Cross-regional settlement flow prediction and deviation management and control method and system

Abstract

The invention discloses a cross-regional settlement traffic prediction and deviation management and control method and system, and the method comprises the steps: collecting bandwidth settlement traffic time sequence data and external covariable data of a target region, and carrying out the preprocessing; constructing a double-flow depth time sequence prediction model, and predicting the settlement flow based on the preprocessing result and the double-flow depth time sequence prediction model to obtain predicted settlement flow; calculating a real-time deviation index of the actual settlement flow and the predicted settlement flow; monitoring a real-time deviation index, and performing layered drilling analysis under the condition that the real-time deviation index exceeds a dynamic threshold value and an early warning condition is met to obtain a traceability result; and executing a traffic governance strategy based on the traceability result, and performing iterative calibration on the double-flow depth time sequence prediction model by taking the governed traffic feature data as a correction sample to form a continuously self-optimized closed loop. According to the invention, high-precision short-term prediction and deviation pre-management and control of settlement flow can be realized.

Description

Technical Field

[0001] This invention relates to the field of big data analytics, specifically to a method and system for cross-regional settlement flow prediction and deviation control. Background Technology

[0002] In cross-regional bandwidth settlement and traffic management for telecommunications operators, traditional technologies face a series of challenges, particularly limitations in time-series forecasting, deviation analysis, and settlement risk early warning. Existing technologies typically rely on post-event analysis, which, while capable of tracing traffic anomalies, suffers from the following drawbacks: Insufficient accuracy in time-series forecasting: Existing time-series forecasting methods (such as ARIMA and Prophet) have significant limitations when handling cross-regional traffic, particularly in their inability to effectively integrate complex external characteristics (such as network routing changes and PCDN rollover) and multiple periodicities (such as monthly and quarterly periodic changes). This results in forecasts that do not accurately reflect actual traffic fluctuations, potentially leading to significant deviations in end-of-month settlements and affecting the accuracy of the settlement process.

[0003] Slow response to sudden events: Existing technologies often respond slowly to sudden increases or decreases in traffic and struggle to accurately pinpoint the root causes of these changes (such as malicious behavior, network failures, or external events). This technological limitation makes traffic discrepancies more pronounced at the end of the month, affecting the accuracy and timeliness of settlement.

[0004] The lag in deviation analysis: Due to the lag in real-time monitoring and deviation analysis of traditional methods, telecom operators often can only discover the deviation between traffic and forecast values ​​after the settlement period has ended. Such ex-post analysis not only increases the complexity of operation and management, but may also lead to large traffic deviations at the end of the month, affecting the smoothness and efficiency of the entire settlement process.

[0005] Therefore, existing technologies have significant shortcomings in short-term forecasting and deviation analysis of cross-regional bandwidth settlement traffic. There is an urgent need for a technical solution that can achieve high-precision short-term forecasting, timely early warning, and risk analysis to avoid excessive deviations at the end of the month and improve the accuracy and efficiency of settlement. Summary of the Invention

[0006] To address the aforementioned issues, this invention proposes a method and system for cross-regional settlement flow prediction and deviation control, which enables high-precision short-term prediction and proactive deviation control of settlement flow.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solution: This invention is a method for cross-regional settlement flow prediction and deviation control, comprising: Collect time-series data of bandwidth settlement traffic in the target area and external covariate data associated with the time-series data of bandwidth settlement traffic, and perform preprocessing; A dual-stream deep time series prediction model is constructed, which includes a flow feature extraction branch, a covariate feature extraction branch, and a cross-attention fusion module. Based on the preprocessing results and the dual-stream deep time series prediction model, the settlement flow is predicted to obtain the predicted settlement flow. Calculate the real-time deviation index between the actual settlement flow and the predicted settlement flow; Monitor real-time deviation indicators, and when the real-time deviation indicators exceed the dynamic threshold and the warning conditions are met, perform stratified drill-down analysis to obtain the source tracing results; Based on the source tracing results, a traffic governance strategy is implemented, and the governance-enhanced traffic characteristic data is used as a correction sample to iteratively calibrate the dual-flow deep time series prediction model, forming a continuously self-optimizing closed loop.

[0008] A further improvement of this invention lies in: external covariate data It can be divided into at least three dimensions: network routing and scheduling, net flow management, and business settlement cycle.

[0009] A further improvement of the present invention is that the pretreatment includes: Align bandwidth settlement traffic time-series data and external covariate data on timestamps; For external covariate data containing lagged feature data at multiple future time steps after an event is triggered, event impact lag window modeling is adopted; Z-score standardization was performed on all continuous variables in the bandwidth settlement traffic time-series data and external covariate data. Multivalued embedding encoding is used for categorical covariates in external covariate data.

[0010] A further improvement of the present invention is that, in the dual-stream deep time-series prediction model, the traffic feature extraction branch extracts features from the bandwidth settlement traffic time-series data to generate traffic features as query vectors; the covariate feature extraction branch extracts features of external events from the external covariate data to generate external event features as key vectors and value vectors; and the cross-attention fusion module calculates the dynamic attention weights of external event features on traffic features, generates fused features, and outputs the predicted settlement traffic.

[0011] A further improvement of the present invention is that the dynamic threshold is obtained in the following way: Dynamically generate initial dynamic threshold using adaptive quantile thresholding method For the initial dynamic threshold A smoothing process is performed to obtain a dynamic threshold for comparison with the real-time deviation index. Among them, the initial dynamic threshold The calculation expression is: ; in: As the initial dynamic threshold, Sensitivity coefficient It is the 99th percentile. For time window, This is the real-time deviation indicator, where t is the time.

[0012] A further improvement of the present invention is that the hierarchical drill-down analysis includes a first-level dimension positioning and a second-level entity drill-down. The first-level dimension positioning includes: extracting the attention weight matrix from the cross-attention fusion module, pre-mapping the feature factors in the external covariate data to the corresponding dimensions, including network routing scheduling dimension, net flow management dimension, and business settlement cycle dimension. Within the time window when the real-time deviation index deviates from the dynamic threshold, the total attention response value of the corresponding feature factors of each dimension in the attention weight matrix of the dual-flow deep time series prediction model is aggregated and calculated respectively. The dimension with the highest total attention response value and exceeding the significance threshold is determined as the dominant settlement influence dimension. The second level of entity drill-down includes: retrieving related business log data through the metadata mapping table based on the dominant settlement impact dimension, and drilling down layer by layer to locate the specific business anomaly entity, wherein the drill-down query adopts asynchronous parallel calls.

[0013] A further improvement of this invention is that the calibration of the dual-stream deep time-series prediction model adopts a two-stage update strategy, including short-term rapid adaptation and long-term stable learning. The short-term rapid adaptation includes storing newly added corrected samples into the incremental learning buffer each time a first set time period is reached, and fine-tuning is performed online using a first learning rate. The long-term stable learning includes performing full retraining using the complete historical dataset each time a second set time period is reached, and introducing elastic weights to consolidate the loss during training. The complete historical dataset includes bandwidth settlement traffic time-series data, external covariate data, and corrected samples.

[0014] The cross-regional settlement flow prediction and deviation control system of the present invention includes: The data acquisition and preprocessing module is used to acquire time-series data of bandwidth settlement traffic in the target area and external covariate data associated with the time-series data of bandwidth settlement traffic, and to perform preprocessing. The dual-stream deep time series prediction model module is used to construct a dual-stream deep time series prediction model that includes a flow feature extraction branch, a covariate feature extraction branch, and a cross-attention fusion module. Based on the preprocessing results and the dual-stream deep time series prediction model, the settlement flow is predicted to obtain the predicted settlement flow. The real-time deviation monitoring and early warning module is used to calculate the real-time deviation index between the actual settlement flow and the predicted settlement flow, monitor the real-time deviation index, and issue an early warning when the early warning conditions are met. The layered drilling analysis module is used to perform layered drilling analysis and obtain the source tracing results when the real-time deviation index exceeds the dynamic threshold and the early warning conditions are met. The closed-loop governance and model calibration module is used to execute traffic governance strategies and use the governed traffic characteristic data as correction samples to iteratively calibrate the dual-flow deep time series prediction model, forming a continuously self-optimizing closed loop.

[0015] The electronic device of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the above-described cross-regional settlement flow prediction and deviation control method.

[0016] The present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described cross-regional settlement flow prediction and deviation control method.

[0017] The beneficial effects of this invention are as follows: The dual-flow deep time-series prediction model of this invention, through cross-attention fusion, effectively overcomes the shortcomings of traditional models in integrating complex multi-dimensional external features, greatly improving the accuracy of traffic prediction and fundamentally solving the problem of large settlement deviations. This invention adopts a two-level hierarchical drill-down analysis strategy, solving the problem of traditional analysis relying on expert experience and being time-consuming through rapid location of flow feature data and business logs. The dynamic threshold and real-time deviation monitoring mechanism proposed in this invention ensures that early warnings are triggered at the first moment of deviation occurrence, avoiding the lag of deviations and facilitating proactive pre-emptive control. Furthermore, this invention solves the engineering challenge of real-time acquisition of multi-source data through metadata mapping tables and asynchronous parallel queries, enabling hierarchical drill-down analysis to be completed within seconds. Attached Figure Description

[0018] Figure 1 This is a flowchart of the method in an embodiment of the present invention; Figure 2 This is a diagram of the cross-regional settlement flow prediction and deviation control system architecture in an embodiment of the present invention; Figure 3 This is a schematic diagram of the data acquisition and preprocessing process in an embodiment of the present invention; Figure 4 This is a diagram of the dual-stream deep time-series prediction model architecture in an embodiment of the present invention; Figure 5 This is a flowchart of the layered drilling analysis in an embodiment of the present invention; Figure 6This is a flowchart of closed-loop governance and model calibration in an embodiment of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0020] like Figure 1 As shown, the cross-regional settlement flow prediction and deviation control method of this embodiment includes the following steps: Step S1: Collect time-series data of bandwidth settlement traffic in the target area, and simultaneously collect external covariate data associated with the time-series data of bandwidth settlement traffic, and perform preprocessing.

[0021] External covariate data should be divided into at least three dimensions: network routing and scheduling, net flow management, and business settlement cycle. The network routing and scheduling dimension includes BGP route change records, the net flow management dimension includes the percentage of cleared or rate-limited IP traffic and PCDN rollover events, and the business settlement cycle dimension includes monthly settlement day markers and quarterly sprint markers.

[0022] Preprocessing of bandwidth settlement traffic time-series data and external covariate data includes handling outliers and missing values, and Z-score standardization. The external covariate data is strictly aligned with the bandwidth settlement traffic time-series data in terms of timestamps, and time window moving average or nearest neighbor interpolation is used to unify data from different collection frequencies to the same time granularity. For events with latency effects, such as PCDN rollover, event impact lag window modeling is used. Subsequently, Z-score standardization is performed on the numerical features of continuous variables, and one-hot / emedding encoding is used for categorical features.

[0023] Step S2: Construct a dual-flow deep time series prediction model that includes a flow feature extraction branch, a covariate feature extraction branch, and a cross-attention fusion module. Based on the preprocessing results and the dual-flow deep time series prediction model, predict the settlement flow to obtain the predicted settlement flow.

[0024] The structure of the dual-stream depth time-series prediction model in this embodiment is as follows: Figure 4 As shown.

[0025] Traffic feature extraction branches calculate traffic time-series data based on preprocessed bandwidth. This serves as the input, aiming to capture the historical dependency patterns, long- and short-term time-series characteristics, and multiple periodic patterns of the traffic itself. The specific structure is as follows: Input embedding layer: The preprocessed bandwidth settlement traffic time series data is projected onto a high-dimensional feature space through one-dimensional convolution or linear mapping to obtain the embedded sequence of bandwidth settlement traffic time series data. ,in, Let T be a matrix, and T be the length of the time window. For feature dimensions.

[0026] A temporal feature extractor containing LSTM layers and multi-head self-attention layers: The embedded sequence is input into a two-layer Long Short-Term Memory (LSTM) network through LSTM layers to capture the short-term temporal dependence and dynamic trends of the flow, outputting a hidden state sequence. ,in, The feature dimension of the hidden state is defined. To enhance the modeling ability of long-distance dependencies, the output of the LSTM layer is fed into a multi-head self-attention mechanism within the multi-head self-attention layer. Global contextual information is captured by calculating the attention weights between any two time points within the hidden state sequence.

[0027] The periodic feature enhancement module, which includes a Fourier transform module and a feature fusion layer, is used to explicitly model the multi-periodic characteristics of the flow, such as daily, weekly, and monthly settlement cycles. The Fourier transform module is introduced in parallel into the flow feature extraction branch to perform a Fast Fourier Transform (FFT) on the flow sequence, extract the amplitude and phase spectra in the frequency domain, and screen out the periodic components of the main frequencies with concentrated energy. The screened periodic components are reconstructed into time-domain periodic features through inverse transform and fused with the output of the LSTM layer to enhance the ability of the dual-flow deep time series prediction model to perceive periodic fluctuations.

[0028] The multi-source features, including the hidden state layer of the LSTM layer, the output of the multi-head self-attention mechanism, and the periodic features, are concatenated and mapped through a fully connected layer to generate a query vector representing the inherent fluctuation trend of traffic at the current moment. The query vector This will be used as a query for the cross-attention fusion module.

[0029] The covariate feature extraction branch is responsible for processing external covariate data that is strongly correlated with bandwidth settlement traffic. In this embodiment, the external covariate data is divided into three dimensions: network routing scheduling dimension, net flow management dimension, and business settlement cycle dimension. The covariate feature extraction branch generates key vectors and value vectors through dimension separation encoding and feature fusion networks. The specific structure is as follows: Feature splitter: Based on business semantics, it separates external covariate data by dimension and sends each part to its corresponding dedicated encoder, where: Network routing and scheduling dimension: Includes event data such as BGP route changes and link state adjustments, and features are extracted using the following encoder: BGP Event Encoder: Performs point-in-time encoding and type embedding for BGP route update, revocation, and other events; Link Status Encoder: Performs sliding window statistics on status changes such as link interruption and bandwidth adjustment to generate status change intensity features; Routing policy encoder: Encodes events for changes in routing policies, such as outbound optimization and traffic engineering adjustments.

[0030] Net flow governance dimension: Includes governance behavior data such as PCDN rollover, IP rate limiting, and IP blocking, and features are extracted using the following encoder: PCDN Removal Time Encoder: Time-encodes the start time and duration of removal events; IP blocking record encoder: performs aggregated statistical encoding of the number of blocked IPs, blocking duration, and blocking type; Traffic shaping event encoder: Encodes the effective time and strength of rate limiting and shaping policies.

[0031] Business settlement cycle dimension: Includes data on periodic business activities such as monthly settlement days and quarterly sprints, and extracts features using the following encoder: Seasonal pattern encoder: Encodes historical traffic patterns from the same period to generate seasonal baseline features; Promotional activity encoder: Embeds and represents the time window and activity type of promotional activities; Settlement date periodic encoder: performs periodic position encoding on the settlement date marker.

[0032] The feature vectors output by the encoders of each dimension are fed into a shared feature fusion network for cross-dimensional information interaction and high-dimensional mapping, generating a unified covariate representation. The feature fusion network in this embodiment uses an MLP (Multi-Level Processing) model, and the specific operations are as follows: The feature vectors of the three dimensions are concatenated and then input into a two-layer fully connected network to obtain the fused features. . Fusing features Two independent linear mapping layers are used to generate key vectors that measure the matching degree between external events and current traffic queries. and a value vector carrying the actual impact values ​​of external events. value vector The sum will be weighted and summed with the attention weights in the cross-attention module.

[0033] The cross-attention fusion module generates query vectors from traffic feature extraction branches. Key vectors generated by covariate feature extraction branches Value vector Cross-attention calculation is performed to dynamically fuse the impact of external events on traffic prediction. The calculation expression is: ; in: As a feature of fusion, The superscript T represents the scaling factor. AttentionMatrix is ​​the attention weight matrix used to quantify the magnitude of the correction effect of external covariate data on the current traffic prediction.

[0034] Fusion features This represents a traffic context vector that incorporates the influence of external events, representing the fused features. The predicted settlement flow is obtained by concatenating the multi-source features extracted by the flow feature extraction branch with the feature concatenation layer of the dual-flow deep time series prediction model, and then performing linear transformation and nonlinear mapping through a fully connected prediction layer. .

[0035] Step S3: Obtain the actual settlement flow that occurs in real time. Calculate the actual settlement flow With forecasted settlement flow Real-time deviation index It retains a deviation sequence consisting of real-time deviation indices from the most recent N time points. Real-time deviation indices Aimed at quantifying actual settlement flow Predicting settlement flows using the model The degree of deviation serves as the core basis for early warning. Real-time deviation index The calculation expression is: .

[0036] Step S4: Monitor real-time deviation indicators and in real-time deviation indicators Exceeding the dynamic threshold In this case, a layered drill-down analysis is performed to obtain the source tracing results.

[0037] This embodiment utilizes the adaptive quantile thresholding method to dynamically generate the initial dynamic threshold. For the initial dynamic threshold A smoothing process is performed to obtain a dynamic threshold for comparison with the real-time deviation index. Within each W time window, calculate the history. The 99th percentile of the sliding window is used as the baseline and multiplied by a sensitivity coefficient. Among them, history The sensitivity coefficient of a sliding window, such as the same period over the past 7 days. The default value is 1.0; adjust the sensitivity coefficient according to business tolerance. The value of this value determines the manual threshold adjustment, with an adjustment range of 0.8 to 1.2. Manual threshold adjustment is achieved through a sensitivity coefficient adjuster; when the business has a low tolerance for deviation, the sensitivity coefficient is adjusted accordingly. Lower the sensitivity coefficient when the business wants to reduce false positives. Increase the initial dynamic threshold. The calculation expression is: ;

[0038] in: As the initial dynamic threshold, Sensitivity coefficient It is the 99th percentile. For time window, This is the real-time deviation indicator, where t is the time.

[0039] To improve the stability of the dynamic threshold and avoid frequent jumps in the dynamic threshold due to short-term data fluctuations, the initial dynamic threshold is generated... Then, threshold smoothing is introduced. Specifically, an exponentially weighted moving average (EWMA) is used to smooth the initial threshold sequence: ; in: for The dynamic threshold at any given time. This is a smoothing factor, with a default value range of 0.7 to 0.9, controlling the weight of historical dynamic thresholds. The smoothed dynamic threshold... As a dynamic threshold used in practice for deviation comparison, it effectively suppresses the interference of abnormal fluctuations on the dynamic threshold itself while maintaining its adaptive capability.

[0040] This embodiment uses a deviation threshold comparator to perform real-time deviation indicators. With dynamic threshold The comparison, in real-time deviation index Greater than the dynamic threshold When this occurs, an early warning process is triggered, immediately tracing back the deviation sequence of the most recent N time points. Calculate the corresponding statistics, such as mean, variance, or quantiles. If the deviation between the statistics and the current value exceeds a set threshold, the current value is determined to be an instantaneous outlier, belonging to data noise or an outlier. The warning conditions are not met, no warning is issued, stratified drill-down analysis is not triggered, and only filtering is performed.

[0041] When the deviation between the statistic and the current value does not exceed a set threshold, i.e., when the warning conditions are met, the warning level is divided based on the degree of deviation between the statistic and the current value, such as general warning and severe warning. For severe warnings, a complete hierarchical drill-down analysis is immediately triggered to locate the dominant settlement-affecting dimension and specific abnormal entities. Based on the source tracing results obtained from the hierarchical drill-down analysis, the corresponding traffic governance strategy is executed, i.e., governance actions are taken. After governance is completed, the obtained traffic characteristic data will be fed back to the dual-flow deep time-series prediction model as a correction sample. For general warnings, a simplified version of hierarchical drill-down analysis is triggered, i.e., only the first-level dimension is located, without second-level entity drill-down, and governance actions are not immediately executed. However, if general warnings continue to appear in the same dimension, it is upgraded to a severe warning and triggers a complete process including hierarchical drill-down analysis and governance actions.

[0042] The layered drilling analysis in this embodiment is as follows: Figure 5 As shown, it specifically includes: First-level dimensional localization: Extract the attention weight matrix (AttentionMatrix) obtained from the cross-attention fusion module in step S2. Pre-map the feature factors in the external covariate data to the network routing scheduling dimension, net flow management dimension, and business settlement cycle dimension. Within the time window where the deviation occurs, aggregate and calculate the total attention response value of the corresponding feature factors in the attention weight matrix for each dimension. The dimension with the highest total attention response value exceeding the significance threshold is determined as the dominant settlement-influencing dimension. The significance threshold is set as the 95th quantile of the historical distribution of the total attention response value for each dimension. If the aggregated value of a dimension exceeds the significance threshold, it is considered significant.

[0043] Second-level entity drill-down: Based on the dominant settlement impact dimension, retrieve the associated business log data through the pre-set metadata mapping table, drill down layer by layer to locate the specific business anomaly entity, and generate a root cause analysis report.

[0044] The metadata mapping table stores the mapping relationship between feature factors, data sources, query interfaces, and key fields. For example: network routing scheduling dimension → BGP routing log database → REST API / api / bgp / events → fields: as_src, as_dst, timestamp, change_type; Net flow governance dimension → DPI feature library → gRPC service dpi_analyzer:GetFlowFeatures → fields: ip_range, app_protocol, flow_ratio.

[0045] The drill-down query uses asynchronous parallel calls and returns the aggregated result within a set timeout period. If the timeout occurs, the most recently cached result is returned as a fallback. In this embodiment, the timeout period is set to 2 seconds.

[0046] If the dominant settlement impact dimension is the network routing scheduling dimension, then retrieve the BGP routing logs, analyze the top n regional flow changes of cross-region outflow traffic, pinpoint the target regional autonomous system domain (AS domain) that caused the deviation, and generate a root cause analysis report.

[0047] If the dominant settlement impact dimension is net flow governance, then retrieve the DPI deep packet inspection logs, analyze the changes in traffic recognition rate of different application protocols, identify the specific PCDN business line with feature failure, and generate a root cause analysis report.

[0048] If the dominant settlement impact dimension is the business settlement cycle dimension, then retrieve business operation data, analyze the time window and traffic fluctuation characteristics of periodic activities such as monthly settlement days, locate specific settlement cycle events or activity entities, confirm the periodic effect of the corresponding settlement cycle events or activity entities on traffic, and generate a root cause analysis report.

[0049] This embodiment matches the source tracing results of layered drill-down analysis with corresponding governance actions. For example, if the warning level is severe and the drill-down locates an anomaly in the PCDN service line under the net flow governance dimension, then the governance action of "updating the feature library and blocking IP" is executed.

[0050] Step S5, calibration of closed-loop governance and dual-flow depth time series prediction model, such as Figure 6 As shown, a traffic governance strategy is executed based on the source tracing results, and the governed traffic characteristic data, such as traffic from cleaned IPs, is fed back to step S1 as a correction sample to iteratively calibrate the dual-stream deep time-series prediction model, forming a continuously self-optimizing closed loop. The governed traffic characteristic data is used as a correction sample; for example, it is labeled as "governed traffic" and used as a new covariate or correction label. This embodiment employs a two-stage update strategy and an anti-forgetting mechanism to calibrate the dual-stream deep time-series prediction model, as detailed below: Short-term rapid adaptation: New samples are stored in an incremental learning buffer daily and fine-tuned online using a small learning rate to quickly adapt to concept drift. These new samples include governance labels.

[0051] Long-term stable learning: Full retraining is performed weekly using the complete historical dataset, with a forgetting prevention mechanism introduced during training to prevent catastrophic forgetting. The complete historical dataset includes bandwidth settlement traffic time-series data, external covariate data, and corrected samples.

[0052] In this embodiment, the anti-forgetting mechanism employs Elastic Weight Consolidation Loss (EWC). Its principle is to penalize historical data based on the importance of the model parameters during long-term retraining, limiting significant changes in important parameters and thus retaining old knowledge while absorbing new knowledge. Specifically, this is achieved by introducing an EWC penalty term into the loss function during training to constrain the updates of important parameters and prevent forgetting.

[0053] The above method is implemented through the cross-regional settlement flow prediction and deviation control system of this embodiment, such as... Figure 2 As shown, the system includes: The data acquisition and preprocessing module is used to acquire time-series data of bandwidth settlement traffic in the target area and external covariate data associated with the time-series data of bandwidth settlement traffic, and to perform preprocessing. The dual-stream deep time series prediction model module is used to construct a dual-stream deep time series prediction model that includes a flow feature extraction branch, a covariate feature extraction branch, and a cross-attention fusion module. Based on the preprocessing results and the dual-stream deep time series prediction model, the settlement flow is predicted to obtain the predicted settlement flow. The real-time deviation monitoring and early warning module is used to calculate the real-time deviation index between the actual settlement flow and the predicted settlement flow, monitor the real-time deviation index, and issue an early warning when the early warning conditions are met. The layered drilling analysis module is used to perform layered drilling analysis and obtain the source tracing results when the real-time deviation index exceeds the dynamic threshold and the early warning conditions are met. The closed-loop governance and model calibration module is used to execute traffic governance strategies and use the governed traffic characteristic data as correction samples to iteratively calibrate the dual-flow deep time series prediction model, forming a continuously self-optimizing closed loop.

[0054] like Figure 3As shown, the data acquisition and preprocessing module accesses multi-source data from the data source layer through the data access layer, and the data preprocessing layer preprocesses the multi-source data. Preprocessing operations include handling outliers and missing values, and feature construction. Feature construction refers to the process of processing, transforming, and constructing features from the raw data, including Z-score normalization, One-Hot or Embedding encoding of categorical features, and event impact hysteresis window modeling. The preprocessed data is stored in the data storage layer. This embodiment uses the 3Sigm principle and box plots for outlier detection and processing, and linear interpolation or previous value imputation is used for missing values. The data source layer includes a traffic monitoring system, a routing management system, a security governance system, a business operation system, and external data sources. This embodiment divides the multi-source data into external covariate data and bandwidth settlement traffic time-series data. The bandwidth settlement traffic time-series data comes from the traffic monitoring system, specifically collected via protocols such as SNMP, NetFlow, and sFlow. The external covariate data related to the bandwidth settlement traffic time-series data comes from the routing management system, the security governance system, the business operation system, and external data sources. The BGP route change records, including AS path changes, LDP label distribution events, IS-IS link state adjustments, and routing policy updates, are sourced from the routing management system. PCDN decommissioning events, IP blocking, IP rate limiting records, and traffic shaping policy activation logs are sourced from the security governance system. Monthly settlement date markers are sourced from the business operations system. External factors that may affect traffic, such as holidays and weather, are sourced from external data sources.

[0055] The data access layer includes Kafka and Flume tools for collecting real-time incoming traffic, ETL tools for accessing batch data, and REST and GraphQL tools for accessing APL interfaces. The data storage layer includes a time-series database, a feature database, and metadata management. The time-series database stores pre-processed bandwidth billing traffic time-series data, and the feature database stores pre-processed external covariate data. The metadata management layer stores a feature dictionary and a metadata mapping table. The feature dictionary is used for dimension separation and encoding of the covariate feature extraction branch in step S2, and the metadata mapping table is used for asynchronous parallel queries of the second-level entity drill-down in step S4.

[0056] The application of the cross-regional settlement flow prediction and deviation control system in this embodiment will be further described in detail below with reference to actual scenarios.

[0057] Root cause localization: Scenario: One afternoon, the real-time deviation index of the inflow to area A suddenly exceeded the dynamic threshold, triggering an alert. A real-time deviation index value of 15% indicates that the actual settlement flow is 15% higher than the predicted settlement flow, signifying a significant abnormal deviation.

[0058] First-level dimension localization: The cross-regional settlement traffic prediction and deviation control system immediately extracts the attention weight matrix output by the time-based dual-stream deep time-series prediction model. Aggregate analysis reveals that the network routing scheduling dimension, including features such as BGP changes and link interruptions, has a significantly higher total attention response value than the other two dimensions, exceeding the significance threshold.

[0059] Judgment: The dominant settlement dimension is the network routing and scheduling dimension.

[0060] Second-level entity drill-down: Based on the judgment results, the routing log is automatically retrieved. The log shows that a major backbone link from region B to region A was cut over 10 minutes before the deviation occurred. The cross-regional settlement traffic prediction and deviation control system accurately pinpoints the target region AS domain that caused the deviation and generates a structured root cause analysis report on "Traffic Impact of Routing Cutover".

[0061] Results: Prevents maintenance personnel from wasting resources on inefficient IP traffic analysis, reducing response time from hours to minutes.

[0062] Net flow management dimensional positioning and model calibration closed loop: Scenario: For three consecutive days, the real-time deviation index of inflow into a certain area has consistently exceeded the limit slightly, for example, the real-time deviation index hovered between 5% and 8%, while the dynamic threshold was 4%. The first-level dimension positioning showed that the total attention response value of the net flow management dimension remained the highest. This consistently higher-than-expected real-time deviation index suggests the possible existence of unidentified structural pull flow.

[0063] Second-level entity drill-down: Based on the judgment results, the system automatically retrieves flow characteristic records from the security management system. Analysis reveals that the inflow-to-outflow ratio of this abnormal traffic group is significantly higher than that of normal business traffic, and the port concentration is dispersed. Specific IP groups or traffic patterns are identified as abnormal entities, and a root cause analysis report is generated.

[0064] Governance and Calibration: Based on the root cause analysis report information, operations and maintenance personnel update the DPI signature database of the security governance system and block the newly discovered non-compliant IPs. Simultaneously, the traffic from these IPs is marked as "governed traffic," and this is used as an increment of the net flow governance dimension covariate in step S1, fed back into the dual-flow deep time-series prediction model. In the next round of training, the dual-flow deep time-series prediction model will learn this new malicious traffic pattern and incorporate its impact into the prediction considerations, achieving automatic calibration of prediction accuracy.

[0065] It will be understood by those skilled in the art that, unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. It should also be understood that terms such as those defined in general dictionaries should be understood to have the same meaning as in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless defined as herein.

[0066] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for cross-regional settlement flow forecasting and deviation control, characterized in that, include: Collect time-series data of bandwidth settlement traffic in the target area and external covariate data associated with the time-series data of bandwidth settlement traffic, and perform preprocessing; A dual-stream deep time series prediction model is constructed, which includes a flow feature extraction branch, a covariate feature extraction branch, and a cross-attention fusion module. Based on the preprocessing results and the dual-stream deep time series prediction model, the settlement flow is predicted to obtain the predicted settlement flow. Calculate the real-time deviation index between the actual settlement flow and the predicted settlement flow; Monitor real-time deviation indicators, and when the real-time deviation indicators exceed the dynamic threshold and the warning conditions are met, perform stratified drill-down analysis to obtain the source tracing results; Based on the source tracing results, a traffic governance strategy is implemented, and the governance-enhanced traffic characteristic data is used as a correction sample to iteratively calibrate the dual-flow deep time series prediction model, forming a continuously self-optimizing closed loop.

2. The method for cross-regional settlement flow prediction and deviation control according to claim 1, characterized in that, External covariate data should be divided into at least three dimensions: network routing and scheduling, net flow management, and business settlement cycle.

3. The method for cross-regional settlement flow prediction and deviation control according to claim 2, characterized in that, Preprocessing includes: Align bandwidth settlement traffic time-series data and external covariate data on timestamps; For external covariate data containing lagged feature data at multiple future time steps after an event is triggered, event impact lag window modeling is adopted; Z-score standardization was performed on all continuous variables in the bandwidth settlement traffic time-series data and external covariate data. Multivalued embedding encoding is used for categorical covariates in external covariate data.

4. The method for cross-regional settlement flow prediction and deviation control according to claim 1, characterized in that, In the dual-stream deep time-series prediction model, the traffic feature extraction branch extracts features from the bandwidth settlement traffic time-series data to generate traffic features as a query vector. The covariate feature extraction branch extracts features of external events from external covariate data, generating external event features as key vectors and value vectors; The cross-attention fusion module calculates the dynamic attention weights of external event features on traffic features, generates fused features, and outputs the predicted settlement traffic.

5. The method for cross-regional settlement flow prediction and deviation control according to claim 1, characterized in that, The dynamic threshold is obtained in the following way: Dynamically generate initial dynamic threshold using adaptive quantile thresholding method For the initial dynamic threshold After smoothing, a dynamic threshold is obtained for comparison with the real-time deviation index, wherein the initial dynamic threshold... The calculation expression is: ； in: As the initial dynamic threshold, Sensitivity coefficient It is the 99th percentile. For time window, This is the real-time deviation indicator, where t is the time.

6. The method for cross-regional settlement flow prediction and deviation control according to claim 4, characterized in that, The hierarchical drill-down analysis includes first-level dimension positioning and second-level entity drill-down. First-level dimension positioning includes: extracting the attention weight matrix from the cross-attention fusion module, pre-mapping the feature factors in the external covariate data to the corresponding dimensions, including network routing scheduling, net flow management, and business settlement cycle. Within the time window when the real-time deviation index deviates from the dynamic threshold, the total attention response value of the corresponding feature factors of each dimension in the attention weight matrix of the dual-flow deep time series prediction model is aggregated and calculated. The dimension with the highest total attention response value that exceeds the significance threshold is determined as the dominant settlement influence dimension. The second level of entity drill-down includes: retrieving related business log data through the metadata mapping table based on the dominant settlement impact dimension, and drilling down layer by layer to locate the specific business anomaly entity, wherein the drill-down query adopts asynchronous parallel calls.

7. The method for cross-regional settlement flow prediction and deviation control according to claim 1, characterized in that, The calibration of the dual-stream deep time series prediction model adopts a two-stage update strategy, including short-term rapid adaptation and long-term stable learning. Short-term rapid adaptation includes storing newly added corrected samples into the incremental learning buffer and fine-tuning online using the first learning rate each time the first set time period is reached. Long-term stable learning includes retraining with the complete historical dataset each time the second set time period is reached. Elastic weights are introduced to consolidate the loss during training. The complete historical dataset includes bandwidth settlement traffic time series data, external covariate data, and corrected samples.

8. A cross-regional settlement flow forecasting and deviation control system, characterized in that, include: The data acquisition and preprocessing module is used to acquire time-series data of bandwidth settlement traffic in the target area and external covariate data associated with the time-series data of bandwidth settlement traffic, and to perform preprocessing. The dual-stream deep time series prediction model module is used to construct a dual-stream deep time series prediction model that includes a flow feature extraction branch, a covariate feature extraction branch, and a cross-attention fusion module. Based on the preprocessing results and the dual-stream deep time series prediction model, the settlement flow is predicted to obtain the predicted settlement flow. The real-time deviation monitoring and early warning module is used to calculate the real-time deviation index between the actual settlement flow and the predicted settlement flow, monitor the real-time deviation index, and issue an early warning when the early warning conditions are met. The layered drilling analysis module is used to perform layered drilling analysis and obtain the source tracing results when the real-time deviation index exceeds the dynamic threshold and the early warning conditions are met. The closed-loop governance and model calibration module is used to execute traffic governance strategies and use the governed traffic characteristic data as correction samples to iteratively calibrate the dual-flow deep time series prediction model, forming a continuously self-optimizing closed loop.

9. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the cross-regional settlement flow prediction and deviation control method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the cross-regional settlement flow prediction and deviation control method as described in any one of claims 1 to 7.

Images