Network health degree prediction method and system based on AI learning

Abstract

The invention relates to the technical field of network prediction, in particular to a network health degree prediction method and system based on AI learning, and the method comprises the following steps: constructing a network link time delay sequence, calculating a fluctuation feature vector based on a time window slice, and inputting the fluctuation feature vector into a long short-term memory network to generate a next node time delay prediction value. And calculating a network state deviation index between the real-time data and the predicted value, and mapping the deviation by using an exponential attenuation function to generate a network health degree prediction result. According to the method, the time sequence evolution rule of the time delay data is deeply mined by using the long-short-term memory network, and the real-time data and the predicted value are dynamically compared to calculate the deviation degree, so that the dependence on a fixed threshold value and artificial experience is eliminated, and the defect of the traditional statistical method in sensitivity is overcome; the attenuation degree of the network performance under the abnormal disturbance is accurately quantified by using the exponential attenuation function, the scientificity of network operation and maintenance decision is improved, and the full-dimension accurate evaluation and prediction of the network health situation are realized.

Description

Technical Field

[0001] This invention relates to the field of network prediction technology, and in particular to a method and system for predicting network health based on AI learning. Background Technology

[0002] Network prediction technology involves a set of technologies for modeling, evaluating, and predicting the operational status of communication networks. This technology is based on network operation data and focuses on core issues such as network connectivity, transmission latency, packet loss, link stability, and service availability. It is typically applied in campus networks, data center networks, and wide area network environments to support network operation status analysis, capacity planning, and operation and maintenance decisions. The technical solutions in this field generally rely on the periodic detection results of network nodes and links, statistically process network performance data at different time scales, and infer the trend of network status changes based on historical operation records, thereby forming a prediction of the future operation status of the network. Traditional network health prediction methods rely on manually set rules or fixed threshold systems to compare and analyze latency, packet loss rate, number of successful connections, and service response status obtained during network probing. By comparing the current probing results with preset standard ranges, it determines whether network assets are in a normal, degraded, or abnormal state. The results are then summarized over time to infer the overall network performance level. These methods typically depend on maintenance personnel setting the value ranges of various performance indicators based on experience. By statistically calculating continuous minute-level or hourly probing data and combining it with historical operation records under similar scenarios, the changing trends of network health status are predicted and judged.

[0003] Traditional prediction methods rely on manually set rules or fixed threshold systems to compare and analyze network detection data. They lack the ability to adapt to the instantaneous dynamic fluctuations in network traffic, leading to frequent false alarms or missed alarms. Furthermore, these methods rely excessively on the subjective experience of operations and maintenance personnel to set the range of indicators, making it difficult to cover complex and ever-changing network scenarios. At the same time, they only perform coarse-grained statistics on continuous minute-level or hour-level data, resulting in significant lag in status assessment. They cannot accurately capture subtle trend changes or potential signs of degradation in network performance, thus restricting the timeliness of network operation and maintenance decisions. Summary of the Invention

[0004] To address the technical problems existing in the prior art, embodiments of the present invention provide a network health prediction method based on AI learning, comprising the following steps: To achieve the above objectives, the present invention adopts the following technical solution: a network health prediction method based on AI learning, comprising the following steps: S1: Collect Internet Control Message Protocol (ICP) messages of the target network assets, extract the corresponding sending and receiving timestamps, calculate the round-trip time values, and sort them in chronological order to construct a network link delay sequence; S2: Based on a preset time window length, slice the network link delay sequence, calculate the standard deviation and average value for the sliced ​​data segments, and use the standard deviation and average value to construct a network delay fluctuation feature vector. S3: Input the network latency fluctuation feature vector into the pre-trained long short-term memory network, and use the long short-term memory network to perform time-series evolution operation to generate the latency prediction value of the next node; S4: Obtain the current time delay data, calculate the absolute value of the difference between the current time delay data and the predicted delay value of the next node, call the normalization function to process the absolute value of the difference, and calculate the network state deviation index. S5: Call the preset exponential decay function to perform mapping processing on the network state deviation index, determine the distribution position of the mapping result within the standard health value range, and generate the network health prediction result.

[0005] As a further aspect of the present invention, the network link delay sequence includes a time sequence index identifier, a round-trip delay value, and a message sequence identifier; the network delay fluctuation feature vector includes local dispersion features, trend center features, and peak deviation features; the next node delay prediction value includes a future time delay estimate, an upper limit of the prediction confidence interval, and a lower limit of the prediction confidence interval; the network state deviation index includes an absolute error normalized component, a relative error ratio component, and a deviation trend slope component; and the network health prediction result includes a comprehensive health score, a current risk level, and a reliability prediction probability.

[0006] As a further aspect of the present invention, the specific steps of S1 are as follows: S101: Collect Internet Control Message Protocol (ICP) messages sent by the target network asset, parse the header structure of the ICP messages, locate and extract the sending timestamp that identifies the time the message leaves the source node and the receiving timestamp that identifies the time the message returns, perform one-to-one data binding between the sending timestamp and the receiving timestamp, and generate message sending and receiving timestamp pairs. S102: Call the message sending and receiving timestamp pair, perform the difference calculation between the received timestamp value and the sent timestamp value, obtain the physical time overhead generated by the data packet in the bidirectional network link, verify the non-negativity of the calculation result, standardize the data type of the time overhead value to double-precision floating-point format, and generate a single link round-trip delay value. S103: For the multiple single link round-trip delay values ​​accumulated within the continuous monitoring time window, retrieve the time dimension index data corresponding to each delay value, perform time-series rearrangement on all single link round-trip delay values ​​according to the linear increment logic of the time dimension index, fill the sorted delay data stream into the linear time series container, and construct the network link delay sequence.

[0007] As a further aspect of the present invention, the specific steps of S2 are as follows: S201: Call the network link delay sequence, read the preset time window length configuration parameter, perform sliding interception on the time axis of the network link delay sequence with a fixed time step, identify the valid round-trip delay value falling within the time span of each sliding window, establish the mapping logic between the delay value and the window index, aggregate all values ​​in the same window into independent analysis units, and generate a delay data slice set. S202: For each analysis unit included in the latency data slice set, calculate the average latency value of the slice within the unit, solve the degree of discrete distribution of the value within the unit relative to the average latency value of the slice based on the standard deviation calculation logic, obtain the standard deviation of the slice latency, and associate and bind the two to generate a latency statistical feature pair. S203: Based on the time window sequence corresponding to each analysis unit, the delay statistical feature pairs are serialized and recombined to maintain the continuity of the time dimension. The average delay value of the slice is mapped to the trend dimension component of the vector, and the standard deviation of the slice delay is mapped to the fluctuation dimension component of the vector to generate a network delay fluctuation feature vector.

[0008] As a further aspect of the present invention, the process of identifying the valid round-trip delay values ​​falling within each sliding window time span specifically involves: performing ascending sorting on the original round-trip delay values ​​falling within the current sliding window time span to construct a temporary sorting sequence; determining the first quantile value at the quarter position and the third quantile value at the three-quarter position based on the total amount of data in the temporary sorting sequence; determining the interquartile range statistic using the calculation result of subtracting the first quantile value from the third quantile value; obtaining a preset anomaly detection sensitivity coefficient, wherein the lower limit filtering threshold is specifically set by subtracting the interquartile range statistic from the first quantile value and the anomaly detection sensitivity coefficient, and the upper limit filtering threshold is specifically set by adding the interquartile range statistic to the third quantile value and the anomaly detection sensitivity coefficient; traversing the temporary sorting sequence to remove abnormal data whose values ​​are less than the lower limit filtering threshold or greater than the upper limit filtering threshold; and determining the values ​​retained within the closed interval between the lower and upper limit filtering thresholds as valid round-trip delay values.

[0009] As a further aspect of the present invention, the specific steps of S3 are as follows: S301: Call the network latency fluctuation feature vector and input it into the pre-trained long short-term memory network. Utilize the forget gate structure inside the network to calculate the forgetting coefficient of historical information based on the current input and the hidden layer output of the previous time step. Combine the input gate structure to perform a weighted evaluation of the information importance of the current feature vector. Through element-wise weighted summation logic, perform a fusion update of the selected historical state and the newly generated candidate state to refresh the temporal memory content of the network's internal storage units and generate a long short-term memory unit state vector. S302: For the updated long short-term memory unit state vector, call the output gate structure to calculate the output gating coefficient of the current time step, use the hyperbolic tangent activation function to perform nonlinear mapping processing on the state values ​​in the memory unit, perform element-wise multiplication operation based on Hadamard product on the mapped state values ​​and the output gating coefficient, extract the effective feature components that contribute to the future trend from the internal memory state, and generate the time-series evolution hidden layer output vector. S303: The time-series evolution hidden layer output vector is imported into the final fully connected regression layer of the network. The trained and optimized weight matrix is ​​called to perform a linear weighted combination operation on the multi-dimensional hidden layer features. The corresponding bias vector is superimposed to correct the baseline deviation of the linear transformation. Through the projection mapping from the high-dimensional space to the low-dimensional scalar domain, the numerical value that quantifies the evolution trend of network delay at future moments is calculated, and the delay prediction value of the next node is generated.

[0010] As a further aspect of the present invention, the specific steps of S4 are as follows: S401: Periodically reads the link transmission status data at the current moment using real-time telemetry probes deployed at network edge nodes, extracts round-trip time readings that characterize the actual transmission efficiency of the current physical link through the underlying protocol stack parsing logic, performs timestamp alignment verification, removes invalid noise, and generates real-time delay monitoring values. S402: Call the next node delay prediction value as a theoretical reference benchmark, calculate the numerical difference between the real-time delay monitoring value and the theoretical reference benchmark, apply the absolute value function to non-negatively process the difference result, retain the scalar magnitude of the quantization deviation, and generate the absolute error of the delay prediction. S403: Obtain the preset normalized scaling parameters and maximum tolerance threshold, construct a nonlinear mapping model based on the inverse hyperbolic tangent function, input the absolute error of the time delay prediction into the model to perform dimensionless compression processing, project the error value into the standardized confidence interval, quantify the statistical significance of the deviation of the actual network operating state from the expected trajectory, and obtain the network state deviation index.

[0011] As a further aspect of the present invention, the specific steps of S5 are as follows: S501: Call the preset exponential decay function model and decay coefficient parameters, use the natural logarithm base to construct a nonlinear mapping relationship, substitute the network state deviation index into the exponential operation logic to perform reverse mapping processing, simulate the decay law of network performance as state deviation increases, calculate the original score characterizing the current function retention of the network, and generate a performance retention decay score. S502: For the performance retention degradation score, retrieve the boundary configuration of the standard health value interval, apply the linear normalization algorithm to dynamically project the score into the standard interval, perform boundary truncation verification to avoid the risk of numerical overflow, and determine the actual landing point coordinate of the current score in the global health spectrum by comparing the relative distance between the score and each point in the interval, quantify the relative position attribute under the standard evaluation system, and generate interval distribution positioning coordinates. S503: Based on the interval distribution and location coordinates, call the state parsing engine to perform the conversion from numerical to semantic, associate the corresponding risk level description and reliability confidence probability, encapsulate the quantitative coordinate values ​​and qualitative state labels in a structured manner, construct a full-dimensional prediction model of network health status, and generate network health prediction results.

[0012] As a further aspect of the present invention, the specific steps of S5 are as follows: The process of configuring the boundary of the standard health score range is as follows: statistically analyze the distribution of historical health score data in a fault-free operating state; calculate the expected value and variance of the historical health score data distribution; determine the lower boundary value by subtracting a preset multiple from the expected value and the upper boundary value by adding a preset multiple to the expected value; and define the standard health score range by combining the lower boundary value and the upper boundary value.

[0013] A network health prediction system based on AI learning, the system comprising: The latency data processing module collects Internet Control Message Protocol (ICP) messages of the target network assets, extracts the corresponding sending and receiving timestamps, calculates the round-trip time values, and sorts them in chronological order to construct a network link latency sequence. The fluctuation feature analysis module slices the network link delay sequence based on a preset time window length, calculates the standard deviation and average value for the sliced ​​data segments, and constructs a network delay fluctuation feature vector using the standard deviation and average value. The latency prediction and analysis module inputs the network latency fluctuation feature vector into a pre-trained long short-term memory network, and uses the long short-term memory network to perform time-series evolution operations to generate the latency prediction value of the next node. The state deviation identification module acquires the current time delay data, calculates the absolute value of the difference between the current time delay data and the predicted delay value of the next node, calls the normalization function to process the absolute value of the difference, and calculates the network state deviation index. The network health assessment module calls a preset exponential decay function to perform mapping processing on the network state deviation index, determines the distribution position of the mapping result within the standard health value range, and generates a network health prediction result.

[0014] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, by constructing a network link delay sequence and extracting fluctuation feature vectors, and by using a long short-term memory network to deeply mine the temporal evolution pattern of delay data, a highly reliable next node delay prediction value is generated. The real-time collected data is dynamically compared with the prediction value to calculate the state deviation. This eliminates the dependence on fixed thresholds and human experience, effectively overcoming the shortcomings of traditional statistical methods in terms of sensitivity and real-time performance. Furthermore, by using an exponential decay function to perform nonlinear mapping on the deviation index, the degree of network performance degradation under abnormal disturbances is accurately quantified, achieving a comprehensive and accurate assessment and forward-looking prediction of network health status. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a schematic diagram of the steps of the present invention; Figure 2 This is a detailed schematic diagram of S1 of the present invention; Figure 3 This is a detailed schematic diagram of S2 of the present invention; Figure 4 This is a detailed schematic diagram of S3 of the present invention; Figure 5 This is a detailed schematic diagram of S4 of the present invention; Figure 6 This is a detailed schematic diagram of S5 of the present invention; Figure 7 This is a system module diagram of the present invention. Detailed Implementation

[0017] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0018] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0019] Please see Figure 1 This invention provides a method for predicting network health based on AI learning, comprising the following steps: S1: Collect Internet Control Message Protocol (ICP) messages sent to the target network asset, extract the sending and receiving timestamps of the ICP messages, calculate the round-trip time (RTT) values ​​based on the sending and receiving timestamps, arrange the RTT values ​​in chronological order, and construct a network link delay sequence. S2: Call the network link delay sequence, slice the network link delay sequence based on the preset time window length, calculate the standard deviation and average value of the sliced ​​data segments, and construct the network delay fluctuation feature vector. S3: Input the network latency fluctuation feature vector into the pre-trained long short-term memory network, and use the long short-term memory network to perform time-series evolution operation to generate the latency prediction value of the next node; S4: Obtain the real-time latency data at the current moment, calculate the absolute value of the difference between the current latency data and the latency prediction value of the next node, call the normalization function to process the absolute value of the difference, and calculate the network state deviation index. S5: Call the preset exponential decay function to map the network state deviation index, determine the distribution position of the mapping result within the standard health value range, and generate the network health prediction result. The network link delay sequence includes a time sequence index identifier, round-trip delay value, and message sequence identifier. The network delay fluctuation feature vector includes local dispersion features, trend center features, and peak deviation features. The next node delay prediction value includes the estimated delay value at future time, the upper limit of the prediction confidence interval, and the lower limit of the prediction confidence interval. The network state deviation index includes the normalized absolute error component, the relative error ratio component, and the deviation trend slope component. The network health prediction result includes a comprehensive health score, the current risk level, and the reliability prediction probability.

[0020] Please see Figure 2 The specific steps of S1 are as follows: S101: Collect Internet Control Message Protocol (ICP) messages sent by the target network assets, parse the header structure of the ICP messages, locate and extract the sending timestamp that identifies when the message leaves the source node and the receiving timestamp that identifies when the message returns, bind the sending timestamp and receiving timestamp to generate a message sending and receiving timestamp pair. The process captures Internet Control Message Protocol (ICP) packets output via network ports using the underlying network driver interface deployed on the source node. This process does not rely on higher-level application interfaces; instead, it directly listens for link-layer frame data via the RawSocket mechanism. For the captured binary data stream, it reads the protocol field at a fixed byte offset in the ICP header, identifies the packet type field (echo request Type 8 or echo response Type 0), and extracts the Code field to confirm the packet subtype. After confirming that the packet conforms to the ICP standard format, it further parses the Identifier and SequenceNumber fields in the packet header; these two fields together constitute the packet's unique fingerprint. Simultaneously, it calls the operating system kernel's high-precision timer interface to record a transmission timestamp at the physical moment the packet leaves the source network interface card (NIC). This timestamp must be accurate to the microsecond or nanosecond level to meet the monitoring requirements of high-frequency trading or real-time control systems. When the response packet from the target node arrives at the source node, the kernel interrupt handler is triggered again to record a reception timestamp at the moment the packet enters the NIC's receive buffer. The data binding operation is performed by traversing the cached table of sent message records in memory. The parsed sequence number (SequenceNumber) is used as the hash key for retrieval and matching, establishing a one-to-one correspondence between the received timestamp of a received message and the sending timestamp of a sending record with the same sequence number. If no corresponding sending record is found within the preset cache lifetime, the message is considered an orphan and discarded. Through this matching logic, paired sending and receiving timestamps are encapsulated into independent data structures, generating message send / receive time stamp pairs containing the source address, destination address, sequence number, sending time, and receiving time. For example, in a specific implementation scenario, the monitoring system captures an ICMP request message with sequence number 1001, whose sending timestamp is 1675830000.123456 seconds; subsequently, it captures a response message with the same sequence number 1001, whose receiving timestamp is 1675830000.128500 seconds. These two timestamp values ​​are extracted and locked to construct a tag pair {Seq: 1001, T_send: 1675830000.123456, T_recv: 1675830000.128500}, providing the original physical credentials for subsequent latency calculations.

[0021] S102: Call the message sending and receiving timestamp pair, perform the difference calculation between the received timestamp value and the sent timestamp value, obtain the physical time overhead generated by the transmission of the data packet in the bidirectional network link, verify the non-negativity of the calculation result, standardize the data type of the time overhead value to double-precision floating-point format, and generate the single link round-trip delay value. The process of verifying the non-negativity of the calculation result specifically involves: obtaining the pre-configured minimum physical delay benchmark value and the maximum round-trip timeout threshold; performing a value interval determination on the difference between the calculated received timestamp value and the transmitted timestamp value, checking whether the difference falls within the effective delay interval jointly formed by the minimum physical delay benchmark value and the maximum round-trip timeout threshold; if the detection result indicates that the difference is greater than or equal to the minimum physical delay benchmark value and simultaneously less than or equal to the maximum round-trip timeout threshold, then the calculation result is determined to satisfy the non-negativity and physical reasonableness constraints, and the difference is confirmed as valid data; if the detection result indicates that the difference is less than the minimum physical delay benchmark value ... calculation result is determined to satisfy the non-negativity and physical reasonableness constraints, and the difference is confirmed as valid data. If the minimum physical delay baseline value is greater than the maximum round-trip timeout threshold, the calculation result is determined to have a clock synchronization logic abnormality or a transmission timeout error, triggering an abnormal data cleaning instruction to remove the difference from the processing flow. The minimum physical delay baseline value is set based on the theoretical propagation speed limit of the optical signal in the optical fiber transmission medium, combined with the physical link route length between the source node and the target node. The maximum round-trip timeout threshold is set based on the default request waiting time parameter defined in the network control protocol stack, and with reference to the statistical upper bound of the network delay probability distribution obtained from the historical monitoring period. The system reads the message transmission and reception timestamp pairs cached in memory, extracts the receive timestamp and send timestamp values, and performs a subtraction operation (subtracting the send timestamp from the receive timestamp) to obtain the original physical time overhead value. To ensure calculation accuracy, the timestamp data involved in the calculation and the calculation result are forcibly converted to DoublePrecision floating-point format to retain at least 6 significant digits after the decimal point. Subsequently, the system enters the data verification and standardization process. First, it obtains the minimum physical latency baseline value and the maximum round-trip timeout threshold pre-stored in the configuration file. The calculation of the minimum physical delay baseline depends on the physical speed of light limit and the routing distance. The specific setting process is as follows: Query the optical cable route length between the source and target nodes, obtain the refractive index parameter of the optical signal in the optical fiber medium (typically approximately 1.468), calculate the propagation speed of light in a vacuum (approximately 299,792,458 m / s) divided by the refractive index to obtain the medium propagation speed (approximately 204,218,295 m / s), divide the route length by this medium propagation speed and multiply by 2 (representing a round trip) to obtain the theoretical physical limit delay. Set 0.9 times this value as the minimum physical delay baseline to tolerate measurement errors. The maximum round trip timeout threshold is set to the network protocol stack's default request timeout time (e.g., 2000 milliseconds) or based on the 99.9th percentile value of the most recent 7 days of historical data. After obtaining these two boundary values, determine whether the calculated original difference is within the closed interval of [minimum physical delay baseline, maximum round trip timeout threshold]. If the original difference satisfies the range constraint, the data is considered a valid single-link round-trip delay value. If the original difference is less than the minimum physical delay baseline (e.g., a negative or extremely small value, indicating system clock rollback or calculation error) or greater than the maximum round-trip timeout threshold (indicating link interruption or extremely severe congestion), it is considered abnormal data, and a cleaning command is directly triggered to remove it from the data stream, preventing it from subsequent statistical analysis. For example, in an actual operation, the receive timestamp is 1675830000.128500 seconds, and the send timestamp is 1675830000.123456 seconds. Subtraction yields a difference of 0.005044 seconds, or 5.044 milliseconds. The preset minimum physical latency benchmark is 0.5 milliseconds (based on a 100km fiber optic cable), and the maximum round-trip timeout threshold is 2000 milliseconds. A value of 5.044 milliseconds was detected, falling between 0.5 and 2000 milliseconds and being non-negative; therefore, it was considered a valid single-link round-trip latency value. Conversely, if the calculated result is -0.001 seconds or 3000 milliseconds, it will be immediately discarded.

[0022] S103: For multiple single link round-trip delay values ​​accumulated within the continuous monitoring time window, retrieve the time dimension index data corresponding to each delay value, perform time-series rearrangement on all single link round-trip delay values ​​according to the linear increment logic of the time dimension index, fill the sorted delay data stream into the linear time series container, and construct the network link delay sequence. Within a specified time period (e.g., the past minute), verified single-link round-trip delay values ​​are continuously collected, forming an unordered dataset. To construct an analysis object with time-series characteristics, the original transmission timestamp associated with each delay value is read as the sorting index key. A QuickSort or MergeSort algorithm is used to rearrange all delay values ​​according to their timestamp values ​​in ascending order, ensuring the data's monotonically increasing nature over time. After sorting, a linear time series container (such as a dynamic array or linked list) is created, and the sorted delay values ​​are sequentially filled into this container. If multiple delay values ​​are generated at the same time (with identical microsecond values), they are then sorted in ascending order of sequence number. Through this process, discrete, potentially out-of-order network measurement data is transformed into a strictly time-series network link delay sequence, which realistically reproduces the dynamic trajectory of network quality evolution over time. For example, if three data points are collected within one second, their original order is: A (time 10.5 seconds, delay 3 ms), B (time 10.1 seconds, delay 4 ms), and C (time 10.3 seconds, delay 2 ms). After this step, the data points are rearranged according to the time indices 10.1, 10.3, and 10.5 to generate an ordered sequence [4 ms, 2 ms, 3 ms], which is then stored in a delay sequence container for subsequent sliding window analysis.

[0023] Please refer to Table 1, which contains examples of link delay sequence rearrangements.

[0024] As shown in Table 1, the captured messages were rearranged according to their sending timestamps. Although Pkg_104 was captured later in the sequence, it was placed second in the sequence because its sending timestamp was earlier than that of Pkg_103. Meanwhile, Pkg_102 was marked in step S102 due to an abnormal value (the setting exceeded the threshold) and was not included in the final sequence in this step.

[0025] Please see Figure 3 The specific steps of S2 are as follows: S201: Call the network link delay sequence, read the preset time window length configuration parameter, perform sliding interception on the time axis of the network link delay sequence with a fixed time step, identify the valid round-trip delay values ​​falling within the time span of each sliding window, establish the mapping logic between the delay values ​​and the index of the window to which they belong, aggregate all values ​​in the same window into independent analysis units, and generate a delay data slice set. The process of identifying valid round-trip delay values ​​falling within each sliding window time span specifically involves: sorting the original round-trip delay values ​​falling within the current sliding window time span in ascending order to construct a temporary sorted sequence; determining the first quantile value at the quarter-th position and the third quantile value at the third-quarter position based on the total data volume of the temporary sorted sequence; determining the interquartile range statistic by subtracting the first quantile value from the third quantile value; obtaining a preset anomaly detection sensitivity coefficient, which is used to adjust the algorithm's tolerance for outlier noise data; and then, based on the first quantile value, the interquartile range statistic, and the anomaly detection... The sensitivity coefficient is used to construct the lower limit filtering threshold for valid data. The specific method for setting the lower limit filtering threshold is to subtract the product of the interquartile range statistic and the anomaly detection sensitivity coefficient from the first quantile value. The upper limit filtering threshold for valid data is constructed based on the third quantile value, the interquartile range statistic, and the anomaly detection sensitivity coefficient. The specific method for setting the upper limit filtering threshold is to add the product of the interquartile range statistic and the anomaly detection sensitivity coefficient to the third quantile value. The temporary sorting sequence is traversed to remove abnormal data whose values ​​are less than the lower limit filtering threshold or greater than the upper limit filtering threshold. The values ​​retained within the closed interval between the lower limit filtering threshold and the upper limit filtering threshold are determined as valid round-trip delay values. Load the preset time window length configuration parameters (e.g., window length set to 60 seconds) and sliding step parameters (e.g., step size set to 10 seconds), establish the first time window on the time axis with the start time point of the sequence as zero, and identify all valid round-trip delay values ​​within the start and end time range of this window. Then, shift the window towards future time according to the sliding step size, repeating the identification process until the entire data sequence is covered. Within each independent sliding window, to eliminate the interference of sudden noise on statistical characteristics, noise reduction processing based on interquartile range (IQR) is performed. Specifically, first, all delay values ​​within the current window are sorted in ascending order to form a temporary sorted sequence. Based on the total number of sequence elements N, calculate the position index of the first quartile Q1 (i.e., N multiplied by 0.25) and the position index of the third quartile Q3 (i.e., N multiplied by 0.75). Read the values ​​at these two positions and record them as Q1 and Q3 values, respectively. Then, perform a subtraction operation, subtracting the Q1 value from the Q3 value to obtain the interquartile range (IQR). Read the preset anomaly detection sensitivity coefficient k (usually 1.5), which determines the strictness of the filtering. Calculate the lower limit filtering threshold using the formula: Q1 value minus (IQR multiplied by k); simultaneously calculate the upper limit filtering threshold: Q3 value plus (IQR multiplied by k). Finally, iterate through all values ​​in the current window, identifying values ​​less than the lower limit filtering threshold or greater than the upper limit filtering threshold as outliers and removing them. Only retain data within the closed interval [lower limit filtering threshold, upper limit filtering threshold], aggregating them into an effective delay data slice for that window. For example, a window contains data [10, 11, 12, 12, 13, 13, 14, 100], a total of 8 data points. Q1 position is the 2nd data point (11), and Q3 position is the 6th data point (13). IQR = 13 - 11 = 2. Let k = 1.5. Lower limit threshold = 11 - (2 × 1.5) = 8. The upper threshold is 13 + (2 × 1.5) = 16. Traversing the data, it was found that 100 is greater than the upper threshold of 16, and was therefore identified as an anomaly and removed. The final valid data for this window is [10, 11, 12, 12, 13, 13, 14]. This process ensures that subsequent feature extraction is based on steady-state data, avoiding the misleading influence of instantaneous fluctuations on trend judgment.

[0026] S202: For each analysis unit included in the time delay data slice set, calculate the average time delay value of the slice within the unit, solve the degree of dispersion of the value within the unit relative to the average time delay value of the slice based on the standard deviation calculation logic, quantify the fluctuation range of the data within the current time window, obtain the standard deviation of the slice time delay, and associate and bind the two to generate a time delay statistical feature pair. The slice average latency is calculated by summing all valid round-trip latency values ​​retained within the analysis unit. The number of valid values ​​within the unit is then counted, and a division operation is performed (the sum divided by the number of data points) to obtain the arithmetic mean. This mean represents the central trend of network transmission within the current time window. Subsequently, the slice latency standard deviation is calculated based on the standard deviation calculation logic to quantify the jitter level. Specifically, each valid value within the unit is iterated, and its difference from the slice average latency is calculated. Each difference is squared to obtain a sequence of squared differences. All squared differences are summed to obtain a total sum. This total sum is divided by the number of data points (or the number of data points minus 1, i.e., using an unbiased estimate) to obtain the variance. Finally, the square root of the variance is calculated to obtain the slice latency standard deviation. The calculated slice average latency and slice latency standard deviation are combined to generate a latency statistical feature pair containing two floating-point values. For example, in the data [10, 11, 12, 12, 13, 13, 14] retained in the previous step, there are 7 data points. The cumulative sum is 85, and the average slice latency is approximately 12.14 milliseconds (85 / 7). The squares of the differences between each value and 12.14 are calculated, and the variance is obtained by summing them. Taking the square root of this variance gives the standard deviation of the slice latency, which is approximately 1.35 milliseconds. This finally generates a feature pair {Mean: 12.14, Std: 1.35}, which accurately describes the average speed and fluctuation stability of the network within this time period.

[0027] S203: Based on the time window sequence corresponding to each analysis unit, the delay statistical feature pairs are serialized and recombined to maintain the continuity of the time dimension. The average delay value of the slice is mapped to the trend dimension component of the vector, and the standard deviation of the delay of the slice is mapped to the fluctuation dimension component of the vector. A numerical structure with multi-dimensional time series attributes is constructed to generate the network delay fluctuation feature vector. Multiple time-delay statistical feature pairs are serialized and recombined to create a multi-dimensional vector container. For each time step t, the corresponding slice average time delay value is mapped to the first dimension component of the vector, representing trend information; the corresponding slice time delay standard deviation is mapped to the second dimension component of the vector, representing fluctuation information. In this way, the original one-dimensional scalar time series is upgraded to a two-dimensional feature vector sequence. This process maintains strict temporal continuity and must not disrupt the window order. The final generated network time delay fluctuation feature vector has a matrix structure of [time step, feature dimension], which not only contains information about "how slow the network is" but also information about "how unstable the network is," providing rich high-dimensional input features for subsequent Long Short-Term Memory (LSTM) networks. For example, if the feature pairs for three consecutive time windows are {12.14, 1.35}, {12.50, 1.40}, and {13.00, 2.10}, then the constructed network delay fluctuation feature vector is [[12.14, 1.35], [12.50, 1.40], [13.00, 2.10]]. This structured data directly fits the input layer requirements of the LSTM network.

[0028] Please see Figure 4 The specific steps of S3 are as follows: S301: Call the network latency fluctuation feature vector and input it into the pre-trained long short-term memory network. Utilize the forget gate structure inside the network to calculate the forgetting coefficient of historical information based on the current input and the hidden layer output of the previous time step. Combine the input gate structure to perform a weighted evaluation of the information importance of the current feature vector. Through element-wise weighted summation logic, perform a fusion update of the selected historical state and the newly generated candidate state, refresh the temporal memory content of the network's internal storage units, and generate the long short-term memory unit state vector. The process of fusing and updating the selected historical states with the newly generated candidate states through element-wise weighted summation logic is as follows: First, the network latency fluctuation feature vector is concatenated with the hidden layer output vector from the previous time step to construct the input state combination vector of the Long Short-Term Memory (LSTM) network. Then, a preset forget gate weight matrix is ​​used to perform a linear weighted operation on the LSM input state combination vector, and the result is vector-added with a preset forget gate bias term. The addition result is then non-linearly mapped using the Sigmoid activation function to generate forgetting coefficients. Next, a preset input gate weight matrix is ​​used to perform a linear transformation on the LSM input state combination vector and add the input gate bias term, which is then processed by the Sigmoid function to generate input gating coefficients. Finally, a preset unit state weight matrix is ​​used to perform a linear transformation on the LSM input state combination vector and add the unit state bias term. Candidate states are generated through hyperbolic tangent function processing; bitwise multiplication is performed on the long short-term memory unit state vector of the previous time step using the forgetting coefficient, bitwise multiplication is performed on the candidate states using the input gating coefficient, and the results of the two multiplication operations are vector-summed to generate the long short-term memory unit state vector; the forgetting gate weight matrix, input gate weight matrix, and unit state weight matrix are set in the following way: a sample set containing historical time delay data is obtained, the initial values ​​of each weight matrix are set using a normal distribution random initialization strategy, a mean squared error loss function representing the difference between the time delay prediction value and the true value is constructed, the gradient information of the loss function with respect to each weight matrix is ​​calculated using the backpropagation algorithm over time, and the values ​​of each weight matrix are iteratively corrected using an adaptive moment estimation optimization algorithm based on the gradient information until the convergence of the loss function meets the preset training termination condition; The constructed network latency fluctuation feature vector is input into a pre-trained Long Short-Term Memory (LSTM) network. At the current time step t, the network first performs a forgetting gate operation: obtaining the current input vector (i.e., the current average latency and standard deviation) and the hidden layer output vector from the previous time step t-1. These two vectors are concatenated to construct a combined input vector. A pre-set forgetting gate weight matrix is ​​used to perform a linear weighted summation (i.e., matrix multiplication) on the combined input vector, and the result is added with a forgetting gate bias term. The result of this linear operation is applied to the Sigmoid activation function, compressing the values ​​to an open interval between 0 and 1, generating forgetting coefficients. These coefficients determine how much information from the previous unit state needs to be retained. Simultaneously, an input gate operation is performed: again using the combined input vector, linear operations are performed on the input gate weight matrix and the unit state update weight matrix, respectively, and their respective bias terms are superimposed. The former is processed by the Sigmoid function to generate input gating coefficients (determining how much new information is updated), and the latter is processed by the hyperbolic tangent function Tanh to generate candidate state vectors (i.e., the new information at the current time step). Next, cell state updates are performed: the cell state vector from the previous time step is multiplied element-wise with the forgetting coefficient (discarding old information), and the candidate state vector is multiplied element-wise with the input gating coefficient (filtering new information). Finally, the two products are summed element-wise to generate the long short-term memory cell state vector at the current time t. In this process, the weight matrices involved (forgetting gate, input gate, cell state weights) are determined through offline training. The training process is as follows: a sample set containing historical latency data is constructed, and a training set and a validation set are created. Each weight matrix is ​​initialized using a normal distribution (e.g., mean 0, standard deviation 0.01). The mean squared error (MSE) loss function is defined, which calculates the square of the Euclidean distance between the network's predicted output and the true label. The backpropagation time-propagation (BPTT) algorithm is used to calculate the partial derivative (gradient) of the loss function with respect to each weight parameter. The adaptive moment estimation optimization algorithm Adam is used, with a learning rate set (e.g., 0.001), and the calculated gradient information is used to iteratively update the weight matrix values ​​to minimize the loss function value. The iteration continues until the error on the validation set no longer decreases or reaches a preset number of rounds (e.g., 1000 rounds). For example, the combined input vector dimension is set to 10, and the forget gate weight matrix is ​​5x10. The linear operation result is [0.5, -0.5, 0, 1, -1]. After adding the bias and activating with a sigmoid function, the forgetting coefficient vector is obtained as [0.62, 0.37, 0.5, 0.73, 0.26]. If the previous state was [1, 1, 1, 1, 1], then the retained state after the forgetting step is [0.62, 0.37, 0.5, 0.73, 0.26]. This mechanism allows the network to "remember" long-term latency trends while ignoring short-term random fluctuations.

[0029] Please refer to Table 2, which contains examples of operational parameters for Long Short-Term Memory (LSTM) networks.

[0030] As shown in Table 2, the LSTM internally processes the input two-dimensional features through high-dimensional matrix operations. The input feature vector has a dimension of 2 (mean, standard deviation), and the number of hidden layer units is set to 64. The forget gate outputs a value between 0 and 1 through the sigmoid function, precisely controlling the historical state. The retention ratio is used to model long-term network behavior patterns.

[0031] S302: For the updated long short-term memory unit state vector, the output gate structure is called to calculate the output gating coefficient of the current time step. The hyperbolic tangent activation function is used to perform nonlinear mapping processing on the state values ​​in the memory unit. The mapped state values ​​and the output gating coefficients are multiplied element-wise based on the Hadamard product. Effective feature components that contribute to future trends are extracted from the internal memory state to generate the time-series evolution hidden layer output vector. The output gate structure is invoked, and a combined vector formed by concatenating the current input vector and the hidden layer output from the previous time step is performed with a preset output gate weight matrix. An output gate bias term is then added. The result is input into a Sigmoid activation function to generate output gating coefficients. Each element of these coefficients has a value between 0 and 1, used to select which state information from the memory cells should be output. Simultaneously, the long short-term memory cell state vector, updated in step S301, is nonlinearly mapped using the hyperbolic tangent function Tanh, standardizing its values ​​to between -1 and 1 to prevent value explosion or disappearance during transmission. Finally, element-wise multiplication (Hadamard product) is performed, multiplying the standardized cell state vector with the output gating coefficients. This operation extracts effective feature components from the internal memory states that significantly contribute to predicting the delay of the next time step, generating the temporal evolution hidden layer output vector. For example, if the updated cell state vector, after Tanh mapping, is set to [0.8, -0.5, 0.9], and the calculated output gating coefficient is [0.9, 0.1, 0.5], then the final generated hidden layer output vector is [0.8 × 0.9, -0.5 × 0.1, 0.9 × 0.5] = [0.72, -0.05, 0.45]. This vector implicitly represents the network's "congestion trend" and "fluctuation inertia" at the current moment.

[0032] S303: The output vector of the hidden layer with temporal evolution is imported into the fully connected regression layer at the end of the network. The trained and optimized weight matrix is ​​called to perform a linear weighted combination operation on the multidimensional hidden layer features. The corresponding bias vector is superimposed to correct the baseline deviation of the linear transformation. Through the projection mapping from the high-dimensional space to the low-dimensional scalar domain, the numerical value that quantifies the evolution trend of network delay at future moments is calculated, and the delay prediction value of the next node is generated. The temporal evolution hidden layer output vector is input to the final fully connected regression layer, DenseLayer, of the network. This layer projects the high-dimensional hidden feature space onto a one-dimensional prediction numerical space. Specifically, the trained and optimized fully connected layer weight matrix (typically 1 x the number of hidden nodes) is used to perform a linear weighted combination operation on the temporal evolution hidden layer output vector. That is, each element in the hidden vector is multiplied by its corresponding weight and summed. Then, a scalar bias term is added to correct the baseline bias of the linear transformation. The result of this linear operation is the network's quantitative estimate of the future time delay. Since it is a regression task, the last layer typically does not use an activation function (or uses a linear activation function), directly outputting a real value, and marking this calculation result as the predicted time delay value for the next node. For example, the hidden layer output vector is [0.72, -0.05, 0.45], the weight vector is [0.5, 1.0, 2.0], and the bias is 0.1. The calculation logic is: (0.72×0.5)+(-0.05×1.0)+(0.45×2.0)+0.1=0.36-0.05+0.9+0.1=1.31. Based on this, the network latency at the next moment is predicted to reach 1.31 milliseconds.

[0033] Please see Figure 5 The specific steps of S4 are as follows: S401: Utilizes real-time telemetry probes deployed at network edge nodes to periodically read the link transmission status data at the current moment, extracts round-trip time readings that characterize the actual transmission efficiency of the current physical link through the underlying protocol stack parsing logic, performs timestamp alignment verification to ensure that the observation data is strictly synchronized with the model prediction step size, eliminates invalid noise caused by instantaneous jitter, and generates real-time delay monitoring values. Real-time telemetry probes (based on gRPC or SNMP protocols) deployed at network edge nodes periodically read the link transmission status data at the current moment. The probes interact directly with the control plane of the network devices, extracting the round-trip time (RTT) reading, which characterizes the actual transmission efficiency of the current physical link, through the underlying protocol stack parsing logic. Simultaneously with acquiring the readings, timestamp alignment verification must be performed. This is because the model prediction is generated based on a specific time step (e.g., T+1), so it must be ensured that the collected real-time data strictly corresponds to that prediction time. The collected timestamp is compared with the prediction target timestamp; if the deviation exceeds the allowable range (e.g., 100 milliseconds), interpolation correction is performed or the data is discarded. Furthermore, to prevent reading spikes caused by occasional microsecond-level hardware interruptions, the readings within continuously acquired small time windows are smoothed to remove invalid noise caused by instantaneous jitter, ultimately generating a stable and reliable real-time delay monitoring value. For example, the prediction system outputs a prediction value for T=110 seconds at T=100 seconds. When the time reaches T=110 seconds, the probe collects the actual RTT of 1.35 milliseconds. After verification, the time deviation is only 2 milliseconds (within the allowable range), and this value is not noise. Therefore, it is confirmed as the real-time delay monitoring value of 1.35 milliseconds.

[0034] S402: Call the next node's time delay prediction value as a theoretical reference benchmark, calculate the numerical difference between the real-time delay monitoring value and the theoretical reference benchmark, apply the absolute value function to non-negatively process the difference result, eliminate the influence of the directional sign on the error measurement, retain only the scalar magnitude of the quantized deviation amplitude, ensure the monotonicity of the error measurement, and generate the absolute error of the time delay prediction. By subtracting the predicted delay of the next node from the real-time latency monitoring value, and considering that network deviations can be positive (actually slower than predicted) or negative (actually faster than predicted), an absolute value function is applied to non-negatively quantify the magnitude of the deviation. This operation eliminates the influence of directional sign on the error metric, retaining only the scalar magnitude of the quantified deviation, ensuring the monotonicity of the error metric (i.e., the larger the difference, the larger the value). The calculated result is the absolute error of the latency prediction. Substituting the aforementioned example data into the logical operation: the real-time latency monitoring value is 1.35 milliseconds, and the predicted delay of the next node is 1.31 milliseconds. The difference is 1.35 - 1.31 = 0.04 milliseconds. Taking the absolute value yields 0.04 milliseconds. If the actual value is 1.20 milliseconds, the difference is -0.11 milliseconds, and the absolute value is 0.11 milliseconds. This value of 0.04 milliseconds directly reflects the degree of agreement between the current network behavior and the model's expected behavior; the smaller the error, the more closely the network operates according to the expected healthy trajectory.

[0035] S403: Obtain the preset normalized scaling parameters and maximum tolerance threshold, construct a nonlinear mapping model based on the inverse hyperbolic tangent function, input the absolute error of the time delay prediction into the model to perform dimensionless compression processing, project the widely distributed physical error values ​​into the standardized confidence interval, quantify the statistical significance of the deviation of the actual network operating state from the expected trajectory, and obtain the network state deviation index. The process of constructing a nonlinear mapping model based on the inverse hyperbolic tangent function is as follows: First, retrieve the accumulated absolute delay prediction error sample data within the historical monitoring period. Calculate the quantile statistical characteristics of the sample data and select the high quantile value as the basic reference boundary. Second, set the maximum tolerance threshold as the product of the basic reference boundary and a preset service sensitivity factor, where the service sensitivity factor establishes an inverse mapping relationship with the tolerance level of delay jitter based on the service type carried by the network link. Third, perform a division operation between the absolute delay prediction error and the maximum tolerance threshold to obtain the relative error ratio. Input the relative error ratio as an independent variable into the inverse hyperbolic tangent function structure for nonlinear transformation. Fourth, configure a normalization scaling parameter as a gain coefficient to adjust the steepness of the function curve, mapping the output value of the inverse hyperbolic tangent function to a predefined standard evaluation interval. Fifth, set a saturation truncation logic. When the relative error ratio is greater than or equal to the preset saturation threshold, forcibly lock the mapping result to the maximum value of the network state deviation index definition domain to prevent extreme abnormal data from damaging the measurement linearity of the evaluation index. Calculate the network state deviation index based on the above logic. To convert physical errors into dimensionless deviation indicators, a nonlinear mapping model based on the inverse hyperbolic tangent function Atanh is constructed by obtaining preset normalized scaling parameters (e.g., Gain=2.0) and a maximum tolerance threshold. First, the maximum tolerance threshold is not arbitrarily set but is calculated based on quantile statistical characteristics of accumulated absolute delay prediction error sample data within historical monitoring periods. The high quantile (e.g., the 95th quantile, set to 1.0 millisecond) is selected as the basic reference boundary, combined with a business sensitivity factor (e.g., video conferencing is latency-sensitive, so the factor is set to 0.8; file downloads are not sensitive, so the factor is set to 1.5). Assuming the current business is video conferencing, the maximum tolerance threshold = 1.0 × 0.8 = 0.8 milliseconds. Next, a division operation is performed: the calculated absolute delay prediction error is divided by this maximum tolerance threshold to obtain the relative error ratio. A saturation truncation logic is introduced: if the relative error ratio is greater than or equal to a preset saturation threshold (e.g., 0.95), the result is forcibly locked to 1.0 (or the domain boundary of the mapping function) to prevent extreme abnormal data (such as huge errors caused by complete link interruption) from destroying the linearity of subsequent mappings. If the ratio is between 0 and 0.95, the ratio is multiplied by the normalization scaling parameter as the independent variable and input into the inverse hyperbolic tangent function. However, since the inverse hyperbolic tangent function tends to infinity when the input is close to 1, in practical engineering, variants of the hyperbolic tangent function Tanh or normalized functions are usually used to map to the [0, 1] interval, or at least Atanh and its inverse function properties are used to expand the projection to a specific interval. In the preferred logic of this embodiment, the Tanh function is used to compress the unbounded physical error to the [0, 1] interval to represent the deviation: Network state deviation index = Tanh(relative error ratio × normalization scaling parameter). Substituting the aforementioned example data: the absolute error of the delay prediction is 0.04 milliseconds, and the maximum tolerance threshold is 0.8 milliseconds. The relative error ratio = 0.04 / 0.8 = 0.05. Saturation cutoff was not triggered. Substituting into the mapping function: Tanh(0.05×2.0) = Tanh(0.1) ≈ 0.0997. This result, 0.0997, is the network state deviation index. If the error reaches 0.8 milliseconds, the ratio is 1.0, triggering saturation, and the index is directly set to its maximum value (e.g., 1.0). This result shows that through nonlinear mapping, the sensitivity in the low error range can be effectively stretched, while the divergence in the high error range can be compressed.

[0036] Please see Figure 6 The specific steps of S5 are as follows: S501: Call the preset exponential decay function model and decay coefficient parameters, use the natural logarithm base to construct a nonlinear mapping relationship, substitute the network state deviation index into the exponential operation logic to perform reverse mapping processing, simulate the decay law of network performance as state deviation increases, calculate the original score characterizing the current function retention of the network, and generate a performance retention decay score. The process of calling the preset exponential decay function model and decay coefficient parameters is as follows: Access the server storing historical network operation data; extract the network state deviation sample set and corresponding service quality interruption event records within the historical time window; perform correlation analysis on the network state deviation sample set and service quality interruption event records using a logistic regression statistical algorithm to determine the critical gradient value at which network service performance decreases as the degree of state deviation increases; map the critical gradient value to a sensitivity factor characterizing the sensitivity of the service to network fluctuations; select a preset basic decay benchmark value; calculate the product of the basic decay benchmark value and the sensitivity factor; set the resulting product value as the decay coefficient parameter; construct a mathematical expression with the natural logarithm base as the base and the negative of the product of the network state deviation index and the decay coefficient parameter as the exponent; and establish this mathematical expression as the exponential decay function model. First, determine the attenuation coefficient parameter, access historical data stored on the server, and extract the network state deviation sample set and corresponding QoS interruption event records (such as video buffering counts) within the historical time window. Use logistic regression statistical algorithms to analyze the correlation between the two, determining the critical gradient value at which service performance degrades as state deviation increases (e.g., for every 0.1 increase in deviation, the probability of buffering increases by 5%). Map this gradient to a sensitivity factor (e.g., Alpha = 5.0). Select a baseline attenuation value (e.g., 1.0), calculate its product with the sensitivity factor, and set it as the attenuation coefficient parameter (here, set to 5.0). Construct an exponential attenuation model: This model uses the base of the natural logarithm, e (approximately 2.71828), and the exponent is the negative of the product of the network state deviation index and the decay coefficient. This model simulates the non-linear, sharp decline in network performance as state deviation increases; a small increase in deviation can lead to a significant drop in score, reflecting real-world user experience. Substituting the data from the previous example: the network state deviation index is 0.0997, and the decay coefficient is 5.0. The product is 0.0997 × 5.0 = 0.4985. Performing the exponentiation: The value of 0.6074 represents the performance retention degradation score. This score means that, with the current small deviation, the network performance retains approximately 60.74% of the theoretical maximum (this is just an example; actual parameter adjustments can smooth the score). If the deviation is 0, the score is 1.0; if the deviation is large, the score approaches 0.

[0037] S502: For performance retention degradation scores, retrieve the boundary configuration of the standard health value range, apply a linear normalization algorithm to dynamically project the score into the standard range, perform boundary truncation verification to avoid the risk of numerical overflow, and determine the actual landing point coordinate of the current score in the global health spectrum by comparing the relative distance between the score and each quantile in the range, quantify the relative position attribute under the standard evaluation system, and generate the range distribution positioning coordinates. The process of retrieving the boundary configuration of the standard health score range is as follows: statistically analyze the distribution of historical health score data in the fault-free operation state of the network; calculate the expected value and variance of the historical health score data distribution; determine the lower boundary value by subtracting the variance value of the expected value from the variance value of the preset multiple; determine the upper boundary value by adding the variance value of the preset multiple to the expected value; and define the standard health score range by the lower boundary value and the upper boundary value together. The process of dynamically projecting the performance retention decay score into the standard range using the linear normalization algorithm is as follows: calculate the numerical difference between the performance retention decay score and the lower boundary value; calculate the full range span between the upper boundary value and the lower boundary value; use division to solve the proportion of the numerical difference in the full range span value, and use the proportion as the projected value. Retrieve the boundary configuration of the standard health score range and statistically analyze the historical health score data distribution of the network under fault-free (healthy) operation. Calculate the expected value (mean, e.g., 0.95) and variance (e.g., 0.05) of this distribution. Set the lower boundary value = expected value - 3 times variance = 0.95 - 0.15 = 0.80. Set the upper boundary value = expected value + 1 times variance (or directly set to the theoretical maximum value of 1.0). This is a demonstration calculation; the original score range corresponding to the standard interval is set to [0.4, 1.0], and the target mapping interval is [0, 100]. Apply the linear normalization algorithm: first, perform boundary truncation verification; if the performance retention decay score is less than 0.4, it is forcibly considered as 0.4; if it is greater than 1.0, it is forcibly considered as 1.0. Calculate the numerical difference between the score and the lower boundary value (0.4); calculate the full range span value (1.0 - 0.4 = 0.6). Perform division to calculate the percentage ratio, then multiply by the target interval span (100) and add the target baseline (0). Substitute the data from the previous example: the performance retention degradation score is 0.6074. Within the interval [0.4, 1.0]. Numerical difference = 0.6074 - 0.4 = 0.2074. Full range = 0.6. Percentage ratio = 0.2074 / 0.6 ≈ 0.3457. Mapped to a 0-100 score scale: 0.3457 × 100 = 34.57 points. Generate interval distribution location coordinates, i.e., 34.57. This value quantifies the relative position of the current network state under the standard evaluation system.

[0038] S503: Based on the interval distribution of the location coordinates, the state parsing engine is called to perform the conversion from numerical values ​​to semantics, and the corresponding risk level description and reliability confidence probability are associated. The quantitative coordinate values ​​and qualitative state labels are encapsulated in a structured manner to build a full-dimensional prediction model of network health status. The output includes data entities such as scores, current risk levels and future reliability prediction probabilities, and generates network health prediction results.

[0039] The system invokes a state resolution engine to convert numerical values ​​into semantics, incorporating a built-in tiered threshold table: for example, [0, 40) represents "high risk," [40, 70) represents "medium risk," and [70, 100] represents "healthy." Comparing 34.57 with the threshold, it determines the current level as "high risk" and associates it with the corresponding risk description, "Severe network performance degradation, immediate intervention recommended." Simultaneously, based on the score's position in the historical distribution, a reliability confidence probability is calculated (e.g., if this score has an extremely low probability of appearing in historical data and is often associated with failures, the probability of no failures in the next hour is predicted to be 20%). The quantitative coordinate value (34.57), the qualitative state label (high risk), and the predicted probability (20%) are structured and encapsulated to construct a data entity. Finally, the network health prediction result is output.

[0040] Please refer to Table 3, which contains an example of the output results for network health prediction.

[0041] As shown in Table 3, the complex latency fluctuation characteristics and nonlinear mapping results are ultimately transformed into an indicator system that operations and maintenance personnel can directly understand. The low score of 34.57 directly triggered a "high-risk" alarm and provided specific probability predictions and action suggestions, realizing a closed-loop system from data collection to decision support.

[0042] Please see Figure 7 A network health prediction system based on AI learning includes: The latency data processing module collects Internet Control Message Protocol (ICP) messages of the target network assets, extracts the corresponding sending and receiving timestamps, calculates the round-trip time values, and sorts them in chronological order to construct a network link latency sequence. The fluctuation feature analysis module processes the network link delay sequence by slicing it according to a preset time window length. It calculates the standard deviation and average value of the sliced ​​data segments and uses the standard deviation and average value to construct a network delay fluctuation feature vector. The latency prediction and analysis module inputs the network latency fluctuation feature vector into a pre-trained long short-term memory network, uses the long short-term memory network to perform time-series evolution operations, and generates the latency prediction value for the next node. The state deviation identification module acquires the current time delay data, calculates the absolute value of the difference between the current time delay data and the predicted delay value of the next node, calls the normalization function to process the absolute value of the difference, and calculates the network state deviation index. The network health assessment module calls a preset exponential decay function to perform mapping processing on the network state deviation index, determines the distribution position of the mapping result within the standard health value range, and generates a network health prediction result.

[0043] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of protection of the described technical solutions.

Claims

1. A method for predicting network health based on AI learning, characterized in that, Includes the following steps: S1: Collect Internet Control Message Protocol (ICP) messages of the target network assets, extract the corresponding sending and receiving timestamps, calculate the round-trip time values, and sort them in chronological order to construct a network link delay sequence; S2: Based on a preset time window length, slice the network link delay sequence, calculate the standard deviation and average value for the sliced ​​data segments, and use the standard deviation and average value to construct a network delay fluctuation feature vector. S3: Input the network latency fluctuation feature vector into the pre-trained long short-term memory network, and use the long short-term memory network to perform time-series evolution operation to generate the latency prediction value of the next node; S4: Obtain the current time delay data, calculate the absolute value of the difference between the current time delay data and the predicted delay value of the next node, call the normalization function to process the absolute value of the difference, and calculate the network state deviation index. S5: Call the preset exponential decay function to perform mapping processing on the network state deviation index, determine the distribution position of the mapping result within the standard health value range, and generate the network health prediction result.

2. The network health prediction method based on AI learning according to claim 1, characterized in that, The network link delay sequence includes a time sequence index identifier, a round-trip delay value, and a message sequence identifier. The network delay fluctuation feature vector includes local dispersion features, trend center features, and peak deviation features. The next node delay prediction value includes a future time delay estimate, an upper limit of the prediction confidence interval, and a lower limit of the prediction confidence interval. The network state deviation index includes an absolute error normalized component, a relative error ratio component, and a deviation trend slope component. The network health prediction result includes a comprehensive health score, a current risk level, and a reliability prediction probability.

3. The network health prediction method based on AI learning according to claim 1, characterized in that, The specific steps of S1 are as follows: S101: Collect Internet Control Message Protocol (ICP) messages sent by the target network asset, parse the header structure of the ICP messages, locate and extract the sending timestamp that identifies the time the message leaves the source node and the receiving timestamp that identifies the time the message returns, perform one-to-one data binding between the sending timestamp and the receiving timestamp, and generate message sending and receiving timestamp pairs. S102: Call the message sending and receiving timestamp pair, perform the difference calculation between the received timestamp value and the sent timestamp value, obtain the physical time overhead generated by the data packet in the bidirectional network link, verify the non-negativity of the calculation result, standardize the data type of the time overhead value to double-precision floating-point format, and generate a single link round-trip delay value. S103: For the multiple single link round-trip delay values ​​accumulated within the continuous monitoring time window, retrieve the time dimension index data corresponding to each delay value, perform time-series rearrangement on all single link round-trip delay values ​​according to the linear increment logic of the time dimension index, fill the sorted delay data stream into the linear time series container, and construct the network link delay sequence.

4. The network health prediction method based on AI learning according to claim 1, characterized in that, The specific steps of S2 are as follows: S201: Call the network link delay sequence, read the preset time window length configuration parameter, perform sliding interception on the time axis of the network link delay sequence with a fixed time step, identify the valid round-trip delay value falling within the time span of each sliding window, establish the mapping logic between the delay value and the window index, aggregate all values ​​in the same window into independent analysis units, and generate a delay data slice set. S202: For each analysis unit included in the latency data slice set, calculate the average latency value of the slice within the unit, solve the degree of discrete distribution of the value within the unit relative to the average latency value of the slice based on the standard deviation calculation logic, obtain the standard deviation of the slice latency, and associate and bind the two to generate a latency statistical feature pair. S203: Based on the time window sequence corresponding to each analysis unit, the delay statistical feature pairs are serialized and recombined to maintain the continuity of the time dimension. The average delay value of the slice is mapped to the trend dimension component of the vector, and the standard deviation of the slice delay is mapped to the fluctuation dimension component of the vector to generate a network delay fluctuation feature vector.

5. The network health prediction method based on AI learning according to claim 4, characterized in that, The process of identifying valid round-trip delay values ​​falling within each sliding window time span specifically involves: sorting the original round-trip delay values ​​falling within the current sliding window time span in ascending order to construct a temporary sorting sequence; determining the first quantile value at the quarter-th position and the third quantile value at the three-quarters position based on the total amount of data in the temporary sorting sequence; determining the interquartile range statistic by subtracting the first quantile value from the third quantile value; obtaining a preset anomaly detection sensitivity coefficient, wherein the lower limit filtering threshold is set by subtracting the interquartile range statistic from the first quantile value and the anomaly detection sensitivity coefficient, and the upper limit filtering threshold is set by adding the interquartile range statistic to the third quantile value and the anomaly detection sensitivity coefficient; traversing the temporary sorting sequence and removing abnormal data with values ​​less than the lower limit filtering threshold or greater than the upper limit filtering threshold; and determining the values ​​retained within the closed interval between the lower and upper limit filtering thresholds as valid round-trip delay values.

6. The network health prediction method based on AI learning according to claim 1, characterized in that, The specific steps for S3 are as follows: S301: Call the network latency fluctuation feature vector and input it into the pre-trained long short-term memory network. Utilize the forget gate structure inside the network to calculate the forgetting coefficient of historical information based on the current input and the hidden layer output of the previous time step. Combine the input gate structure to perform a weighted evaluation of the information importance of the current feature vector. Through element-wise weighted summation logic, perform a fusion update of the selected historical state and the newly generated candidate state to refresh the temporal memory content of the network's internal storage units and generate a long short-term memory unit state vector. S302: For the updated long short-term memory unit state vector, call the output gate structure to calculate the output gating coefficient of the current time step, use the hyperbolic tangent activation function to perform nonlinear mapping processing on the state values ​​in the memory unit, perform element-wise multiplication operation based on Hadamard product on the mapped state values ​​and the output gating coefficient, extract the effective feature components that contribute to the future trend from the internal memory state, and generate the time-series evolution hidden layer output vector. S303: The time-series evolution hidden layer output vector is imported into the final fully connected regression layer of the network. The trained and optimized weight matrix is ​​called to perform a linear weighted combination operation on the multi-dimensional hidden layer features. The corresponding bias vector is superimposed to correct the baseline deviation of the linear transformation. Through the projection mapping from the high-dimensional space to the low-dimensional scalar domain, the numerical value that quantifies the evolution trend of network delay at future moments is calculated, and the delay prediction value of the next node is generated.

7. The network health prediction method based on AI learning according to claim 1, characterized in that, The specific steps of S4 are as follows: S401: Periodically reads the link transmission status data at the current moment using real-time telemetry probes deployed at network edge nodes, extracts round-trip time readings that characterize the actual transmission efficiency of the current physical link through the underlying protocol stack parsing logic, performs timestamp alignment verification, removes invalid noise, and generates real-time delay monitoring values. S402: Call the next node delay prediction value as a theoretical reference benchmark, calculate the numerical difference between the real-time delay monitoring value and the theoretical reference benchmark, apply the absolute value function to non-negatively process the difference result, retain the scalar magnitude of the quantization deviation, and generate the absolute error of the delay prediction. S403: Obtain the preset normalized scaling parameters and maximum tolerance threshold, construct a nonlinear mapping model based on the inverse hyperbolic tangent function, input the absolute error of the time delay prediction into the model to perform dimensionless compression processing, project the error value into the standardized confidence interval, quantify the statistical significance of the deviation of the actual network operating state from the expected trajectory, and obtain the network state deviation index.

8. The network health prediction method based on AI learning according to claim 1, characterized in that, The specific steps of S5 are as follows: S501: Call the preset exponential decay function model and decay coefficient parameters, use the natural logarithm base to construct a nonlinear mapping relationship, substitute the network state deviation index into the exponential operation logic to perform reverse mapping processing, simulate the decay law of network performance as state deviation increases, calculate the original score characterizing the current function retention of the network, and generate a performance retention decay score. S502: For the performance retention degradation score, retrieve the boundary configuration of the standard health value interval, apply the linear normalization algorithm to dynamically project the score into the standard interval, perform boundary truncation verification to avoid the risk of numerical overflow, and determine the actual landing point coordinate of the current score in the global health spectrum by comparing the relative distance between the score and each point in the interval, quantify the relative position attribute under the standard evaluation system, and generate interval distribution positioning coordinates. S503: Based on the interval distribution and location coordinates, call the state parsing engine to perform the conversion from numerical to semantic, associate the corresponding risk level description and reliability confidence probability, encapsulate the quantitative coordinate values ​​and qualitative state labels in a structured manner, construct a full-dimensional prediction model of network health status, and generate network health prediction results.

9. The network health prediction method based on AI learning according to claim 8, characterized in that, The specific steps of S5 are as follows: The process of configuring the boundary of the standard health score range is as follows: statistically analyze the distribution of historical health score data in a fault-free operating state; calculate the expected value and variance of the historical health score data distribution; determine the lower boundary value by subtracting a preset multiple from the expected value and the upper boundary value by adding a preset multiple to the expected value; and define the standard health score range by combining the lower boundary value and the upper boundary value.

10. A network health prediction system based on AI learning, characterized in that, The system is used to implement the AI-based network health prediction method according to any one of claims 1-9, the system comprising: The latency data processing module collects Internet Control Message Protocol (ICP) messages of the target network assets, extracts the corresponding sending and receiving timestamps, calculates the round-trip time values, and sorts them in chronological order to construct a network link latency sequence. The fluctuation feature analysis module slices the network link delay sequence based on a preset time window length, calculates the standard deviation and average value for the sliced ​​data segments, and constructs a network delay fluctuation feature vector using the standard deviation and average value. The latency prediction and analysis module inputs the network latency fluctuation feature vector into a pre-trained long short-term memory network, and uses the long short-term memory network to perform time-series evolution operations to generate the latency prediction value of the next node. The state deviation identification module acquires the current time delay data, calculates the absolute value of the difference between the current time delay data and the predicted delay value of the next node, calls the normalization function to process the absolute value of the difference, and calculates the network state deviation index. The network health assessment module calls a preset exponential decay function to perform mapping processing on the network state deviation index, determines the distribution position of the mapping result within the standard health value range, and generates a network health prediction result.

Images