AI-based government and enterprise gateway fault automatic diagnosis and self-healing method and device and medium

Abstract

The invention provides an AI-based government and enterprise gateway fault automatic diagnosis and self-healing method and device and a medium, and the method comprises the steps: collecting message data in real time, carrying out the preprocessing, and obtaining a time sequence feature; constructing a time sequence feature convolutional neural network and a topological graph neural network, respectively extracting time sequence domain features and topological domain features, fusing the two features, and respectively obtaining link anomaly types, root cause equipment or link positions and anomaly influence range identification through a multi-task output structure based on fused feature vectors; constructing a fault knowledge graph, attributing the abnormal type of the link, and giving a corresponding execution strategy; constructing a strategy security sandbox, carrying out sandbox simulation execution, and executing self-healing operation after passing the sandbox simulation execution; through tracking and replaying faults, novel link faults are collected, incremental learning is carried out, and continuous optimization of a model pair is ensured. According to the invention, efficient monitoring and real-time recovery of the gateway link quality can be realized, and the network stability is improved.

Description

Technical Field

[0001] This invention relates to the field of network quality monitoring technology, and in particular to an AI-based method, device, and medium for automatic fault diagnosis and self-healing of government and enterprise gateways. Background Technology

[0002] Government and enterprise networks are critical infrastructure for government agencies, public institutions, financial institutions, and large enterprises. With the rapid growth of applications such as cloud computing, mobile office, and video conferencing, link quality (such as packet loss, jitter, and latency) directly determines the stability of government systems and internal operations.

[0003] Link quality anomalies are among the most typical but also the most difficult network problems to diagnose. They mainly include short-term jitter, micro-burst congestion, intermittent packet loss, instantaneous RTT spikes, MTU / path mismatch, and composite anomalies caused by crosstalk between upstream and downstream devices. These anomalies may last only 10 to 200 ms, causing significant lag in government video conferencing, OA systems, and business access.

[0004] Existing link quality management mainly relies on SNMP monitoring systems (sampling period of 5 seconds to 1 minute), log analysis platforms, or manual operation and maintenance experience. These methods have obvious shortcomings in actual government and enterprise scenarios: high collection latency, inability to capture short-term link fluctuations (tens of milliseconds), long sampling periods of tools such as SNMP and NetFlow, inability to reflect fine-grained changes in links at the millisecond level, inability to identify non-periodic, intermittent, and sudden link anomalies, inability to determine the root cause of link problems in the topology, and complete reliance on manual intervention during the fault recovery phase, resulting in long response times.

[0005] Traditional technologies struggle to diagnose these anomalies in real time, let alone achieve automatic self-healing. Therefore, it is necessary to propose a high-performance, real-time analyzeable, and automatically recoverable intelligent diagnostic and self-healing system for link quality anomalies. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide an AI-based method, device and medium for automatic diagnosis and self-healing of faults in government and enterprise gateways, so as to improve the efficiency and accuracy of identifying abnormalities in gateway link quality and realize automatic repair of abnormalities.

[0007] In a first aspect, the present invention provides an AI-based method for automatic fault diagnosis and self-healing of government and enterprise gateways, comprising the following steps: Step S1: Collect message data in real time, perform preprocessing, and obtain time-series characteristics; Step S2: Construct a temporal feature convolutional neural network and a topology graph neural network to extract temporal domain features and topology domain features respectively, and fuse the two types of features. Based on the fused feature vector, obtain the link anomaly type, root cause device or link location and anomaly impact range through a multi-task output structure. Step S3: Construct a fault knowledge graph, attribute the causes of link anomalies, and provide corresponding execution strategies; Step S4: Build a policy security sandbox, perform sandbox simulation execution, and execute self-healing operation after passing the simulation. Step S5: By tracking and replaying faults, new types of link faults are collected, and incremental learning is performed to ensure continuous optimization of the model.

[0008] Furthermore, step S1 specifically includes: Step S11: Use DPDK to collect data at a line speed of 100Gbps and extract link quality-related metadata for each packet. The metadata includes RTT, jitter, packet loss inference, error frames / retransmissions, application response time, port utilization and queue length. Step S12: Perform protocol parsing and stream reassembly, including using an improved time wheel algorithm to clean up timed-out fragments to achieve IP fragment reassembly, using an ordered buffer to handle out-of-order data to achieve TCP stream reassembly, and application layer parsing to support HTTPSClientHello / SNI, DNS, and HTTP. Step S13: By constructing a 60-point time window and 8 core dimensions for the link metrics, a [60×8] input matrix format of time series features is formed for subsequent time series CNN analysis; the 8 core dimensions include RTT, Jitter, packet loss rate, TCP retransmission rate, queue length, egress bandwidth utilization, ingress bandwidth utilization, and error frame / CRC count.

[0009] Furthermore, step S2 specifically includes: Step S21: Construct a temporal convolutional neural network to learn the curve shape corresponding to temporal features and perform deep feature extraction on the link quality time series. The temporal convolutional neural network structure includes three layers of depthwise separable convolutions, a max pooling layer (MaxPool), a batch normalization layer (BatchNorm), and a ReLU activation function. The depthwise separable convolutions are used to extract key peak shapes. Specifically, the first depthwise separable convolution is used to capture rapid fluctuations, the second depthwise separable convolution is used to capture medium-term change trends, and the third depthwise separable convolution is used to capture the overall trend and curve shape to ensure that high-frequency, medium-frequency, and low-frequency features are captured. The ReLU activation function is used for nonlinear modeling, allowing the model to learn different temporal patterns. Step S22: Construct a government and enterprise network topology graph neural network to obtain the spatial representation results of anomalies in the topology domain, including the anomaly contribution of each node / link, the direction of anomaly propagation, and the root cause probability distribution, for subsequent fusion judgment and strategy reasoning. The network topology graph includes nodes, edges, node features, and edge features. The nodes include gateways, switches, and routers. The edges are weighted links. The node features include device load, error count, and port status. The edge features include packet loss rate, latency, and jitter. Step S23, which combines the outputs of steps S21 and S22, uses the fused feature vector to obtain the link anomaly type, root cause device or link location, and anomaly impact range through a multi-task output structure.

[0010] Furthermore, step S3 specifically includes: constructing a fault knowledge graph of anomaly type-cause pattern-self-healing strategy triples based on existing expert rules, attributing link anomaly types through path reasoning, and providing corresponding execution strategies.

[0011] Furthermore, step S4 specifically includes: Step S41: Build a policy security sandbox. Before the self-healing operation, simulate and verify in the sandbox to pre-conduct route change risk investigation, NAT / ACL conflict verification, configuration consistency verification, and network loop check. Step S42: AI selects a strategy to perform self-healing operations, including digital signature verification, sandbox simulation, and execution of Begin-Apply-Verify-Commit. After execution, the link quality is backtested, and if there is no improvement, it is automatically rolled back. The self-healing operations include interface reset, switching backup links, MTU adjustment, automatic ARP / ND cleanup, queue optimization (Queue / Buffer), QoS priority adjustment, and enabling or adjusting ECN / WRED.

[0012] Furthermore, step S5 specifically includes providing a visualized topology, creating a real-time heatmap of link metrics, tracking and replaying faults, supporting online incremental learning of the model, and automatically clustering samples.

[0013] Secondly, this invention provides an AI-based automatic fault diagnosis and self-healing device for government and enterprise gateways, comprising: The high-speed data acquisition module is used to acquire message data in real time, perform preprocessing, and obtain time-series characteristics; The link quality intelligent analysis module is used to construct a temporal feature convolutional neural network and a topology graph neural network to extract temporal domain features and topology domain features respectively, and then fuse the two types of features. Based on the fused feature vector, the link anomaly type, root cause device or link location, and anomaly impact range are identified through a multi-task output structure. The root cause localization and strategy reasoning module is used to construct a fault knowledge graph, attribute the causes of link anomalies, and provide corresponding execution strategies. The self-healing execution and security control module is used to build a policy security sandbox, perform sandbox simulation execution, and perform self-healing operations after passing the simulation. The operation and maintenance support and optimization module is used to collect new link faults by tracking and replaying faults, and to perform incremental learning to ensure continuous optimization of the model.

[0014] Furthermore, the high-speed data acquisition module specifically includes: DPDK is used to collect data at a line rate of 100Gbps. Metadata related to link quality is extracted from each packet. The metadata includes RTT, jitter, packet loss inference, error frames / retransmissions, application response time, port utilization and queue length. Perform protocol parsing and stream reassembly, including using an improved time wheel algorithm to clean up timed-out fragments to achieve IP fragment reassembly, using an ordered buffer to handle out-of-order data to achieve TCP stream reassembly, and application layer parsing to support HTTPS ClientHello / SNI, DNS, and HTTP; By constructing a 60-point time window and 8 core dimensions for link metrics, a [60×8] input matrix format of time series features is formed for subsequent time series CNN analysis. The 8 core dimensions include RTT, Jitter, packet loss rate, TCP retransmission rate, queue length, egress bandwidth utilization, ingress bandwidth utilization, and error frame / CRC count.

[0015] Furthermore, the link quality intelligent analysis module specifically includes: A temporal convolutional neural network is constructed to learn the curve shape corresponding to temporal features, and to perform deep feature extraction on the link quality time series. The temporal convolutional neural network structure includes three layers of depthwise separable convolutions, a max pooling layer (MaxPool), a batch normalization layer (BatchNorm), and a ReLU activation function. The depthwise separable convolutions are used to extract key peak shapes. Specifically, the first depthwise separable convolution is used to capture rapid fluctuations, the second depthwise separable convolution is used to capture medium-term trends, and the third depthwise separable convolution is used to capture the overall trend and curve shape, ensuring that high-frequency, medium-frequency, and low-frequency features are captured. The ReLU activation function is used for non-linear modeling, allowing the model to learn different temporal patterns. A neural network for government and enterprise network topology is constructed to obtain the spatial representation results of anomalies in the topology domain, including the anomaly contribution of each node / link, the direction of anomaly propagation, and the root cause probability distribution, which are used for subsequent fusion judgment and strategy reasoning. The network topology graph includes nodes, edges, node features, and edge features. The nodes include gateways, switches, and routers. The edges are weighted links. The node features include device load, error count, and port status. The edge features include packet loss rate, latency, and jitter. By fusing the outputs of a temporal convolutional neural network and a government-enterprise network topology graph neural network, and based on the fused feature vector, the link anomaly type, root cause device or link location, and anomaly impact range are obtained through a multi-task output structure.

[0016] Furthermore, the root cause localization and strategy reasoning module specifically includes: constructing a fault knowledge graph of anomaly type-cause pattern-self-healing strategy triples based on existing expert rules, attributing link anomaly types through path reasoning, and providing corresponding execution strategies.

[0017] Furthermore, the self-healing execution and security control module specifically includes: Build a policy security sandbox and simulate and verify it in the sandbox before the self-healing operation. Perform routing change risk investigation, NAT / ACL conflict verification, configuration consistency verification and network loop check in advance. AI selects a strategy to perform self-healing operations, including digital signature verification, sandbox simulation, Begin-Apply-Verify-Commit, and backtesting link quality after execution. If there is no improvement, it automatically rolls back. The self-healing operations include interface reset, switching backup links, MTU adjustment, automatic ARP / ND cleanup, queue optimization, QoS priority adjustment, and enabling or adjusting ECN / WRED.

[0018] Furthermore, the operation and maintenance support and optimization module specifically includes providing a visualized topology, creating real-time heatmaps of link indicators, tracking and replaying faults, supporting online incremental learning of models, and automatically clustering samples. Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0019] One or more technical solutions provided by this invention have at least the following technical effects or advantages: 1. Achieve millisecond-level detection (< 100 ms) of link quality anomalies; 2. Improve the accuracy of identifying timing anomalies such as link jitter, intermittent packet loss, and micro-burst congestion; 3. By locating the abnormal propagation path and root cause device of the link through the topology model, the recovery strategy is automatically generated and self-healing is executed after verification in the security sandbox, forming a fully closed-loop automated system of data collection, analysis, location, execution and verification. Attached Figure Description

[0020] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0021] Figure 1 This is an execution flowchart of an AI-based automatic fault diagnosis and self-healing method for government and enterprise gateways in Embodiment 1 of the present invention. Figure 2 This is a schematic diagram of the structure of an AI-based automatic fault diagnosis and self-healing device for government and enterprise gateways in Embodiment 2 of the present invention. Figure 3 This is a schematic diagram of the structure of the medium in Embodiment 3 of the present invention. Detailed Implementation

[0022] This application provides an AI-based method, device, and medium for automatic fault diagnosis and self-healing of government and enterprise gateways, which can achieve efficient diagnosis and automated repair of gateway link quality anomalies.

[0023] The overall approach of the technical solution in this application is as follows: A temporal convolutional diagnostic model (T-CNN) for link quality anomalies is constructed to identify the shape of link anomaly curves; a graph neural network (GNN) model for link topology correlation analysis is constructed, abstracting network devices and links into a graph structure. The GNN is used to pass messages between the temporal and state features of nodes (devices) and edges (links) to infer the propagation path of anomalies and the most likely root cause device; a spatiotemporal fusion link fault analysis architecture combining CNN and GNN fuses the temporal domain (local link behavior features extracted by T-CNN) with the topological domain (propagation relationships inferred by GNN) to achieve more accurate fault classification and root cause localization. Here, the topological domain refers to the feature space modeling the spatial correlation between devices and links using the network topology as a coordinate system; the propagation relationship refers to the causal transmission relationship of link anomalies affecting downstream nodes and links level by level along devices and links in the network topology. Temporal information determines "what happened," while topological information determines "where it happened / how it propagated." This invention also realizes a knowledge graph-based link self-healing strategy reasoning mechanism. Based on fault classification and root cause localization results, combined with operation and maintenance expert rules and equipment capability information, it matches and infers a safe and prioritized combination of self-healing strategies in the knowledge graph. Before execution, it ensures operational safety through sandbox verification, digital signature verification and rollback mechanism, thereby forming a fully closed-loop automated system of data collection, analysis, localization, execution and verification.

[0024] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods. Example 1

[0025] like Figure 1 and Figure 2 As shown in the figure, this embodiment provides an AI-based method for automatic fault diagnosis and self-healing of government and enterprise gateways, including the following steps: Step S1: Collect message data in real time, perform preprocessing, and obtain time-series characteristics; Step S2: Construct a temporal feature convolutional neural network and a topology graph neural network to extract temporal domain features and topology domain features respectively, and fuse the two types of features. Based on the fused feature vector, the link anomaly type, root cause device or link location, and anomaly impact range are identified through a multi-task output structure. Step S3: Construct a fault knowledge graph, attribute the causes of link anomalies, and provide corresponding execution strategies; Step S4: Build a policy security sandbox, perform sandbox simulation execution, and execute self-healing operation after passing the simulation. Step S5: By tracking and replaying faults, new types of link faults are collected, and incremental learning is performed to ensure continuous optimization of the model.

[0026] Preferably, step S1 specifically includes: Step S11: Use DPDK to collect data at a line speed of 100Gbps and extract link quality-related metadata for each packet. The metadata includes RTT, jitter, packet loss inference, error frames / retransmissions, application response time, port utilization and queue length. Step S12: Perform protocol parsing and stream reassembly, including using an improved time wheel algorithm to clean up timed-out fragments to achieve IP fragment reassembly, using an ordered buffer (RB-tree) to handle out-of-order data to achieve TCP stream reassembly, and application layer parsing to support HTTPS ClientHello / SNI, DNS, and HTTP; Step S13: By constructing a 60-point time window and 8 core dimensions for the link metrics, a [60×8] input matrix format of time series features is formed for subsequent time series CNN analysis; the 8 core dimensions include RTT, Jitter, packet loss rate, TCP retransmission rate, queue length, egress bandwidth utilization, ingress bandwidth utilization, and error frame / CRC count.

[0027] Preferably, step S2 specifically includes: Step S21: Construct a temporal convolutional neural network to learn the curve shape corresponding to the temporal features and perform deep feature extraction on the link quality time series. For example, for abnormal micro-burst congestion RTT, the CNN's identification feature is short spikes + increased jitter; for abnormal intermittent packet loss RTT, the CNN's identification feature is sawtooth fluctuations; for abnormal random jitter, the CNN's identification feature is a high-frequency oscillation curve; for abnormal MTU mismatch, the CNN's identification feature is a periodic step-like increase in RTT; for queue overuse, the CNN's identification feature is a linear increase in latency. The temporal convolutional neural network structure includes three depthwise separable convolutional layers (kernel=3), a max pooling layer (MaxPool), a batch normalization layer (BatchNorm), and a ReLU activation function. The depthwise separable convolutions are used to extract key peak shapes, focusing on "important change points" and ignoring noise, making them very suitable for identifying "sudden congestion and spike anomalies." Specifically, the first depthwise separable convolutional layer is used to capture rapid fluctuations, the second depthwise separable convolutional layer is used to capture medium-term change trends, and the third depthwise separable convolutional layer is used to capture the overall trend and curve shape, ensuring that high-frequency, medium-frequency, and low-frequency features are captured. The batch normalization layer (BatchNorm) is used to accelerate convergence and improve stability, preventing training instability due to differences in link data. The ReLU activation function is used for non-linear modeling, allowing the model to learn different temporal patterns, and thus automatically classifying link anomaly types through deep learning curve shapes. The temporal convolutional neural network outputs a 128-dimensional link temporal feature vector. Instead of directly outputting link anomaly categories, the network performs deep feature extraction on the link quality time series, outputting a set of fixed-dimensional link temporal feature vectors to characterize the temporal behavior patterns of link quality changes within the time window. These link temporal feature vectors serve as intermediate features input to subsequent modules to complete link anomaly classification, root cause localization, and self-healing strategy inference.

[0028] Step S22: Construct a government and enterprise network topology graph neural network to obtain the spatial representation results of anomalies in the topology domain, including the anomaly contribution of each node / link, the anomaly propagation direction, and the root cause probability distribution, for subsequent fusion judgment and strategy reasoning. The network topology graph includes nodes, edges, node features, and edge features. The nodes include gateways, switches, and routers. The edges are weighted links. The node features include device load, error count, and port status. The edge features include packet loss rate, latency, and jitter. The government and enterprise network topology graph neural network can identify anomaly propagation paths, determine root cause nodes (bottleneck devices), and determine whether it is an upstream link problem. The packet loss rate, latency, and jitter of the links constitute edge feature vectors. The edge feature vectors are input into the government and enterprise network topology graph neural network, and the corresponding edge weights are calculated during message transmission to adjust the influence intensity of different links on anomaly propagation. The quality status of the link is quantified by the weights to achieve accurate location of the root cause of the link anomaly.

[0029] For example, when the terminal RTT increases, the GNN analyzes that the anomaly originates from the path "aggregation switch → uplink X2". The increased terminal RTT is treated as a "symptom," and the GNN seeks the "most reasonable explanation for the cause" within the entire network topology. When an anomaly in terminal link quality is detected, this anomaly is injected as an observation signal into the corresponding terminal node in the network topology graph. The neural network, considering the network topology, node operating states, and link quality weights, models the propagation path of the anomaly's impact in the topology (including using message passing and state update functions defined in the graph neural network to propagate the node's abnormal state layer by layer in the topology, thereby learning the anomaly's diffusion path and impact range in the network). It calculates the contribution of each node and link to the anomaly through multi-layer message passing. Based on these contributions, it determines the most likely anomaly propagation path and root cause link leading to the terminal link quality anomaly.

[0030] By using a neural network to obtain the structured results of "abnormal contribution / root cause probability" of each node and link in the government-enterprise network topology graph under the current abnormal scenario, the results can be used to support fault classification, root cause location and impact range assessment.

[0031] Step S23, which integrates the outputs of steps S21 and S22, uses the fused feature vector to obtain the link anomaly type, root cause device or link location, and anomaly impact range through a multi-task output structure. Specifically, the output identification results can be determined by Softmax.

[0032] The temporal convolutional neural network and the network topology graph neural network are executed in parallel to extract the temporal behavior features and topological association features of the link quality, respectively. Then, the feature vectors of the two neural networks are fused. The fusion includes at least one of feature concatenation, weighting or attention mechanism.

[0033] Preferably, step S3 specifically includes: constructing a fault knowledge graph of anomaly type-cause pattern-self-healing strategy triples based on existing expert rules, wherein each anomaly type corresponds to an anomaly pattern node, forming a directed causal relationship with the corresponding cause pattern and self-healing strategy; attributing the link anomaly type through path reasoning; and providing the corresponding execution strategy.

[0034] Example: (RTT jagged increase → MTU mismatch → Adjust MTU + Clear ARP) (Jitter high-frequency fluctuations → upstream interface jitter → Reset interface) (Periodic packet loss → queue congestion → enable ECN or increase queue size) In a preferred embodiment, the fault knowledge graph also supports semantic matching and multi-strategy combination generation, specifically including: First, a semantic matching operation is performed: the identified link anomaly types are precisely matched with the corresponding anomaly pattern nodes in the knowledge graph, thereby filtering out the rule subset (i.e., subgraph) most relevant to the current anomaly type to limit the search space of path reasoning, providing accurate input for path reasoning and self-healing strategy generation, thereby improving reasoning efficiency; Next, path reasoning is performed: the identified set of abnormal nodes (i.e., root cause devices or root cause nodes) serves as the starting node for path reasoning. Combined with the anomaly judgment information of root cause devices and upstream links, a restricted search is performed along predefined causal relationship edges in the subgraph. During path reasoning, each candidate reasoning path is scored and filtered based on the anomaly confidence level, rule weights, and runtime context output by the model. The rule weights characterize the credibility or priority of causal rules in the knowledge graph; they can be dynamically adjusted based on expert experience, historical execution performance statistics, or model feedback, and participate in the scoring and filtering of candidate reasoning paths during the path reasoning process.

[0035] Strategy extraction and combination generation: For multiple inference paths whose scores meet the preset threshold, the corresponding self-healing strategy nodes in the paths are further extracted, and the impact of the strategy is evaluated in combination with the scope of the anomaly. Multiple strategy combinations are generated through conflict detection, dependency analysis and execution risk assessment, and the strategy combinations are sorted. Finally, the executable self-healing solution after scoring and sorting is output, which includes specific strategy operations and execution order, for subsequent strategy sandbox verification and safe execution.

[0036] Preferably, step S4 specifically includes: Step S41: Build a policy security sandbox. Before the self-healing operation, simulate and verify in the sandbox to pre-conduct route change risk investigation, NAT / ACL conflict verification, configuration consistency verification, and network loop check. Step S42: The AI ​​selects a strategy to perform self-healing operations, including digital signature verification (to prevent policy tampering), sandbox simulation, execution of Begin-Apply-Verify-Commit, and backtesting of link quality (within 5 seconds). If there is no improvement, it automatically rolls back. The self-healing operations include interface reset (shutdown / no shutdown), switching to backup links, MTU adjustment, automatic ARP / ND cleanup, queue tuning (Queue / Buffer), QoS priority adjustment, enabling or adjusting ECN / WRED, and supporting NETCONF / YANG, RESTCONF, and CLI interfaces. Specifically, the AI ​​strategy selection involves calculating the priority score of each strategy or strategy combination from multiple candidate self-healing strategies (derived from path inference and multi-strategy combination generation modules) based on link anomaly type, root cause localization, model confidence, and context constraints, and selecting the optimal strategy or optimal strategy combination for execution.

[0037] The strategy is validated in a static sandbox after generation (for security and legality checks) and executed in a dynamic sandbox before execution (for actual strategy simulation / drills), ensuring feasibility in real-world environments. The two execution sandbox simulations, "strategy review" and "execution drills," simulate different aspects and timings, complementing each other.

[0038] Preferably, step S5 specifically includes providing a visualized topology, creating a real-time heatmap of link metrics, tracking and replaying faults, supporting online incremental learning of the model, and automatic clustering of samples (DBSCAN). The purpose of automatic clustering here is to classify a large number of historical or real-time link fault samples according to feature similarity, thereby discovering potential new anomaly patterns, assisting in anomaly analysis, and optimizing AI model training.

[0039] The method of this invention can run on architectures such as ARM and x86.

[0040] Based on the same inventive concept, this application also provides an apparatus corresponding to the method in Embodiment 1, as detailed in Embodiment 2. Example 2

[0041] like Figure 2 As shown, this embodiment provides an AI-based automatic fault diagnosis and self-healing device for government and enterprise gateways, including: The high-speed data acquisition module is used to acquire message data in real time, perform preprocessing, and obtain time-series characteristics; The link quality intelligent analysis module is used to construct a temporal feature convolutional neural network and a topology graph neural network to extract temporal domain features and topology domain features respectively, and then fuse the two types of features. Based on the fused feature vector, the link anomaly type, root cause device or link location, and anomaly impact range are obtained through a multi-task output structure. The root cause localization and strategy reasoning module is used to construct a fault knowledge graph, attribute the causes of link anomalies, and provide corresponding execution strategies. The self-healing execution and security control module is used to build a policy security sandbox, perform sandbox simulation execution, and perform self-healing operations after passing the simulation. The operation and maintenance support and optimization module is used to collect new link faults by tracking and replaying faults, and to perform incremental learning to ensure continuous optimization of the model.

[0042] Preferably, the high-speed data acquisition module specifically includes: DPDK is used to collect data at a line rate of 100Gbps. Metadata related to link quality is extracted from each packet. The metadata includes RTT, jitter, packet loss inference, error frames / retransmissions, application response time, port utilization and queue length. Perform protocol parsing and stream reassembly, including using an improved time wheel algorithm to clean up timed-out fragments to achieve IP fragment reassembly, using an ordered buffer (RB-tree) to handle out-of-order packets to achieve TCP stream reassembly, and application-layer parsing to support HTTPSClientHello / SNI, DNS, and HTTP; By constructing a 60-point time window and 8 core dimensions for link metrics, a [60×8] input matrix format of time series features is formed for subsequent time series CNN analysis. The 8 core dimensions include RTT, Jitter, packet loss rate, TCP retransmission rate, queue length, egress bandwidth utilization, ingress bandwidth utilization, and error frame / CRC count.

[0043] Preferably, the link quality intelligent analysis module specifically includes: A temporal convolutional neural network is constructed to learn the curve shape corresponding to temporal features, and deep feature extraction is performed on the link quality time series. For example, for abnormal micro-burst congestion RTT, the CNN's identification feature is short spikes + increased jitter; for abnormal intermittent packet loss RTT, the CNN's identification feature is sawtooth fluctuations; for abnormal random jitter, the CNN's identification feature is a high-frequency oscillating curve; for abnormal MTU mismatch, the CNN's identification feature is a periodic step-like increase in RTT; for queue overuse, the CNN's identification feature is a linear increase in latency. The temporal convolutional neural network structure includes three depthwise separable convolutional layers (kernel=3), a max pooling layer (MaxPool), a batch normalization layer (BatchNorm), and a ReLU activation function. The depthwise separable convolutions are used to extract key peak shapes, focusing on "important change points" and ignoring noise, making them very suitable for identifying "sudden congestion and spike anomalies." Specifically, the first depthwise separable convolutional layer is used to capture rapid fluctuations, the second depthwise separable convolutional layer is used to capture medium-term change trends, and the third depthwise separable convolutional layer is used to capture the overall trend and curve shape, ensuring that high-frequency, medium-frequency, and low-frequency features are captured. The batch normalization layer (BatchNorm) is used to accelerate convergence and improve stability, preventing training instability due to differences in link data. The ReLU activation function is used for non-linear modeling, allowing the model to learn different temporal patterns, and thus automatically classifying link anomaly types through deep learning curve shapes. The temporal convolutional neural network outputs a 128-dimensional link temporal feature vector. Instead of directly outputting link anomaly categories, the network performs deep feature extraction on the link quality time series, outputting a set of fixed-dimensional link temporal feature vectors to characterize the temporal behavior patterns of link quality changes within the time window. These link temporal feature vectors serve as intermediate features input to subsequent modules to complete link anomaly classification, root cause localization, and self-healing strategy inference. A neural network for government and enterprise networks is constructed to obtain spatial representations of anomalies in the topology domain, including the anomaly contribution of each node / link, the direction of anomaly propagation, and the probability distribution of root causes. These are used for subsequent fusion judgment and strategy reasoning. The network topology graph includes nodes, edges, node features, and edge features. Nodes include gateways, switches, and routers; edges are weighted links; node features include device load, error count, and port status; and edge features include packet loss rate, latency, and jitter. This neural network can identify anomaly propagation paths, determine root cause nodes (bottleneck devices), and determine whether the problem originates from an upstream link. The packet loss rate, latency, and jitter of each link constitute an edge feature vector. This vector is input into the neural network, and corresponding edge weights are calculated during message transmission to adjust the influence of different links on anomaly propagation. The quality status of the link is quantified through these weights to accurately locate the root cause of link anomalies.

[0044] For example, when the terminal RTT increases, the GNN analyzes that the anomaly originates from the path "aggregation switch → uplink X2". The increased terminal RTT is treated as a "symptom," and the GNN seeks the "most reasonable explanation for the cause" within the entire network topology. When an anomaly in terminal link quality is detected, this anomaly is injected as an observation signal into the corresponding terminal node in the network topology graph. The neural network, considering the network topology, node operating states, and link quality weights, models the propagation path of the anomaly's impact in the topology (including using message passing and state update functions defined in the graph neural network to propagate the node's abnormal state layer by layer in the topology, thereby learning the anomaly's diffusion path and impact range in the network). It calculates the contribution of each node and link to the anomaly through multi-layer message passing. Based on these contributions, it determines the most likely anomaly propagation path and root cause link leading to the terminal link quality anomaly.

[0045] By using a neural network to obtain the structured results of "abnormal contribution / root cause probability" of each node and link in the government-enterprise network topology graph under the current abnormal scenario, the results can be used to support fault classification, root cause location and impact range assessment.

[0046] By fusing the outputs of a temporal convolutional neural network and a government-enterprise network topology graph neural network, and based on the fused feature vector, the link anomaly type, root cause device or link location, and anomaly impact range are obtained through a multi-task output structure. Specifically, the output identification results can be determined by Softmax.

[0047] The temporal convolutional neural network and the network topology graph neural network are executed in parallel to extract the temporal behavior features and topological association features of the link quality, respectively. Then, the feature vectors of the two neural networks are fused. The fusion includes at least one of feature concatenation, weighting or attention mechanism.

[0048] Preferably, the root cause localization and strategy reasoning module specifically includes: constructing a fault knowledge graph of anomaly type-cause pattern-self-healing strategy triples based on existing expert rules, wherein each anomaly type corresponds to an anomaly pattern node, forming a directed causal relationship with the corresponding cause pattern and self-healing strategy; attributing the link anomaly type to the path through path reasoning; and providing the corresponding execution strategy.

[0049] Example: (RTT jagged increase → MTU mismatch → Adjust MTU + Clear ARP) (Jitter high-frequency fluctuations → upstream interface jitter → Reset interface) (Periodic packet loss → queue congestion → enable ECN or increase queue size) In a preferred embodiment, the fault knowledge graph also supports semantic matching and multi-strategy combination generation, specifically including: First, a semantic matching operation is performed: the identified link anomaly types are precisely matched with the corresponding anomaly pattern nodes in the knowledge graph, thereby filtering out the rule subset (i.e., subgraph) most relevant to the current anomaly type to limit the search space of path reasoning, providing accurate input for path reasoning and self-healing strategy generation, thereby improving reasoning efficiency; Next, path reasoning is performed: the identified set of abnormal nodes (i.e., root cause devices or root cause nodes) serves as the starting node for path reasoning. Combined with the anomaly judgment information of root cause devices and upstream links, a restricted search is performed along predefined causal relationship edges in the subgraph. During path reasoning, each candidate reasoning path is scored and filtered based on the anomaly confidence level, rule weights, and runtime context output by the model. The rule weights characterize the credibility or priority of causal rules in the knowledge graph; they can be dynamically adjusted based on expert experience, historical execution performance statistics, or model feedback, and participate in the scoring and filtering of candidate reasoning paths during the path reasoning process.

[0050] Strategy extraction and combination generation: For multiple inference paths whose scores meet the preset threshold, the corresponding self-healing strategy nodes in the paths are further extracted, and the impact of the strategy is evaluated in combination with the scope of the anomaly. Multiple strategy combinations are generated through conflict detection, dependency analysis and execution risk assessment, and the strategy combinations are sorted. Finally, the executable self-healing solution after scoring and sorting is output, which includes specific strategy operations and execution order, for subsequent strategy sandbox verification and safe execution.

[0051] Furthermore, the self-healing execution and security control module specifically includes: Build a policy security sandbox and simulate and verify it in the sandbox before the self-healing operation. Perform routing change risk investigation, NAT / ACL conflict verification, configuration consistency verification and network loop check in advance. AI selects a strategy to perform self-healing operations, including digital signature verification, sandbox simulation, Begin-Apply-Verify-Commit, and backtesting link quality after execution. If there is no improvement, it automatically rolls back. The self-healing operations include interface reset (shutdown / no shutdown), switching to backup links, MTU adjustment, automatic ARP / ND cleanup, queue optimization (Queue / Buffer), QoS priority adjustment, enabling or adjusting ECN / WRED, and supporting NETCONF / YANG, RESTCONF, and CLI interfaces.

[0052] The AI ​​selection strategy here specifically includes: among multiple candidate self-healing strategies (derived from the path reasoning and multi-strategy combination generation module), calculating the priority score of each strategy or strategy combination based on the link anomaly type, root cause localization, model confidence, and context constraints, and selecting the optimal strategy or optimal strategy combination to execute.

[0053] The strategy is validated in a static sandbox after generation (for security and legality checks) and executed in a dynamic sandbox before execution (for actual strategy simulation / drills), ensuring feasibility in real-world environments. The two execution sandbox simulations, "strategy review" and "execution drills," simulate different aspects and timings, complementing each other.

[0054] Preferably, the operation and maintenance support and optimization module specifically includes providing visualized topology, generating real-time heatmaps of link metrics, tracking and replaying faults, supporting online incremental learning of the model, and automatic clustering of samples. The purpose of automatic clustering here is to classify a large number of historical or real-time link fault samples according to feature similarity, thereby discovering potential new anomaly patterns, assisting in anomaly analysis, and optimizing AI model training.

[0055] Since the apparatus described in Embodiment 2 of the present invention is an apparatus used to implement the method of Embodiment 1 of the present invention, those skilled in the art can understand the specific structure and variations of the apparatus based on the method described in Embodiment 1 of the present invention, and therefore will not be described again here. All apparatuses used in the method of Embodiment 1 of the present invention fall within the scope of protection of the present invention.

[0056] Based on the same inventive concept, this application provides a storage medium corresponding to Embodiment 1, as detailed in Embodiment 3. Example 3

[0057] This embodiment provides a computer-readable storage medium, such as... Figure 3 As shown, a computer program is stored thereon, which, when executed by a processor, can implement any of the embodiments in Example 1.

[0058] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0059] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus, and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0060] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0061] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0062] The technical solution provided in this application embodiment has at least the following technical effects or advantages: it can achieve millisecond-level link anomaly capture and collect 1ms-level link fluctuations, which is far superior to the minute-level sampling of SNMP; it has a high accuracy rate (>98%) in identifying complex link anomalies, and can identify link curve features using CNN, which is especially suitable for short-term jitter and micro-burst packet loss; it can automatically locate the root cause of link anomalies in the topology, and can infer which link and which device the anomaly originates from through GNN; it achieves fully automated closed-loop self-healing, with the entire process of fault → location → policy → execution → verification → rollback requiring no manual intervention; it is friendly to high-security environments for government and enterprises, and can achieve local inference without relying on the cloud, meeting the requirements of sensitive networks; in addition, this invention supports continuous evolution, and ensures that the model continuously adapts to new link faults through incremental learning.

[0063] While specific embodiments of the present invention have been described above, those skilled in the art should understand that the specific embodiments described are merely illustrative and not intended to limit the scope of the present invention. Equivalent modifications and variations made by those skilled in the art in accordance with the spirit of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. An AI-based government-enterprise gateway fault automatic diagnosis and self-healing method, characterized in that: Includes the following steps: Step S1: Collect message data in real time, perform preprocessing, and obtain time-series characteristics; Step S2: Construct a temporal feature convolutional neural network and a topology graph neural network to extract temporal domain features and topology domain features respectively, and fuse the two types of features. Based on the fused feature vector, the link anomaly type, root cause device or link location, and anomaly impact range are obtained through a multi-task output structure. Step S3: Construct a fault knowledge graph, attribute the causes of link anomalies, and provide corresponding execution strategies; Step S4: Build a policy security sandbox, perform sandbox simulation execution, and execute self-healing operation after passing the simulation. Step S5: By tracking and replaying faults, new types of link faults are collected, and incremental learning is performed to ensure continuous optimization of the model.

2. The method of claim 1, wherein: Step S1 specifically includes: Step S11: Use DPDK to collect data at a line speed of 100Gbps and extract link quality-related metadata for each packet. The metadata includes RTT, jitter, packet loss inference, error frames / retransmissions, application response time, port utilization and queue length. Step S12: Perform protocol parsing and stream reassembly, including using an improved time wheel algorithm to clean up timed-out fragments to achieve IP fragment reassembly, and using an ordered buffer to handle out-of-order data to achieve TCP stream reassembly. Step S13: By constructing a 60-point time window and 8 core dimensions for the link metrics, a [60×8] input matrix format of time series features is formed for subsequent time series CNN analysis; the 8 core dimensions include RTT, Jitter, packet loss rate, TCP retransmission rate, queue length, outgoing bandwidth utilization, incoming bandwidth utilization, and error frame / CRC count.

3. The method of claim 1, wherein: Step S2 specifically includes: Step S21: Construct a temporal convolutional neural network to learn the curve shape corresponding to temporal features and perform deep feature extraction on the link quality time series. The temporal convolutional neural network structure includes three layers of depthwise separable convolutions, a max pooling layer (MaxPool), a batch normalization layer (BatchNorm), and a ReLU activation function. The depthwise separable convolutions are used to extract key peak shapes. Specifically, the first depthwise separable convolution is used to capture rapid fluctuations, the second depthwise separable convolution is used to capture medium-term change trends, and the third depthwise separable convolution is used to capture the overall trend and curve shape. The ReLU activation function is used for nonlinear modeling, allowing the model to learn different temporal patterns. Step S22: Construct a government and enterprise network topology graph neural network to obtain the spatial representation results of anomalies in the topology domain, including the anomaly contribution of each node / link, the direction of anomaly propagation, and the root cause probability distribution, for subsequent fusion judgment and strategy reasoning. The network topology graph includes nodes, edges, node features, and edge features. The nodes include gateways, switches, and routers. The edges are weighted links. The node features include device load, error count, and port status. The edge features include packet loss rate, latency, and jitter. Step S23, which combines the outputs of steps S21 and S22, uses the fused feature vector to obtain the link anomaly type, root cause device or link location, and anomaly impact range through a multi-task output structure.

4. The method of claim 1, wherein: Step S3 specifically includes: constructing a fault knowledge graph of anomaly type-cause pattern-self-healing strategy triples based on existing expert rules, attributing link anomaly types through path reasoning, and providing corresponding execution strategies.

5. The method of claim 1, wherein: Step S4 specifically includes: Step S41: Build a policy security sandbox. Before the self-healing operation, simulate and verify in the sandbox to pre-conduct route change risk investigation, NAT / ACL conflict verification, configuration consistency verification, and network loop check. Step S42: AI selects a strategy to perform self-healing operations, including digital signature verification, sandbox simulation, and execution of Begin-Apply-Verify-Commit. After execution, the link quality is backtested, and if there is no improvement, it is automatically rolled back. The self-healing operations include interface reset, switching backup links, MTU adjustment, automatic ARP / ND cleanup, queue optimization, QoS priority adjustment, and enabling or adjusting ECN / WRED.

6. The method of claim 1, wherein: Step S5 specifically includes providing a visualized topology, creating a real-time heatmap of link metrics, tracking and replaying faults, supporting online incremental learning of the model, and automatically clustering samples.

7. The AI-based government-enterprise gateway fault automatic diagnosis and self-healing device is characterized in that: include: The high-speed data acquisition module is used to acquire message data in real time, perform preprocessing, and obtain time-series characteristics; The link quality intelligent analysis module is used to construct a temporal feature convolutional neural network and a topology graph neural network to extract temporal domain features and topology domain features respectively, and then fuse the two types of features. Based on the fused feature vector, the link anomaly type, root cause device or link location, and anomaly impact range are identified through a multi-task output structure. The root cause localization and strategy reasoning module is used to construct a fault knowledge graph, attribute the causes of link anomalies, and provide corresponding execution strategies. The self-healing execution and security control module is used to build a policy security sandbox, perform sandbox simulation execution, and perform self-healing operations after passing the simulation. The operation and maintenance support and optimization module is used to collect new link faults by tracking and replaying faults, and to perform incremental learning to ensure continuous optimization of the model.

8. The apparatus of claim 7, wherein: The high-speed data acquisition module specifically includes: DPDK is used to collect data at a line rate of 100Gbps. Metadata related to link quality is extracted from each packet. The metadata includes RTT, jitter, packet loss inference, error frames / retransmissions, application response time, port utilization and queue length. Perform protocol parsing and stream reassembly, including using an improved time-round algorithm to clean up timed-out fragments to achieve IP fragment reassembly, and using an ordered buffer (RB-tree) to handle out-of-order data to achieve TCP stream reassembly; By constructing a 60-point time window and 8 core dimensions for link metrics, a [60×8] input matrix format of time series features is formed for subsequent time series CNN analysis. The 8 core dimensions include RTT, Jitter, packet loss rate, TCP retransmission rate, queue length, egress bandwidth utilization, ingress bandwidth utilization, and error frame / CRC count.

9. The apparatus of claim 7, wherein: The link quality intelligent analysis module specifically includes: A temporal convolutional neural network is constructed to learn the curve shape corresponding to temporal features, and to perform deep feature extraction on the link quality time series. The temporal convolutional neural network structure includes three layers of depthwise separable convolutions, a max pooling layer (MaxPool), a batch normalization layer (BatchNorm), and a ReLU activation function. The depthwise separable convolutions are used to extract key peak shapes. Specifically, the first depthwise separable convolution is used to capture rapid fluctuations, the second depthwise separable convolution is used to capture medium-term trends, and the third depthwise separable convolution is used to capture the overall trend and curve shape. The ReLU activation function is used for nonlinear modeling, allowing the model to learn different temporal patterns. A neural network for government and enterprise network topology is constructed to obtain the spatial representation results of anomalies in the topology domain, including the anomaly contribution of each node / link, the direction of anomaly propagation, and the root cause probability distribution, which are used for subsequent fusion judgment and strategy reasoning. The network topology graph includes nodes, edges, node features, and edge features. The nodes include gateways, switches, and routers. The edges are weighted links. The node features include device load, error count, and port status. The edge features include packet loss rate, latency, and jitter. By fusing the outputs of a temporal convolutional neural network and a government-enterprise network topology graph neural network, and based on the fused feature vector, the link anomaly type, root cause device or link location, and anomaly impact range are obtained through a multi-task output structure.

10. A computer readable storage medium having stored thereon a computer program, characterized in that: When the program is executed by the processor, it implements the method as described in any one of claims 1 to 4.

Images