System and method for monitoring direct connection equipment by switch

Abstract

The invention discloses a system and a method for monitoring direct connection equipment by a switch, which belong to the field of network equipment monitoring, and are characterized in that after the switch receives a link signal from the direct connection equipment, link handshake mechanism parameters are recorded; collecting a feature set containing a handshake parameter and an electrical layer connection noise parameter at a set time interval; constructing a basic link behavior model of the direct connection equipment; comparing the newest feature with the model, and generating an initial abnormal identifier if the newest feature exceeds a threshold value; extracting physical layer disturbance data in a corresponding time period, reconstructing an anomaly enhancement vector, and judging an anomaly type through a classification model; when a physical layer intermittent fault appears and repeatedly appears in a plurality of periods, generating an equipment failure early warning signal; when the sudden high-frequency disturbance is identified, the sampling frequency is increased and key monitoring is carried out; according to the invention, active perception and fault early warning of the terminal equipment without the management protocol can be realized, and the link security and the equipment availability are improved.

Description

Technical Field

[0001] This invention relates to the field of network device monitoring, and specifically to a system and method for monitoring directly connected devices by a switch. Background Technology

[0002] In current data center and edge computing environments, a large number of terminal devices (such as servers, industrial gateways, and cameras) are directly connected to switches without intermediate network management nodes to reduce network latency and deployment complexity. However, in actual operation, because switches only perform link detection on the upper-layer network structure (such as routers and controllers) by default, they lack an effective availability monitoring mechanism for directly connected terminal devices. This results in the inability to detect device failures, unexpected power outages, or abnormal connection states in a timely manner, leading to problems such as service interruptions and data loss.

[0003] Especially in industrial scenarios or unattended environments, directly connected devices often experience intermittent offline due to non-network layer factors such as vibration, voltage fluctuations, and humidity changes. Such anomalies are difficult to identify in traditional switches. At the same time, since directly connected devices usually do not have management capabilities such as SNMP (Simple Network Management Protocol), switches cannot monitor and model their operating status in a conventional way, further exacerbating the blind spots in device monitoring.

[0004] In summary, how to enable switches to proactively detect and model the operational status of directly connected devices without relying on additional network management protocols or third-party probes has become a key issue that urgently needs to be addressed in the current network management field. Summary of the Invention

[0005] The purpose of this invention is to provide a monitoring system and method for a switch to monitor directly connected devices, in order to address the shortcomings in the prior art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for monitoring directly connected devices by a switch, comprising: S100. After the switch receives the link signal from the directly connected device, it records the link handshake mechanism parameter P of the directly connected device, including the handshake response delay, link establishment time and physical rate negotiation value. S200. Collect continuous link signal feature sets Q1, Q2, ..., Qi, ..., Qn of directly connected devices at set time intervals, wherein each group Qi includes the link handshake mechanism parameter Pi and the electrical layer connection noise parameter Ni at time i. S300. Construct a basic link behavior model M for directly connected devices based on the continuous link signal feature set, which is used to characterize the link feature range of directly connected devices under stable operating conditions. S400. Compare the basic link behavior model with the latest feature set Q(n+1) collected in the current period. If any feature value in Q(n+1) exceeds the normal threshold range, generate an initial anomaly identifier E1. S500: Based on the parameter type indicated by the initial anomaly identifier E1, extract the physical layer disturbance data R corresponding to the time period from the switch port buffer, including bit error rate, signal reflectivity and port voltage surge. S600. Combine physical layer perturbation data R and Q(n+1) to perform feature reconstruction, generate an anomaly enhancement vector E2, and determine the anomaly category accordingly. S700 If the judgment result is an intermittent physical layer fault, and the abnormal enhancement vector E2 appears stably over multiple cycles, a direct-connected device failure warning signal is generated; if the judgment result is a sudden high-frequency disturbance, the port is added to the key monitoring list and the sampling frequency is increased.

[0007] Preferably, S300 includes: S301. Sort the obtained continuous link signal feature set by time series, and remove outliers from the handshake mechanism parameter Pi and electrical layer connection noise parameter Ni of each link to obtain an effective feature dataset. S302. Based on the effective feature dataset, calculate the statistical distribution range of each link handshake mechanism parameter Pi and electrical layer connection noise parameter Ni within the stable sampling period to form the corresponding feature benchmark range. S303. Merge the feature benchmark ranges according to preset weights to construct a set of multi-dimensional link behavior feature vectors for directly connected devices; S304. Generate a basic link behavior model M based on a set of multi-dimensional link behavior feature vectors.

[0008] Preferably, S400 includes: S401. Receive the latest feature set Q(n+1) and extract the corresponding link handshake mechanism parameters and electrical layer connection noise parameters from it to construct the multi-dimensional link behavior feature vector V(n+1) for the current period. S402. Compare the feature vector V(n+1) with the mean vector and covariance matrix in the basic link behavior model to obtain its similarity score D in the model distribution space. S403. Compare the similarity score D with the preset threshold U. If D is greater than U, it is determined that the current feature has deviated. S404. Generate an initial anomaly identifier E1 based on the parameter dimension and deviation magnitude of the deviation.

[0009] Preferably, S600 includes: S601. Concatenate the link behavior feature vector of the current period with the physical layer disturbance data to construct a high-dimensional joint feature vector containing link handshake mechanism parameters, electrical layer connection noise parameters and physical disturbance features. S602. Normalize the joint feature vector and extract the most discriminative feature components based on the principal component analysis algorithm to form the anomaly enhancement vector E2. S603. Input the anomaly enhancement vector into the anomaly classification model built during the training phase, and output the anomaly category label according to the position of the vector in different classification boundaries. S604. Based on the anomaly category label, determine that the currently directly connected device is in one of the following states: physical link anomaly, electrical interference anomaly, or link performance degradation.

[0010] Preferably, S700 includes: S701. Perform time series analysis on the abnormal enhancement vector E2 obtained in multiple consecutive monitoring periods to determine whether the abnormal enhancement vector exhibits a stable and recurring characteristic pattern within a preset number of consecutive periods. S702. When the anomaly category corresponding to the anomaly enhancement vector is determined to be an intermittent physical layer fault, and the feature pattern remains consistent over multiple consecutive cycles, a warning judgment result indicating that the directly connected device has a risk of failure is generated. S703. Based on the early warning judgment result, generate a direct-connected device failure early warning signal; S704. When the anomaly category corresponding to the anomaly enhancement vector is determined to be a sudden high-frequency disturbance, the corresponding switch port is added to the key monitoring list, and the link feature sampling frequency of the port is increased.

[0011] Preferably, S100 includes: The handshake response delay refers to the time interval between the switch port receiving the response signal from the directly connected device after sending a link probe frame; the link establishment time refers to the total time from when the switch detects a change in the physical connection status to when the entire link negotiation process is completed; the physical rate negotiation value refers to the transmission rate value of the link that is finally successfully negotiated.

[0012] The present invention also provides a monitoring system for a switch to directly connected devices, comprising: The link handshake parameter acquisition module records the link handshake mechanism parameters P of the directly connected device after the switch receives the link signal from the directly connected device, including the handshake response delay, link establishment time, and physical rate negotiation value. The link feature acquisition module acquires continuous link signal feature sets Q1, Q2, ..., Qi, ..., Qn of directly connected devices at set time intervals, where each group Qi includes the link handshake mechanism parameter Pi and the electrical layer connection noise parameter Ni at time i. The link behavior modeling module constructs a basic link behavior model M for directly connected devices based on the continuous link signal feature set, which is used to characterize the link feature range of directly connected devices under stable operating conditions. The feature anomaly determination module compares the basic link behavior model with the latest feature set Q(n+1) collected in the current period. If any feature value in Q(n+1) exceeds the normal threshold range, an initial anomaly identifier E1 is generated. The physical layer disturbance extraction module extracts physical layer disturbance data R for the corresponding time period from the switch port buffer based on the parameter type indicated by the initial anomaly identifier E1, including bit error rate, signal reflectivity and port voltage surge. The enhanced feature generation and classification module combines physical layer perturbation data R and Q(n+1) to reconstruct features, generate an anomaly enhancement vector E2, and determine the anomaly category based on it; If the monitoring and control module determines that the physical layer is experiencing an intermittent fault and the abnormal enhancement vector E2 appears stably over multiple cycles, it will generate a direct-connected device failure warning signal. If the determination result is a sudden high-frequency disturbance, the port will be added to the key monitoring list and the sampling frequency will be increased.

[0013] The technical effects and advantages provided by the present invention in the above technical solution are as follows: 1. This invention constructs a feature set including link handshake mechanism parameters and electrical layer connection noise parameters, and establishes a link behavior model based on time series data, effectively characterizing the behavioral features of directly connected devices under stable operating conditions. Compared to traditional methods that rely solely on link status judgment, this scheme can precisely identify link performance fluctuations and early abnormal trends, significantly improving the granularity and accuracy of the switch's perception of the operating status of directly connected devices.

[0014] 2. This invention integrates physical layer disturbance data and link behavior characteristics to reconstruct a high-dimensional anomaly enhancement vector, and introduces a classification model to accurately identify anomaly types. It can not only distinguish between various fault modes such as physical link anomalies, electrical interference, and performance degradation, but also realize early warning and dynamic sampling adjustment of equipment failure risks based on the evolution trend of enhancement features in the time series, thereby significantly improving the stability of network operation and maintenance efficiency. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0016] Figure 1 This is a flowchart of the method of the present invention.

[0017] Figure 2 This is a flowchart of the system modules of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Example 1, please refer to Figure 1 As shown in this embodiment, a method for monitoring directly connected devices by a switch includes: S100. After the switch receives the link signal from the directly connected device, it records the link handshake mechanism parameters P of the directly connected device, including the handshake response delay, link establishment time, and physical rate negotiation value.

[0020] In this invention, when a switch detects a link establishment event on a port, i.e., receives a link signal from a directly connected device, it initiates link handshake mechanism parameter acquisition and records the initialization information of the currently directly connected device on that port. The link handshake mechanism parameter P includes at least the following three items: Handshake Response Delay (T1): This refers to the time interval between when a switch port receives a response signal from a directly connected device after sending a link probe frame (such as an Ethernet probe or LLDP frame). This delay reflects the responsiveness of the directly connected device and the stability of the link in its initial stages.

[0021] Link establishment time (T2): This refers to the total time from when the switch detects a change in the physical connection status to when the entire link negotiation process (including duplex mode, rate negotiation, flow control capability confirmation, etc.) is completed. This time is usually significantly longer when there are abnormal physical connections of the device or firmware aging.

[0022] Physical Rate Negotiation Value (R1): This refers to the final successfully negotiated transmission rate value of the link, such as 100Mbps, 1Gbps, 10Gbps, etc. It is used to identify whether the device has a rate degradation phenomenon or abnormal negotiation (for example, it should support gigabit speeds but only negotiates to 100Mbps).

[0023] During the data collection process, the switch stores the parameter P in a structured record format in the local port parameter table and attaches the current timestamp for subsequent trend modeling.

[0024] For example, when port eth3 is connected to an edge gateway device, the switch detects a link trigger signal on this port and collects the following parameters: Handshake response delay T1 = 12ms; Link establishment time T2 = 97ms; Physical rate negotiation value R1 = 1000 Mbps; The above parameters are encapsulated as P={12,97,1000} and recorded in the corresponding data structure of eth3.

[0025] S200. Collect continuous link signal feature sets Q1, Q2, ..., Qi, ..., Qn of directly connected devices at set time intervals, where each group Qi includes the link handshake mechanism parameter Pi and the electrical layer connection noise parameter Ni at time i.

[0026] Based on the initial link handshake mechanism parameter P obtained in step S100, the switch enters a periodic monitoring mode, continuously collecting link signal feature set Qi from directly connected devices at set time intervals T (e.g., 10 seconds, 30 seconds, or according to user configuration). The feature set Qi consists of two parts: Link handshake mechanism parameter Pi: ​​The set of handshake parameters re-recorded at the i-th sampling time, including handshake response delay. Link establishment time Physical rate negotiation value This is used to compare changes in the link negotiation behavior of devices at different times; Electrical layer connection noise parameter Ni: Reflects the physical layer abnormal signal index detected by the switch port during the i-th sampling period, and includes at least the following: Short-term bit error rate The bit error rate measured within a micro-time window, typically expressed in units of 1. The level reflects the stability of the line; echo reflection amplitude This indicates the degree of impedance mismatch in the connection line. A high reflection value may indicate cable damage or a loose connection. Voltage jump number The number of instantaneous abnormal voltage jumps detected at the switch port during the monitoring period may be caused by poor contact, power interference, or momentary interruption.

[0027] Each feature set Qi = {Pi, Ni} has the following specific form: ; ; For example, in a specific environment, switch port eth3 performs link feature collection every 30 seconds, forming the following partial continuous feature sequence: Q1={{12ms,95ms,1000Mbps},{1.2× -18dB, 2 times; Q2={{11ms,97ms,1000Mbps},{1.4× -17dB, 3 times; Q3={{13ms,110ms,100Mbps},{2.6× -12dB, 7 times; As shown above, over time, feature sets Q1, Q2, ..., Qi, ..., Qn are gradually accumulated. These data will serve as the basic input data for constructing the device link behavior model M in the subsequent step S300, and will be used to identify the feature differences of the device in normal and abnormal states.

[0028] S300. Construct a basic link behavior model M for directly connected devices based on the continuous link signal feature set, which is used to characterize the link feature range of directly connected devices under stable operating conditions.

[0029] Step S301: The switch first sorts the collected feature sets Q1 to Qn by time series, based on the timestamps corresponding to each feature set, arranged sequentially from the earliest collection time. After sorting, the switch extracts the link handshake mechanism parameters Pi (including handshake response delay, link establishment time, and physical rate negotiation value) and electrical layer connection noise parameters Ni (including short-term bit error rate, echo reflection amplitude, and voltage transition count) corresponding to each time point.

[0030] To ensure data quality, the exchange performs outlier removal on all parameters. A moving median filtering algorithm is used, with a moving window length of 5. A median baseline is established for each parameter, and the deviation of each sample point from the median is calculated. If a data point deviates from the median by more than three standard deviations, it is considered an outlier and removed. The removed data constitutes the effective feature dataset, denoted as Q′1 to Q′m, where m ≤ n.

[0031] Step S302: The switch performs statistical analysis on each type of parameter in the valid feature dataset to determine its normal distribution range within a stable sampling period. Specifically, for handshake response delay, link establishment time, physical rate negotiation value, short-term bit error rate, echo reflection amplitude, and voltage jump count, the following values ​​are calculated: average value; standard deviation; maximum and minimum values; and 95% confidence interval.

[0032] The statistical distribution interval is constructed using a parameter estimation method based on a normal distribution. For example, for handshake response delay, let its mean be A and its standard deviation be B, then its characteristic baseline range is defined as [A−2B, A+2B], which serves as the stable operating threshold range for this parameter. All parameters have their characteristic baseline ranges defined in this manner.

[0033] Step S303: To integrate the capabilities of parameters from different dimensions expressed in the same modeling space, the switch fuses the feature baseline ranges of each parameter based on empirical weights or training data weights. Let the fusion weights for handshake response delay, link establishment time, and physical rate negotiation value be w1, w2, and w3, respectively, and the fusion weights for each parameter in the electrical layer connection noise be w4, w5, and w6. The weights must satisfy w1 + w2 + w3 + w4 + w5 + w6 = 1. These weights can be set through prior experience or obtained through training on a large-scale sample.

[0034] After fusion, a set of multi-dimensional link behavior feature vectors is generated, each vector corresponding to an effective feature sampling period, in the form of: There are a total of m feature vectors, denoted as V1 to Vm.

[0035] Step S304: The switch uses the constructed multi-dimensional link behavior feature vector set V1 to Vm as input samples and employs a Gaussian mixture clustering-based modeling algorithm to generate a basic link behavior model M. The specific steps are as follows: Set the number of clusters K in the model. The default K=3, which corresponds to the highly stable state, the normal fluctuation state, and the boundary anomaly state. The eigenvector set is trained using the expectation-maximization algorithm, and the mean vector μ and covariance matrix Σ are output for each dimension. The trained Gaussian mixture model is used as model M to characterize the typical link feature distribution of the current directly connected devices.

[0036] S400. Compare the basic link behavior model with the latest feature set Q(n+1) collected in the current period. If any feature value in Q(n+1) exceeds the normal threshold range, generate an initial anomaly identifier E1.

[0037] Step S401: After completing the construction of the basic link behavior model, the switch enters the real-time monitoring stage. After collecting the link signal feature set Q(n+1) of the current period, the link handshake mechanism parameters (handshake response delay, link establishment time, physical rate negotiation value) and electrical layer connection noise parameters (short-term bit error rate, echo reflection amplitude, voltage jump number) contained in the feature set are extracted first.

[0038] Subsequently, according to the weight configuration adopted in the model construction phase, the parameters are weighted to construct the multi-dimensional link behavior feature vector V(n+1) for the current period, represented as: Among them, w1 to w6 are the feature fusion weights set in the basic link behavior model stage, and the sum of all weights is 1.

[0039] Step S402: To determine whether the current feature conforms to the stable state feature range described by the model, the switch uses the Mahalanobis distance calculation method to compare the current feature vector V(n+1) with the mean vector μ and covariance matrix Σ in the basic link behavior model, calculating its deviation in the model distribution space. The Mahalanobis distance is calculated as follows: T is the vector transpose; this method can comprehensively consider the covariance relationship between various features, thereby accurately reflecting the overall abnormality of the features.

[0040] Step S403: The switch pre-sets a similarity scoring threshold U to identify abnormal states. The threshold U is the Mahalanobis distance confidence boundary value obtained in the large sample space during the training phase, and is generally taken as the 95th percentile value of the normal state feature distribution within the model.

[0041] If the calculated similarity score D is greater than the preset threshold U, it indicates that the current feature V(n+1) deviates significantly from the model distribution, and the switch determines that the current link status has an abnormal trend.

[0042] Step S404: After identifying the abnormal characteristics, the switch further analyzes the source and extent of the anomaly. Specifically, this includes: Identify the main parameter dimensions that cause the similarity score D to exceed the threshold U; Calculate the offset direction (above or below the mean) and the deviation magnitude (difference from the mean) for each outlier dimension. Based on the deviation characteristics, an initial anomaly identifier E1 is generated.

[0043] The initial anomaly identifier E1 is represented in the form of structured data, including the time of anomaly occurrence, anomaly parameter name, offset direction, offset value, and corresponding similarity score D, which serves as the input basis for subsequent enhanced anomaly analysis and classification identification.

[0044] S500: Based on the parameter type indicated by the initial anomaly identifier E1, extract the physical layer disturbance data R corresponding to the time period from the switch port buffer, including bit error rate, signal reflectivity and port voltage fluctuation.

[0045] In this invention, each physical port of the switch is equipped with a ring buffer structure to record low-level electrical signal characteristics related to the link layer in real time. The sampling period is 1 second, covering historical data of the most recent 300 seconds. Each record is accompanied by a timestamp and synchronized with the feature data collected from higher layers to ensure data correlation.

[0046] When the initial anomaly flag E1 indicates a deviation in one or more link behavior parameters, the switch resolves the specific parameter type and the corresponding anomaly occurrence time Te. Then, it performs the following operations: Determine the data extraction window: Based on time Te, locate the physical layer sampling data 30 seconds before and after in the port buffer, and construct a time window of [Te−30,Te+30] seconds; Extracting disturbance parameters: Within this time window, the switch extracts the following three types of electrical layer disturbance parameters to form a disturbance dataset R: Bit error rate: The ratio of the total number of erroneous bits received by a port within a statistical window to the total number of transmitted bits, expressed as an error ratio (e.g., ...). ); Signal reflectivity: The ratio of the echo strength of the signal transmitted on the link to the original signal strength, usually expressed in decibels, is used to evaluate the impedance matching of the physical connection. Port voltage surge: The number of abnormal voltage surge events that occur within a statistical time window. A surge event is defined as a voltage jump that exceeds a set threshold (e.g., 500 millivolts) within 1 millisecond.

[0047] Structured storage of perturbation data R: The above three parameters are encapsulated into a structured vector in a time-aligned manner, represented as: R={BER[Te],ERR[Te],TVC[Te]}; where: BER[Te] represents the average bit error rate within the time window; ERR[Te] represents the maximum echo reflection ratio within the time window; and TVC[Te] represents the total number of port voltage surges.

[0048] For example, during a certain monitoring period, the switch identifies a significant increase in the link establishment time on port eth5, generating an initial anomaly flag E1. Based on the anomaly occurrence time indicated in E1 as Te=12:03:17, the switch extracts electrical disturbance data from the physical layer buffer of eth5 for the period [12:02:47 to 12:03:47], obtaining the following parameter: BER[Te]= ERR[Te] = -13.2 dB; TVC[Te] = 9 times. This dataset R will be used as input for subsequent anomaly enhancement analysis to further determine whether the link performance anomalies are caused by physical factors such as link quality degradation, poor cable contact, or power instability.

[0049] S600. Combine the physical layer perturbation data R and Q(n+1) to perform feature reconstruction, generate an anomaly enhancement vector E2, and determine the anomaly category based on it.

[0050] Step S601: The switch receives the link behavior feature vector V(n+1) for the current period. This vector consists of link handshake mechanism parameters and electrical layer connection noise parameters, containing a total of 6 dimensions. At the same time, the switch obtains the physical layer disturbance data R corresponding to the time window from the physical layer buffer, which includes bit error rate, signal reflectivity, and port transient voltage, totaling 3 dimensions.

[0051] V(n+1) and R are concatenated according to their feature order to generate a 9-dimensional high-dimensional joint feature vector F, in the form of: F=[T1,T2,R1,BER,ERR,TVC,RBER,RERR,RTVC]; where: T1,T2,R1 are handshake mechanism parameters; BER,ERR,TVC are electrical layer connection noise parameters; RBER,RERR,RTVC are physical layer perturbation parameters.

[0052] Step S602: To eliminate the influence of parameters with different dimensions on subsequent model training and recognition, the switch performs normalization processing on the joint feature vector FFF, using the range normalization method to map all features to the [0,1] interval. The normalization method is as follows: Where Fi represents the original feature value, and Fmin and Fmax represent the historical minimum and maximum values ​​of the feature, respectively. The normalized vector is denoted as F′, and Principal Component Analysis (PCA) is then performed using F′ as input. The PCA modeling process is as follows: Calculate the covariance matrix of F′; Eigenvalue decomposition of the covariance matrix is ​​performed to obtain the principal component directions; Select the top principal component vectors with a cumulative contribution rate of over 90%, usually the first 3 dimensions; The original normalized features are projected onto the principal component space to generate the anomaly enhancement vector E2.

[0053] The vector E2 extracts the most discriminative composite anomaly features, which are used to improve the accuracy of subsequent anomaly classification.

[0054] Step S603: The switch inputs the anomaly enhancement vector E2 into the anomaly classification model. This model is a multi-class discrimination model built based on a large number of labeled samples during the training phase. It is trained using the support vector machine algorithm, and the model structure includes: Input layer: Receives enhanced feature vectors; Kernel function: Uses Gaussian radial basis function as the nonlinear mapping kernel; Classification boundary: Divides different anomaly types in high-dimensional space using the maximum margin principle. Three anomaly boundaries are defined during model training: Category 1: Physical link anomaly; Category 2: Electrical interference anomaly; Category 3: Link performance degradation. After inputting the enhanced vector E2 into the model, the anomaly category label is output based on its position within the classification boundary.

[0055] Step S604: The switch determines the current anomaly based on the labels output by the classification model: If the output is Category 1, it indicates that the feature deviation is concentrated in dimensions such as signal reflectivity, bit error rate, and physical rate negotiation, suggesting that the directly connected device may have poor physical link contact, aging, or loose cables; if the output is Category 2, it indicates that the main components of the anomaly are concentrated in voltage jumps and reflection deviations, suggesting that there is strong electrical interference, unstable power supply, or port common-mode voltage disturbance around the device; if the output is Category 3, it indicates that the feature deviation is small but persistent in multiple dimensions, suggesting that the link performance is degrading, possibly due to changes in device load or temperature rise. The switch stores the classification results and the anomaly enhancement vector together, and uses them as the basis for subsequent key monitoring and alarm decisions.

[0056] S700 If the judgment result is an intermittent physical layer fault, and the abnormal enhancement vector E2 appears stably over multiple cycles, a direct-connected device failure warning signal is generated; if the judgment result is a sudden high-frequency disturbance, the port is added to the key monitoring list and the sampling frequency is increased.

[0057] Step S701: The switch stores the anomaly enhancement vector E2 generated in each cycle in a time-series buffer bound to the port. This buffer supports a fixed-length rolling window structure to record the anomaly enhancement vector data of the most recent N cycles. The default value of N is 10, which can be configured according to the actual scenario.

[0058] For consecutive E2(n−9) to E2(n), the switch performs a time series analysis process, which mainly includes the following two sub-steps: Vector distance stability determination: Calculate the Euclidean distance between the enhancement vectors of any adjacent periods. If the distance is less than the set threshold δ for S consecutive periods, it is considered that the abnormal mode is stably repeated. The threshold δ is set according to the normal state fluctuation range obtained during the model training phase. Category consistency test: Extract the corresponding anomaly category label sequence. If S consecutive labels are all identified as "physical layer intermittent fault", then the anomaly is considered to be consistent.

[0059] S is set to 5 by default to ensure that the results have time continuity and statistical significance.

[0060] Step S702: Once the stability determination condition of step S701 is met, the switch generates an early warning determination result. The early warning rules are as follows: If the fluctuation range of the abnormal enhancement vector is lower than the threshold δ in S consecutive cycles, and the corresponding abnormal category is physical layer intermittent fault; This indicates that the currently directly connected device has a periodic or intermittent risk of physical layer instability. Such risks are typically related to interface aging, poor contact, loose cables, or changes in environmental stress (such as vibration or temperature differences). This determination will be processed in subsequent alarm procedures.

[0061] Step S703: The switch generates a failure warning signal for the directly connected device based on the determination result of step S702. This warning signal includes the following fields: abnormal port number; unique identifier of the corresponding directly connected device; warning trigger time; summary of the abnormal enhancement vector change trend; and predicted risk level (e.g., high, medium, low). This signal is sent to the upper-layer network management platform through the management interface to remind on-duty personnel to inspect or replace potentially faulty directly connected devices.

[0062] Step S704: If the current period classification result of the abnormal enhancement vector is determined to be a sudden high-frequency disturbance, it indicates that the physical link connected to the device is subjected to short-term high-frequency external interference, which may be caused by electromagnetic pulses, power supply jitter, or device-side abnormalities. Therefore, the switch performs the following policy adjustment steps: Add the port where the anomaly occurred to the key monitoring list and set its status to high-frequency interference; The sampling period of this port can be dynamically adjusted from the default 30 seconds to an interval of 5 seconds or less; Enable continuous sampling mode to ensure that disturbance change characteristics can be captured in real time; The frequency and amplitude of disturbances are recorded synchronously for subsequent trend analysis and interference source localization.

[0063] This strategy enables the switch to have higher response sensitivity and data accuracy when facing sudden disturbances, thereby ensuring early detection and early location of link anomalies.

[0064] Example 2, please refer to Figure 2 As shown in this embodiment, a monitoring system for directly connected devices via a switch includes: The link handshake parameter acquisition module records the link handshake mechanism parameters P of the directly connected device after the switch receives the link signal from the directly connected device, including the handshake response delay, link establishment time, and physical rate negotiation value. The link feature acquisition module acquires continuous link signal feature sets Q1, Q2, ..., Qi, ..., Qn of directly connected devices at set time intervals, where each group Qi includes the link handshake mechanism parameter Pi and the electrical layer connection noise parameter Ni at time i. The link behavior modeling module constructs a basic link behavior model M for directly connected devices based on the continuous link signal feature set, which is used to characterize the link feature range of directly connected devices under stable operating conditions. The feature anomaly determination module compares the basic link behavior model with the latest feature set Q(n+1) collected in the current period. If any feature value in Q(n+1) exceeds the normal threshold range, an initial anomaly identifier E1 is generated. The physical layer disturbance extraction module extracts physical layer disturbance data R for the corresponding time period from the switch port buffer based on the parameter type indicated by the initial anomaly identifier E1, including bit error rate, signal reflectivity and port voltage surge. The enhanced feature generation and classification module combines physical layer perturbation data R and Q(n+1) to reconstruct features, generate an anomaly enhancement vector E2, and determine the anomaly category based on it; If the monitoring and control module determines that the physical layer is experiencing an intermittent fault and the abnormal enhancement vector E2 appears stably over multiple cycles, it will generate a direct-connected device failure warning signal. If the determination result is a sudden high-frequency disturbance, the port will be added to the key monitoring list and the sampling frequency will be increased.

[0065] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A method for monitoring directly connected devices by a switch, characterized in that: include: S100. After the switch receives the link signal from the directly connected device, it records the link handshake mechanism parameter P of the directly connected device, including the handshake response delay, link establishment time and physical rate negotiation value. S200. Collect continuous link signal feature sets Q1, Q2, ..., Qi, ..., Qn of directly connected devices at set time intervals, wherein each group Qi includes the link handshake mechanism parameter Pi and the electrical layer connection noise parameter Ni at time i. S300. Construct a basic link behavior model M for directly connected devices based on the continuous link signal feature set, which is used to characterize the link feature range of directly connected devices under stable operating conditions. S400. Compare the basic link behavior model with the latest feature set Q(n+1) collected in the current period. If any feature value in Q(n+1) exceeds the normal threshold range, generate an initial anomaly identifier E1. S500: Based on the parameter type indicated by the initial anomaly identifier E1, extract the physical layer disturbance data R corresponding to the time period from the switch port buffer, including bit error rate, signal reflectivity and port voltage fluctuation. S600. Combine the physical layer perturbation data R and Q(n+1) to perform feature reconstruction, generate an anomaly enhancement vector E2, and determine the anomaly category accordingly. S700. If the judgment result is an intermittent physical layer fault, and the abnormal enhancement vector E2 appears stably over multiple cycles, a direct-connected device failure warning signal is generated. If the result indicates a sudden high-frequency disturbance, the port will be added to the key monitoring list, and the sampling frequency will be increased.

2. The method for monitoring directly connected devices by a switch according to claim 1, characterized in that: The S300 includes: S301. Sort the acquired continuous link signal feature set by time series and remove outliers from the handshake mechanism parameter Pi and electrical layer connection noise parameter Ni of each link to obtain an effective feature dataset. S302. Based on the effective feature dataset, calculate the statistical distribution range of each link handshake mechanism parameter Pi and electrical layer connection noise parameter Ni within the stable sampling period to form the corresponding feature benchmark range. S303. Merge the feature benchmark ranges according to preset weights to construct a set of multi-dimensional link behavior feature vectors for directly connected devices; S304. Generate a basic link behavior model M based on a set of multi-dimensional link behavior feature vectors.

3. The method for monitoring directly connected devices by a switch according to claim 1, characterized in that: The S400 includes: S401. Receive the latest feature set Q(n+1) and extract the corresponding link handshake mechanism parameters and electrical layer connection noise parameters from it to construct the multi-dimensional link behavior feature vector V(n+1) for the current period. S402. Compare the feature vector V(n+1) with the mean vector and covariance matrix in the basic link behavior model to obtain its similarity score D in the model distribution space. S403. Compare the similarity score D with the preset threshold U. If D is greater than U, it is determined that the current feature has deviated. S404. Generate an initial anomaly identifier E1 based on the parameter dimension and deviation magnitude of the deviation.

4. A method for monitoring directly connected devices by a switch according to claim 1, characterized in that: The S600 includes: S601. Concatenate the link behavior feature vector of the current period with the physical layer disturbance data to construct a high-dimensional joint feature vector containing link handshake mechanism parameters, electrical layer connection noise parameters and physical disturbance features. S602. Normalize the joint feature vector and extract the most discriminative feature components based on the principal component analysis algorithm to form the anomaly enhancement vector E2. S603. Input the anomaly enhancement vector into the anomaly classification model built during the training phase, and output the anomaly category label based on the position of the vector in different classification boundaries. S604. Based on the anomaly category label, determine that the currently directly connected device is in one of the following states: physical link anomaly, electrical interference anomaly, or link performance degradation.

5. A method for monitoring directly connected devices by a switch according to claim 1, characterized in that: The S700 includes: S701. Perform time series analysis on the abnormal enhancement vector E2 obtained in multiple consecutive monitoring periods to determine whether the abnormal enhancement vector exhibits a stable and recurring characteristic pattern within a preset number of consecutive periods. S702. When the anomaly category corresponding to the anomaly enhancement vector is determined to be an intermittent physical layer fault, and the feature pattern remains consistent over multiple consecutive cycles, a warning judgment result indicating that the directly connected device has a risk of failure is generated. S703. Based on the early warning judgment result, generate a direct-connected device failure early warning signal; S704. When the anomaly category corresponding to the anomaly enhancement vector is determined to be a sudden high-frequency disturbance, the corresponding switch port is added to the key monitoring list, and the link feature sampling frequency of the port is increased.

6. A method for monitoring directly connected devices by a switch according to claim 1, characterized in that: S100 includes: The handshake response delay refers to the time interval between the switch port receiving the response signal from the directly connected device after sending a link probe frame; the link establishment time refers to the total time from when the switch detects a change in the physical connection status to when the entire link negotiation process is completed; the physical rate negotiation value refers to the transmission rate value of the link that is finally successfully negotiated.

7. A monitoring system for a switch to directly connected devices, used to implement the monitoring method for a switch to directly connected devices as described in any one of claims 1-6, characterized in that: include: The link handshake parameter acquisition module records the link handshake mechanism parameters P of the directly connected device after the switch receives the link signal from the directly connected device, including the handshake response delay, link establishment time, and physical rate negotiation value. The link feature acquisition module acquires continuous link signal feature sets Q1, Q2, ..., Qi, ..., Qn of directly connected devices at set time intervals, where each group Qi includes the link handshake mechanism parameter Pi and the electrical layer connection noise parameter Ni at time i. The link behavior modeling module constructs a basic link behavior model M for directly connected devices based on the continuous link signal feature set, which is used to characterize the link feature range of directly connected devices under stable operating conditions. The feature anomaly determination module compares the basic link behavior model with the latest feature set Q(n+1) collected in the current period. If any feature value in Q(n+1) exceeds the normal threshold range, an initial anomaly identifier E1 is generated. The physical layer disturbance extraction module extracts physical layer disturbance data R for the corresponding time period from the switch port buffer based on the parameter type indicated by the initial anomaly identifier E1, including bit error rate, signal reflectivity and port voltage surge. The enhanced feature generation and classification module combines physical layer perturbation data R and Q(n+1) to reconstruct features, generate an anomaly enhancement vector E2, and determine the anomaly category based on it; If the monitoring and control module determines that the physical layer is an intermittent fault and the abnormal enhancement vector E2 appears stably over multiple cycles, a direct-connection device failure warning signal will be generated. If the result indicates a sudden high-frequency disturbance, the port will be added to the key monitoring list, and the sampling frequency will be increased.

Images