly, the present invention also provides a network slice load balancing device, including a second acquisition module, a construction module, and a load balancing module. The second acquisition module is used to acquire network slices with abnormal load and their preset expansion range, wherein the network slices with abnormal load are obtained by the network slice anomaly detection device provided in the third aspect. The construction module is connected to the second acquisition module and is used to construct a digital twin corresponding to the network slice with abnormal load. The load balancing module is connected to the construction module and the second acquisition module respectively and is used to update the resource quota of the network slice with abnormal load according to the preset expansion range and the digital twin, so as to achieve load balancing of the network slice with abnormal load.

[0014] Fifthly, the present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the network slice anomaly detection method provided in the first aspect or the network slice load balancing method provided in the second aspect.

[0015] In a sixth aspect, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the network slice anomaly detection method provided in the first aspect or the network slice load balancing method provided in the second aspect.

[0016] This invention provides a method for anomaly detection, a load balancing method, an apparatus, an electronic device, and a computer-readable storage medium for network slices. By constructing an operational profile of the network slice through multi-dimensional operational status data, it can more comprehensively capture the operational characteristics of the network slice, thereby more accurately assessing the overall imbalance coefficient and health load index of the network slice. This improves the accuracy and reliability of detecting network slices with abnormal loads, helps to promptly identify potential network problems, and provides a basis for the rational allocation and adjustment of network resources. This allows for timely implementation of corresponding measures to prevent network slices from affecting information processing due to abnormal loads, helping operators manage network resources more efficiently, reducing construction and operation costs, improving the overall performance and value of the network, and thus reducing negative impacts on user experience and increasing user satisfaction when using network services. Therefore, this invention can achieve comprehensive and effective anomaly detection of network slices, thereby achieving fast and effective load balancing of network slices. Attached Figure Description

[0017] Figure 1 This is a flowchart of an anomaly detection method for network slicing according to Embodiment 1 of the present invention;

[0018] Figure 2 This is an example diagram of a network slicing load balancing system according to Embodiment 1 of the present invention;

[0019] Figure 3 This is a flowchart of a network slicing load balancing method according to Embodiment 2 of the present invention;

[0020] Figure 4 This is a schematic diagram of the structure of a network slice anomaly detection device according to Embodiment 3 of the present invention;

[0021] Figure 5 This is a schematic diagram of a network slicing load balancing device according to Embodiment 4 of the present invention. Detailed Implementation

[0022] To enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0023] It is understood that the specific embodiments and accompanying drawings described herein are merely for explaining the invention and are not intended to limit the invention.

[0024] It is understood that, without conflict, the various embodiments and features in the embodiments of the present invention can be combined with each other.

[0025] It is understood that, for ease of description, only the parts related to the present invention are shown in the accompanying drawings, while the parts unrelated to the present invention are not shown in the drawings.

[0026] It is understood that each unit or module involved in the embodiments of the present invention may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple units or modules may be integrated into one entity structure.

[0027] It is understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of this invention may occur in a different order than that marked in the accompanying drawings.

[0028] It is understood that the flowcharts and block diagrams of this invention illustrate the possible architecture, functions, and operations of systems, apparatuses, devices, and methods according to various embodiments of this invention. Each block in the flowchart or block diagram may represent a unit, module, program segment, or code, containing executable instructions for implementing the specified function. Furthermore, each block or combination of blocks in the block diagram and flowchart can be implemented using a hardware-based system to achieve the specified function, or using a combination of hardware and computer instructions.

[0029] It is understood that the units and modules involved in the embodiments of the present invention can be implemented by software or by hardware. For example, the units and modules can be located in a processor.

[0030] Example 1:

[0031] like Figure 1 As shown, this embodiment provides an anomaly detection method for network slices.

[0032] In this embodiment, the anomaly detection method for network slicing is applied to Figure 2 The network slice load balancing system shown includes an indicator system module, an anomaly detection module, and intelligent auditing module.

[0033] Anomaly detection methods for network slicing include:

[0034] S101, obtain the running profiles of several network slices, where the running profiles include multi-dimensional running status data.

[0035] In this embodiment, the network slice operation profile is used to comprehensively and systematically describe and characterize the multi-dimensional features and status information of the network slice during operation. It integrates the network slice operation status data in different aspects, which can help network operators, managers and related technical personnel to gain a deeper understanding of the network slice operation status, discover potential problems in a timely manner, optimize resource allocation, and ensure the efficient and stable operation of the network slice.

[0036] Specifically, obtaining operational profiles of several network slices includes steps S1011-S1012:

[0037] S1011, acquire multi-dimensional operational status data of several network slices, including CPU utilization data, NUMA non-uniform memory access data, link data, and service-aware data.

[0038] In this embodiment, the indicator system module includes, but is not limited to: a monitoring collector and a time-series database. The monitoring collector collects CPU (Central Processing Unit) utilization data and NUMA (Non-Uniform Memory Access) data of the network slice. The NUMA data includes, but is not limited to, NUMA imbalance. The collection frequency includes, but is not limited to, once every 5 seconds. The monitoring interface of the network device, the network management system, or a third-party network monitoring tool obtains link data of the network slice at a first preset frequency. The link data includes, but is not limited to, bandwidth utilization entropy value, SRv6, and path load difference. The first preset frequency includes, but is not limited to, once every 30 seconds. The logs and monitoring interface of the application layer monitoring tool, the service management platform, or the application server obtain service-aware data at a second preset frequency. The service-aware data includes, but is not limited to, latency p99, throughput, and packet loss rate. The second preset frequency includes, but is not limited to, once every 1 second. This embodiment captures multi-dimensional operational status data of network slices in real time at differentiated frequencies, covering all dimensions of computing resources, link status, and service experience. This ensures second-level perception and fine-grained monitoring of the network slice operational status, providing a high-precision data foundation for subsequent analysis and decision-making, and can adapt to the complex data collection needs in 4G and 5G shared network slice environments.

[0039] S1012 uses network slices as nodes and multi-dimensional operational status data as node attributes to construct operational profiles for several network slices.

[0040] It should be noted that this embodiment can also organize and collect the operational profiles of several network slices into tables to provide a visual understanding of the network slice's operational status and identify stable data. For example, CPU utilization and NUMA imbalance can be compared in real time. When CPU utilization increases, NUMA imbalance will decrease, showing a negative correlation. When NUMA imbalance approaches zero and imbalance approaches 100%, the CPU is within its normal operating range. This embodiment also stores the tables in a time-series database for convenient subsequent scheduling. By comparing the dynamic relationship between CPU utilization and NUMA imbalance, as well as the correlation data between link imbalance and service perception, this embodiment intuitively reflects the mapping relationship between resource allocation and service experience, helping operations and maintenance personnel quickly grasp the system status.

[0041] S102, evaluate the operational status indicators of several network slices based on the operational profile, including the comprehensive imbalance coefficient and the health load index.

[0042] In this embodiment, the comprehensive imbalance coefficient is used as an operational status indicator to measure the degree of imbalance in resource usage across multiple dimensions of a network slice. The health load index is used as an operational status indicator to assess whether the load status of a network slice is within a healthy and reasonable range.

[0043] Specifically, S102: Evaluate the operational status indicators of several network slices based on the operational profile, including steps S1021-S1023:

[0044] S1021 evaluates the computational balance, link balance, and service awareness of several network slices based on multi-dimensional operational status data.

[0045] In this embodiment, according to the formula: Evaluate the computational balance of several network slices. ,in, This represents the variance of CPU utilization in the CPU utilization data. This represents the maximum variance of CPU utilization in the CPU utilization data. This indicates the NUMA imbalance in the NUMA data. This represents the maximum value of the NUMA imbalance in the NUMA data. and These represent the first weight and the second weight, respectively. .

[0046] According to the formula: Evaluate the link balance of several network slices ,in, This represents the bandwidth utilization entropy value, SRv6, and path load difference of a network slice. Indicates the number of links in a network slice. The maximum value occurs when the bandwidth utilization entropy, SRv6, and path load of all links are equal, i.e. When ρ=1, the load on all paths is completely consistent, and the link reaches an ideal state; while when ρ=0, the traffic is severely concentrated on a few paths, and the link is in a severely unbalanced state.

[0047] Business perception includes, but is not limited to: user-level SLA achievement rate and the proportion of 1–P99 latency exceeding the standard. The proportion of P99 latency exceeding the standard refers to the number of samples with measured P99 latency > SLA threshold divided by the total number of samples. The closer the proportion of P99 latency exceeding the standard is to 1, the healthier the network slice is in terms of user experience, with fewer latency and stuttering phenomena experienced by users, thus improving the overall service quality. The anomaly detection module is used to perform comprehensive and detailed detection of the network slice's operational status. Computational load balancing, link load balancing, and business perception are important indicators used to measure the distribution and perceived load pressure of the network slice, and are also commonly used in the evaluation of operational status indicators. The correlation between computational load balancing, link load balancing, and service perception is manifested in the following ways: When computational load balancing is low, some network slices will become hotspots, leading to uneven resource allocation and a significant deterioration in service perception. Similarly, if link load balancing is low, some links will carry excessive traffic, forming hotspots, which will also lead to a significant decrease in service perception. If service perception fails to meet the predetermined SLA standard, it can be inferred that the current network slice load is too high and needs to be adjusted in a timely manner.

[0048] S1022 evaluates the overall imbalance coefficient of several network slices based on the calculation balance, link balance, and service awareness.

[0049] In this embodiment, the comprehensive imbalance coefficient of several network slices is evaluated according to the formula: Comprehensive Imbalance Coefficient = 1 - (Computational Balance + Link Balance + Service Awareness). The closer the comprehensive imbalance coefficient is to 1, the higher the risk level of the network slice and the more serious the potential problems. The anomaly detection module comprehensively calculates the computational balance, link balance, and service awareness to assess the overall health of the communication network. This allows for timely detection and location of potential problems in the communication network, ensuring the efficient and stable operation of the network slices.

[0050] S1023 assesses the health load index of several network slices based on the comprehensive imbalance coefficient and the preset load index.

[0051] In this embodiment, the health load index can be further derived through the intelligent audit module and the comprehensive imbalance coefficient. The specific calculation formula is: Health Load Index = Preset Load Index × (1 - Comprehensive Imbalance Coefficient), where the preset load index is 80%. When the health load index is approximately equal to 1, it indicates that although the network slice load is high, its distribution is extremely balanced, and the overall state is healthy. It is not necessary to carry out expansion operations for the time being to avoid unnecessary waste of resources. If the health load index is less than 0.8, the network slice situation is more serious. It usually means that the network slice load is not only high, but also severely imbalanced, and there is a great risk to the network operation. The "expansion / migration / rate limiting" closed-loop mechanism should be triggered immediately to quickly alleviate network pressure and ensure its stable operation.

[0052] S103, detect network slices with abnormal load, wherein network slices with abnormal load refer to network slices whose comprehensive imbalance coefficient and healthy load index have reached the first preset value and the second preset value, respectively.

[0053] In this embodiment, the first preset value includes, but is not limited to, 0.3 and 0.2, and the second preset value includes, but is not limited to, 80% and 90%. When the overall imbalance coefficient of a network slice exceeds 0.3 and the health load index of the network slice is below 80%, the network slice is classified as green, indicating that the network slice's resources are relatively abundant and the distribution is relatively reasonable, requiring no additional scheduling operations. When the overall imbalance coefficient of a network slice exceeds 0.3 and the health load index of the network slice is above 90%, the network slice is classified as red, indicating that the network slice's resources are extremely scarce and the distribution is extremely uneven, requiring immediate expansion to prevent system crashes.

[0054] It should be noted that when the service awareness of a network slice is less than 0.95 and the overall imbalance coefficient is less than 0.2, this embodiment classifies the network slice as yellow, indicating that although the network slice has a high load, the distribution is relatively even, and only rate limiting measures are needed to effectively alleviate the pressure. In summary, the green state indicates that resources are abundant and no additional scheduling is required; the red state warns of resource shortages and uneven distribution, requiring immediate capacity expansion measures; while the yellow state indicates that although the load is high, it is evenly distributed, and only rate limiting measures are needed to maintain network stability. This provides clear guidance for intelligent network operation and maintenance, ensuring efficient network operation under different load conditions.

[0055] After detecting network slices with abnormal load, this embodiment can also update the resource quotas of the network slices with abnormal load through the policy verification module of the network slice load balancing system to achieve load balancing. Updating the resource quotas of the network slices with abnormal load to achieve load balancing specifically includes: constructing a digital twin corresponding to the network slice with abnormal load, and using a preset expansion range (e.g., increasing computing resources by 20% and bandwidth by 50Mbps) as the first expansion range; performing an expansion operation on the digital twin according to the i-th expansion range to synchronously update the slice resource quotas; evaluating and verifying the balance indicators of the digital twin after the i-th expansion, wherein the balance indicators include, but are not limited to: load variance reduction rate, high-value service P99 latency, and resource utilization; and resource quotas include, but are not limited to: CPU, memory, and bandwidth. If the load variance decrease rate is ≥20%, the latency of high-value services P99 recovers to within its SLA commitment value, and the resource utilization rate is ≤70%, the digital twin after the i-th expansion is determined to be balanced, the expansion operation ends, and the i-th expansion range is recorded. If the load variance decrease rate is ≥20%, the latency of high-value services P99 recovers to within its SLA commitment value, and the resource utilization rate is ≤70%, at least one of these conditions is not met, the i-th expansion range is adjusted to obtain the (i+1)-th expansion range, and the expansion operation is repeated on the digital twin to synchronously update the slice resource quota, evaluate and verify the balance index of the expanded digital twin until it meets the standard. The judgment criteria and adjustment strategies in the policy verification module of this embodiment are optimized and can take reasonable measures in a timely manner according to different network states to ensure the stable operation and service quality of network slices. When the expansion range is limited, this embodiment can also adjust the network slices with abnormal loads to balance the load of the network slices with abnormal loads, for example, by adding associated slices to expand the network slices with abnormal loads. If the digital twin fails to achieve balance after three consecutive expansion and adjustment cycles, an alarm will be triggered and pushed to the operation and maintenance system, whereby manual intervention will be required to analyze the root cause (such as slicing design defects or unexpected sudden business growth).

[0056] According to the formula Evaluate the rate of decrease in load variance of the digital twin after the i-th expansion. ,in, This represents the load variance of the digital twin after the i-th expansion. This represents the load variance of the unexpanded digital twin. , Indicating the first in a digital twin The load rate of each network slice (such as CPU utilization, bandwidth utilization). This represents the average load rate of all network slices in the digital twin. According to the formula: The resource utilization rate of the digital twin after the i-th expansion is evaluated. The resources used by the network slice include, but are not limited to: the total amount of resources actually occupied by all services or users in the network slice (such as bandwidth, CPU, memory). The total available resources of the network slice after the i-th expansion refers to the upper limit of resources reallocated by the network slice after the i-th expansion operation is completed.

[0057] This embodiment can also update the resource quota of the network slice where the high-value service is located through the policy verification module of the network slice load balancing system, so as to make the network slice where the high-value service is located load balanced. Specifically, it includes: evaluating the service value of the network slice, sorting the network slices according to the service value, and allocating bandwidth in sequence (e.g., high value: L3:L2:L1=5:3:1:1) to ensure that high-value services get resources first.

[0058] In addition, this embodiment sets a total rate cap for hotspot network slices (e.g., link bandwidth cap is set to 80% of its capacity) to avoid exacerbating congestion; and sets a strict rate cap for excess sessions of network slices (e.g., 50% of normal sessions), with lower priority than compliant sessions. Historical data on network slice expansion (e.g., expansion effects, rate limiting feedback) is acquired, and load variance thresholds (e.g., relaxed to 35% when business fluctuations are large), P99 latency SLA (updated based on business needs), and business value assessment rules (e.g., adding new business type labels) are periodically optimized based on historical data. Expansion verification and rate limiting policies effectively improve the performance and stability of network slices, and the optimization mechanism continuously adapts to network changes and business needs, continuously improving system performance. Through a closed-loop process of "anomaly detection – intelligent auditing – policy execution – effect verification," potential risks can be identified and resolved in a timely manner, enabling rapid response (within minutes) after load imbalance. Combined with digital twin verification and dynamic parameter optimization, it ensures that over 90% of imbalance scenarios can be restored to equilibrium within three policy adjustments, significantly shortening the time when services are affected, ensuring the stability and efficiency of the entire network, and achieving efficient resource utilization.

[0059] To ensure network stability and reliability, network slicing can trigger an intervention mechanism in advance when the overall imbalance coefficient exceeds a critical value (such as 0.95). This prevents the deterioration of service perception caused by load imbalance (such as excessive latency and increased packet loss rate), eliminates potential faults in their infancy, reduces the risk of system crash, and ensures smooth user experience and data transmission.

[0060] This embodiment provides a network slice anomaly detection method. By constructing a network slice operational profile through multi-dimensional operational status data, it can more comprehensively capture the operational characteristics of the network slice, thereby more accurately assessing the comprehensive imbalance coefficient and health load index of the network slice. This improves the accuracy and reliability of detecting network slices with abnormal loads, helps to promptly identify potential network problems, and provides a basis for the rational allocation and adjustment of network resources. This allows for timely implementation of corresponding measures to prevent network slices from affecting information processing due to abnormal loads. It also helps operators manage network resources more efficiently, reduce construction and operation costs, improve the overall performance and value of the network, thereby reducing negative impacts on user experience and increasing user satisfaction when using network services. This comprehensive and effective anomaly detection of network slices ultimately leads to rapid and effective load balancing of network slices.

[0061] Example 2:

[0062] like Figure 3 As shown, this embodiment provides a load balancing method for network slicing. The load balancing method for network slicing includes:

[0063] S201, obtain the network slice with abnormal load and its preset expansion range.

[0064] In this embodiment, CPU (Central Processing Unit) utilization data and NUMA (Non-Uniform Memory Access) data of network slices are collected by a monitoring collector. NUMA data includes, but is not limited to, NUMA imbalance. The collection frequency includes, but is not limited to, once every 5 seconds. Link data of network slices is acquired at a first preset frequency through the monitoring interface of network devices, network management systems, or third-party network monitoring tools. Link data includes, but is not limited to, bandwidth utilization entropy, SRv6, and path load differences. The first preset frequency includes, but is not limited to, once every 30 seconds. Service-aware data is acquired at a second preset frequency through application-layer monitoring tools, service management platforms, or application server logs and monitoring interfaces. Service-aware data includes, but is not limited to, latency p99, throughput, and packet loss rate. The second preset frequency includes, but is not limited to, once every 1 second. By treating network slices as nodes and multi-dimensional operational status data as node attributes, operational profiles of several network slices are constructed.

[0065] According to the formula: Evaluate the computational balance of several network slices. ,in, This represents the variance of CPU utilization in the CPU utilization data. This represents the maximum variance of CPU utilization in the CPU utilization data. This indicates the NUMA imbalance in the NUMA data. This represents the maximum value of the NUMA imbalance in the NUMA data. and These represent the first weight and the second weight, respectively. .

[0066] According to the formula: Evaluate the link balance of several network slices ,in, This represents the bandwidth utilization entropy value, SRv6, and path load difference of a network slice. Indicates the number of links in a network slice. The maximum value occurs when the bandwidth utilization entropy, SRv6, and path load of all links are equal, i.e. When ρ=1, the load on all paths is completely consistent, and the link reaches an ideal state; while when ρ=0, the traffic is severely concentrated on a few paths, and the link is in a severely unbalanced state.

[0067] Business perception includes, but is not limited to: user-level SLA achievement rate and the proportion of 1–P99 latency exceeding the standard. The proportion of P99 latency exceeding the standard refers to the number of samples with measured P99 latency > SLA threshold divided by the total number of samples. The closer the proportion of P99 latency exceeding the standard is to 1, the healthier the network slice is in terms of user experience, with fewer latency and stuttering phenomena experienced by users, thus improving the overall service quality. The anomaly detection module is used to perform comprehensive and detailed detection of the network slice's operational status. Computational load balancing, link load balancing, and business perception are important indicators used to measure the distribution and perceived load pressure of the network slice, and are also commonly used in the evaluation of operational status indicators. The correlation between computational load balancing, link load balancing, and service perception is manifested in the following ways: When computational load balancing is low, some network slices will become hotspots, leading to uneven resource allocation and a significant deterioration in service perception. Similarly, if link load balancing is low, some links will carry excessive traffic, forming hotspots, which will also lead to a significant decrease in service perception. If service perception fails to meet the predetermined SLA standard, it can be inferred that the current network slice load is too high and needs to be adjusted in a timely manner.

[0068] Based on the formula: Overall Imbalance Coefficient = 1 - (Calculated Balance + Link Balance + Service Awareness), the overall imbalance coefficient of several network slices is evaluated. The closer the overall imbalance coefficient is to 1, the higher the risk level of the network slice and the more serious the potential problems. Through the intelligent audit module and the overall imbalance coefficient, the health load index can be further derived. Its specific calculation formula is: Health Load Index = Preset Load Index × (1 - Overall Imbalance Coefficient), where the preset load index is 80%.

[0069] The first preset values ​​include, but are not limited to, 0.3 and 0.2, and the second preset values ​​include, but are not limited to, 80% and 90%. When the overall imbalance coefficient of a network slice exceeds 0.3 and the health load index of the network slice is below 80%, the network slice is classified as green, indicating that the network slice's resources are relatively abundant and the distribution is relatively reasonable, requiring no additional scheduling operations. When the overall imbalance coefficient of a network slice exceeds 0.3 and the health load index of the network slice is above 90%, the network slice is classified as red, indicating that the network slice's resources are extremely scarce and the distribution is extremely uneven, requiring immediate expansion to prevent system crashes.

[0070] It should be noted that when the service awareness of a network slice is less than 0.95 and the overall imbalance coefficient is less than 0.2, this embodiment classifies the network slice as yellow, indicating that although the network slice has a high load, the distribution is relatively even, and only rate limiting measures are needed to effectively alleviate the pressure. In summary, the green state indicates that resources are abundant and no additional scheduling is required; the red state warns of resource shortages and uneven distribution, requiring immediate capacity expansion measures; while the yellow state indicates that although the load is high, it is evenly distributed, and only rate limiting measures are needed to maintain network stability. This provides clear guidance for intelligent network operation and maintenance, ensuring efficient network operation under different load conditions.

[0071] S202, Construct a digital twin of the network slice with abnormal load.

[0072] S203, based on the preset expansion range and digital twin, update the resource quota of the network slice with abnormal load, so as to balance the load of the network slice with abnormal load.

[0073] Specifically, S203: Based on the preset expansion range and digital twin, update the resource quotas of network slices with abnormal loads to achieve load balancing of network slices with abnormal loads, including steps S2031-S2032:

[0074] S2031, based on the preset expansion range and the digital twin, determine the target expansion range of the network slice with abnormal load.

[0075] Specifically, S2031: Based on the preset expansion range and the digital twin, determine the target expansion range for the network slice with abnormal load, including: S1, let i=1, and set the first expansion range as the preset expansion range; S2, update the resource quota of the digital twin according to the i-th expansion range to obtain the digital twin after the i-th expansion; S3, evaluate the balance index of the digital twin after the i-th expansion, and determine the size of the balance index and the third preset value; in response to the balance index being equal to or greater than the third preset value, determine the i-th expansion range as the target expansion range for the network slice with abnormal load, and end the process; in response to the balance index being less than the third preset value, execute step S4; S4, adjust the i-th expansion range according to the preset rules to obtain the (i+1)-th expansion range; S5, let i=i+1, and repeat S2-S4 until the balance index is equal to or greater than the third preset value, and determine the i-th expansion range as the target expansion range for the network slice with abnormal load.

[0076] S2032, update the resource quota of network slices with abnormal load according to the target expansion range, so as to balance the load of network slices with abnormal load.

[0077] In this embodiment, after detecting a network slice with abnormal load, the resource quota of the network slice with abnormal load is updated by the policy verification module of the network slice load balancing system to achieve load balancing. Updating the resource quota of the network slice with abnormal load to achieve load balancing specifically includes: constructing a digital twin corresponding to the network slice with abnormal load, and using a preset expansion range (e.g., increasing computing resources by 20% and bandwidth by 50Mbps) as the first expansion range; performing an expansion operation on the digital twin according to the i-th expansion range to synchronously update the slice resource quota; evaluating and verifying the balance indicators of the digital twin after the i-th expansion, wherein the balance indicators include, but are not limited to: load variance reduction rate, high-value service P99 latency, and resource utilization; and resource quotas include, but are not limited to: CPU, memory, and bandwidth. If the load variance decrease rate is ≥20%, the latency of high-value services P99 recovers to within its SLA commitment value, and the resource utilization rate is ≤70%, the digital twin after the i-th expansion is determined to be balanced, the expansion operation ends, and the i-th expansion range is recorded. If the load variance decrease rate is ≥20%, the latency of high-value services P99 recovers to within its SLA commitment value, and the resource utilization rate is ≤70%, at least one of these conditions is not met, the i-th expansion range is adjusted to obtain the (i+1)-th expansion range, and the expansion operation is repeated on the digital twin to synchronously update the slice resource quota, evaluate and verify the balance index of the expanded digital twin until it meets the standard. The judgment criteria and adjustment strategies in the policy verification module of this embodiment are optimized and can take reasonable measures in a timely manner according to different network states to ensure the stable operation and service quality of network slices. When the expansion range is limited, this embodiment can also adjust the network slices with abnormal loads to balance the load of the network slices with abnormal loads, for example, by adding associated slices to expand the network slices with abnormal loads. If the digital twin fails to achieve balance after three consecutive expansion and adjustment cycles, an alarm will be triggered and pushed to the operation and maintenance system, whereby manual intervention will be required to analyze the root cause (such as slicing design defects or unexpected sudden business growth).

[0078] According to the formula Evaluate the rate of decrease in load variance of the digital twin after the i-th expansion. ,in, This represents the load variance of the digital twin after the i-th expansion. This represents the load variance of the unexpanded digital twin. , Indicating the first in a digital twin The load rate of each network slice (such as CPU utilization, bandwidth utilization). This represents the average load rate of all network slices in the digital twin. According to the formula: The resource utilization rate of the digital twin after the i-th expansion is evaluated. The resources used by the network slice include, but are not limited to: the total amount of resources actually occupied by all services or users in the network slice (such as bandwidth, CPU, memory). The total available resources of the network slice after the i-th expansion refers to the upper limit of resources reallocated by the network slice after the i-th expansion operation is completed.

[0079] This embodiment can also update the resource quota of the network slice where the high-value service is located through the policy verification module of the network slice load balancing system, so as to make the network slice where the high-value service is located load balanced. Specifically, it includes: evaluating the service value of the network slice, sorting the network slices according to the service value, and allocating bandwidth in sequence (e.g., high value: L3:L2:L1=5:3:1:1) to ensure that high-value services get resources first.

[0080] In addition, this embodiment sets a total rate cap for hotspot network slices (e.g., link bandwidth cap is set to 80% of its capacity) to avoid exacerbating congestion; and sets a strict rate cap for excess sessions of network slices (e.g., 50% of normal sessions), with lower priority than compliant sessions. Historical data on network slice expansion (e.g., expansion effects, rate limiting feedback) is acquired, and load variance thresholds (e.g., relaxed to 35% when business fluctuations are large), P99 latency SLA (updated based on business needs), and business value assessment rules (e.g., adding new business type labels) are periodically optimized based on historical data. Expansion verification and rate limiting policies effectively improve the performance and stability of network slices, and the optimization mechanism continuously adapts to network changes and business needs, continuously improving system performance. Through a closed-loop process of "anomaly detection – intelligent auditing – policy execution – effect verification," potential risks can be identified and resolved in a timely manner, enabling rapid response (within minutes) after load imbalance. Combined with digital twin verification and dynamic parameter optimization, it ensures that over 90% of imbalance scenarios can be restored to equilibrium within three policy adjustments, significantly shortening the time when services are affected, ensuring the stability and efficiency of the entire network, and achieving efficient resource utilization.

[0081] To ensure network stability and reliability, network slicing can trigger an intervention mechanism in advance when the overall imbalance coefficient exceeds a critical value (such as 0.95). This prevents the deterioration of service perception caused by load imbalance (such as excessive latency and increased packet loss rate), eliminates potential faults in their infancy, reduces the risk of system crash, and ensures smooth user experience and data transmission.

[0082] This embodiment provides a network slice load balancing method that detects network slices with abnormal loads in a timely and accurate manner, and combines digital twin technology to reasonably allocate and adjust network resources for these slices. This improves the accuracy and efficiency of network slice load balancing, prevents network slices from affecting information processing due to abnormal loads, helps operators manage network resources more efficiently, reduces construction and operation costs, improves the overall performance and value of the network, thereby reducing negative impacts on user experience, increasing user satisfaction when using network services, and achieving fast and effective load balancing of network slices.

[0083] Example 3:

[0084] like Figure 4 As shown, this embodiment also provides an anomaly detection device for network slices, including a first acquisition module 31, an evaluation module 32, and a detection module 33. The first acquisition module 31 is used to acquire the operation profiles of several network slices, wherein the operation profiles include multi-dimensional operation status data. The evaluation module 32 is connected to the first acquisition module 31 and is used to evaluate the operation status indicators of several network slices based on the operation profiles, wherein the operation status indicators include a comprehensive imbalance coefficient and a health load index. The detection module 33 is connected to the evaluation module 32 and is used to detect network slices with abnormal loads, wherein network slices with abnormal loads refer to network slices whose comprehensive imbalance coefficient and health load index reach a first preset value and a second preset value, respectively.

[0085] Specifically, the first acquisition module 31 includes an acquisition unit 311 and a construction unit 312. The acquisition unit 311 is used to acquire multi-dimensional operational status data of several network slices, wherein the multi-dimensional operational status data includes CPU utilization data, non-uniform memory access (NUMA) data, link data, and service-aware data. The construction unit 312 is used to construct operational profiles of several network slices by using network slices as nodes and multi-dimensional operational status data as node attributes.

[0086] Specifically, the evaluation module 32 includes: a first evaluation unit 321, a second evaluation unit 322, and a third evaluation unit 323. The first evaluation unit 321 is used to evaluate the computational balance, link balance, and service awareness of several network slices based on the multi-dimensional operating status data. The second evaluation unit 322 is used to evaluate the comprehensive imbalance coefficient of several network slices based on the computational balance, link balance, and service awareness. The third evaluation unit 323 is used to evaluate the health load index of several network slices based on the comprehensive imbalance coefficient and a preset load index.

[0087] Understandably, the network slice anomaly detection device provided above performs the network slice anomaly detection method corresponding to Embodiment 1 provided above. Therefore, the beneficial effects it can achieve can be referred to the beneficial effects of the scheme corresponding to the network slice anomaly detection method of Embodiment 1 above, which will not be repeated here.

[0088] Example 4:

[0089] like Figure 5 As shown, this embodiment also provides an anomaly detection device for network slices, including a second acquisition module 41, a construction module 42, and a load balancing module 43. The second acquisition module 41 is used to acquire network slices with abnormal load and their preset expansion range. The construction module 42 is connected to the second acquisition module 41 and is used to construct a digital twin corresponding to the network slice with abnormal load. The load balancing module 43 is connected to the construction module 42 and the second acquisition module 41 respectively and is used to update the resource quota of the network slice with abnormal load according to the preset expansion range and the digital twin, so as to balance the load of the network slice with abnormal load.

[0090] Specifically, the load balancing module 43 includes a determining unit 431 and an updating unit 432. The determining unit 431 is used to determine the target expansion range of the network slice with abnormal load based on the preset expansion range and the digital twin. The updating unit 432 is used to update the resource quota of the network slice with abnormal load based on the target expansion range, so as to achieve load balancing of the network slice with abnormal load.

[0091] Specifically, the determining unit 431 includes: a setting subunit, an updating subunit, an evaluation subunit, a determining subunit, and an adjusting subunit. The setting subunit is used to set i=1 and set the first expansion range as a preset expansion range. The updating subunit is used to update the resource quota of the digital twin according to the i-th expansion range to obtain the digital twin after the i-th expansion. The evaluation subunit is used to evaluate the balance index of the digital twin after the i-th expansion and determine the size of the balance index and the third preset value. The determining subunit is used to determine the i-th expansion range as the target expansion range of the network slice with abnormal load in response to the balance index being equal to or greater than the third preset value, and end the process. The adjusting subunit is used to adjust the i-th expansion range according to the preset rules in response to the balance index being less than the third preset value to obtain the (i+1)-th expansion range. The determining subunit is also used to set i=i+1 and repeat until the balance index is equal to or greater than the third preset value, and determine the i-th expansion range as the target expansion range of the network slice with abnormal load.

[0092] Understandably, the network slice anomaly detection device provided above performs the network slice anomaly detection method corresponding to Embodiment 1 provided above. Therefore, the beneficial effects it can achieve can be referred to the beneficial effects of the scheme corresponding to the network slice anomaly detection method of Embodiment 1 above, which will not be repeated here.

[0093] Example 5:

[0094] This embodiment also provides an electronic device, including a memory and a processor. The memory stores a computer program, and the processor is configured to run the computer program to implement the network slice anomaly detection method in Embodiment 1 or the network slice anomaly detection method in Embodiment 2.

[0095] Example 6:

[0096] This embodiment also provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the network slice anomaly detection method in Embodiment 1 or the network slice anomaly detection method in Embodiment 2.

[0097] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. An anomaly detection method for network slices, characterized in that, include: Obtain operational profiles for several network slices, where the operational profiles include multi-dimensional operational status data; The operational status indicators of several network slices are evaluated based on the operational profile. These operational status indicators include the comprehensive imbalance coefficient and the health load index. Network slices with abnormal loads are detected. Network slices with abnormal loads refer to network slices whose comprehensive imbalance coefficient and healthy load index have reached the first preset value and the second preset value, respectively.

2. The anomaly detection method for network slices according to claim 1, characterized in that, The acquisition of operational profiles of several network slices specifically includes: Acquire multi-dimensional operational status data for several network slices, including CPU utilization data, NUMA non-uniform memory access data, link data, and service-aware data. By treating network slices as nodes and multi-dimensional operational status data as node attributes, operational profiles of several network slices are constructed.

3. The anomaly detection method for network slices according to claim 1, characterized in that, The evaluation of operational status indicators for several network slices based on operational profiles specifically includes: The computational balance, link balance, and service awareness of several network slices are evaluated based on the multi-dimensional operational status data. Based on the calculation balance, link balance, and service awareness, the comprehensive imbalance coefficient of several network slices is evaluated. Based on the comprehensive imbalance coefficient and the preset load index, the health load index of several network slices is evaluated.

4. A load balancing method for network slicing, characterized in that, include: Obtain network slices with abnormal load and their preset expansion range, wherein the network slices with abnormal load are obtained by the network slice anomaly detection method according to any one of claims 1-3; Construct digital twins of network slices with abnormal loads; Based on the preset expansion range and digital twin, update the resource quotas of network slices with abnormal loads to achieve load balancing of network slices with abnormal loads.

5. The load balancing method for network slicing according to claim 4, characterized in that, The step of updating the resource quotas of network slices with abnormal loads based on preset expansion ranges and digital twins to achieve load balancing of network slices with abnormal loads specifically includes: Based on the preset expansion range and the digital twin, determine the target expansion range for network slices with abnormal loads; Update the resource quotas of network slices with abnormal load according to the target expansion amount, so as to balance the load of network slices with abnormal load.

6. The load balancing method for network slicing according to claim 5, characterized in that, The step of determining the target expansion range of network slices with abnormal load based on the preset expansion range and the digital twin specifically includes: S1, let i=1, and set the first expansion range to the preset expansion range; S2, update the resource quota of the digital twin according to the i-th expansion range to obtain the digital twin after the i-th expansion; S3, evaluate the balance index of the digital twin after the i-th expansion, and determine the magnitude of the balance index compared with the third preset value; In response to the balancing index being equal to or greater than the third preset value, the i-th expansion range is determined as the target expansion range for the network slice with abnormal load, and the process ends. If the equilibrium index is less than the third preset value, proceed to step S4; S4, adjust the i-th expansion range according to the preset rules to obtain the (i+1)-th expansion range; S5, let i = i + 1, and repeat S2-S4 until the balancing index is equal to or greater than the third preset value, and determine the i-th expansion range as the target expansion range of the network slice with abnormal load.

7. An anomaly detection device for network slicing, characterized in that, It includes a first acquisition module, an evaluation module, and a detection module. The first acquisition module is used to acquire operational profiles of several network slices, whereby the operational profiles include multi-dimensional operational status data. The evaluation module, connected to the first acquisition module, is used to evaluate the operational status indicators of several network slices based on the operational profile. These operational status indicators include a comprehensive imbalance coefficient and a health load index. The detection module, connected to the evaluation module, is used to detect network slices with abnormal loads. Network slices with abnormal loads refer to network slices whose comprehensive imbalance coefficient and healthy load index reach the first preset value and the second preset value, respectively.

8. A load balancing device for network slicing, characterized in that, It includes a second acquisition module, a construction module, and a load balancing module. The second acquisition module is used to acquire network slices with abnormal loads and their preset expansion ranges, wherein the network slices with abnormal loads are obtained by the network slice anomaly detection device as described in claim 7. The construction module, connected to the second acquisition module, is used to construct digital twins corresponding to network slices with abnormal loads. The load balancing module, connected to the construction module and the second acquisition module respectively, is used to update the resource quota of network slices with abnormal load according to the preset expansion range and digital twin, so as to balance the load of network slices with abnormal load.

9. An electronic device, characterized in that, The device includes a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to implement an anomaly detection method for a network slice as described in any one of claims 1 to 3 or a load balancing method for a network slice as described in any one of claims 4 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements an anomaly detection method for network slices as described in any one of claims 1 to 3 or a load balancing method for network slices as described in any one of claims 4 to 6.

Images