Network state detection method, device, equipment and chip

Abstract

The invention discloses a network state detection method and device, equipment and a chip, and belongs to the field of data processing. Comprising the steps of obtaining current network operation information of a switch; inputting the network operation information into a network state detection model to obtain a network state detection result; wherein the network state detection model is obtained by training a decision tree by using a plurality of pieces of historical network operation information, and each level in the decision tree corresponds to one of a plurality of attributes contained in the network operation information; the level of each attribute in the plurality of attributes in the decision tree is determined according to the influence degree of the attribute on the network state detection result.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of computers, and particularly relates to a network state detection method, device, equipment and core. BACKGROUND

[0002] With the rapid development of the Internet and the widespread application of cloud computing services, network traffic prediction plays a crucial role in ensuring network stability and security. These models analyze historical and real-time data to predict the trend of network traffic in the future, helping network administrators take proactive measures to avoid network congestion or security incidents. However, existing network state detection technologies have some significant limitations.

[0003] Firstly, these methods usually only detect and classify a single dimension of network traffic data, such as only considering the sending rate of data packets or only focusing on network latency. This method cannot fully utilize multi-dimensional data (such as data packet loss rate, bandwidth usage, network latency, etc.) to comprehensively judge the state of network links. This single-dimensional detection method may lead to misjudgment of the network state and cannot fully reflect the actual operation of the network.

[0004] Secondly, existing technical solutions lack the ability of active learning. They usually rely on pre-set fixed threshold ranges to identify network failures, which cannot adapt to the dynamic changes of network environments. For example, the peak of network traffic may temporarily increase due to special events (such as large online activities), but this does not mean that the network has failed. The fixed threshold method cannot distinguish between such normal fluctuations and real failures, leading to false positives or false negatives.

[0005] These limitations limit the accuracy and efficiency of network state detection, affecting the stability and security of the network. SUMMARY

[0006] The purpose of the embodiments of the present application is to provide a network state detection method, device, equipment and core that can solve the above problems.

[0007] To solve the above technical problems, the present application is implemented as follows: In a first aspect, the embodiments of the present application provide a network state detection method, which comprises: obtaining the current network running information of the switch; inputting the network running information into a network state detection model to obtain a network state detection result; The network state detection model is obtained by training a decision tree using a plurality of historical network operation information, each level in the decision tree corresponds to one attribute of a plurality of attributes contained in the network operation information, and the level of each attribute in the decision tree is determined according to the influence degree of the attribute on the network state detection result.

[0008] Optionally, the method further comprises: obtaining a plurality of historical network operation information in a target time period; labeling the plurality of historical network operation information according to whether the network state is abnormal, and dividing the plurality of historical network operation information after labeling into a training set and a test set; training the decision tree using the training set, and verifying the trained decision tree using the test set; in a case where the classification success rate of the decision tree on the test set is greater than a preset classification success rate threshold, determining that the network state detection model is trained.

[0009] Optionally, the level of each attribute in the decision tree is determined by the following steps, comprising: dividing the training set into a normal data set and an abnormal data set according to the type of the label; the normal data set contains a plurality of historical network operation information indicating a normal network state, and the abnormal data set contains a plurality of historical network operation information indicating an abnormal network state; respectively calculating the expected information amount of the normal data set and the expected information amount of the abnormal data set; for each attribute, dividing into a plurality of first value intervals according to a preset number of subsets and a value range of the attribute; each first value interval corresponds to an attribute subset, and each attribute subset contains historical network operation information in the value interval; determining the information gain of each attribute subset according to the expected information amount of the normal data set, the expected information amount of the abnormal data set, and the expected information amount of each attribute subset; determining the optimized information gain of each attribute subset according to the number of attribute subsets of each attribute, the number of historical network operation information contained in the attribute subset, the expected information amount of the attribute subset, and the information gain of each attribute subset; determining the level of each attribute in the decision tree according to the size order of the optimized information gain of each attribute subset.

[0010] Optionally, the method further comprises: For each attribute, the multiple labeled historical network state information in the training set is classified according to a first value range to which the multiple labeled historical network state information belongs; In the case that the labels of the multiple labeled historical network state information included in the first value range are different, the first value range is divided to obtain multiple second value ranges, the second value range corresponds to a node at a level of the attribute in the decision tree, and the labels of the multiple labeled historical network state information included in the second value range are the same; Based on the level of each attribute in the decision tree and the second value range of each attribute, a decision tree is constructed; Each node at each level in the decision tree corresponds to multiple second value ranges of an attribute, each second value range is labeled with a corresponding label, and each second value range is used to indicate whether the attribute in the network state information is abnormal.

[0011] Optionally, the network running information is input into the network state detection model to obtain a network state detection result, including: According to the second value range in which the value of each attribute is located, it is determined whether the attribute is abnormal in the order of the level sequence of the decision tree from top to bottom; In the case that it is determined that there is an abnormal attribute in the second value range at a level of the decision tree, it is determined that the network state detection result indicates that the current network is abnormal, and whether the attribute at the next level is abnormal is not determined; In the case that it is determined that there is no abnormal attribute in the second value range at a level of the decision tree, it is determined whether the attribute at the next level is abnormal; In the case that it is determined that all attributes are not abnormal, it is determined that the network state detection result indicates that the current network is normal.

[0012] Optionally, the method further includes: After obtaining the network state detection model, the current network running information and the current network state detection result are stored in a database; the current network state detection result is used as a label of the current network running information; The current network running information and the current network state detection result stored in the database within a preset time window are used as a new training set and a new test set to perform secondary training and verification on the network traffic prediction model to obtain an updated network traffic prediction model; According to the attribute corresponding to each level in the decision tree corresponding to the updated network traffic prediction model and the second value range corresponding to the node at each level, the current network running information is detected for network state.

[0013] Optionally, the method further includes: In a case where the network state detection result indicates that the current network is abnormal, the current link of the switch is switched to a backup link by a southward issuing component.

[0014] In a second aspect, an embodiment of the present application provides a network state detection device, and the device comprises: a collection module configured to acquire current network running information of a switch; a detection module configured to input the network running information into a network state detection model to obtain a network state detection result; The network state detection model is obtained by training a decision tree using a plurality of historical network running information, each level in the decision tree corresponds to one attribute of a plurality of attributes contained in the network running information, and the level of each attribute in the decision tree is determined according to an influence degree of the attribute on the network state detection result.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, which comprises a processor, a memory, and a program or instruction stored in the memory and executable on the processor, and the program or instruction is executed by the processor to implement the steps of the method in the first aspect.

[0016] In a fourth aspect, an embodiment of the present application provides a chip, which comprises a processor and a communication interface, the communication interface is coupled with the processor, and the processor is configured to run a program or instruction to implement the steps of the method in the first aspect. In the embodiments of the present application, a network state detection method, device, equipment and chip are provided, and the method comprises: acquiring current network running information of a switch; inputting the network running information into a network state detection model to obtain a network state detection result; wherein the network state detection model is obtained by training a decision tree using a plurality of historical network running information, each level in the decision tree corresponds to one attribute of a plurality of attributes contained in the network running information, and the level of each attribute in the decision tree is determined according to an influence degree of the attribute on the network state detection result.

[0017] Through the technical solutions of the above embodiments, by utilizing the pre-trained network state detection model to analyze the multi-dimensional network running information, the abnormal state of the network can be more accurately identified, thereby improving the accuracy of network state detection. The network state detection model is trained by utilizing rich historical network running information to train the decision tree, thereby realizing accurate prediction of the network state. Each level of the decision tree in the model corresponds to a key attribute in the network running information, and the hierarchical ordering of these attributes in the tree is based on the accurate evaluation of their influence on the network state detection result, so that the network state detection model can give priority to the attributes that have the greatest influence on the network state, thereby improving the accuracy and efficiency of detection. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 is a flowchart of a network state detection method provided by the present application; Figure 2 is a complete flowchart of a network state detection method provided by an embodiment of the present application; Figure 3 is a framework schematic diagram of a network state detection device provided by an embodiment of the present application; Figure 4 is a hardware structure schematic diagram of an electronic device for implementing an embodiment of the present application. DETAILED DESCRIPTION The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0019] The terms "first", "second", and the like in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein. In addition, "and / or" in the specification and claims indicates at least one of the connected objects, and the character " / ", generally indicates that the front and rear associated objects are in a "or" relationship.

[0020] The network state detection method, device, equipment and chip provided by the embodiments of the present application will be described in detail below with reference to the drawings and through specific embodiments and application scenarios.

[0021] Figure 1 is a flowchart of a network state detection method provided by the present application, and reference is made to Figure 1The application provides a network state detection method, which comprises steps S11-S12. In step S11, current network operation information of the switch is acquired.

[0022] In this embodiment, the network data acquisition component of the SDN controller configured in the network is used to collect the current network operation information from the switch in real time.

[0023] The network operation information comprises the IP address of the current link local interconnection, the egress traffic rate of the switch port under the current link , the ingress traffic rate of the switch port under the current link , the ingress packet loss number of the switch port under the current link , the egress packet loss number of the switch port under the current link , the network delay from the customer gateway to the switch port under the current link , the time stamp of the current time and other key performance indicators.

[0024] The network operation information, as multi-dimensional data for evaluating the network state, can reflect the performance and health status of the current network.

[0025] In step S12, the network operation information is input into a network state detection model to obtain a network state detection result. The network state detection model is obtained by training a decision tree using a plurality of historical network operation information, each level of the decision tree corresponds to one attribute of a plurality of attributes contained in the network operation information, and the level of each attribute in the decision tree is determined according to the influence degree of the attribute on the network state detection result.

[0026] In this embodiment, the collected network operation information is input into a pre-trained network state detection model to obtain a network state detection result, and the network state detection result is used to indicate whether the current network state is abnormal or normal. The network state detection model is based on a plurality of historical network running information as a training set and a test set, and is obtained by training a decision tree algorithm. In the decision tree, each level corresponds to an attribute in the network running information, such as an export traffic rate or a network latency. The position (level) of each attribute in the decision tree is determined according to its influence on the network state detection result, that is, important attributes are placed at higher levels of the decision tree so that the attributes are considered first in the classification process of the network state detection model. In this way, the network running information containing multi-dimensional attributes can be evaluated by the network state detection model, and a network state detection result indicating whether the current network state is normal or abnormal can be output, so that the future network state can be predicted based on the network state detection result, and appropriate measures can be taken before the network collapses.

[0027] Through the technical solutions of the above embodiments, by using the pre-trained network state detection model to analyze multi-dimensional network running information, the abnormal state of the network can be more accurately identified, thereby improving the accuracy of network state detection. By classifying and learning multi-dimensional network information data without using the threshold setting method in traditional methods, the decision tree is used to classify network data, thereby improving the accuracy of identifying private line network abnormalities.

[0028] At the same time, the network state detection model is trained by using rich historical network running information to realize accurate prediction of the network state. Each level of the decision tree in the model corresponds to a key attribute in the network running information, and the hierarchical ordering of these attributes in the tree is based on the accurate evaluation of their influence on the network state detection result, so that the network state detection model can give priority to the attributes that have the greatest impact on the network state, thereby improving the accuracy and efficiency of network state detection.

[0029] In combination with the technical solutions of the above embodiments, an embodiment of the present application further provides another network state detection method, which shows the training process of network state detection, and the method further specifically includes steps S21 to S24: Step S21, obtaining a plurality of historical network running information in a target time period. In this embodiment, the network data collection component obtains the network running information from the switch and pushes it into the switch information cache middleware. Then, the data storage component reads the network running information in the switch information cache middleware and stores it into the central area database, so that the central area database contains a plurality of historical network running information.

[0030] Then, a plurality of historical network running information in a target time period (e.g., the past year) is retrieved from the central database. Similarly, the historical network running information includes, but is not limited to, the IP address of the current link local interconnection, the exit traffic rate of the switch port under the current link , the ingress traffic rate of the switch port under the current link , the ingress packet loss of the switch port under the current link , the exit packet loss of the switch port under the current link , the network delay from the customer gateway to the switch port under the current link , the timestamp of the current time , and other key performance indicators.

[0031] In step S22, the plurality of historical network running information is labeled according to whether the network state is abnormal, and the plurality of historical network running information after labeling is divided into a training set and a test set.

[0032] In this embodiment, after collecting the plurality of historical network running information, the historical network running information needs to be preprocessed, including labeling each historical network running information according to whether its network state is abnormal according to known network fault records or other diagnostic information, and the label is divided into abnormal or normal.

[0033] Then, the plurality of historical network running information after labeling is divided into two parts to obtain the training set and the test set. The training set is used to train the decision tree, and the test set is used to evaluate the classification accuracy of the trained decision tree.

[0034] For example, the division principle is to divide the plurality of historical network running information in the target time period by month, divided into {k1, k2, …, k12}. Randomly select 9 months of data as the training set, and the other three months as the test set.

[0035] In step S23, the training set is used to train the decision tree, and the test set is used to verify the trained decision tree.

[0036] In this embodiment, the training set divided in step S22 is used to train the decision tree. During training, the decision tree predicts whether the network state is abnormal according to the attributes of the network running information. After training, the test set is used to verify the decision tree. During verification, the model classifies the data in the test set and compares the classification result with the label to evaluate the accuracy and reliability of the decision tree.

[0037] Step S24, in the case that the classification success rate of the decision tree on the verification set is greater than a preset classification success rate threshold, it is determined that the network state detection model training is completed.

[0038] In the embodiment, in the verification process, in the case that the classification success rate of the decision tree on the test set exceeds a preset classification success rate threshold (such as 99%), it is considered that the network state detection model training is completed and the effect is satisfactory. The preset classification success rate threshold is set according to the specific requirements of business requirements and network environment, so as to ensure that the model can achieve the expected performance in actual application. After the network state detection model is trained, it can be used for real-time monitoring of network state, and prediction and identification of potential network anomalies.

[0039] In combination with the technical solutions of the above embodiments, an embodiment of the present application further provides another network state detection method, wherein the level of each attribute in the decision tree is determined through the following steps S31 to S36: Step S31, the training set is divided into a normal data set and an abnormal data set according to the type of label; the normal data set contains a plurality of historical network running information representing normal network state, and the abnormal data set contains a plurality of historical network running information representing abnormal network state.

[0040] Step S32, the expected information amount of the normal data set and the expected information amount of the abnormal data set are calculated respectively.

[0041] In the embodiment, the expected information amount of the normal data set and the abnormal data set calculated according to the type of label is: .

[0042] Wherein, the sample data amount of historical network running information contained in each label category is , is the probability of historical network running information belonging to the i-th label category in the training set. , the sample data amount of historical network running information contained in the training set is , i represents the i-th.

[0043] Step S33, for each attribute, according to a preset subset number and the value range of the attribute, a plurality of first value intervals are divided; each first value interval corresponds to an attribute subset, and each attribute subset contains historical network running information in the value interval.

[0044] In the embodiment, for each attribute in the historical network running information, according to its value range (interval of maximum value and minimum value) and preset number of subsets (for example, 3), the value range is evenly divided into multiple first-level value intervals. Each first-level value interval corresponds to an attribute subset, and the attribute subset contains multiple historical network running information in the value interval.

[0045] For example, if the attribute is the export traffic rate, the value range is between 0Kbps and 9Gbps: it can be divided into 0Kbps-3Gbps, 3Gbps-6Gbps, 6Gbps-9Gbps three first-level value intervals.

[0046] According to the first-level value interval in which the value of the export traffic rate in each historical network running information falls, the export traffic rate in the multiple historical network running information is classified to obtain the attribute subset corresponding to the first-level value interval.

[0047] In step S34, the information gain of each attribute subset is determined according to the expected information amount of the normal data set, the expected information amount of the abnormal data set, and the expected information amount of each attribute subset.

[0048] According to the value of the attribute (such as the export traffic rate), the attribute subset is divided into k attribute subsets , each attribute subset The number of data samples of the historical network running information contained in each label category is , Pi,j represents the probability that the jth attribute subset data belongs to the ith category label, , the expected information amount of each attribute subset is : ; Then, the information entropy of each attribute subset of each attribute is further calculated , and the information gain of each attribute subset of each attribute is calculated .

[0049] ; .

[0050] In step S35, the optimized information gain of each attribute subset is determined according to the number of attribute subsets of each attribute, the number of multiple historical network running information contained in the attribute subset, the expected information amount of the attribute subset, and the information gain of each attribute subset.

[0051] In the embodiment, the information gain is optimized according to , computing the optimization bias coefficient .

[0052] ; The optimized information gain is .

[0053] Step S36, according to the size order of the optimized information gain of each attribute subset, the level of each attribute in the decision tree is determined.

[0054] In the embodiment, after the optimized information gain of each attribute subset is obtained through the above steps, the attribute subset with the largest optimized information gain in each attribute is determined, and then the order of the multiple attributes is determined according to the order from large to small of the information gain of the attribute subset with the largest optimized information gain in each attribute, and the order of the multiple attributes is determined as the level of the multiple attributes in the decision tree.

[0055] For example, the order of the multiple attributes is determined in turn as: the egress traffic rate of the switch port under the current link , the ingress traffic rate of the switch port under the current link , the ingress packet loss number of the switch port under the current link , the egress packet loss number of the switch port under the current link , the network delay from the customer side gateway to the switch port under the current link .

[0056] Then the level of the attribute in the decision tree from high to low is in turn: the egress traffic rate of the switch port under the current link , the ingress traffic rate of the switch port under the current link , the ingress packet loss number of the switch port under the current link , the egress packet loss number of the switch port under the current link , the network delay from the customer side gateway to the switch port under the current link .

[0057] In combination with the technical solutions of the above embodiment, another network state detection method is provided in an embodiment of the application, and the method further includes steps S41 to S43: Step S41, for each attribute, the multiple labeled historical network state information in the training set is classified according to the first level value range to which it belongs.

[0058] In this embodiment, in this step, for each level attribute in the decision tree, the corresponding attribute in the plurality of historical network state information carrying labels in the training set is classified according to the first value range of the attribute.

[0059] For example, if the attribute is the export traffic rate, each first value range corresponds to an attribute subset containing the corresponding attribute in the plurality of historical network state information falling within the value range.

[0060] Step S42, in the case where the labels of the plurality of historical network state information carrying labels included in the first value range are different, the first value range is divided to obtain a plurality of second value ranges, the second value ranges correspond to the nodes of the level of the attribute in the decision tree, and the labels of the plurality of historical network state information carrying labels included in the second value range are the same. Each node in the decision tree corresponds to a plurality of second value ranges of an attribute, and each second value range is used to indicate whether the attribute in the network state information is abnormal.

[0061] In this embodiment, it is judged whether the labels corresponding to the corresponding attributes in the plurality of historical network state information included in the divided attribute subset are the same, and in the case where the labels of the plurality of historical network state information carrying labels included in the first value range are different, the first value range with different labels is further divided until the labels of each value range are the same, to obtain a plurality of second value ranges (if the same value range after division still has different labels, the value range is further divided, and if the same value range after division has the same label, it means that the value range has been divided). Finally, a plurality of second value ranges of the attribute are obtained, and the second value ranges correspond to a plurality of nodes of the level of the attribute in the decision tree. Each second value range is labeled with a corresponding label (such as normal or abnormal), and when the attribute falls within the second value range, it means that the attribute corresponds to the label.

[0062] Step S43, based on the level of each attribute in the decision tree and the second value range of each attribute, a decision tree is constructed.

[0063] In this embodiment, based on the level of each attribute in the decision tree and the second value range of each attribute, a decision tree is constructed. Each node in the decision tree corresponds to a plurality of second value ranges of an attribute, and each second value range is used to indicate whether the attribute in the network state information is abnormal.

[0064] For example, the first layer of the decision tree can correspond to the second value range of the export traffic rate, the second layer can correspond to the second value range of the packet loss rate, and so on, to obtain the trained decision tree.

[0065] In combination with the technical solutions of the above-mentioned embodiments, an embodiment of the present application further provides another network state detection method, which shows the specific process of using the trained network state detection model to perform actual network state detection. In the method, the step S12 of "inputting the network running information into the network state detection model to obtain a network state detection result" includes steps S12-1 to S12-4: In step S12-1, according to the value of each attribute, it is determined whether the attribute is abnormal according to the secondary value range in which the value of each attribute falls in the decision tree from top to bottom.

[0066] In this embodiment, the network running information obtained in real time is evaluated using the decision tree in the trained network state detection model. The network state detection model starts from the top layer of the decision tree and judges whether the attribute is abnormal layer by layer.

[0067] In each layer, the model determines whether the attribute is abnormal according to the secondary value range in which the value of the attribute falls. For example, if the value of the attribute falls in the secondary value range marked as abnormal in the first layer of the decision tree (the corresponding attribute is the exit traffic rate), the attribute is marked as abnormal.

[0068] In step S12-2, in the case where it is determined that there is an abnormal attribute in the secondary value range of a layer of the decision tree, it is determined that the network state detection result indicates that the current network is abnormal, and whether the attribute of the next layer is abnormal is not judged.

[0069] In this embodiment, if the value of the attribute falls in the secondary value range marked as abnormal in any layer of the decision tree, it is immediately determined that the current network state is abnormal, the evaluation of the deeper attributes in the decision tree is stopped, and a network abnormality report is sent to the network administrator based on the abnormal attribute, so as to improve the efficiency and timeliness of network state detection.

[0070] In step S12-3, in the case where it is determined that there is no abnormal attribute in the secondary value range of a layer of the decision tree, whether the attribute of the next layer is abnormal is judged.

[0071] In this embodiment, if it is determined that the value of the attribute does not show abnormality in the secondary value range of a layer of the decision tree, the evaluation of the attribute of the next layer is continued.

[0072] In step S12-4, in the case where it is determined that all attributes are normal, it is determined that the network state detection result indicates that the current network is normal.

[0073] In the embodiment, if no abnormal attribute is found in all levels of the decision tree, i.e., the values of all attributes of the network running information fall within the normal two-level value range in each level, it is finally determined that the network status detection result indicates that the current network is normal.

[0074] In combination with the technical solutions of the above embodiments, an embodiment of the present application further provides another network status detection method, which shows that by continuously learning the latest network running information, the network status detection model can adapt to the changes in the network environment, dynamically update the structure of the decision tree, and improve the recognition ability of network anomalies. In the method, it further specifically includes steps S51 to S53: Step S51, after obtaining the network status detection model, storing the current network running information and the current network status detection result in a database; the current network status detection result is used as a label of the current network running information.

[0075] In the embodiment, the current network running information acquired in real time and the network status detection result obtained by the decision tree model are stored in the central database together. The current network status detection result is used as a label of these network running information, which is used for training set and validation set in the subsequent model updating process.

[0076] Step S52, using the current network running information and the current network status detection result stored in the database within a preset time window as a new training set and a new test set, performing secondary training and verification on the network traffic prediction model to obtain an updated network traffic prediction model.

[0077] In the embodiment, the network running information and the corresponding network status detection result stored in the central database within a preset time window are extracted to generate a new training set and a test set. The original network traffic prediction model is trained and verified again using the new training set and the test set, so as to update the structure of the decision tree in the model, thereby obtaining a more accurate updated network traffic prediction model through dynamic updating.

[0078] In addition, for the network status detection result of the network status detection model in the actual application process, the correct result is re-labeled and used as a counterexample to train the network status detection model.

[0079] Step S53, performing network status detection on the current network running information according to the attributes corresponding to each level in the decision tree of the updated network traffic prediction model and the two-level value range corresponding to each node in each level.

[0080] In this embodiment, using the updated network traffic prediction model, the network state detection is performed on the current network running information according to the attributes corresponding to each level in the decision tree and the secondary value range corresponding to each level node. The model will evaluate the current network state according to the latest decision tree structure to determine whether there is an anomaly.

[0081] Figure 2 is a complete flowchart of a network state detection method provided by an embodiment of the present application, referring to Figure 2 .

[0082] In combination with the technical solutions of the above embodiments, another network state detection method is provided by an embodiment of the present application, which further includes step S61: Step S61, in the case that the network state detection result indicates that the current network is abnormal, switching the current link of the switch to a backup link by a southward issuing component.

[0083] In this embodiment, when the network state detection model analyzes the current network running information and obtains a network state detection result that the network state is abnormal, a preset response mechanism is automatically triggered. The preset response mechanism is implemented by a southward issuing component in the SDN (Software Defined Network) architecture. The southward issuing component is responsible for issuing control instructions to the switch.

[0084] Specifically, the southward issuing component switches the current link currently working of the switch to a backup link configured in advance. Thus, when the main link is detected to be abnormal, the network traffic can be seamlessly transferred to the backup link to ensure the continuity and reliability of the network service, and the need for human intervention is reduced and the speed of fault recovery is accelerated through the automatic link switching mechanism.

[0085] The network state detection method provided by the present application effectively overcomes the limitations of the prior art. By constructing a network state detection model based on multi-dimensional data analysis, the model can not only comprehensively consider multiple key network performance indicators such as export traffic rate, import and export packet loss rate, and network delay, but also dynamically adjust the judgment standard according to real-time data to realize active learning. This adaptive detection mechanism significantly improves the recognition accuracy of network abnormal state, optimizes the network management efficiency, enhances the reliability and stability of the network, and enables network administrators to respond to network changes more quickly and accurately, ensuring the continuity and high quality of network services, thereby providing solid technical support for stable operation and safe management of the network.

[0086] Figure 3 is a framework schematic diagram of a network state detection device provided by an embodiment of the present application, referring to Figure 3 , the device includes: The collection module 11 is configured to acquire current network running information of the switch; The detection module 12 is configured to input the network running information into a network state detection model to obtain a network state detection result. The network state detection model is obtained by training a decision tree using a plurality of historical network running information, each level in the decision tree corresponds to one attribute of a plurality of attributes contained in the network running information, and the level of each attribute in the decision tree is determined according to the influence degree of the attribute on the network state detection result.

[0087] Optionally, the apparatus further comprises: The historical network running information acquisition module is configured to acquire a plurality of historical network running information in a target time period. The first data set division module is configured to add labels to the plurality of historical network running information according to whether the network state is abnormal, and divide the plurality of historical network running information after adding labels into a training set and a test set. The model training module is configured to train the decision tree using the training set, and verify the trained decision tree using the test set. The determination module is configured to determine that the network state detection model is trained when the classification success rate of the decision tree on the test set is greater than a preset classification success rate threshold.

[0088] Optionally, the apparatus further comprises: The second data set division module is configured to divide the training set into a normal data set and an abnormal data set according to the type of labels, the normal data set contains a plurality of historical network running information representing a normal network state, and the abnormal data set contains a plurality of historical network running information representing an abnormal network state. The expected information amount calculation module is configured to calculate the expected information amount of the normal data set and the expected information amount of the abnormal data set, respectively. The first value interval division module is configured to divide each attribute into a plurality of first value intervals according to a preset number of subsets and a value range of the attribute, each first value interval corresponds to an attribute subset, and each attribute subset contains historical network running information in the value interval. The information gain determination module is configured to determine the information gain of each attribute subset according to the expected information amount of the normal data set, the expected information amount of the abnormal data set, and the expected information amount of each attribute subset. an optimization module, configured to determine an optimized information gain of each attribute subset according to a number of attribute subsets of each attribute, a number of pieces of historical network running information contained in the attribute subsets, an expected information amount of the attribute subsets, and the information gain of each attribute subset; an attribute hierarchy determination module, configured to determine a hierarchy of each attribute in the decision tree according to a size order of the optimized information gain of each attribute subset.

[0089] Optionally, the apparatus further includes: a classification module, configured to classify, for each attribute, the pieces of historical network state information carrying labels in the training set according to a first value range to which the historical network state information belongs; a second value range division module, configured to divide the first value range to obtain a plurality of second value ranges in a case where labels of the pieces of historical network state information carrying labels contained in the first value range are different, the second value ranges corresponding to nodes at a hierarchy of the attribute in the decision tree, and labels of the pieces of historical network state information carrying labels contained in the second value ranges being same; a decision tree construction module, configured to construct the decision tree based on the hierarchy of each attribute in the plurality of attributes in the decision tree and the second value ranges of each attribute; each node at each hierarchy in the decision tree corresponds to a plurality of second value ranges of an attribute, each second value range is labeled with a corresponding label, and each second value range is used to indicate whether the attribute in the network state information is abnormal.

[0090] Optionally, the detection module 12 includes: a detection unit, configured to determine, according to a second value range in which a value of each attribute is located, whether the attribute is abnormal in a hierarchy order from top to bottom of the decision tree; a first abnormality determination unit, configured to determine that the network state detection result indicates that the current network is abnormal and not to determine whether an attribute at a next hierarchy is abnormal in a case where it is determined that there is an abnormal attribute in the second value range at the hierarchy of the decision tree; a second abnormality determination unit, configured to determine whether an attribute at a next hierarchy is abnormal in a case where it is determined that there is no abnormal attribute in the second value range at the hierarchy of the decision tree; a normality determination unit, configured to determine that the network state detection result indicates that the current network is normal in a case where it is determined that all attributes are not abnormal.

[0091] Optionally, the apparatus further includes: a storage module, configured to store the current network running information and the current network state detection result in a database after obtaining the network state detection model, wherein the current network state detection result serves as a label of the current network running information; a third data set division module, configured to divide the current network running information and the current network state detection result stored in the database within a preset time window as a new training set and a new test set, perform secondary training and verification on the network traffic prediction model, and obtain an updated network traffic prediction model; an updated detection module, configured to perform network state detection on the current network running information according to the attribute corresponding to each level in the decision tree corresponding to the updated network traffic prediction model and the secondary value range corresponding to the node of each level.

[0092] Optionally, the apparatus further includes: a switching module, configured to switch the current link of the switch to a backup link through a southward issuing component in a case where the network state detection result indicates that the current network is abnormal.

[0093] It should be noted that the network state detection method provided in the embodiments of the present application can be executed by a network state detection apparatus, or a control module in the network state detection apparatus for executing the network state detection method. In the embodiments of the present application, the network state detection apparatus is taken as an example for executing the network state detection method to illustrate the network state detection method provided in the embodiments of the present application.

[0094] The network state detection apparatus in the embodiments of the present application can be a device, or a component, an integrated circuit or a chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. Illustratively, the mobile electronic device can be a mobile phone, a tablet computer, a notebook computer, a palm computer, a vehicle-mounted electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook or a personal digital assistant (PDA), etc., and the non-mobile electronic device can be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., and the embodiments of the present application are not limited in this regard.

[0095] The network state detection apparatus in the embodiments of the present application can be an apparatus with an operating system. The operating system can be an Android operating system, an ios operating system, or other possible operating systems, which are not limited in the embodiments of the present application.

[0096] The network state detection apparatus provided in the embodiments of the present application can realize Figures 1 to 2 The processes realized by the network state detection apparatus in the method embodiments are not described herein again to avoid repetition.

[0097] Optionally, Figure 4 A hardware structure schematic diagram of an electronic device for implementing the embodiments of the present application is shown. The embodiments of the present application also provide an electronic device. It should be noted that the electronic device in the embodiments of the present application includes the mobile electronic device and the non-mobile electronic device described above.

[0098] The electronic device includes, but is not limited to, a radio frequency unit, a network module, an audio output unit, an input unit, a sensor, a display unit, a user input unit, an interface unit, a memory, and a processor, and the like.

[0099] Those skilled in the art can understand that the electronic device can also include a power supply (such as a battery) for supplying power to each component. The power supply can be logically connected to the processor through a power management system, so as to realize functions such as management of charging, discharging, and power consumption management through the power management system. Figure 4 The structure of the electronic device shown in the embodiments of the present application does not constitute a limitation on the electronic device. The electronic device can include more or fewer components than those shown, or combine certain components, or arrange different components, which are not described herein again. As an example, as shown in Figure 4 The electronic device 600 includes a memory 610 and a processor 620, the memory 610 and the processor 620 are communicatively connected through a bus, and the memory 610 stores a computer program which can run on the processor 620, thereby realizing the steps in the network state detection method disclosed in the above embodiments of the present application.

[0100] For the apparatus, since it is basically similar to the method embodiments, the description is relatively simple, and the related parts are described in the part of the method embodiments.

[0101] Each of the embodiments in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same and similar parts between the embodiments can be referred to each other.

[0102] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, device, or computer program product. Therefore, the embodiments of the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects.

[0103] Further, the embodiments of the present application also provide a readable storage medium, which stores a program or instruction, and the program or instruction is executed by a processor to realize the processes of the network state detection method embodiments and achieve the same technical effects. To avoid repetition, details are not described herein.

[0104] The processor is the processor in the electronic device in the above embodiments. The readable storage medium includes a computer readable storage medium, such as a computer readable memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, etc.

[0105] The embodiments of the present application also provide a chip, which includes a processor and a communication interface. The communication interface is coupled with the processor. The processor is configured to run a program or instruction to realize the processes of the network state detection method embodiments and achieve the same technical effects. To avoid repetition, details are not described herein.

[0106] It should be understood that the chip mentioned in the embodiments of the present application can also be referred to as a system-level chip, a system chip, a chip system, or a system-on-chip chip, etc.

[0107] It should be noted that, in this document, the term "comprising" or "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that processes, methods, articles, or devices including a series of elements not only include those elements, but also include other elements not explicitly listed, or include elements inherent to such processes, methods, articles, or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of additional identical elements in the process, method, article, or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to the order of performing the functions shown or discussed, and can also include performing the functions in a substantially simultaneous manner or in a reverse order, for example, the described method can be performed in an order different from that described, and various steps can also be added, omitted, or combined. In addition, the features described with reference to certain examples can be combined in other examples.

[0108] Through the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned example methods can be realized by means of software and a necessary general hardware platform, and of course, can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product in essence or in the form of a part that contributes to the prior art. The computer software product is stored in a storage medium (such as a ROM / RAM, a magnetic disk, or an optical disk) and includes a plurality of instructions for causing a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in the various embodiments of the present application.

[0109] The embodiments of the present application are described above in combination with the drawings, but the present application is not limited to the above-mentioned specific embodiments, and the above-mentioned specific embodiments are only illustrative and not restrictive. Those skilled in the art can make many forms without departing from the scope of the present application under the inspiration of the present application, and all of them belong to the protection of the present application.

Claims

1. A network state detection method characterized by, The method comprises: obtaining current network operation information of the switch; inputting the network operation information into a network state detection model to obtain a network state detection result; wherein the network state detection model is obtained by training a decision tree using a plurality of historical network operation information, each level in the decision tree corresponds to one attribute of a plurality of attributes contained in the network operation information, and the level of each attribute in the decision tree is determined according to the influence of the attribute on the network state detection result.

2. The network state detection method according to claim 1, wherein The method further comprises: obtaining a plurality of historical network operation information in a target time period; labeling the plurality of historical network operation information according to whether the network state is abnormal, and dividing the labeled plurality of historical network operation information into a training set and a test set; training the decision tree using the training set, and verifying the trained decision tree using the test set; if the classification success rate of the decision tree on the test set is greater than a preset classification success rate threshold, determining that the network state detection model is trained.

3. The network state detection method according to claim 2, wherein The level of each attribute in the decision tree is determined by the following steps, comprising: dividing the training set into a normal data set and an abnormal data set according to the type of label; the normal data set contains a plurality of historical network operation information indicating a normal network state, and the abnormal data set contains a plurality of historical network operation information indicating an abnormal network state; calculating the expected information amount of the normal data set and the expected information amount of the abnormal data set, respectively; for each attribute, dividing a plurality of first value intervals according to a preset number of subsets and the value range of the attribute; each first value interval corresponds to an attribute subset, and each attribute subset contains historical network operation information in the value interval; determining the information gain of each attribute subset according to the expected information amount of the normal data set, the expected information amount of the abnormal data set, and the expected information amount of each attribute subset; determining the optimized information gain of each attribute subset according to the number of attribute subsets of each attribute, the number of historical network operation information contained in the attribute subset, the expected information amount of the attribute subset, and the information gain of each attribute subset; determining the level of each attribute in the decision tree according to the size order of the optimized information gain of each attribute subset.

4. The network state detection method according to claim 3, wherein The method further comprises: for each attribute, classifying a plurality of historical network state information carrying labels in the training set according to the first value range to which they belong; if the labels of the plurality of historical network state information carrying labels contained in the first value range are different, dividing the first value range to obtain a plurality of second value ranges, the second value range corresponding to a node at the level of the attribute in the decision tree, and the labels of the plurality of historical network state information carrying labels contained in the second value range being the same; based on the level of each attribute in the decision tree and the second value range of each attribute, a decision tree is constructed. Each node in the decision tree corresponds to a plurality of secondary value ranges of an attribute, each secondary value range is labeled with a corresponding label, and each secondary value range is used to represent whether the attribute in the network state information is abnormal.

5. The network state detection method according to claim 4, wherein The network state detection model is trained by using a plurality of historical network running information, each level in the decision tree corresponds to one attribute of the plurality of attributes contained in the network running information, and the level of each attribute in the decision tree is determined according to the influence degree of the attribute on the network state detection result. In sequence, according to the level order of the decision tree from top to bottom, whether each attribute is abnormal is determined according to the secondary value range in which the value of the attribute is located. In the case where it is determined that there is an abnormal attribute in the secondary value range of one level of the decision tree, it is determined that the network state detection result represents that the current network is abnormal, and whether the attribute of the next level is abnormal is not judged. In the case where it is determined that there is no abnormal attribute in the secondary value range of one level of the decision tree, whether the attribute of the next level is abnormal is judged. In the case where it is determined that all attributes are not abnormal, it is determined that the network state detection result represents that the current network is normal.

6. The network state detection method according to claim 5, wherein The method further comprises: After obtaining the network state detection model, the current network running information and the current network state detection result stored in the database within a preset time window are stored in the database; the current network state detection result is used as a label of the current network running information; The current network running information is used as a new training set and a new test set, and the network traffic prediction model is trained and verified again to obtain an updated network traffic prediction model. The method further comprises:

7. The network state detection method according to claim 1, wherein In the case where the network state detection result represents that the current network is abnormal, the current link of the switch is switched to a backup link by a southward issuing component. The apparatus comprises:

8. A network state detection apparatus characterized by comprising: The acquisition module is configured to acquire the current network running information of the switch. The detection module is configured to input the network running information into a network state detection model to obtain a network state detection result. The network state detection model is trained by using a plurality of historical network running information, each level in the decision tree corresponds to one attribute of the plurality of attributes contained in the network running information, and the level of each attribute in the decision tree is determined according to the influence degree of the attribute on the network state detection result. The chip comprises a processor and a communication interface, the communication interface and the processor are coupled, the processor is used to run programs or instructions, and the steps of the network state detection method in claims 1-7 are realized.

9. An electronic device, comprising: The chip comprises a processor and a communication interface, the communication interface and the processor are coupled, the processor is used to run programs or instructions, and the steps of the network state detection method in claims 1-7 are realized.

10. A chip, characterized by ​

Images