Intelligent operation and maintenance method and system of core network and electronic equipment

Abstract

The invention relates to the technical field of communication network operation and maintenance, in particular to an intelligent operation and maintenance method and system of a core network and electronic equipment. The method comprises the following steps: carrying out unified time sequence on a core network KPI (Key Performance Indicator), a log and a virtual resource index in a data acquisition layer; the data analysis layer calls a Merlion library to complete exception scoring and outputs an event portrait; the diagnosis decision-making layer learns the inter-index time lag causal graph through NOTEARS and is coupled with a Drools rule engine to generate a fault root cause list sorted according to suspiciousness; and the operation and maintenance execution layer automatically triggers AMF / SMF virtualization capacity expansion or parameter adjustment according to the strategy, and feeds back a result to the acquisition layer to form a closed loop. The current network verification shows that the method can compress the traditional 72-hour optimization period to the minute level, the manual workload is reduced by 90%, and the key KPI (Key Performance Indicator) such as the registration success rate is improved by 1.8%.

Description

Technical Field

[0001] This invention relates to the field of communication network operation and maintenance technology, and more specifically, to an intelligent operation and maintenance method, system, and electronic device for a core network. Background Technology

[0002] With the increasing complexity and cloudification of 4G / 5G networks, core network operation and maintenance face enormous challenges. Massive amounts of multi-dimensional operational data (such as Key Performance Indicators (KPIs), signaling logs, resource utilization, etc.) are generated daily, creating a "data black hole." Traditional methods relying on manual experience for anomaly detection and root cause analysis are inefficient and slow to respond. Existing technologies typically employ alarm systems based on fixed thresholds or simple correlation rules, which have the following drawbacks:

[0003] Alarm storms and false alarms: Static thresholds are difficult to adapt to dynamic changes in the network, easily generating a large number of invalid alarms and drowning out real fault signals.

[0004] Root cause identification is difficult: Fault phenomena (such as a decline in business KPIs) are often caused by a combination of problems in multiple aspects such as underlying resources, signaling processes, and network topology. Existing methods lack the ability to automatically correlate cross-layer and cross-domain indicators and conduct in-depth causal analysis, resulting in inaccurate identification.

[0005] Delayed response and repair: From problem discovery and analysis to repair execution, it relies heavily on manual intervention, resulting in a long closed-loop cycle that is difficult to meet the requirements of a high-availability network.

[0006] Therefore, there is an urgent need for a closed-loop operation and maintenance solution that can automatically detect anomalies, intelligently diagnose root causes, and quickly perform repairs. Summary of the Invention

[0007] In view of this, the embodiments of this application are committed to providing an intelligent operation and maintenance method, system and electronic device for core networks, so as to solve the problems of low operation and maintenance efficiency, difficulty in root cause location and slow response speed in the prior art.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides an intelligent operation and maintenance method for a core network, comprising the following steps: Multi-dimensional time-series data, including key performance indicators (KPIs), signaling process logs, and system resource utilization, are collected from core network elements and then cleaned and standardized. Based on the monitoring of multi-dimensional time-series data of the core network, primary abnormal events are identified, and at least one other dimension indicator that is adjacent to the primary abnormal event in the time domain and has a preset correlation relationship is automatically associated to generate a multi-dimensional abnormal feature vector. The multidimensional abnormal feature vector is input into the diagnostic decision model, wherein the diagnostic decision model performs reasoning by fusing an inter-indicator causal network learned from historical data with pre-set domain knowledge rules, and outputs the root cause localization result of the primary abnormal event. Based on the root cause location results, targeted network repair operations are automatically triggered and executed, and the operation and maintenance closed loop is verified based on the data feedback after the repair.

[0009] Optionally, automatic association specifically involves: based on a pre-constructed causal network between indicators, identifying other indicator nodes that have a strong causal relationship with the indicator node corresponding to the primary abnormal event, and integrating the state change information of the other indicator nodes within a preset time window into the multidimensional abnormal feature vector.

[0010] Optionally, the causal network between indicators is obtained by training historical operation and maintenance data through a causal discovery algorithm, which includes a gradient-based acyclic graph structure learning algorithm, PC algorithm, or Granger causality test algorithm.

[0011] Optionally, the inference process involving the fusion of an inter-indicator causal network learned from historical data and pre-defined domain knowledge rules includes: Using the probabilistic graphical model constructed from the causal network between the indicators, the first confidence level of each potential root cause node is calculated; Using the domain knowledge rules, logical reasoning is performed based on the multidimensional anomaly feature vector to generate the second confidence level or constraint condition for each potential root cause node. By combining the first confidence level with the second confidence level or constraints, the final root cause localization result and remediation recommendations are determined.

[0012] Optionally, the domain knowledge rules include IF-THEN rules for characterizing the logical relationships between network devices, service processes, and failure modes.

[0013] Optionally, the network repair operation includes at least one of the following: elastic scaling of resources for the target network element, restarting the service process, adjusting the network load balancing strategy, issuing key parameter configurations, or triggering network slice reconfiguration.

[0014] Secondly, the present invention provides an intelligent operation and maintenance system for a core network, used to implement the above-mentioned method, including: The data acquisition layer is configured to collect multi-dimensional time-series data from core network elements, including key performance indicators (KPIs), signaling process logs, and system resource utilization, and then perform cleaning and standardization processing. The data analysis layer is configured to identify primary abnormal events based on the monitoring of multi-dimensional time-series data of the core network, and automatically associate at least one other dimension indicator that is adjacent to the primary abnormal event in the time domain and has a preset correlation relationship, thereby generating a multi-dimensional abnormal feature vector. The diagnostic decision layer is configured to input the multidimensional abnormal feature vector into the diagnostic decision model, wherein the diagnostic decision model performs reasoning by fusing an inter-indicator causal network learned from historical data with pre-set domain knowledge rules, and outputs the root cause localization result of the primary abnormal event. The operation and maintenance execution layer is configured to automatically trigger and execute targeted network repair operations based on the root cause localization results, and verify the operation and maintenance closed loop based on the data feedback after the repair.

[0015] Optionally, the data analysis layer includes: A time-series anomaly detection unit is used to identify the primary anomaly events from the multi-dimensional time-series data; A causal association unit is used to access the stored causal network between the indicators and perform the automatic association.

[0016] Optionally, the diagnostic decision layer includes: A probabilistic inference unit is used to run a probabilistic graphical model constructed based on the causal network between the indices; The rule reasoning unit is used to load and run the domain knowledge rules.

[0017] Thirdly, the present invention provides an electronic device including a processor and a memory, wherein the memory stores a computer program, and the processor executes the program to implement the method described above.

[0018] The intelligent operation and maintenance method for core networks provided in this application creatively integrates causal discovery technology with expert rule base by constructing a full-link system of "data collection-collaborative perception-intelligent diagnosis-automatic execution-closed-loop verification". This enables automatic and accurate location of the root cause of the fault and triggering of repair from massive and multi-dimensional operation and maintenance data, significantly improving the automation, intelligence level and response efficiency of core network operation and maintenance. Attached Figure Description

[0019] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0020] Figure 1This is a flowchart illustrating an intelligent operation and maintenance method for a core network provided in one embodiment of this application; Figure 2 This is a schematic diagram of the structure of an intelligent operation and maintenance system for a core network provided in one embodiment of this application; Figure 3 This is a schematic diagram of an electronic device structure provided in one embodiment of this application. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Figure 1 This is a flowchart illustrating an intelligent operation and maintenance method for a core network provided in one embodiment of this application. Figure 1 As shown, the method includes the following:

[0023] Step S110: Collect multi-dimensional time-series data from core network elements, including key performance indicators (KPIs), signaling process logs, and system resource utilization, and perform cleaning and standardization processing. This step forms the data foundation for the system's intelligent analysis, aiming to obtain unified, well-organized, high-quality data from the complex core network environment.

[0024] The data sources and content (i.e., multi-dimensional time-series data) include: Core network elements: These refer to the functional entities that constitute the core network of mobile communication. In 5G networks, they mainly include Access and Mobility Management Functions (AMF), Session Management Functions (SMF), User Plane Functions (UPF), and Unified Data Management (UDM). Each network element is responsible for different network functions and generates corresponding operational data.

[0025] Key Performance Indicators (KPIs): Core metrics used to measure network and service health. Examples include: Service Success Rate: User registration success rate, service request connection rate, handover success rate. Service Quality: User plane uplink / downlink speeds, end-to-end latency, jitter. Service Volume: Number of concurrent online users, number of signaling connections, data traffic. Signaling Flow Log: Records details of control signaling interactions between network elements to establish, maintain, and release connections. "Signaling" refers to instruction messages used to control communication behavior. The log records message types, timestamps, success / failure statuses, and reason values ​​on interfaces such as N1 (terminal to AMF), N2 (base station to AMF), N4 (SMF to UPF), and SBI (service-based interface).

[0026] System resource utilization: refers to the resource consumption of physical or virtual servers that host the core network software. This mainly includes: CPU utilization, memory usage, disk I / O speed, network interface throughput, and packet loss rate.

[0027] It should be noted that in practical applications, the specific content of multi-dimensional time series data can be adjusted based on actual needs, adding necessary content or removing unnecessary content.

[0028] Furthermore, due to network packet loss, collector malfunctions, and other reasons, the raw data may contain missing, duplicate, erroneous, or noisy (unreasonable spikes). The cleaning process includes: removing obviously erroneous outliers, interpolating and filling randomly missing data points, and removing duplicate records.

[0029] Because the data collected from different network elements and interfaces varies in format, unit, and dimension, it needs to be standardized. Standardization aims to transform it into a unified and comparable format. For example, values ​​such as CPU utilization (percentage), memory usage (GB), and latency (milliseconds) are scaled to a similar numerical range (e.g., 0-1) using normalization methods, and timestamp precision is standardized. The processed data is organized into a multi-dimensional time-series data stream with timestamps and stored in a time-series database for subsequent real-time analysis.

[0030] Step S120: Based on the monitoring of multi-dimensional time-series data of the core network, identify primary abnormal events, and automatically associate at least one other dimension indicator that is adjacent to the primary abnormal event in the time domain and has a preset correlation relationship, and generate a multi-dimensional abnormal feature vector. This step enables the intelligent discovery of abnormal clues from massive amounts of data and their transformation into structured diagnostic evidence.

[0031] Primary anomalies refer to clearly defined abnormal signals detected for the first time through relatively simple rules or models, typically representing performance degradation that is directly perceptible to users or the network. For example, by setting a dynamic threshold (calculated based on historical baselines), a primary anomaly is triggered when the "user registration success rate in a certain region" falls below the threshold for multiple consecutive sampling periods. Essentially, it is an anomaly trigger or problem symptom. The system continuously monitors the preprocessed time-series data stream.

[0032] Temporally adjacent: This refers to extending a specific time window forward and backward from the time of the initial abnormal event (e.g., 5 minutes before to 5 minutes after the event). The system searches for abnormal changes in other indicators within this window. It should be noted that the extended time window can be adjusted based on specific indicators. For example, for indicators with causal relationships and significant lag effects, an extended time window can be added specifically for that indicator.

[0033] Predefined relationships: These refer to the logical or causal connections between indicators that are predefined by the system or learned from it. For example, a decrease in "user registration success rate" may be strongly correlated with a surge in "CPU utilization of AMF network elements" or an increase in "N2 interface signaling drop rate". Such relationships can be stored in an "indicator relationship graph" or "causal network".

[0034] In multidimensional anomaly feature vectors, "multidimensional" refers to the fusion of multiple indicator information from different levels (business KPIs, signaling, resources). Feature vector, a term in machine learning, refers to a mathematical data structure (usually an array or list) where each element (feature) represents a specific attribute or measure of a data object.

[0035] In this step, the system extracts, quantifies, and concatenates information about the primary anomaly itself (such as the name of the anomaly indicator and the degree of deviation) with the status information of other anomaly indicators captured within the associated time window (such as the peak value of CPU utilization and the upward slope of the signaling drop rate), ultimately forming a structured "multidimensional anomaly feature vector" containing rich contextual information. This vector serves as the unified input for subsequent deep diagnostics.

[0036] Step S130: Input the multidimensional abnormal feature vector into the diagnostic decision model, wherein the diagnostic decision model performs reasoning by fusing an inter-indicator causal network learned from historical data with preset domain knowledge rules, and outputs the root cause localization result of the primary abnormal event. This step is the core of the solution's intelligence, responsible for performing deep reasoning on abnormal features to find the root cause of the problem.

[0037] Diagnostic decision model: This is a software algorithm module that encapsulates complex reasoning logic. It receives "multi-dimensional abnormal feature vectors" as input, analyzes and calculates them, and then outputs diagnostic conclusions.

[0038] Fusion reasoning mechanism: including causal networks between indicators learned from historical data, and pre-defined domain knowledge rules.

[0039] In this context, a causal network is a graphical model where nodes represent operational metrics, and directed edges represent causal relationships (not just correlations) between metrics. For example, the edge "A → B" indicates that a change in A will lead to a change in B.

[0040] The causal network between indicators based on historical data learning is not manually created, but automatically generated after offline analysis of massive amounts of historical operation and maintenance data using causal discovery algorithms (such as NOTEARS and PC algorithms). It mines the potential causal driving relationships between indicators from the data.

[0041] In the pre-defined domain knowledge rules, domain knowledge refers to the experience and knowledge accumulated by communication network operation and maintenance experts over a long period of time, such as "If the AMF CPU is too high and its N2 interface messages are dropped, it is very likely that the AMF is experiencing signaling congestion."

[0042] The pre-defined domain knowledge rules are based on pre-set rules: for example, rules usually exist in the form of logical statements such as "if...then..." and are encoded into the system's rule base.

[0043] The fusion reasoning mechanism specifically refers to the following: during diagnosis, the model simultaneously utilizes causal networks for data-driven probabilistic inference (calculating the probability of various root cause hypotheses) and a rule base for knowledge-driven logical verification and constraints. The conclusions of both complement and correct each other, ultimately producing a more accurate and reliable root cause localization result. A root cause refers to the most fundamental and originating failure point or event that leads to a series of abnormal phenomena.

[0044] Step S140: Based on the root cause localization result, automatically trigger and execute targeted network repair operations, and verify the operation and maintenance closed loop based on the data feedback after repair.

[0045] This step creates a closed loop from "diagnosis" to "cure," improving the level of automation in operations and maintenance.

[0046] Based on the diagnosed root cause, the system automatically matches predefined repair strategy scripts or workflows and executes specific operations by calling network control systems, cloud management platforms, etc., through application programming interfaces (APIs). For example: If the root cause is "insufficient server CPU resources", then virtual machine elastic scaling will be triggered to automatically increase the number of vCPUs.

[0047] If the root cause is "a service process has crashed", then a service restart command will be triggered.

[0048] If the root cause is "uneven load", then adjust the load balancing strategy.

[0049] After the repair action is executed, the system continuously monitors the changes in the original abnormal indicators and related indicators. If the indicators return to normal within the set observation period, the repair is considered successful, and the fault handling loop ends. If the fault does not recover, an alarm escalation may be triggered or a new round of diagnostic analysis may be initiated.

[0050] This complete process of "monitoring -> diagnosis -> execution -> verification" constitutes an automated operation and maintenance closed loop, which significantly reduces manual intervention and enables rapid self-healing of problems.

[0051] In some embodiments, automatic association specifically involves: based on a pre-constructed causal network between indicators, identifying other indicator nodes that have a strong causal relationship with the indicator node corresponding to the primary abnormal event, and integrating the state change information of the other indicator nodes within a preset time window into the multidimensional abnormal feature vector.

[0052] Specifically, the "automatic association" operation described in step S120 relies on a core component—a pre-built causal network between indicators. The purpose of this implementation is to upgrade static association rules based on expert experience to a dynamic and interpretable intelligent association mechanism based on data-driven discovery.

[0053] When the system identifies a primary anomalous event (e.g., "KPI_A indicator anomalous"), it maps the event to a specific indicator node in a pre-built causal network between indicators.

[0054] Subsequently, the system performs a "graph traversal" within the network, starting from this node, to find other indicator nodes that are directly connected to it via directed edges or indirectly connected within one or two steps. The indicators represented by these nodes are determined by the algorithm to have a strong causal relationship with "KPI_A". "Strong causal relationship" here means that, based on historical data learning, the changes in these indicators are statistically significantly caused by the fundamental fault corresponding to "KPI_A", or are the direct cause of the anomaly in "KPI_A".

[0055] For example, a causal network might show that "server CPU utilization (metric B)" and "network interface packet loss rate (metric C)" are strong causal indicators that cause the degradation of "business response latency (KPI_A)".

[0056] After the system identifies the relevant indicators (B, C, etc.), it does not simply judge whether their current value exceeds the threshold. Instead, it backtracks to a preset time window (such as 10 minutes before and after) centered on the time when the primary abnormal event occurred.

[0057] Within this window, extract the complete state change sequence information for each associated indicator. This includes, but is not limited to: the indicator's numerical curve, change trend (such as slope), statistical characteristics (such as mean, variance, peak value), and whether any abnormal patterns occur.

[0058] Finally, the system encodes and integrates the characteristics of primary abnormal events (such as type and deviation) with the state change information of all retrieved strong causal correlation indicators within the time window.

[0059] The integration can be achieved through vector concatenation or by constructing a structured feature map. The resulting "multidimensional anomaly feature vector" not only contains the "symptoms" of the problem (primary anomalies) but also systematically encapsulates detailed "health check reports" of "candidate causes" (correlation indicators) inferred from a causal perspective that may lead to the symptoms. This provides depth and context for subsequent diagnostic steps, greatly improving the accuracy and efficiency of root cause analysis.

[0060] By utilizing causal networks, the system achieves accurate and interpretable associations, avoiding the problems of overly broad association ranges or omission of key factors caused by simple correlations or empirical rules. This results in higher information quality in feature vectors and directly improves the reliability of the entire intelligent diagnostic process.

[0061] In some embodiments, the causal network between indicators is obtained by training historical operation and maintenance data using a causal discovery algorithm, which includes a gradient-based acyclic graph structure learning algorithm, PC algorithm, or Granger causality test algorithm.

[0062] In other words, the causal network between indicators is not statically defined by human experience, but is automatically generated through a data-driven approach, using causal discovery algorithms to train and mine large-scale historical operational data offline. This method can discover hidden causal dependencies in complex real-world operational data that are difficult to summarize fully manually, thus making the network model more adaptable and accurate.

[0063] Specifically, the causal discovery algorithms include, but are not limited to, the following categories: Gradient-based noncyclic graph structure learning algorithm: Algorithm Explanation: This is a class of modern causal discovery methods based on continuous optimization. "Acyclic graph" refers to a causal network where there are no cyclic causal relationships (i.e., A leads to B, and B leads to A). "Gradient-based" means the algorithm uses optimization techniques such as gradient descent to solve the problem.

[0064] How it works: This type of algorithm (e.g., the NOTEARS algorithm) transforms the discrete graph structure search problem into a continuous, differentiable optimization problem. It defines a loss function that measures the goodness of fit to the data and the complexity of the graph structure, and automatically adjusts the connection strength between nodes in the graph using gradient information, ultimately learning an optimal causal graph structure.

[0065] Application value in this invention: This type of method is particularly suitable for handling a large number of complex nonlinear relationships that may exist in core network operation and maintenance. It can robustly learn causal networks from high-dimensional time series data and is an advanced technical means in modern artificial intelligence-driven operation and maintenance (AIOps).

[0066] PC algorithm: Algorithm Explanation: The PC algorithm is a classic and widely used constraint-based causal discovery algorithm, named after its proposers Peter Spirtes and Clark Glymour.

[0067] How it works: The core idea is to gradually eliminate non-existent edges between variables and determine the causal direction through a series of statistical independence tests. The algorithm starts with a fully connected undirected graph and removes irrelevant edges by testing whether two variables are independent given certain other variables. Then, it uses a series of logical rules (such as orientation rules) to determine the direction of the remaining edges.

[0068] The application value in this invention lies in the fact that the PC algorithm has a clear principle and is highly effective in scenarios with sufficient data and relatively clear causal relationships. It provides this invention with a stable and interpretable method for constructing causal networks.

[0069] Granger causality test algorithm: Algorithm Explanation: The Granger causality test is a prediction-based statistical test of causality, primarily used for time series data. Its core concept is that if historical information about a variable X helps to better predict the future value of another variable Y, then statistically, X is considered a "Granger cause" of Y.

[0070] How it works: This method compares the prediction errors of two regression models: one model uses only historical data of Y itself to predict Y, while the other model uses historical data of both Y and X. If the prediction accuracy of the second model is significantly better than that of the first, then a Granger causal relationship from X to Y is considered to exist.

[0071] The application value in this invention: Since core network operation and maintenance data is essentially a multivariate time series, Granger causality test is very suitable for the time series characteristics of the data. It is particularly good at discovering predictable causal driving relationships with a time sequence, such as whether "increased CPU utilization" leads in time and significantly affects "business processing latency".

[0072] Before actual deployment, the system collects historical, multi-dimensional, time-series operational data spanning several weeks or months (i.e., the data described in step S110). This data is then analyzed and trained offline using one or more of the aforementioned causal discovery algorithms. The training process aims to identify and quantify the causal relationships, directions, and strengths between different KPIs, resource metrics, and signaling metrics. The final output causal network between metrics is a graphical knowledge model where nodes represent metrics and directed edges represent causal relationships. This model serves as the core knowledge base and reasoning foundation for subsequent real-time intelligent association and diagnosis. Constructing the causal network through this data-driven approach is a key manifestation of the invention's intelligence and adaptability.

[0073] In some embodiments, the reasoning process of fusing the causal network between indicators learned from historical data with pre-defined domain knowledge rules includes: Using the probabilistic graphical model constructed from the causal network between the indicators, the first confidence level of each potential root cause node is calculated; Using the domain knowledge rules, logical reasoning is performed based on the multidimensional anomaly feature vector to generate the second confidence level or constraint condition for each potential root cause node. By combining the first confidence level with the second confidence level or constraints, the final root cause localization result and remediation recommendations are determined.

[0074] The method integrates causal networks between indicators learned from historical data with pre-defined domain knowledge rules for reasoning. Internally, it executes a collaborative and complementary hybrid reasoning process. This process aims to combine the objectivity of data-driven methods with the precision of knowledge-driven methods. Its specific steps are broken down as follows: 1. Calculate the first confidence level based on the probabilistic graphical model: Probabilistic graphical model construction: First, the causal network between indicators described in step S120 is transformed into a probabilistic graphical model that can be used for probability calculation, such as a Bayesian network. In this model, network nodes represent operational indicators, directed edges between nodes represent causal dependencies, and conditional probability tables quantify the strength of these dependencies.

[0075] Reasoning and Computation: When a "multidimensional anomaly feature vector" is used as input observational evidence (e.g., observing "KPI A is abnormal," "Indicator B is abnormal," and "Indicator C is normal"), the probabilistic graphical model performs probability propagation (e.g., using a confidence propagation algorithm) based on its embedded probability relationships. Its output is a posterior probability estimate of each potential root cause node in the model (typically representing nodes representing underlying hardware failures, configuration errors, or external events) as the cause of all currently observed phenomena. This probability value is called the first confidence level, which, from a purely statistical perspective, provides a ranking of the probabilities of each root cause hypothesis.

[0076] 2. Generate second confidence levels or constraints based on domain knowledge rules: Rule base application: At the same time, the system inputs the same "multidimensional anomaly feature vector" into the domain knowledge rules. This rule base is solidified from the experience of operations and maintenance experts and contains a series of logical rules in the form of "IF-THEN".

[0077] Logical reasoning: The rule engine performs pattern matching on the input feature vector, triggering all rules that meet the conditions. Each triggered rule points to one or more possible root causes and generates a second confidence score for these root causes based on the rule's predefined weights or deterministic factors. Furthermore, some rules may not directly provide a confidence score but instead offer constraints, such as: "The root cause must be an event occurring on network element X," or "Root causes Y and Z cannot both be true simultaneously." These constraints provide important prior restrictions on the root cause search space.

[0078] 3. Comprehensive decision-making to generate the final result: Finally, the system has a decision fusion module, which is responsible for integrating the outputs of the two paths mentioned above.

[0079] For root cause hypotheses that obtain both a first confidence level (data probability) and a second confidence level (rule weight), the fusion module can use methods such as weighted averaging and DS evidence theory to calculate a comprehensive confidence level. The constraints provided by the rules are then used to filter or correct the results of probabilistic inference. For example, if a root cause scores highly in the probability graph (high first confidence level) but violates a strong rule constraint, it may be downweighted or excluded.

[0080] By ranking all candidate root causes based on their overall confidence levels and considering all constraints, the system ultimately determines the most likely root cause. Based on this root cause, the system can further match corresponding remediation suggestions from the rule base or strategy base, thus completing a full diagnostic decision from "what is the problem" to "how to solve it".

[0081] The key advantage of this embodiment lies in its ingenious integration of "what the data tells us" and "what the experts know" through the synergy of a "probabilistic model + rule engine." Probabilistic models excel at handling uncertainty and discovering complex relationships, but may be limited by data quality and completeness; the rule engine, on the other hand, ensures the strict execution and logical transparency of key operational experience. This integration allows the diagnostic process to possess both the breadth and adaptability of data intelligence and the depth and reliability of domain knowledge, thereby significantly improving the accuracy of root cause localization and the credibility of decisions.

[0082] In some embodiments, the domain knowledge rules include IF-THEN rules for characterizing the logical relationships between network devices, service processes, and failure modes.

[0083] Among them, network devices are conditions or conclusions in the rules that involve specific physical or virtual network elements (such as AMF, SMF, routers, servers) and their components (such as CPU, memory, interfaces).

[0084] Business processes are rules that are linked to specific telecommunications business processes, such as user registration, handover, and session establishment. Their health is reflected through KPIs (such as success rate and latency).

[0085] The failure mode is: the conclusion of the rule directly points to the typical failure scenario or root cause category that has been summarized, such as "hardware resource overload", "software process dead", "configuration error", "link congestion", etc.

[0086] Examples of specific IF-THEN rules are as follows: IF user registration success rate drops significantly (business process) and server (network equipment) CPU usage is high; THEN signaling surge leads to signaling processing congestion due to CPU resource exhaustion (failure mode). It should be noted that the above is merely an illustrative example. In practical applications, the IF-THEN rule needs to be set based on actual needs and is often more complex.

[0087] In some embodiments, the network repair operation includes at least one of the following: elastic scaling of resources for the target network element, restarting the service process, adjusting the network load balancing strategy, issuing key parameter configurations, or triggering network slice reconfiguration.

[0088] "Network repair operations" are a series of automated, specific instructions or scripts designed to directly intervene in the network state to eliminate diagnosed root causes. These operations act as the "executors" in the intelligent operations and maintenance closed loop, translating diagnostic decisions into actual network changes. Specific operation types include, but are not limited to, one or more combinations of the following: 1. Perform elastic scaling of resources on the target network element: Operation Explanation: This refers to dynamically adjusting the virtualized computing resources (such as the number of vCPU cores and memory size) or storage resources of the core network software (i.e., "network elements", such as AMF, SMF, UPF) based on real-time load requirements.

[0089] Implementation: The system sends scaling-out / scale-up or scaling-in / scale-down commands to the virtual machines or containers hosting the target network elements by calling the application programming interface (API) of the cloud management platform (such as OpenStack, Kubernetes) or the Virtualization Infrastructure Manager (VIM).

[0090] Application scenario example: When the root cause of the diagnosis is "AMF network element CPU resource overload", the system automatically triggers the operation of increasing the CPU resource quota of the AMF virtual machine to improve its signaling processing capability.

[0091] 2. Restart the service process: Operation Explanation: This refers to the operation of stopping and then restarting a specific software service process running on a network element. This is a classic recovery method used to resolve process-level failures caused by software defects, memory leaks, or temporary freezes.

[0092] Implementation method: The system sends a command to the target server through Secure Shell Protocol (SSH) or network element management interface to first terminate (Kill) the specified faulty process, and then restart (Start) the process according to the startup script.

[0093] Application scenario example: When the root cause of the diagnosis is "the session management process of the SMF network element is unresponsive", the system automatically triggers a forced restart of the process to restore the session management function.

[0094] 3. Adjust the network load balancing strategy: Operation Explanation: This refers to modifying the configuration of load balancing devices or software to change the distribution ratio or routing rules of service traffic (such as user requests and signaling connections) among different network element instances.

[0095] Implementation: The system updates the parameters of the load balancing algorithm (such as round-robin or weighted), the weight of the backend server pool, or the health check threshold by calling the configuration API of the load balancer (such as Nginx, F5, or the load balancing service of a cloud service provider).

[0096] Application scenario example: When the root cause of the diagnosis is "overloaded traffic of a certain UPF instance while other UPF instances are lightly loaded", the system automatically adjusts the load balancing strategy to direct more new user sessions to the less loaded UPF instances, thereby achieving traffic diversion.

[0097] 4. Issue key parameter configurations: Operation Explanation: This refers to remotely modifying the operating parameters of network devices or network elements. These parameters directly affect the behavior and performance of the devices, such as timers, buffer sizes, and protocol switches.

[0098] Implementation method: The system sends configuration templates or modification instructions that conform to specific standards to the target network element through the network element management system (EMS) or network configuration protocol (such as NETCONF).

[0099] Application scenario example: When the diagnostic root cause is "signaling timeout due to improper N2 interface timer settings", the system automatically sends configuration updates to the relevant AMF and base station to optimize the N2 interface wait response timer (T-wait) parameters.

[0100] 5. Trigger network slice reconfiguration: Operation Explanation: In environments such as 5G that support network slicing, this refers to adjusting or re-instantiating a logically isolated end-to-end network slice (including access, transmission, and core network resources).

[0101] Implementation: The system triggers the reconfiguration of the subnet management function (such as the core network slice subnet management function NSSMF) of the specified slice through the cross-domain coordinator or network slice management system (CSMF / NSMF), which may involve the reallocation of resources or the adjustment of slice templates.

[0102] Application scenario example: When the root cause of the diagnosis is "insufficient core network resources of the slice serving a certain vertical industry, resulting in a decline in service quality", the system automatically triggers the expansion process for that slice or temporarily adjusts the resource quota strategy of the slice.

[0103] In summary, the network repair operations described above cover multiple levels, from underlying resources and software processes to high-level business strategies and network architecture. By automating the correlation and execution of these operations with root cause diagnosis results, this invention achieves a complete closed loop from "problem discovery" to "problem resolution," significantly improving the automation level and response speed of core network operations and maintenance. This is a key technological step in achieving the goal of network self-healing.

[0104] The system embodiments of this application can be used to execute the method embodiments of this application. For details not disclosed in the system embodiments of this application, please refer to the method embodiments of this application.

[0105] Figure 2 The diagram shown is a block diagram of an intelligent operation and maintenance system for a core network provided in one embodiment of this application. Figure 2 As shown, the system includes: An intelligent operation and maintenance system for a core network, used to implement the above method, includes: The data acquisition layer 21 is configured to collect multi-dimensional time-series data from core network elements, including key performance indicators (KPIs), signaling process logs, and system resource utilization, and perform cleaning and standardization processing. The data analysis layer 22 is configured to identify primary abnormal events based on the monitoring of multi-dimensional time-series data of the core network, and automatically associate at least one other dimension indicator that is adjacent to the primary abnormal event in the time domain and has a preset correlation relationship, thereby generating a multi-dimensional abnormal feature vector. The diagnostic decision layer 23 is configured to input the multidimensional abnormal feature vector into the diagnostic decision model, wherein the diagnostic decision model performs reasoning by fusing an inter-indicator causal network learned from historical data with preset domain knowledge rules, and outputs the root cause localization result of the primary abnormal event. The operation and maintenance execution layer 24 is configured to automatically trigger and execute targeted network repair operations based on the root cause localization results, and verify the operation and maintenance closed loop based on the data feedback after repair.

[0106] In some embodiments, the data analysis layer includes: A time-series anomaly detection unit is used to identify the primary anomaly events from the multi-dimensional time-series data; The causal association unit is used to access the stored causal network between the indicators and perform the "automatic association".

[0107] In some embodiments, the diagnostic decision layer includes: A probabilistic inference unit is used to run a probabilistic graphical model constructed based on the causal network between the indices; The rule reasoning unit is used to load and run the domain knowledge rules.

[0108] The solution provided in this application will be described below with reference to specific embodiments: The data acquisition layer is responsible for collecting key indicator information from core network devices, including KPIs of core network services (such as mobile user registration success rate, average mobile user traffic, and number of online mobile users), system operation log files, operation log files of various service processes, failure observation files, etc., and writing the raw data into the time series database after data cleaning. The data analysis layer performs multi-dimensional correlation and intelligent analysis based on time-series data. For example, based on the preset KPI threshold detection, it finds that the mobile user registration success rate KPI indicator is below the threshold at the current moment. Then, it automatically correlates and detects other dimension indicators, such as checking whether the user context resources of each network element (AMF / SMF / UDM / AUSF) related to the user registration process exceed the threshold, analyzing whether the network card packet loss rate and network card traffic fluctuation are abnormal, analyzing whether the message ratios (response message count / request message count) of each core network signaling plane N2 interface / Sbi interface are normal, and analyzing the physical resource CPU / memory / disk I / O status of each network element (AMF / SMF / UDM / AUSF). The diagnostic decision layer, based on multi-dimensional correlated feature data, combines root cause analysis with a root cause reasoning engine to perform root cause analysis. It assigns a "suspicion score" to each anomaly, inputs it into the diagnostic chain for root cause localization and sorting, and finally obtains the root cause of the problem and remediation suggestions. For example, if a low mobile user registration success rate is detected first, then other abnormal indicators near this event point are identified through multi-dimensional correlation: "AMF network element service virtual machine CPU utilization spikes," and "AMF network element N2 interface signaling plane messages contain unresponsive and discarded messages." No anomalies are detected in other surrounding network elements (SMF / UDM / AUSF) near this time point. Further reasoning based on pre-set expert rules leads to the conclusion that "AMF network element N2 interface signaling surge causes signaling congestion." The final report states: At a certain moment, in a certain area, there may be a large-scale event, leading to a surge in the number of mobile users covered in that area. The AMF network element N2 interface responsible for that area receives a surge in signaling, resulting in "N2 interface signaling plane message congestion." Based on the root cause of the fault and the pre-configured rule engine, the operation and maintenance execution layer performs AMF network element service virtual machine expansion operations to increase the number of CPUs to cope with the growth in the number of users.

[0109] Below, for reference Figure 3 This describes an electronic device according to embodiments of the present application. Figure 3 A block diagram of an electronic device according to an embodiment of this application is illustrated.

[0110] like Figure 3 As shown, the electronic device 300 includes one or more processors 310 and memory 320.

[0111] The processor 310 may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 300 to perform desired functions.

[0112] The memory 320 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 310 may execute the program instructions to implement the intelligent operation and maintenance method of the core network of the various embodiments of this application described above, and / or other desired functions. Various contents, such as category correspondence, may also be stored in the computer-readable storage medium.

[0113] In one example, the electronic device 300 may also include an input device 330 and an output device 340, which are interconnected via a bus system and / or other forms of connection mechanism (not shown).

[0114] In addition, the input device 330 may also include, for example, a keyboard, mouse, interface, etc. The output device 340 can output various information to the outside, including analysis results, etc. The output device 340 may include, for example, a display, speaker, printer, and communication network and its connected remote output devices, etc.

[0115] Of course, for the sake of simplicity, Figure 3 Only some of the components of the electronic device relevant to this application are shown in this illustration; components such as buses, input / output interfaces, etc., are omitted. In addition, the electronic device may include any other suitable components depending on the specific application.

[0116] In addition to the methods and devices described above, embodiments of this application may also be computer program products, which include computer program instructions that, when executed by a processor, cause the processor to perform the steps in the intelligent operation and maintenance method of the core network according to various embodiments of this application described in the "Exemplary Methods" section of this specification.

[0117] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of this application. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0118] Furthermore, embodiments of this application may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps in the intelligent operation and maintenance method of the core network according to various embodiments of this application described in the "Exemplary Methods" section above.

[0119] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0120] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this application to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A method for intelligent operation and maintenance of a core network, characterized in that, Includes the following steps: Multi-dimensional time-series data, including key performance indicators (KPIs), signaling process logs, and system resource utilization, are collected from core network elements and then cleaned and standardized. Based on the monitoring of multi-dimensional time-series data of the core network, primary abnormal events are identified, and at least one other dimension indicator that is adjacent to the primary abnormal event in the time domain and has a preset correlation relationship is automatically associated to generate a multi-dimensional abnormal feature vector. The multidimensional abnormal feature vector is input into the diagnostic decision model, wherein the diagnostic decision model performs reasoning by fusing an inter-indicator causal network learned from historical data with pre-set domain knowledge rules, and outputs the root cause localization result of the primary abnormal event. Based on the root cause location results, targeted network repair operations are automatically triggered and executed, and the operation and maintenance closed loop is verified based on the data feedback after the repair.

2. The method according to claim 1, characterized in that, The automatic association specifically involves: based on the pre-constructed causal network between indicators, identifying other indicator nodes that have a strong causal relationship with the indicator node corresponding to the primary abnormal event, and integrating the state change information of the other indicator nodes within a preset time window into the multidimensional abnormal feature vector.

3. The method according to claim 2, characterized in that, The causal network between indicators is obtained by training historical operation and maintenance data using causal discovery algorithms, including gradient-based acyclic graph structure learning algorithms, PC algorithms, or Granger causality test algorithms.

4. The method according to claim 1, characterized in that, The inference process, which integrates the causal network between indicators learned from historical data with pre-defined domain knowledge rules, includes: Using the probabilistic graphical model constructed from the causal network between the indicators, the first confidence level of each potential root cause node is calculated; Using the domain knowledge rules, logical reasoning is performed based on the multidimensional anomaly feature vector to generate the second confidence level or constraint condition for each potential root cause node. By combining the first confidence level with the second confidence level or constraints, the final root cause localization result and remediation recommendations are determined.

5. The method according to claim 1 or 4, characterized in that, The domain knowledge rules include IF-THEN rules used to characterize the logical relationships between network devices, business processes, and failure modes.

6. The method according to claim 1, characterized in that, The network repair operation includes at least one of the following: elastic scaling of resources for the target network element, restarting the service process, adjusting the network load balancing strategy, issuing key parameter configurations, or triggering network slice reconfiguration.

7. An intelligent operation and maintenance system for a core network, used to implement the method as described in any one of claims 1 to 6, characterized in that, include: The data acquisition layer is configured to collect multi-dimensional time-series data from core network elements, including key performance indicators (KPIs), signaling process logs, and system resource utilization, and then perform cleaning and standardization processing. The data analysis layer is configured to identify primary abnormal events based on the monitoring of multi-dimensional time-series data of the core network, and automatically associate at least one other dimension indicator that is adjacent to the primary abnormal event in the time domain and has a preset correlation relationship, thereby generating a multi-dimensional abnormal feature vector. The diagnostic decision layer is configured to input the multidimensional abnormal feature vector into the diagnostic decision model, wherein the diagnostic decision model performs reasoning by fusing an inter-indicator causal network learned from historical data with pre-set domain knowledge rules, and outputs the root cause localization result of the primary abnormal event. The operation and maintenance execution layer is configured to automatically trigger and execute targeted network repair operations based on the root cause localization results, and verify the operation and maintenance closed loop based on the data feedback after the repair.

8. The system according to claim 7, characterized in that, The data analysis layer includes: A time-series anomaly detection unit is used to identify the primary anomaly events from the multi-dimensional time-series data; A causal association unit is used to access the stored causal network between the indicators and perform the automatic association.

9. The system according to claim 7, characterized in that, The diagnostic decision layer includes: A probabilistic inference unit is used to run a probabilistic graphical model constructed based on the causal network between the indices; The rule reasoning unit is used to load and run the domain knowledge rules.

10. An electronic device comprising a processor and a memory, wherein the memory stores a computer program, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 6.

Images