Communication equipment fault automatic diagnosis method and system based on artificial intelligence

Abstract

The invention discloses a communication equipment fault automatic diagnosis system and method based on artificial intelligence, and the system comprises a data collection and fusion module which is used for collecting multi-mode operation and maintenance data from communication equipment; the anomaly detection and feature extraction module is used for carrying out anomaly detection and log feature extraction; the multi-modal fault diagnosis engine is used for analyzing the fused multi-modal features by adopting a graph neural network model and outputting a diagnosis report containing fault categories and root cause positioning; the repair strategy generation and verification module is used for matching the repair strategy from the knowledge base based on the diagnosis report and verifying the repair strategy in the security sandbox; the automatic execution and feedback module executes a strategy passing verification and feeds back a result to optimize the model and the knowledge base, accurate diagnosis of faults is achieved through multi-modal data fusion and intelligent analysis, the reliability of automatic repair is guaranteed through a safety verification mechanism, and the reliability of fault diagnosis is improved. And the automation level and the fault handling efficiency of network operation and maintenance are obviously improved.

Description

Technical Field

[0001] This invention belongs to the field of communication network operation and maintenance technology, specifically relating to an automatic fault diagnosis method and system for communication equipment based on artificial intelligence. Background Technology

[0002] With the rapid development of technologies such as 5G, IoT, and cloud computing, modern communication networks are expanding in scale, becoming increasingly complex in topology, and carrying more diverse types of services. The number of communication devices in the network (including routers, switches, firewalls, load balancers, etc.) is growing exponentially, and the dependencies between them are becoming increasingly close and dynamic. Against this backdrop, network operation and maintenance management faces unprecedented challenges: Currently, most network operations and maintenance still rely on the traditional model of "monitoring and alerting + manual troubleshooting." Engineers in Network Operations Centers (NOCs) face massive amounts of monitoring and alerting information, ranging from performance metrics (such as CPU utilization, port traffic, and packet loss rate) to device logs (Syslog, SNMP Trap) and configuration change records. This data comes from diverse sources, has varying formats, and is enormous in volume. Engineers need to rely on their personal experience for correlation analysis, which is time-consuming, labor-intensive, and inefficient. Especially when facing complex, multi-device cascading failures, the accuracy of manual root cause identification is low, and the mean time to repair (MTTR) is long, potentially leading to severe business interruptions and economic losses.

[0003] Several network monitoring and automation tools exist in the market, but they typically suffer from the following problems: Isolated monitoring: Various tools (performance monitoring, log management, configuration management) operate independently, and data cannot be effectively correlated, forming "data silos." Strong rule dependency: Alarm rules and remediation scripts are mostly based on predefined static thresholds and fixed logic. They have poor adaptability to unknown fault modes or dynamically changing network environments, resulting in high false alarm and false negative rates. Lack of intelligent diagnostic capabilities: Existing tools excel at "discovering the problem" (What), but struggle with "locating the cause" (Why) and "predicting the impact" (How). They cannot understand the causal relationships between faults, nor can they learn from historical data.

[0004] In recent years, artificial intelligence (AI) technologies, especially machine learning (ML) and deep learning (DL), have been attempted to be applied to the field of network operations and maintenance, forming the concept of AIOps (Intelligent Operations and Maintenance). However, current research and application are still in their early stages, with the following bottlenecks: Insufficient data utilization: Most solutions only use a single type of data (such as using only time-series indicators for anomaly detection, or only using logs for pattern matching), failing to fully integrate multi-dimensional information such as device performance data, log semantic information, network traffic characteristics, and topology relationships, resulting in a one-sided diagnostic perspective. Poor model interpretability: Deep learning models are often regarded as "black boxes," and their diagnostic results lack credible evidence support, making it difficult for operations and maintenance personnel to understand and trust them, hindering their implementation in critical production environments. Lack of a closed-loop repair and learning mechanism: Most existing solutions remain at the "diagnosis" level, with diagnostic results disconnected from actual automated repair actions. Even when repair suggestions are provided, a secure verification mechanism is lacking. Furthermore, the system lacks a closed-loop feedback mechanism to continuously learn from repair results and optimize its own diagnostic and decision-making capabilities, failing to achieve true "intelligent evolution." Summary of the Invention

[0005] In view of the shortcomings of the existing technology, the purpose of this invention is to provide an automatic fault diagnosis system for communication equipment that can overcome the above-mentioned defects, realize full data fusion, intelligent and accurate diagnosis, safe automatic repair, and continuous closed-loop learning, so as to improve network reliability, reduce operation and maintenance costs, and ensure the continuous and stable operation of services.

[0006] The technical solution adopted by this invention to solve its technical problem is: An AI-based automatic fault diagnosis method for communication equipment includes the following steps: Data fusion steps: Collect multimodal operation and maintenance data of the target communication device, including time-series performance indicators, event logs and network traffic data; Collaborative diagnostic steps: Based on the multimodal operation and maintenance data, a pre-trained artificial intelligence model is used for joint analysis to generate a preliminary diagnostic report that includes fault category and root cause location; Strategy generation step: Based on the preliminary diagnostic report, match and generate at least one candidate automated repair action from the repair strategy knowledge base; Verification execution steps: Verify the validity of the candidate automated repair actions, and execute them after the verification is passed.

[0007] Preferably, in the collaborative diagnosis step, the pre-trained artificial intelligence model is a graph neural network, which uses devices in the network as nodes and the connections between devices as edges to construct a network topology graph, and generates the fault category and root cause localization by aggregating node features and neighborhood information.

[0008] Preferably, before the collaborative diagnosis step, the method further includes an anomaly detection step: using an unsupervised learning model to analyze the time-series performance indicators, establishing a dynamic baseline, identifying abnormal events that deviate from the dynamic baseline, and providing the abnormal events as key input features to the collaborative diagnosis step.

[0009] Preferably, the processing of the event log includes: converting unstructured logs into structured log templates using a log parsing algorithm, and analyzing the log template sequence using natural language processing technology to extract fault-related event features.

[0010] Preferably, the construction and updating of the repair strategy knowledge base includes: storing historical fault cases and their corresponding verified repair actions; and using case reasoning or reinforcement learning methods to match repair strategies based on the similarity between the diagnostic results and historical cases.

[0011] Preferably, the validity verification in the verification execution step specifically involves: executing the candidate automated repair action in a network sandbox or isolation zone simulating a production environment, and monitoring preset recovery indicators. If the recovery indicators reach the expected threshold, the verification is deemed successful.

[0012] Preferably, the method further includes a closed-loop learning step: using the actual execution effect of the verification execution step, the device status recovery data, and the manual correction information as feedback data to incrementally update and optimize the artificial intelligence model and the repair strategy knowledge base.

[0013] Another technical problem to be solved by the present invention is to provide an automatic fault diagnosis system for communication equipment based on artificial intelligence, for implementing the method described in any one of the above, comprising: A data acquisition and fusion unit is used to perform the data fusion step; The intelligent collaborative diagnostic engine is used to execute the collaborative diagnostic steps. Repair the policy library and generator to perform the policy generation step; A security verifier and executor is used to perform the verification execution steps.

[0014] Preferably, it also includes a human-machine collaboration interface unit, which is used to display the preliminary diagnostic report, candidate repair actions and risk assessment in a visual form, and to receive selection, modification or execution authorization instructions from operation and maintenance personnel, and input the instructions as high-quality labels into the closed-loop learning steps.

[0015] Another technical problem to be solved by the present invention is to provide a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the automatic fault diagnosis method for communication equipment based on artificial intelligence as described in any of the above-mentioned methods.

[0016] The beneficial effects of this invention are as follows: This breakthrough system synchronously collects and integrates device time-series performance metrics (such as CPU, memory, and port status), unstructured event logs (parsed using NLP technology), network traffic characteristic data (such as NetFlow / IPFIX), and device configuration snapshots. This multi-dimensional data fusion analysis of "metrics + logs + traffic + configuration" breaks down the "data silos" formed by traditional monitoring tools, providing a panoramic view for fault diagnosis. For example, when the traffic on a switch port surges abnormally (metric anomaly), the system can simultaneously correlate and analyze whether the device generated "MAC address drift" or "spanning tree topology change" logs during the same period (event correlation), and combine this with traffic characteristics to determine whether it is a loop or an attack. This automates the complex analysis that traditionally required manual cross-verification, improves the accuracy of root cause localization from experience-dependent to data-driven, and effectively reduces false alarms and false negatives.

[0017] Unlike traditional AI applications that simply output "yes / no" anomalies or simple classifications, this system employs advanced models such as Graph Neural Networks (GNNs) to model network devices and their connections as a topology graph. GNNs can understand the propagation path and impact range of faults within the network through neighborhood information aggregation mechanisms. This allows the system to not only determine that "a device has failed," but also to accurately pinpoint "which physical board / logical port of that device" is the root cause of the fault, and to visually demonstrate the fault propagation chain (e.g., a fault in an optical module of core switch A causes routing oscillations in aggregation layer B, ultimately leading to terminal access delays in access layer C). The diagnostic results are accompanied by crucial evidence (such as associated abnormal indicator curves and matching log fragments), greatly enhancing the interpretability of the results and the trust of operations personnel.

[0018] This system creatively couples intelligent diagnostics and automated remediation through a secure "sandbox verification" process. After generating remediation strategies (such as "reboot port," "rollback configuration," and "traffic redirection"), the system does not execute them directly in the production environment but first verifies them in a highly simulated network sandbox or isolation zone. The system monitors preset recovery indicators (such as port status, BGP session establishment, and service connectivity), and only strategies that pass verification are authorized for execution. This mechanism fundamentally solves the risk of "secondary failures" that traditional automation scripts may cause due to environmental differences or unforeseen dependencies, achieving a leap from "timid automation" to "reliable automation," reducing the mean time to repair (MTTR) from hours to minutes or even seconds, greatly ensuring business continuity. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of an automatic fault diagnosis system for communication equipment based on artificial intelligence, according to the present invention. Figure 2 This is a flowchart of an automatic fault diagnosis method for communication equipment based on artificial intelligence according to the present invention. Detailed Implementation

[0020] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments are not intended to limit the present invention.

[0021] Example refer to Figure 1 One embodiment of the present invention provides an automatic fault diagnosis system for communication equipment based on artificial intelligence. The system generally includes: a data acquisition and fusion module, an anomaly detection and feature extraction module, a multimodal fault diagnosis engine, a repair strategy generation and verification module, an automated execution and feedback module, and an optional human-machine collaborative interface module. These modules communicate and exchange data through a system bus or network service interface. The system is connected to managed communication devices (such as routers, switches, firewalls, etc.) and possible network management systems / controllers in the target network environment.

[0022] The following combination Figure 2 The flowchart shown describes in detail the working process of a preferred embodiment of the present invention.

[0023] Step S210: Collection and fusion of multi-source heterogeneous operation and maintenance data.

[0024] The data acquisition and fusion module uses a variety of standardized protocols and interfaces to collect raw data from target communication devices and networks in a low-intrusion or non-intrusive manner.

[0025] Time-series performance metrics collection: Data such as CPU utilization, memory usage, interface inbound / outbound traffic, packet error / loss counts, temperature, and power status are collected by polling or subscribing at fixed intervals (e.g., 30 seconds or 1 minute) via SNMP (Simple Network Management Protocol), Telemetry (push-mode telemetry), or vendor APIs. These data form a structured time series.

[0026] Event log collection: Receive log messages sent by the device in real time via the Syslog protocol, or periodically capture the device's operation logs via SSH / Telnet. The logs are semi-structured or unstructured text.

[0027] Network traffic data collection: Deploy probes on critical links, or collect network flow-level metadata, including source / destination IP, port, protocol, number of bytes, number of packets, flow duration, etc., through the device's own NetFlow, sFlow, and IPFIX functions.

[0028] Configuration information collection: Periodically obtain the complete running configuration or configuration snapshot of the device via SSH or NETCONF / YANG model.

[0029] This module aligns the above four types of data with time (based on a unified timestamp) and associates them according to entities such as devices and interfaces to form a multimodal data packet with a "device-time" dimension, which is stored in the time-series database and the log database.

[0030] Step S220: Anomaly detection and feature preprocessing.

[0031] The anomaly detection and feature extraction module performs real-time and near-real-time analysis on the collected data.

[0032] For time-series performance metrics: Unsupervised anomaly detection algorithms are employed. For example, robust statistical methods (such as moving median and absolute median difference) or machine learning models (such as isolated forests and autoencoders) are used to train historical data (such as the past 24 hours) to establish dynamic baselines for each metric at different periods such as hourly and daily. When real-time data points continuously deviate from the baseline by more than a preset statistical significance threshold (such as 3 standard deviations), a preliminary anomaly event is generated, with attributes including the metric name, degree of deviation, and start time.

[0033] For event logs: First, log parsing is performed. Using clustering-based methods (such as the Drain algorithm) or neural network-based methods, the original log message (e.g., "Interface GigabitEthernet0 / 1, changed state to down") is parsed into a log template ("Interface..."). , changed state to The templates are then divided into variables ("GigabitEthernet0 / 1", "down"). Keywords are extracted and categorized from the templates (e.g., "interface state change", "routing protocol neighbor interruption"). Finally, the sequence of log templates generated by the same device within a short period is transformed into a numerical feature vector (e.g., using a bag-of-words model or TF-IDF) to represent the event combinations within that time period.

[0034] Step S230: Multimodal feature fusion and intelligent diagnosis.

[0035] The multimodal fault diagnosis engine is the core of the system. This embodiment uses a graph neural network model for implementation.

[0036] Graph Construction: The system maintains a network topology graph. Nodes in the graph represent physical or logical devices (a key component of a device, such as a board or virtual router instance, can also be considered a node), and edges represent physical connections, logical adjacency relationships (such as OSPF neighbors or BGP peers), or traffic dependencies between devices.

[0037] Feature Attachment: For each node, the abnormal event vector, log feature vector and related traffic abnormal features (such as the traffic mutation rate of the related links of the node) generated in step S220 are concatenated to form the multimodal feature vector of the node.

[0038] Model Inference: The current topology graph and node feature vectors are input into a pre-trained GNN model. This model has been trained on a large amount of historical fault data and is able to learn the patterns of fault propagation in the graph. The model outputs two key results: a node-level fault probability distribution, which shows the probability of each node belonging to various fault categories (such as "hardware failure", "misconfiguration", "software defect", "resource overload", "external attack"); and a root cause node identification, which, through attention mechanisms or gradient analysis, identifies one or more of the most likely source nodes that caused the currently observed anomaly.

[0039] Report Generation: The engine integrates the output of the GNN, raw anomaly evidence (such as specific anomaly indicator curves and raw logs that triggered alarms), and topology correlation information to generate a structured preliminary fault diagnosis report. The report includes: the most likely fault category (e.g., "Hardware Fault: Optical Module Transceiver Fault"), root cause device location (e.g., "Core Switch A, Slot, Port"), fault impact range assessment, and a list of key data evidence to support the conclusion.

[0040] Step S240: Repair policy matching and security verification.

[0041] The repair strategy generation and verification module receives diagnostic reports.

[0042] Policy Matching: The module maintains a repair policy knowledge base internally. This knowledge base is stored in the form of graphs or cases, with each record associated with a "fault characteristic pattern" and one or more "verified repair action sequences". The system matches the characteristics of the current diagnostic report with the knowledge base. For example, if the "core switch port optical module failure" pattern is matched, the corresponding repair action sequence is retrieved: "1. Switch traffic to the backup link through the network management system; 2. Shutdown the faulty port through the CLI; 3. Generate a hardware replacement work order."

[0043] Strategy generation and risk assessment: The system generates candidate remediation actions and assesses and ranks them based on historical execution success rate, operational complexity, and business impact scope (according to topology dependency analysis).

[0044] Sandbox Validation: To mitigate risks, the system prioritizes the use of the network digital twin sandbox environment. This sandbox synchronizes the latest configuration and topology of the production network. Within the sandbox, the system automatically executes the highest-ranked candidate repair action sequence and verifies key recovery indicators (e.g., whether backup link traffic is normal, whether the faulty port has been closed, and whether relevant service connectivity has been restored) using monitoring probes within the sandbox. Only policies that pass verification are marked as "safe to execute."

[0045] Step S250: Automated execution and closed-loop feedback.

[0046] The automated execution and feedback module is responsible for the final production environment operation and learning.

[0047] Authorization and Execution: For verified low-risk policies, the system can request automatic execution permission through the human-machine collaboration interface 160, or execute automatically according to a preset policy. The execution process is carried out through the device's standard API (such as NETCONF, RESTCONF) or command-line channel (such as SSH) to ensure that the operation is auditable.

[0048] Effect monitoring: After the action is executed, the system immediately strengthens the monitoring of the target device and the affected services to confirm whether the fault has been truly eliminated and whether the service indicators have returned to normal.

[0049] Feedback Learning: Regardless of whether the fault handling is completed automatically or with manual intervention, the entire process of "input data (S210) -> diagnostic results -> execution actions -> final effect" will be recorded as a complete case. The automated execution and feedback module sends this case to the multimodal fault diagnosis engine and the repair strategy generation and verification module.

[0050] Incremental training of diagnostic models: New cases are added to the training dataset, and the GNN model is incrementally trained or fine-tuned periodically to enable it to identify new failure modes.

[0051] Strategy knowledge base enhancement and updates: If the performed repair action is successful and efficient, its weight in the corresponding pattern in the knowledge base is increased; if it fails or is ineffective, its weight is reduced or the knowledge base revision process is triggered. Corrections to diagnoses or strategies made by human operations experts on the interface are considered high-quality tags and prioritized for learning.

[0052] The human-machine collaboration interface module provides a web-based visual interface. The interface displays real-time system status, currently active alarms, diagnostic report details (in the form of topology highlighting, evidence chain lists, etc.), recommended remediation strategies, and their risk levels. On this interface, operations and maintenance experts can: confirm, reject, or modify system diagnostic conclusions; select, modify, queue, or immediately execute remediation actions; view historical fault cases and system self-learning performance reports; and manually input new remediation experiences or rules to directly enrich the strategy knowledge base.

[0053] The above embodiments of the present invention are not intended to limit the scope of protection of the present invention. The implementation of the present invention is not limited thereto. All other modifications, substitutions or alterations made to the above structure of the present invention based on the above content of the present invention, in accordance with ordinary technical knowledge and common practice in the field, without departing from the basic technical idea of ​​the present invention, shall fall within the scope of protection of the present invention.

Claims

1. An automatic fault diagnosis method for communication equipment based on artificial intelligence, characterized in that, Includes the following steps: Data fusion steps: Collect multimodal operation and maintenance data of the target communication device, including time-series performance indicators, event logs and network traffic data; Collaborative diagnostic steps: Based on the multimodal operation and maintenance data, a pre-trained artificial intelligence model is used for joint analysis to generate a preliminary diagnostic report that includes fault category and root cause location; Strategy generation step: Based on the preliminary diagnostic report, match and generate at least one candidate automated repair action from the repair strategy knowledge base; Verification execution steps: Verify the validity of the candidate automated repair actions, and execute them after the verification is passed.

2. The method according to claim 1, characterized in that, In the collaborative diagnosis step, the pre-trained artificial intelligence model is a graph neural network, which uses devices in the network as nodes and the connections between devices as edges to construct a network topology graph. It generates the fault category and root cause localization by aggregating node features and neighborhood information.

3. The method according to claim 1 or 2, characterized in that, Before the collaborative diagnosis step, the method further includes an anomaly detection step: using an unsupervised learning model to analyze the time-series performance indicators, establishing a dynamic baseline, identifying abnormal events that deviate from the dynamic baseline, and providing the abnormal events as key input features to the collaborative diagnosis step.

4. The method according to claim 3, characterized in that, The processing of the event logs includes: converting unstructured logs into structured log templates using log parsing algorithms, and analyzing the log template sequences using natural language processing techniques to extract fault-related event features.

5. The method according to claim 1, characterized in that, The construction and updating of the repair strategy knowledge base includes: storing historical failure cases and their corresponding verified repair actions; and using case reasoning or reinforcement learning methods to match repair strategies based on the similarity between the diagnostic results and historical cases.

6. The method according to claim 1, characterized in that, The validity verification in the verification execution step specifically involves: executing the candidate automated repair action in a network sandbox or isolation zone simulating a production environment, and monitoring preset recovery indicators. If the recovery indicators reach the expected threshold, the verification is deemed successful.

7. The method according to claim 1, characterized in that, The method further includes a closed-loop learning step: using the actual execution effect of the verification execution step, the device status recovery data, and the manual correction information as feedback data to incrementally update and optimize the artificial intelligence model and the repair strategy knowledge base.

8. An artificial intelligence-based automatic fault diagnosis system for communication equipment, used to implement the method according to any one of claims 1 to 7, characterized in that, include: A data acquisition and fusion unit is used to perform the data fusion step; The intelligent collaborative diagnostic engine is used to execute the collaborative diagnostic steps. Repair the policy library and generator to perform the policy generation step; A security verifier and executor is used to perform the verification execution steps.

9. The system according to claim 8, characterized in that, It also includes a human-machine collaboration interface unit, which is used to display the preliminary diagnostic report, candidate repair actions and risk assessment in a visual form, and to receive selection, modification or execution authorization instructions from operation and maintenance personnel, and input the instructions as high-quality labels into the closed-loop learning steps.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the automatic fault diagnosis method for communication equipment based on artificial intelligence as described in any one of claims 1 to 7.

Images