Equipment network offline event statistical analysis and batch-level stability evaluation method

Abstract

The invention discloses an equipment network offline event statistical analysis and batch-level stability evaluation method, relates to the technical field of equipment monitoring, and realizes multi-source data time alignment and credibility fusion by constructing a multi-source observation set and generating an equipment context vector and a reference time index. The CUSUM and the hysteretic threshold are combined to identify the offline event, and the real offline and false alarms are accurately distinguished in combination with the characteristics such as the probability type offline duration of the event, so that the event identification precision is improved. Through common cause event cluster clustering and batch multi-dimensional feature extraction, batch-level exposure normalization evaluation is realized. The stability grade and the index contribution degree can be accurately output based on the stability score of the robust normalization and trend degradation item, data support is provided for operation and maintenance decision, and the equipment network operation and maintenance efficiency and reliability are improved. The problems of heterogeneous multi-source data, inconsistent timestamps and missing conflicts in a large-scale equipment network are effectively solved, and the offline event recognition accuracy and the batch-level stability evaluation reliability are improved.

Description

Device Network Offline Event Statistical Analysis and Batch-Level Stability Assessment Methods Technical Field

[0001] This application relates to the field of equipment monitoring technology, specifically to a method for statistical analysis of offline events in equipment networks and batch-level stability assessment. Background Technology

[0002] With the large-scale deployment of IoT terminals, industrial equipment, edge gateways, and cloud management platforms, the online or offline status of devices has become a key indicator for measuring the network operation quality, network reliability, and operational efficiency. Device offline events are typically triggered by a combination of factors, including heartbeat reporting interruptions, link quality fluctuations, gateway congestion, device restarts or firmware anomalies, and platform-side processing delays. Due to the large scale of devices, heterogeneous data sources, inconsistent timestamps, and the prevalence of missing and conflicting timestamps, accurate identification, statistical analysis, and batch-level stability assessment of offline events require comprehensive processing of multi-source operational data, rather than relying on a single threshold or log entry.

[0003] Traditional technologies typically rely on a single online status bit or alarm log for offline detection. A common approach is to use a fixed threshold to determine if a device is offline if it fails to report within a preset time, and then count the number of offline occurrences, offline duration, or offline rate. For example, Chinese patent CN114296979A proposes a method for detecting abnormal states of IoT devices, which identifies abnormal and offline states by setting a standard reporting frequency for the devices, periodically scanning, and determining whether the devices are offline. However, most of these solutions rely on single-source data, lacking consistency correction and reliability fusion for multi-source status information, and thus fail to accurately reflect the stability differences between different batches under different exposure conditions.

[0004] While the aforementioned solutions can achieve basic online or offline determination and statistics, they still have significant shortcomings in large-scale device networks and batch deployment scenarios. Most solutions rely on fixed thresholds or single-source data, making it difficult to handle time drift, missing data, conflicts, and delays between multi-source data. This can lead to short-term jitter or late reporting being misjudged as offline events, resulting in distorted statistical results. Therefore, accurately identifying real offline events and achieving reliable assessment under multi-source heterogeneous state data conditions is a pressing technical problem that needs to be solved in this field. Summary of the Invention

[0005] To address the aforementioned technical problems, this application proposes the following technical solution: Firstly, embodiments of this application provide a method for statistical analysis of offline events in a device network and batch-level stability assessment, comprising: collecting multi-source status data of devices to construct a multi-source observation set and generating device context vectors; generating batch labels and batch device sets through a mapping function, and simultaneously establishing a reference time index for subsequent time alignment; estimating the time offset of the multi-source observation set based on the reference time index and completing time alignment; calculating dynamic confidence weights and fusing them to obtain an offline probability sequence; using CUSUM and a hysteresis threshold to jointly identify offline events based on the offline probability sequence; calculating the event probability-type offline duration, confidence level, severity, and risk quantity to form an event feature package; constructing an association graph using the event feature package and clustering to obtain common-cause event clusters; calculating the impact of event clusters and extracting batch exposure normalized multidimensional feature indicators according to the batch device set; constructing a reference set based on the batch context to robustly normalize the multidimensional feature indicators; combining trend degradation terms to form a stability score; calculating the confidence lower bound classification; and outputting the stability level and indicator contribution.

[0006] In one possible implementation, the multi-source status data of the acquisition device is used to construct a multi-source observation set and generate a device context vector. A batch label and a batch device set are generated through a mapping function. Simultaneously, a reference time index is established for subsequent time alignment, including: for each device... Collect at least Data sources are organized as multi-source observation sets: in: For equipment A multi-source observation set, For equipment No. source The timestamp of the record For the corresponding observations, For the number of data sources, For equipment In the source The number of records on To constrain the selection, only elements that meet certain conditions belong to the set; device fields are extracted from the master data to form a context column vector. and the Input the batch mapping function to get the batch to which the device belongs: At the same time, establish batch equipment sets ,in: For equipment Batch labels, This is a batch mapping function.

[0007] In one possible implementation, the step of estimating the time offset and performing time alignment of the multi-source observation set based on the reference time index, calculating dynamic confidence weights, and fusing them to obtain an offline probability sequence includes: for each device Each data source On the set of indices that can match the reference event, a robust median is used to estimate the offset: in: Indicates equipment Data source The estimated time offset, Represents a set Find the median using an internal index. For equipment Each data source , For equipment No. Reference timestamps; perform timestamp offset correction on each source record based on the estimated offset: And remap each source record to a unified time grid, generating data source support quantities on a unified time axis; at each time point For data source Calculate the missing strength, conflict rate, and delay penalty to obtain a credibility score, and use the credibility score to calculate the normalized weight of each data source; based on the normalized weight of each data source and the data source support quantity, fuse the online evidence quantity to obtain a fused online probability sequence and an offline probability sequence.

[0008] In one possible implementation, the statement at each time... For data source Calculate the missing strength, conflict rate, and delay penalty to obtain a credibility score, and use the credibility score to calculate the normalized weights of each source, including: in: For equipment Data source At any moment Credibility score, The absolute value of the time offset. For missing strength, For the conflict rate, To report the penalty for delay, , , and The penalty coefficient is... For equipment Data source At any moment Normalized weights, It is an exponential function.

[0009] In one possible implementation, the step of fusing online evidence based on the normalized weights and data source support quantities of each data source to obtain a fused online probability sequence and an offline probability sequence includes: in: To integrate online evidence quantity scores, For time series smoothing coefficients, For state update step size, For the feature coefficient vector, For additional feature vectors, For linear combination terms, For equipment At any moment The probability of fusion online, For the Sigmoid function, This represents the probability of being offline.

[0010] In one possible implementation, the step of jointly identifying offline events based on the offline probability sequence using CUSUM and a hysteresis threshold, and calculating the event probabilistic offline duration, confidence level, severity, and risk quantity to form an event feature package, includes: constructing a CUSUM cumulative statistic based on the offline probability. in: For CUSUM cumulative amount, This indicates taking the maximum value. The tolerance term is used; the start and end times of offline events are determined by combining the cumulative CUSUM statistic, CUSUM threshold, and hysteresis threshold. in: The start time of the e-th offline event. The end time of the e-th offline event. and These are the CUSUM offline trigger threshold and recovery threshold, respectively. and These are the offline confirmation window and the recovery confirmation window, respectively. and These are the hysteresis thresholds, This indicates the earliest time that satisfies the condition. This represents logical AND. This indicates that the condition holds true for all moments within the window; based on the start and end times of the offline event, the probabilistic offline duration, confidence level, severity, and risk level are determined sequentially.

[0011] In one possible implementation, determining the probabilistic offline duration, confidence level, severity, and risk level sequentially based on the start and end times of the offline event includes: calculating the probabilistic offline duration and event confidence level according to the start and end times of the offline event, respectively. in: This is a probabilistic offline duration, representing the time integral of the offline probability, reflecting fluctuating offline activity. For the confidence level of the event, Indicates multiplication. The weight of the data source at the start time of the event. This indicates the degree to which data source k supports the event being truly offline; the severity of the event is calculated using the probabilistic offline duration. in: arrive As weight, It is the natural logarithm. The duration normalization constant, This represents the peak offline probability within the event interval. As a business impact factor, As a key factor for nodes, The time-sensitive factor is used; the event risk is calculated based on the event confidence level and event severity. in: The confidence level amplification index; The event feature package is used to form the event table.

[0012] In one possible implementation, the step of constructing an association graph using the event feature package and clustering it to obtain common cause event clusters, calculating the impact of the event clusters, and extracting batch exposure-normalized multidimensional feature indicators according to the batch device set includes: using the event table as a node set, and according to the... or Candidate screening is performed to reduce the interference of false positives on clustering; for any two events Calculate edge weights to determine the correlation between two events: in: For the event The edge weights of the graph. arrive Assigning weights to each component. For time kernel function, For topological distance, This is the distance attenuation coefficient. and The context vector of the device corresponding to the event. W is the weighted L2 norm squared weight matrix. For the correlation coefficient function, and Let the vector represent the changes in network quality before and after the event; then, an undirected weighted graph is constructed using edge weights, and the modularity maximization objective is adopted: in: for , The weight of the graph is half of the total edge weight. For nodes The weighting degree, and events and The cluster number assigned to, The function is an indicator function, which is 1 if the condition is true and 0 otherwise. Finally, the group influence and batch exposure of each event cluster are calculated in turn, and the event table and cluster table are aggregated by batch to obtain the multidimensional feature index.

[0013] In one possible implementation, the final step involves sequentially calculating the group impact and batch exposure of each event cluster, and aggregating the event table and cluster table by batch to obtain the multidimensional feature index, including: calculating the group impact of each event cluster. in: For event clusters The size of the group influence Sum all events within the cluster. This represents the risk level of the event. A cluster is a collection of devices involved in a cluster. For the number of devices, This is the unbalanced amplification factor. The unevenness function is used to calculate batch exposure. ,in: For batch Total exposure, For batch The collection of devices, For equipment Effective observation duration; Constructing batch index set: , , , , in: Offline event frequency per unit of exposure. This represents the total number of offline events in the batch. Burden on offline time per unit of exposure, Risk burden per unit exposure For the common cause of abnormal burden per unit exposure, For batches involved The set of event clusters, The event interval fluctuation, For a batch of events, the sequence of adjacent intervals. To calculate the standard deviation, To calculate the mean, It is a very small positive number. Indicates the peak nuclear strength. For kernel function, This indicates the kernel bandwidth.

[0014] In one possible implementation, the step of constructing a reference set based on batch context to robustly normalize the multidimensional feature indicators, combining the trend degradation term to form a stability score, calculating the confidence lower bound classification, and outputting the stability level and indicator contribution includes: for each batch Build a reference set based on contextual similarity and for each indicator Obtain the reference sample set Robust normalization of the batch indicator set yields the normalized indicator: in: For batch index stability value, For batch The One original indicator, For batch The reference set in the indicator The sample set on, This indicates the calculation of the median. This indicates the calculation of the median absolute deviation. The conversion factor from MAD to standard deviation scale; constructing batch anomaly sequences on time slices. Calculate the trend deterioration term: , in: The slope of linear degradation. The number of time slices. For slice weights, For weighted average, The weighted average of the indicators The coefficient of the quadratic term, This represents the value of the independent variable that minimizes the objective function. , and These are the parameters for the second-order fitting. This is a trend deterioration item. and The missing weights are used to calculate the basic batch stability score based on the aforementioned degradation items, and then the batch stability score is obtained by shrinkage correction based on the batch exposure amount. in: As a basis for stability scoring, As a basis for stability scoring, The number of indicators used in the scoring. It is a non-linear penalty function. ; Weighting for trend penalties For stability rating, The sample sufficiency coefficient is the coefficient of adequacy. , It is the contraction constant; For reference scoring; based on the batch stability score, the score uncertainty is calculated and a confidence lower bound classification is given: first, give... approximate variance , will the Uncertainty mapped to rating scale ,according to Calculate the lower confidence bound Finally utilize The stability level is determined by grading: in: , This is the sensitivity coefficient mapping frequency fluctuations to rating fluctuations; finally, the indicator contribution is calculated and output together with the stability level. , in: As an indicator For batch Unstable contribution ratio, The percentage of contribution to the trend item.

[0015] In this embodiment, by constructing a multi-source observation set, generating device context vectors and reference time indexes, time alignment and reliability fusion of multi-source data are achieved, avoiding misjudgment issues caused by single-source data and reducing statistical distortion caused by short-term jitter and delayed reporting. CUSUM and hysteresis thresholds are used to jointly identify offline events, combined with features such as event probabilistic offline duration, to accurately distinguish between real offline events and false alarms, improving event identification accuracy. Through common-cause event clustering and batch multi-dimensional feature extraction, batch-level exposure normalization assessment is achieved, clearly reflecting the stability differences between different batches of devices. Based on robust normalization and trend degradation terms, stability scoring can accurately output stability levels and indicator contributions, providing data support for operation and maintenance decisions and improving the efficiency and reliability of device network operation and maintenance. This effectively solves the problems of heterogeneous multi-source data, inconsistent timestamps, and missing / conflicting data in large-scale device networks, improving the accuracy of offline event identification and the reliability of batch-level stability assessment. Attached Figure Description

[0016] Figure 1 is a flowchart illustrating a method for statistical analysis of offline events in a device network and batch-level stability assessment provided in an embodiment of this application; Figure 2 is a schematic diagram illustrating a system for statistical analysis of offline events in a device network and batch-level stability assessment provided in an embodiment of this application. Detailed Implementation

[0017] The present solution will now be described in conjunction with the accompanying drawings and specific embodiments.

[0018] Referring to Figure 1, the device network offline event statistical analysis and batch-level stability assessment method provided in this embodiment includes: S101, collecting multi-source status data of devices to construct a multi-source observation set and generating device context vectors, generating batch labels and batch device sets through a mapping function, and establishing a reference time index for subsequent time alignment.

[0019] As the foundation of the entire evaluation method, the core is to complete the integration of multi-source data of equipment, extract equipment context features, and classify equipment into batches. At the same time, a unified reference time index is established to lay the groundwork for subsequent data analysis in the time dimension. Through standardized sets and function definitions, the data is processed in a standardized manner.

[0020] Specifically, for each device Collect at least Data sources are organized as multi-source observation sets: in: For equipment A multi-source observation set, For equipment No. source The timestamp of the record For the corresponding observations, For the number of data sources, For equipment In the source The number of records on As a condition, only elements that meet the conditions belong to the set.

[0021] Based on multi-source observation sets, device fields that reflect key information such as device attributes, deployment environment, and service type are extracted from the device master data to construct device context column vectors. , This includes: device model, device firmware, device batch number, device site label, device installation time, and device access point information. Of course, The information in this vector is not limited to the examples mentioned above. This vector serves as a feature identifier for the device, providing feature support for subsequent batch segmentation and correlation analysis.

[0022] The Input the batch mapping function to get the batch to which the device belongs: At the same time, establish batch equipment sets ,in: For equipment Batch labels, This is a batch mapping function. Rule tables or decision tree mappings can be used, grouping items into batches based on a set of conditions, and arranging them according to business priority. Hash mappings can also be used, suitable for batches with short, stable IDs and large-scale devices.

[0023] By implementing batch management of devices as described above, and establishing a unified reference time index during data processing, a unified time benchmark is provided for subsequent time alignment operations of different data sources and devices, ensuring the consistency of time dimension analysis.

[0024] S102, estimate the time offset of the multi-source observation set and complete the time alignment according to the reference time index, calculate the dynamic confidence weight and fuse them to obtain the offline probability sequence.

[0025] After the data infrastructure is built in S101, there are problems such as time offset and data quality differences in records from different devices and data sources, which cannot be directly fused and analyzed. Therefore, the core of this step is to solve the problem of time unification of multi-source data and the problem of data credibility weight allocation. Through time offset estimation, correction and credibility weighted fusion, an offline probability sequence that can accurately reflect the network status of devices is generated. All calculations are based on a unified time base and standardized formulas.

[0026] In this embodiment, for each device Each data source Based on the reference time index established in S101, a robust median estimation method is used to calculate the time offset of the data source on the set of indexes that can match the reference events, effectively reducing the impact of outliers on offset estimation. in: Indicates equipment Data source The estimated time offset, Represents a set Find the median using an internal index. For equipment Each data source , For equipment No. Reference timestamp.

[0027] Perform timestamp offset correction on each source record based on the estimated offset: It also remaps each source record to a unified time grid, generates data source support on a unified time axis, completes the time alignment of multi-source data, and realizes the comparability of different data sources in the time dimension.

[0028] At every moment For data source Calculate the missing value intensity, conflict rate, and latency penalty to obtain a credibility score, and then use the credibility score to calculate the normalized weights for each data source. The specific calculation formula is as follows: in: For equipment Data source At any moment Credibility score, The absolute value of the time offset. For missing strength, For the conflict rate, To report the penalty for delay, , , and This is the penalty coefficient.

[0029] In this example This can be obtained through a sliding time window. Specifically, the expected reporting period or expected sampling frequency of the data source can be predetermined (e.g., agreed upon by a protocol, configured by the device model / version, or obtained from historical statistics). Within the time window, the expected number of records to be received and the actual number of records received are counted. The difference between the two is normalized according to the expected number of records to obtain the missing ratio. Then, the missing ratio is truncated or mapped to the [0,1] interval as the missing intensity. In another embodiment, the missing intensity can also be obtained from the normalized value of the continuous non-reporting time relative to the expected period, thus reflecting the characteristic that the longer the continuous missing time, the greater the missing intensity.

[0030] The conflict intensity can be obtained through inter-source consistency comparisons. For example, observations from each data source can be mapped to a unified online support level or online / offline label, and the proportion of data sources that do not match the majority of source voting results can be calculated within a time window. Alternatively, the average difference between the data source and the online support level corresponding to the fusion online probability can be calculated as the conflict intensity. In embodiments where a highly reliable reference source exists (e.g., gateway received logs or server database records), the conflict intensity can also be obtained based on the comparison results between the data source and the reference source.

[0031] To reflect data freshness, the staleness duration can be calculated by taking the difference between the current time and the aligned timestamp of the most recent arriving record from the data source. This staleness duration can then be normalized according to the desired period and truncated or smoothed. In another embodiment, when the data source contains both the event occurrence time and the arrival time, the difference between the arrival time and the occurrence time can be directly used as the input for the reporting delay penalty.

[0032] The penalty coefficient can be a preset parameter, for example, assigning different weights to each item based on its impact on reliability. Larger penalty coefficients can also be set for missing data intensity and conflict intensity to suppress the impact of low-quality data sources on the fusion result. In another embodiment, the penalty coefficient can also be automatically calibrated based on historical validation data, for example, by minimizing the error of the fusion online probability to known online / offline labels through parameter search or regression fitting, thereby obtaining the penalty coefficient.

[0033] Based on the credibility score, a normalized weight for each data source is calculated using an exponential function, achieving a standardized allocation of weights. The weight is positively correlated with the credibility of the data source. in: For equipment Data source At any moment Normalized weights, It is an exponential function.

[0034] Based on the normalized weights of each data source, combined with the data source support on a unified timeline, and by fusing online evidence, and adjusting parameters such as the time-series smoothing coefficient and state update step size, a fused online probability sequence and an offline probability sequence are generated sequentially. The offline probability sequence serves as the core basis for subsequent event recognition. in: To integrate online evidence quantity scores, For time series smoothing coefficients, For state update step size, For the feature coefficient vector, For additional feature vectors, For linear combination terms, For equipment At any moment The probability of fusion online, For the Sigmoid function, This represents the probability of being offline.

[0035] In this embodiment, A preset vector can be used, for example, assigning a positive coefficient to heartbeat density and a negative coefficient to network degradation and alarm intensity; in another embodiment, it can also be learned from historical labeled data, for example, by using a regression or classification model to fit the data so that the fused online probability is more accurate to the real online state, and the fitted parameter vector is used as... . It can consist of auxiliary features related to online or offline status, such as, but not limited to: heartbeat density, effective reporting density, network quality degradation (statistics or changes in packet loss rate, RTT, jitter, signal strength, retransmission rate, etc.) within the time window, weighted counts of alarms related to disconnection / restart / authentication failure, number of reconnections or session reconstructions, and indicators such as platform-side database entry latency or queue backlog. Features can be obtained by performing sliding window statistics, normalization, and encoding on multi-source data.

[0036] S103, based on the offline probability sequence, CUSUM and hysteresis threshold are used to jointly identify offline events, and the offline duration, confidence, severity and risk of the event probability are calculated to form an event feature package.

[0037] After obtaining the device offline probability in S102, this step accurately identifies the start and end times of offline events based on the sequence, and performs multi-dimensional feature quantification on each identified offline event. The probabilistic offline duration, confidence, severity, and risk of the event are calculated using standardized formulas to form a standardized event feature package, providing structured data for subsequent event clustering and batch analysis.

[0038] Specifically, a CUSUM cumulative statistic is constructed based on the offline probability to capture the cumulative trend of the offline probability, and a tolerance term is set to avoid misjudgments caused by small fluctuations: in: For CUSUM cumulative amount, This indicates taking the maximum value. This is a tolerance term; by combining the CUSUM cumulative statistic, CUSUM threshold, and hysteresis threshold, the start and end times of offline events are determined to reduce the probability of false positives and false negatives. in: The start time of the e-th offline event. The end time of the e-th offline event. and These are the CUSUM offline trigger threshold and recovery threshold, respectively. and These are the offline confirmation window and the recovery confirmation window, respectively. and These are the hysteresis thresholds, This indicates the earliest time that satisfies the condition. This represents logical AND. This means that the condition is true at all times within the window.

[0039] In this embodiment, the hysteresis threshold can be a preset threshold, and satisfies the following conditions: Less than This is to avoid frequent switching between offline and recovery caused by fluctuations in the online probability around a threshold. For example, the threshold bandwidth can be set according to the business's sensitivity to offline conditions, or two sets of thresholds can be selected based on the online probability distribution of historical online and offline samples to distinguish between the two distributions.

[0040] Based on the start and end times of the offline event, the probabilistic offline duration, confidence level, severity, and risk level are determined sequentially. Specifically, the probabilistic offline duration and event confidence level are calculated according to the start and end times of the offline event: in: This is a probabilistic offline duration, representing the time integral of the offline probability, reflecting fluctuating offline activity. For the confidence level of the event, Indicates multiplication. The weight of the data source at the start time of the event. This indicates the degree to which data source k supports the event being truly offline.

[0041] Based on probabilistic offline duration, and combined with multiple dimensions such as offline probability peak and business impact factors, the impact of an event is comprehensively assessed. in: arrive As weight, It is the natural logarithm. The duration normalization constant, This represents the peak offline probability within the event interval. As a business impact factor, As a key factor for nodes, It is a time-sensitive factor.

[0042] In this embodiment, This can be obtained based on business log statistics within the offline event occurrence period, such as by normalizing and weighting indicators like task failure rate, request timeouts, message backlog, and critical business downtime. In embodiments where business logs are unavailable, discrete level values ​​can also be set for the business impact factor based on the device's business role or business type.

[0043] The criticality of devices can be determined based on their role in the network topology or service hierarchy. For example, gateways, aggregation nodes, or control nodes can be set to high criticality, while ordinary terminal devices can be set to low criticality. In another embodiment, It can also be calculated based on indicators such as the number of connected devices, traffic share, or connectivity.

[0044] The time sensitivity factor can be obtained based on a preset sensitive time window table. For example, the time sensitivity factor can be increased when the event occurs during a production peak, settlement window, or SLA sensitive window; otherwise, the base value is used. In another embodiment, the time sensitivity factor can also be set with different coefficients according to dimensions such as hour, weekday, and holidays.

[0045] By combining the confidence level and severity of an event, a confidence amplification index is introduced to quantify the overall risk level of the event: in: The confidence level amplification index. This parameter is used to adjust the emphasis of the event risk level on high-confidence events. It can be a preset value, such as 1 to 3, to achieve linear or non-linear amplification. Historical data can be used to select the false alarm control target, so that the impact of low-confidence events on subsequent batch indicators and scores can be effectively suppressed.

[0046] Will The event feature package is used to form the event table.

[0047] S104, construct an association graph using the event feature package and cluster common cause event clusters, calculate the impact of event clusters and extract batch exposure normalized multidimensional feature indicators according to the batch device set.

[0048] Using the event table generated by S103 as the node set, candidate nodes are filtered through preset conditions to eliminate false alarms and reduce clustering interference. For any two filtered events, the graph edge weights are calculated to quantify the correlation between events, taking into account multiple dimensions such as time, topology, device characteristics, and network quality.

[0049] In this embodiment, the event table is used as a set of nodes, according to the... or Candidate screening is performed to reduce the interference of false alarms on clustering.

[0050] For any two events Calculate edge weights to determine the correlation between two events: in: For the event The edge weights of the graph. arrive Assigning weights to each component. For time kernel function, For topological distance, This is the distance attenuation coefficient. and The context vector of the device corresponding to the event. W is the weighted L2 norm squared weight matrix. For the correlation coefficient function, and This is the vector representing the change in network quality before and after the event.

[0051] In this embodiment, This is used to control the rate at which topological distance diminishes the correlation between events. It can be preset based on network topological distance definitions (e.g., hop count from a device to a gateway or path distance from a gateway to a convergence node), ensuring that events under the same gateway or access point have high similarity while the similarity of cross-level events decreases rapidly. In another embodiment, it can also be selected based on the topological distance distribution of historical common-cause event pairs. This is to make the exponential decay term more consistent with the actual common cause law.

[0052] The context vector of the device corresponding to the event can be obtained from the device corresponding to the event. Obtained by direct assignment, i.e., when event e is generated by device i. W is used to define a weighted metric for contextual differences. It can be implemented using a diagonal positive definite matrix with non-negative weights, and the importance of dimensions such as version, gateway, and region can be reflected by preset weights. In another embodiment, W can also be learned based on historical common-cause or non-common-cause event pairs, and its positive definiteness can be guaranteed by setting parameters.

[0053] Then, an undirected weighted graph is constructed based on the edge weights between events. The modularity maximization is used as the clustering objective function, and events with high correlation are grouped into the same common cause event cluster. in: for , The weight of the graph is half of the total edge weight. For nodes The weighting degree, and events and The cluster number assigned to, This is an indicator function; the condition is 1 if true, and 0 otherwise.

[0054] Finally, the group impact and batch exposure of each event cluster are calculated sequentially, and the event table and cluster table are aggregated by batch to obtain the multidimensional feature index. Specifically, the group impact of each event cluster is calculated as follows: in: For event clusters The size of the group influence Sum all events within the cluster. This represents the risk level of the event. A cluster is a collection of devices involved in a cluster. For the number of devices, This is the unbalanced amplification factor. This is the imbalance function.

[0055] To reflect whether the distribution of risk within an event cluster is dominated by a few extreme events, the Gini coefficient can be used: the set of event risk quantities within the cluster is sorted, and the Gini coefficient is calculated as the degree of imbalance; the closer the Gini coefficient is to 1, the higher the degree of imbalance. In another embodiment, the imbalance function can also be implemented using normalized entropy: the risk quantities within the cluster are normalized to a percentage sequence, the Shannon entropy is calculated and normalized, and then 1 minus the normalized entropy is taken as the degree of imbalance. In yet another embodiment, the imbalance function can also be implemented using Top-k percentages: the risk quantities within the cluster are sorted in descending order, and the ratio of the sum of the top k risk quantities to the total sum is taken as the degree of imbalance, where k can be 1, 3, or a preset proportion of the cluster size, thus obtaining an easily interpretable and simple imbalance measurement.

[0056] Calculate batch exposure: ,in: For batch Total exposure, For batch The collection of devices, For equipment Effective observation duration.

[0057] Construct a batch indicator set: , , , , in: Offline event frequency per unit of exposure. This represents the total number of offline events in the batch. Burden on offline time per unit of exposure, Risk burden per unit exposure For the common cause of abnormal burden per unit exposure, For batches involved The set of event clusters, The event interval fluctuation, For a batch of events, the sequence of adjacent intervals. To calculate the standard deviation, To calculate the mean, It is a very small positive number. Indicates the peak nuclear strength. For kernel function, This indicates the kernel bandwidth.

[0058] S105, construct a reference set based on the batch context to robustly normalize the multidimensional feature indicators, combine the trend degradation term to form a stability score, calculate the confidence lower bound classification, and output the stability level and indicator contribution.

[0059] After obtaining the batch multidimensional feature indicators through S104, the core of this step is to complete the robust normalization of the indicators, construct a batch stability scoring model by combining the trend degradation term, calculate the confidence lower bound through scoring uncertainty analysis and complete the stability classification, calculate the contribution of the indicators, and finally output the batch stability level and key influencing factors to provide a decision basis for network optimization.

[0060] In this embodiment, for each batch Build a reference set based on contextual similarity and for each indicator Obtain the reference sample set .

[0061] A robust normalization method is used to process each original indicator in the batch indicator set to reduce the impact of outliers and basic differences between batches. in: For batch index stability value, For batch The One original indicator, For batch The reference set in the indicator The sample set on, This indicates the calculation of the median. This indicates the calculation of the median absolute deviation. This is the conversion factor from MAD to the standard deviation scale.

[0062] Constructing batch anomaly sequences on time slices Calculate the trend deterioration term: , in: The slope of linear degradation. The number of time slices. For slice weights, For weighted average, The weighted average of the indicators The coefficient of the quadratic term, This represents the value of the independent variable that minimizes the objective function. , and These are the parameters for the second-order fitting. This is a trend deterioration item. and This indicates a missing weight.

[0063] By combining the trend deterioration term with the robustly normalized metric, a baseline stability score is first calculated. Then, a shrinkage correction is performed based on batch exposure to eliminate the impact of insufficient sample size, resulting in the final batch stability score. in: As a basis for stability scoring, As a basis for stability scoring, The number of indicators used in the scoring. It is a non-linear penalty function. ; Weighting for trend penalties For stability rating, The sample sufficiency coefficient is the coefficient of adequacy. , It is the contraction constant; For reference only.

[0064] Based on the batch stability score, the score uncertainty is calculated and a confidence lower bound classification is given: First, the following is given... approximate variance , will the Uncertainty mapped to rating scale ,according to Calculate the lower confidence bound Finally utilize The stability level is determined by grading: in: , This is the sensitivity coefficient that maps frequency fluctuations to rating fluctuations.

[0065] Finally, the contribution of the calculated indicators is combined with the stability level and output together: , in: As an indicator For batch Unstable contribution ratio, The percentage of contribution to the trend item.

[0066] Corresponding to the method for statistical analysis of device network offline events and batch-level stability assessment provided in the above embodiments, this application also provides a system for statistical analysis of device network offline events and batch-level stability assessment.

[0067] Referring to Figure 2, the device network offline event statistical analysis and batch-level stability assessment system 20 provided in this embodiment includes: a data access module 201, which is used to collect multi-source status data of devices, construct a multi-source observation set and generate device context vectors, generate batch labels and batch device sets through a mapping function, and establish a reference time index for subsequent time alignment.

[0068] The alignment and fusion module 202 is used to estimate the time offset of the multi-source observation set according to the reference time index and complete the time alignment, calculate the dynamic confidence weight and fuse it to obtain the offline probability sequence.

[0069] The event detection module 203 is used to identify offline events based on the offline probability sequence using CUSUM and hysteresis threshold, and to calculate the event probability offline duration, confidence, severity and risk to form an event feature package.

[0070] The association clustering module 204 is used to construct an association graph based on the event feature package and cluster common cause event clusters, calculate the impact of the event clusters, and extract batch exposure normalized multidimensional feature indicators according to the batch device set.

[0071] The stability assessment module 205 is used to construct a reference set based on the batch context to robustly normalize the multidimensional feature indicators, combine the trend degradation term to form a stability score, calculate the confidence lower bound classification, and output the stability level and indicator contribution.

[0072] The specific implementation steps of the modules in the above system are the same as those in the method embodiment. Please refer to the method embodiment for details, which will not be repeated here.

[0073] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, the simultaneous existence of A and B, or the existence of B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects have an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, and c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0074] The above description is merely a specific embodiment of this application. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application. The protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A method for statistical analysis of device network offline events and batch-level stability assessment, characterized in that, include: Multi-source status data of collected devices is used to construct a multi-source observation set and generate device context vectors. Batch labels and batch device sets are generated through a mapping function, and a reference time index is established for subsequent time alignment. The time offset of the multi-source observation set is estimated and time alignment is completed based on the reference time index. Dynamic confidence weights are calculated and fused to obtain an offline probability sequence. Based on the offline probability sequence, CUSUM and hysteresis threshold are used to jointly identify offline events. The offline duration, confidence, severity, and risk of the event are calculated to form an event feature package. An association graph is constructed using the event feature package and clustered to obtain common cause event clusters. The impact of the event clusters is calculated, and batch exposure normalized multi-dimensional feature indicators are extracted according to the batch device set. Based on the batch context, a reference set is constructed to robustly normalize the multidimensional feature indicators. A stability score is formed by combining the trend degradation term, and the confidence lower bound classification is calculated. The stability level and indicator contribution are then output.

2. The method for statistical analysis of device network offline events and batch-level stability assessment according to claim 1, characterized in that, The multi-source status data from the acquisition devices are used to construct a multi-source observation set and generate device context vectors. A batch label and batch device set are generated through a mapping function. Simultaneously, a reference time index is established for subsequent time alignment, including: for each device... Collect at least Data sources are organized as multi-source observation sets: in: For equipment A multi-source observation set For equipment The Gendai The timestamp of the record For the corresponding observations, For the number of data sources, For equipment In the source The number of records on To constrain the selection, only elements that meet certain conditions belong to the set; device fields are extracted from the master data to form a context column vector. and the Input the batch mapping function to get the batch to which the device belongs: At the same time, establish batch equipment sets ,in: For equipment Batch labels, This is a batch mapping function.

3. The method for statistical analysis of device network offline events and batch-level stability assessment according to claim 2, characterized in that, The step of estimating the time offset and completing time alignment of the multi-source observation set based on the reference time index, calculating dynamic confidence weights, and fusing them to obtain an offline probability sequence includes: for each device Each data source On the set of indices that can match the reference event, a robust median is used to estimate the offset: in: Indicates device Data source The estimated time offset, Represents a set Find the median using an internal index. For equipment Each data source ， For equipment The Reference timestamps; perform timestamp offset correction on each source record based on the estimated offset: And remap each source record to a unified time grid, generating data source support quantities on a unified time axis; at each time point For data source Calculate the missing strength, conflict rate, and delay penalty to obtain a credibility score, and use the credibility score to calculate the normalized weight of each data source; based on the normalized weight of each data source and the data source support quantity, fuse the online evidence quantity to obtain a fused online probability sequence and an offline probability sequence.

4. The method for statistical analysis of device network offline events and batch-level stability assessment according to claim 3, characterized in that, At each time For data source Calculate the missing strength, conflict rate, and delay penalty to obtain a credibility score, and use the credibility score to calculate the normalized weights of each source, including: in: For equipment Data source At any moment Credibility score, The absolute value of the time offset. For missing strength, For conflict rate, To report the penalty for delay, 、 、 and The penalty coefficient is... For equipment Data source At any moment Normalized weights, It is an exponential function.

5. The method for statistical analysis of device network offline events and batch-level stability assessment according to claim 4, characterized in that, The process of fusing online evidence based on the normalized weights and data source support quantities of each data source to obtain the fused online probability sequence and offline probability sequence includes: in: To integrate online evidence quantity scores, For time series smoothing coefficients, For state update step size, For the feature coefficient vector, For additional feature vectors, For linear combination terms, For equipment At any moment The probability of fusion online For the Sigmoid function, This represents the probability of being offline.

6. The method for statistical analysis of device network offline events and batch-level stability assessment according to claim 1, characterized in that, The method of identifying offline events based on the offline probability sequence using CUSUM and a hysteresis threshold, and calculating the event probabilistic offline duration, confidence, severity, and risk to form an event feature package, includes: constructing a CUSUM cumulative statistic based on the offline probability. in: For CUSUM cumulative amount, This indicates taking the maximum value. The tolerance term is used; the start and end times of offline events are determined by combining the cumulative CUSUM statistic, CUSUM threshold, and hysteresis threshold. in: The start time of the e-th offline event. The end time of the e-th offline event. and These are the CUSUM offline trigger threshold and recovery threshold, respectively. and These are the offline confirmation window and the recovery confirmation window, respectively. and These are the hysteresis thresholds, This indicates the earliest time that satisfies the condition. This represents logical AND. This indicates that the condition holds true for all moments within the window; based on the start and end times of the offline event, the probabilistic offline duration, confidence level, severity, and risk level are determined sequentially.

7. The method for statistical analysis of device network offline events and batch-level stability assessment according to claim 6, characterized in that, The step of determining the probabilistic offline duration, confidence level, severity, and risk quantity based on the start and end times of the offline event includes: calculating the probabilistic offline duration and event confidence level according to the start and end times of the offline event. in: This is a probabilistic offline duration, representing the time integral of the offline probability, reflecting fluctuating offline activity. For the confidence level of the event, Indicates multiplication. The weight of the data source at the start time of the event. This indicates the degree to which data source k supports the event being truly offline; the severity of the event is calculated using the probabilistic offline duration. in: arrive As weight, It is the natural logarithm. The duration normalization constant, This represents the peak offline probability within the event interval. As a business impact factor, As a key factor for nodes, The time-sensitive factor is used; the event risk is calculated based on the event confidence level and event severity. in: The confidence level amplification index; The event feature package is used to form the event table.

8. The method for statistical analysis of device network offline events and batch-level stability assessment according to claim 7, characterized in that, The step of constructing an association graph based on the event feature package and clustering it to obtain common cause event clusters, calculating the impact of event clusters, and extracting batch exposure-normalized multidimensional feature indicators according to the batch device set includes: using the event table as the node set, and according to the... or Candidate screening is performed to reduce the interference of false positives on clustering; for any two events Calculate edge weights to determine the correlation between two events: in: For the event The edge weights of the graph. arrive Assigning weights to each component. For time kernel function, For topological distance, This is the distance attenuation coefficient. and The context vector of the device corresponding to the event. W is the weighted L2 norm squared weight matrix. For the correlation coefficient function, and Let the vector represent the changes in network quality before and after the event; then, an undirected weighted graph is constructed using edge weights, and the modularity maximization objective is adopted: in: for ， The weight of the edges in the graph is half of the total edge weight. For nodes The weighting degree, and events and The cluster number assigned to, The function is an indicator function, which is 1 if the condition is true and 0 otherwise. Finally, the group influence and batch exposure of each event cluster are calculated in turn, and the event table and cluster table are aggregated by batch to obtain the multidimensional feature index.

9. The method for statistical analysis of device network offline events and batch-level stability assessment according to claim 8, characterized in that, Finally, the group impact and batch exposure of each event cluster are calculated sequentially, and the event table and cluster table are aggregated by batch to obtain the multidimensional feature index, including: calculating the group impact of each event cluster: in: For event clusters The size of the group influence Sum all events within the cluster. This represents the risk level of the event. A cluster is a collection of devices involved in a cluster. For the number of devices, This is the unbalanced amplification factor. The unevenness function is used to calculate batch exposure. ,in: For batch Total exposure, For batch The collection of devices, For equipment Effective observation duration; Constructing batch index set: ， ， ， ， in: Offline event frequency per unit of exposure This represents the total number of offline events in the batch. Burden on offline time per unit of exposure, Risk burden per unit exposure For the common cause of abnormal burden per unit exposure, For batches involved The set of event clusters The event interval fluctuation, For a batch of events, the sequence of adjacent intervals. To calculate the standard deviation, To calculate the mean, It is a very small positive number. Indicates the peak nuclear strength. For kernel function, This indicates the kernel bandwidth.

10. The method for statistical analysis of device network offline events and batch-level stability assessment according to claim 1, characterized in that, The reference set constructed based on batch context is used to robustly normalize the multidimensional feature indicators, and a stability score is formed by combining the trend degradation term. Confidence lower bound levels are calculated, and the stability level and indicator contribution are output, including: for each batch... Build a reference set based on contextual similarity and for each indicator Obtain the reference sample set Robust normalization of the batch indicator set yields the normalized indicator: in: For batch index stability value, For batch The One original indicator, For batch The reference set in the indicator The sample set on, This indicates the calculation of the median. This indicates the calculation of the median absolute deviation. The conversion factor from MAD to standard deviation scale; constructing batch anomaly sequences on time slices. Calculate the trend deterioration term: ， in: The slope of linear degradation. The number of time slices. For slice weights, For weighted average, The weighted average of the indicators The coefficient of the quadratic term, This represents the value of the independent variable that minimizes the objective function. 、 and These are the parameters for the second-order fitting. This is a trend deterioration item. and The missing weights are used to calculate the basic batch stability score based on the aforementioned degradation items, and then the batch stability score is obtained by shrinkage correction based on the batch exposure amount. in: As a basis for stability scoring, As a basis for stability scoring, The number of indicators used in the scoring. It is a non-linear penalty function. ； Weighting for trend penalties For stability rating, The sample sufficiency coefficient is the coefficient of adequacy. ， It is the contraction constant; For reference scoring; based on the batch stability score, the score uncertainty is calculated and a confidence lower bound classification is given: first, give... approximate variance , will the Uncertainty mapped to rating scale ,according to Calculate the lower confidence bound Finally utilize The stability level is determined by grading: in: ， This is the sensitivity coefficient mapping frequency fluctuations to rating fluctuations; finally, the indicator contribution is calculated and output together with the stability level. ， in: As an indicator For batch Unstable contribution ratio, The percentage of contribution to the trend item.

Images