Network anomaly root cause positioning method, storage medium and computer program product

Abstract

The invention provides a network abnormal root cause positioning method, a storage medium and a computer program product, and further determines a state space based on time sequence format data by determining a time sequence format of a detection point data set. Therefore, on the basis of the time sequence format data and the state space, index parameters for evaluating the network behavior chaos condition of the detection points are determined. Therefore, early recognition can be carried out before the network exception develops to a serious stage. Meanwhile, root cause analysis is performed in combination with the abnormal root cause prediction model, so that the recognition of complex network behaviors can be improved, and the root of network anomaly can be more accurately positioned.

Description

Technical Field

[0001] This disclosure relates to the field of network anomaly detection technology, and in particular to a method for locating the root cause of network anomalies, a storage medium, and a computer program product. Background Technology

[0002] Currently, the field of network anomaly detection and root cause analysis mainly includes several key aspects: network monitoring tools, anomaly detection algorithms, and basic root cause analysis methods. These technologies rely on set thresholds, statistical models, and simple machine learning methods to identify and respond to anomalous states in the network. While these technologies have improved the automation and intelligence of detection to some extent, they still suffer from shortcomings such as insufficient accuracy and limited understanding of complex network behavior. Summary of the Invention

[0003] This disclosure provides a method for locating the root causes of network anomalies, a storage medium, and a computer program product. By utilizing the time-series format and state space of a data set, an anomaly root cause prediction model is generated, thereby achieving accurate identification of abnormal network behavior.

[0004] In one aspect, this embodiment provides a method for locating the root causes of network anomalies. The method includes: determining the time series format of the data set of each of multiple detection points, wherein the time series format is used to determine at least one or more of a chaos score and a dynamic fluctuation index; performing attractor reconstruction on the time series format of the data set of each detection point to determine the state space of each detection point, wherein the state space is used to determine at least one or more of a chaos metric, a threshold abnormal state index, and a dynamic instability index; and generating an anomaly root cause prediction model, wherein the anomaly root cause prediction model is determined at least based on the chaos score, the dynamic fluctuation index, the chaos metric, the threshold abnormal state index, and the dynamic instability index, and the anomaly root cause prediction model is used at least to predict the root causes of network anomalies.

[0005] In embodiments of this disclosure, the method further includes: acquiring data parameters for each detection point, wherein the data parameters include at least one or more of the following: small fluctuation pattern parameters, short latency change parameters, encrypted traffic statistical characteristic parameters, irregular data packet interval time parameters, and system status information data parameters; and constructing a dataset for each detection point based on the data parameters.

[0006] In embodiments of this disclosure, determining the time series format of the data set for each detection point among multiple detection points includes: extracting the data set of all detection points at each time point to form an initial time series set; determining the amount of change in data parameters at adjacent time points based on the initial time series set; and determining the time series format of each detection point based on the amount of change in the data sets at multiple adjacent time points.

[0007] In embodiments of this disclosure, attractor reconstruction is performed on the time-series format of each detection point dataset to determine the state space of each detection point, including: determining the embedding dimension and delay time; determining multiple state space reconstruction vectors for the time-series format of each detection point based on the embedding dimension and delay time; and determining the state space of each detection point based on the multiple state space reconstruction vectors of each detection point, wherein the threshold abnormal state index is determined at least by the degree of deviation of the state space from the set of normal behavior patterns.

[0008] In embodiments of this disclosure, the method further includes: determining multiple Lyapunov characteristic indices for each detection point based on the state space; determining a dynamic stability value based on the multiple Lyapunov characteristic indices; and determining a dynamic instability index based on the magnitude of the dynamic stability value and a preset stability value.

[0009] The process of generating an anomaly root cause prediction model includes: using chaos score, dynamic fluctuation index, chaos metric, threshold anomaly state index, and dynamic instability index as training feature data; determining normal mode labels and anomaly mode labels, wherein the anomaly mode labels include one or more of the dynamic fluctuation index, chaos metric, threshold anomaly state index, and dynamic instability index that are not within a preset range; and training a supervised learning model based on the training feature data to generate the anomaly root cause prediction model.

[0010] In embodiments of this disclosure, the method further includes: acquiring real-time data parameters for each detection point, wherein the real-time data parameters include at least one or more of the following: small fluctuation pattern parameters, short latency change parameters, encrypted traffic statistical characteristic parameters, irregular data packet interval time parameters, and system status information data parameters; determining one or more of the following for each detection point: chaos score, dynamic fluctuation index, chaos metric value, threshold abnormal state index, and dynamic instability index, based on the real-time data parameters; and predicting network anomaly root causes in real time using the real-time data parameters and the anomaly root cause prediction model.

[0011] In the embodiments of this disclosure, real-time prediction of network anomaly root causes is carried out using real-time data parameters and an anomaly root cause prediction model, including: determining the root cause result of the prediction result based on real-time data parameters, prediction results, root cause set, and root cause probability, wherein the root cause set includes multiple root cause information; and generating a root cause anomaly report based on the root cause result, wherein the root cause anomaly report includes at least the anomaly type, root cause information, impact scope, and response measures.

[0012] In another aspect, embodiments of this disclosure provide a non-transitory computer-readable storage medium for storing computer-readable instructions that, when executed by a processor, cause the processor to perform a network anomaly root cause localization method.

[0013] In another aspect, embodiments of this disclosure provide a computer program product, including a computer program that, when executed by a processor, implements the above-described method for locating the root cause of network anomalies. Attached Figure Description

[0014] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0015] Figure 1 The schematic diagram illustrates an environmental application according to an embodiment of the present disclosure.

[0016] Figure 2 The flowchart illustrating a method for locating the root cause of network anomalies according to an embodiment of the present disclosure is shown in the illustration.

[0017] Figure 3 A flowchart illustrating the determination of a time series format according to an embodiment of the present disclosure is shown.

[0018] Figure 4 A flowchart illustrating the determination of the state space according to an embodiment of the present disclosure is shown schematically.

[0019] Figure 5 A schematic diagram illustrating the generation of anomaly root cause prediction models according to embodiments of the present disclosure is provided.

[0020] Figure 6 The flowchart of another network anomaly root cause localization method according to an embodiment of the present disclosure is illustrated.

[0021] Figure 7 A block diagram illustrating a non-transitory computer-readable storage medium according to an embodiment of the present disclosure is shown.

[0022] Figure 8 A block diagram illustrating a computer program product according to an embodiment of the present disclosure is shown schematically. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this disclosure more apparent, exemplary embodiments according to this disclosure will now be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments of this disclosure. It should be understood that this disclosure is not limited to the exemplary embodiments described herein.

[0024] Figure 1The schematic diagram illustrates an environmental application according to an embodiment of the present disclosure.

[0025] like Figure 1 As shown, it includes a computing network device 101 and multiple detection network devices 102. The computing network device 101 and the multiple detection network devices 102 can perform real-time data transmission.

[0026] Multiple detection network devices 102 can be network devices located in critical positions within the network system, such as servers and routers. The detection network devices 102 can collect raw data (traffic, latency, connectivity, etc.) from critical network locations and send it to the computing network device 101.

[0027] The computing network device 101 can receive data sets sent by multiple detection network devices 102, convert the data sets into a time-series format, and reconstruct the state space of each detection network device 102 using the time-series format. This allows it to determine multiple evaluation metrics that reflect the chaotic state of the network behavior of the detection network devices 102 using the time-series format and state space. Simultaneously, the computing network device 101 can also use an anomaly root cause prediction model to predict the real-time data of each detection network device 102 and generate a root cause anomaly report based on the prediction results. The computing network device 101 can be a network device with computing capabilities, such as a server or edge computing node.

[0028] Next, this article will combine Figures 2-6 This paper provides a detailed introduction to the network anomaly root cause localization method applied to computing network device 101.

[0029] Figure 2 The flowchart illustrating a method for locating the root cause of network anomalies according to an embodiment of the present disclosure is shown in the illustration.

[0030] like Figure 2 As shown, a network anomaly root cause localization method according to an embodiment of this disclosure includes S201, S202, and S203: S201. Determine the time series format of the data set for each of the multiple detection points, wherein the time series format is used to determine at least one or more of the chaos score and dynamic fluctuation index.

[0031] In the embodiments of this disclosure, a detection point can refer to a specific location / device / metric collection node used to collect network operation data. Through detection points, raw information about the network status (such as traffic, latency, load, etc.) can be continuously collected. Monitoring data from key locations in the network can be used as detection points, such as core switches, egress routers, important server nodes, both ends of a communication link, request and response nodes of a certain service, etc.

[0032] In the embodiments of this disclosure, the detection points can be monitored in real time, such as acquiring the network data of each detection point, as described above. Figure 2 The method also includes: acquiring data parameters for each detection point, including at least one or more of the following: small fluctuation pattern parameters, short latency change parameters, encrypted traffic statistical characteristic parameters, irregular data packet interval time parameters, and system status information data parameters; and constructing a dataset for each detection point based on the data parameters.

[0033] In embodiments of this disclosure, a monitoring algorithm can be deployed at each detection point to collect data parameters at each detection point. For example, parameters related to minute fluctuation patterns. Traffic analysis techniques can be used to collect and monitor subtle changes and small fluctuations in network traffic over a short period of time. It can be determined using the following formula:

[0034] in, This represents the flow rate measured at time t for the j-th time. This is the average traffic value. For example, deploying network probes on core switches can detect the traffic volume of internal core servers and calculate traffic fluctuations within a fixed detection period.

[0035] For example, short-delay variation parameters This can be collected using network latency measurement technology to record the latency changes of each data packet transmission, including short-term latency variation parameters. It can be determined using the following formula:

[0036] in, This represents the transmission delay of the j-th data packet. For example, when probing core network services using the Internet Control Message Protocol (ICMP), the transmission delay time of a single data packet can be statistically analyzed, and the change in transmission delay within a fixed probing period can be calculated.

[0037] For example, encrypted traffic statistical characteristic parameters Encrypted traffic can be collected using encrypted traffic identification technology and used to analyze its statistical characteristics and statistical feature parameters. It can be determined using the following formula:

[0038] in, is the encrypted traffic characteristic value measured at time t, and p is the number of encrypted traffic characteristics. For example, when deploying probes on a core firewall, the percentage of encrypted traffic packets is counted, and the percentage of encrypted traffic within a fixed probe period is calculated.

[0039] For example, the irregular data packet interval parameter This can be determined by analyzing the time intervals between data packet arrivals, and is used to identify irregular interval patterns. The irregular data packet interval parameter is... It can be determined using the following formula:

[0040] Among them, t l is the arrival time of the l-th data packet, is the average arrival time of data packets, and q is the number of data packets measured. For example, deploying network probes on a core switch to monitor the interval between HTTP data packet responses from the core web server and calculating the standard deviation of the interval.

[0041] For example, system status information data parameters This can be determined by collecting network-related system status information, including CPU utilization and memory usage, and system status information data parameters. It can be determined using the following formula:

[0042] in, This represents the s-th system state index at time t. Here, r represents the corresponding weights, and r is the number of system status indicators. For example, when monitoring CPU and memory thresholds for a core switch, the weights are 0.6 and 0.4 respectively, to calculate the current device load status.

[0043] By collecting different data parameters from different detection points, a dataset for each detection point is constructed. Furthermore, this dataset can be converted into a time-series format. The time-series format involves binding each data point to a corresponding timestamp and then arranging the data in the dataset in chronological order to form an ordered time-data sequence. For example, the traffic data from detection point 1, after being sorted by timestamp, yields the sequence X1, X2, ..., Xt, where Xt is the traffic value at detection point t. Similarly, the delayed time-series data from detection point 2, after being sorted by timestamp, yields the sequence A1, A2, ..., At, where At is the delayed time-series value at detection point t.

[0044] For example, a dataset can be constructed using time series methods for the data collected at each detection point. Furthermore, the data set from all detection points... Summarize and form a network dataset The network dataset integrates comprehensive data collected from various detection points in the network at different time points. The dataset includes... and network datasets They can be expressed by the following formulas:

[0045]

[0046] Each of them This represents the data set of the i-th detection point at time t; The above data parameters.

[0047] In the embodiments of this disclosure, time series analysis methods are applied, and each detection point independently generates time series format data. This time series format data can be used to detect chaotic characteristics in network behavior. It is understood that the denser the detection points, the more precise the monitoring of the network state.

[0048] Figure 3 A flowchart illustrating the determination of a time series format according to an embodiment of the present disclosure is shown.

[0049] like Figure 3 As shown, S201 includes S301, S302, and S303: S301. Extract the data set of all detection points at each time point to form an initial time series set.

[0050] Prior to S201, nonlinear dynamic system analysis techniques can be used to clean and format the collected network dataset. The preprocessed network dataset is then converted into a time-series format.

[0051] In embodiments of this disclosure, preprocessed network datasets can be used. Extract the dataset of all detection points at each time point t. This forms the initial time series set, thus creating an ordered sequence of time-data. The initial time series set can be determined by the following formula:

[0052] in, This represents the initial time series set at time t, where n is the total number of detection points.

[0053] S302. Based on the initial time series set, determine the changes in data parameters at adjacent time points.

[0054] For a given detection point, the data set at each time point can be obtained from the initial time series set. Then calculate the difference between the data set at each time point t and the data set at the previous time point t-1, for example... This yields the change between adjacent time points. It's understandable that calculating the difference here refers to the difference between two adjacent time points for the same detection point and the same type of data parameters (such as CPU utilization or port traffic).

[0055] S303. Determine the time series format for each detection point based on the changes in data sets at multiple adjacent time points.

[0056] For a given monitoring point, the time series format can be determined by the changes in data sets from multiple adjacent time points and by the data sets at multiple time points. For example, the time series format can be determined using the following formula:

[0057] in, This represents the time series converted from the i-th detection point; and These are weighting coefficients, which respectively reflect the importance of the original data parameters in time series analysis and the importance of the data change in time series analysis; express and The difference between them is used to represent the amount of change in a data set at adjacent time points.

[0058] According to embodiments of this disclosure, by fusing the original dataset and data change trends of a single detection point, a time series that better reflects the dynamic characteristics of the network can be generated. By adding the changes between adjacent time points, both the numerical value at the current time and the information on the data change trend are preserved. Furthermore, by using weighting coefficients, different features can be emphasized according to actual needs. For example, to more sensitively capture subtle fluctuations in the data (such as early signs of anomalies), the weighting coefficient can be increased. accomplish.

[0059] In S201 above, the time series format can be used to determine at least one or more of the chaos score and dynamic fluctuation index. The chaos score can be used to quantify the chaotic characteristics of the network behavior at the detection point; the higher the chaos score, the more chaotic and closer to a chaotic state the network behavior at this detection point is. The chaos score can be determined by the following formula:

[0060] in, Let T represent the chaos score of the time series at the i-th detection point, used to quantify the chaotic characteristics of the time series, where T is the total length of the time series. It is the derivative of a time series, reflecting the rate of change of the time series over time.

[0061] Using time series Time series analysis allows us to analyze the chaotic characteristics of network behavior. For example, observing and analyzing multiple chaos scores over a long period helps identify dynamic changes within the system, such as periodicity, quasi-periodicity, and chaos. For instance, if network behavior is stable / periodic (e.g., traffic fluctuates regularly every 10 seconds), the rate of change in the time series will be relatively stable, the absolute value of the derivative will be small, and the final chaos score will be relatively low. Conversely, if network behavior is chaotic / irregular (e.g., traffic fluctuates suddenly and drastically, or the rate of change is inconsistent), the absolute value of the derivative of the time series will frequently increase, and the final chaos score will also be significantly higher.

[0062] Dynamic volatility index can quantify the time series of the detection point. The dynamic fluctuation characteristic of a network can be used to intuitively reflect the degree of fluctuation, nonlinearity, and chaotic nature of network behavior. The dynamic fluctuation index can be determined by the following formula:

[0063] in, This represents the dynamic fluctuation index of the time series at the i-th detection point.

[0064] When the dynamic volatility index is small, it indicates that the time series... The continuous change in a time series is small relative to the overall scale, indicating gentle fluctuations (e.g., periodic or quasi-periodic stable network behavior). A large value indicates a large continuous change relative to the overall scale, indicating drastic fluctuations (e.g., nonlinear or chaotic network behavior, often a precursor to or indicating anomalies). The dynamic volatility index compares the changes in a time series at consecutive points in time with the overall time series value by comparing relative volatility intensity. It considers both the amplitude of the fluctuations and the scale of the series itself, providing a more objective reflection of the degree of volatility in network behavior and thus aiding in the assessment of nonlinear and chaotic characteristics.

[0065] According to embodiments of this disclosure, since chaotic characteristics (such as trajectory divergence and periodicity) are dynamic manifestations of network behavior evolving over time, they must be captured based on time series data. Therefore, by converting the dataset of detection points into a time series format, data with temporal sequence and continuity can be input for subsequent time series analysis (such as determining chaos scores and dynamic fluctuation indices) and state space reconstruction. Compared to traditional monitoring that only looks at the surface patterns of data (such as average flow and whether thresholds are exceeded), the method provided by embodiments of this disclosure performs time series analysis on datasets in time series format, allowing for in-depth analysis of the dynamic patterns of data changes over time (such as whether there is a fixed period, an approximate period, or completely irregular chaotic fluctuations). Through in-depth analysis, potential network anomalies or unstable signals that are invisible to traditional methods can be discovered more accurately.

[0066] S202. Perform attractor reconstruction on the time series format of the data set for each detection point to determine the state space of each detection point. The state space is used to determine at least one or more of the following: chaotic metric, threshold abnormal state index, and dynamic instability index.

[0067] In the embodiments of this disclosure, attractor reconstruction techniques can be used to reconstruct the state space of a network system from time-series data. Analysis of the state space reveals the network's inherent dynamic structure, including chaotic characteristics and anomalous patterns. For example, attractor reconstruction techniques can be used to reconstruct the state space of time-series data. This is transformed into a high-dimensional state space. For example, a high-dimensional state space can reveal chaotic characteristics: trajectories in a high-dimensional state space will exhibit the shape of "chaotic attractors" (such as complex curves resembling butterfly wings), thus directly identifying chaotic properties. Another example is the discovery of anomalous patterns: the state space trajectory of a normal network will stabilize within a certain "attractor region," and if the trajectory suddenly deviates from this region (such as shape deformation or scattering), it is an anomalous signal. Furthermore, a high-dimensional state space can reveal the inherent dynamic structure: the hidden dynamic laws of the network, such as periodicity and nonlinearity, can be intuitively presented through the trajectory in high-dimensional space, providing a better understanding of the network's true operating state than simply looking at a one-dimensional sequence.

[0068] Figure 4 A flowchart illustrating the determination of the state space according to an embodiment of the present disclosure is shown schematically.

[0069] like Figure 4 As shown, the above S202 includes S401, S402 and S403: S401. Determine the embedding dimension and delay time.

[0070] In embodiments of this disclosure, a time-series format for the data set can be selected. As the foundational data, time-series data for each detection point Perform attractor reconstruction. Consider the embedding dimension *m* and the delay time. The key to whether the reconstruction can accurately reflect the dynamic characteristics of the system is that the embedding dimension *m* is the dimension of the state space. The core is to ensure that the reconstructed space can fully represent the dynamic structure of the system, including the delay time. When constructing a high-dimensional vector, the embedding dimension *m* represents the time interval between adjacent data points. The core principle is to ensure that the delayed sequence retains the dynamic correlation of the system. The embedding dimension *m* can be determined using the pseudo-nearest neighbor method or other methods, and the delay time... The average mutual information method or the autocorrelation method can be used to determine it, and there is no restriction here.

[0071] S402. Based on the embedding dimension and delay time, determine multiple state space reconstruction vectors in time series format for each detection point.

[0072] A single detection point can compute one (or more) state-space reconstruction vectors, which can be determined by the following formula:

[0073] in, Represents the i-th detection point (d i The set of all state space reconstruction vectors of the detection point corresponds to all trajectory data in the state space of the detection point. Represents the time series at this detection point The data corresponding to the t-th time point. Represents the time series at this detection point The Middle Data corresponding to each time point. That is, from time point... From the beginning to the end, each time point t corresponds to a state-space reconstruction vector, and t can be represented as a time series. The length. That is, the time series from the detection point The values ​​at different times are extracted and combined to form a high-dimensional vector group.

[0074] S403. Based on multiple state space reconstruction vectors for each detection point, determine the state space of each detection point, wherein the threshold abnormal state index is determined at least by the degree of deviation between the state space and the set of normal behavior patterns.

[0075] By weighting the reconstructed state space vectors at different times and then merging them into a complete state space, the state space can more accurately reflect the dynamic structure of the network. The state space of the detection point can be determined by the following formula:

[0076] in, The reconstructed state space for the i-th detection point is a high-dimensional space set, where each point corresponds to the state of the network at a specific time. For the direct sum operation of vector space, it is to concatenate m state space reconstruction vectors (with embedding dimension of m) with different delays into a higher-dimensional space structure (equivalent to merging multiple subspaces into a complete state space). For the i-th detection point at time The state-space reconstruction vector (j is the delay step size, (This is the delay time). This is the Hadamard product. This is a weight coefficient vector that is dynamically adjusted based on network behavior, used to control the importance of the state space reconstruction vector at different delay times in the state space.

[0077] In the embodiments of this disclosure, chaos metrics, threshold anomalous state indices, and dynamic instability indices can also be determined based on the state space. The state space allows for the analysis of the dynamic behavior of network systems, such as attractor identification and chaotic dynamics feature analysis. It also enables the identification of abnormal network behavior patterns and the quantitative evaluation and classification of chaotic characteristics of network behavior.

[0078] For example, in the reconstructed state space, attractors can be identified first: observe the long-term distribution of trajectories in the state space; if the trajectories eventually converge to a complex, non-repeating fractal region, this can be identified as a chaotic attractor. Then, for the identified chaotic attractors, corresponding chaos quantification indicators are calculated, such as the chaos score mentioned above, and the chaos metric value here. These indicators reflect the degree of chaos, ultimately enabling the analysis of the network's dynamic behavior. The chaos metric value can be determined using the following formula:

[0079] in, This represents the chaos metric, specifically the degree of chaos at the i-th detection point. Is The Jacobian matrix at a given point is used to analyze the local dynamic characteristics of the system near that point.

[0080] The threshold anomaly index refers to the identification of whether the network behavior of a single detection point constitutes an anomalous pattern. The threshold anomaly index is determined by the degree of deviation of the state space from the set of normal behavior patterns. The threshold anomaly index can be determined using the following formula:

[0081] in, This represents the threshold abnormality index of the i-th detection point, and the final output is the judgment result of abnormal / normal (e.g., 0 represents normal and 1 represents abnormal). It is a threshold function used to determine whether network behavior is abnormal. It compares the "average deviation" of the input with a preset abnormal threshold. If it exceeds the threshold, it is judged as abnormal; otherwise, it is judged as normal. It is a comparison function used to measure the actual state space against the set of normal behavior patterns. The degree of deviation is the greater the deviation, the less the current state conforms to the normal pattern. N is the length of the observation time window.

[0082] In embodiments of this disclosure, Figure 2 The method also includes: determining multiple Lyapunov feature indices for each detection point based on the state space; determining dynamic stability values ​​based on the multiple Lyapunov feature indices; and determining dynamic instability indices based on the magnitude of the dynamic stability values ​​and preset stability values.

[0083] The Lyapunov exponent is a core indicator used to describe the dynamic characteristics of attractors, directly reflecting the evolution of trajectories within the attractor. When the Lyapunov exponent is negative, it indicates that adjacent trajectories within the attractor gradually converge, and the system behaves stably and regularly. When at least one Lyapunov exponent is positive, it indicates that adjacent trajectories within the attractor diverge rapidly (reflecting the sensitivity of chaotic systems to initial conditions). When all Lyapunov exponents are negative, it indicates that adjacent trajectories converge to the same point, and the system is in a completely stable state.

[0084] Reconstructed network system state space As the foundational data for analysis, the Lyapunov exponent is calculated by combining the divergence velocities of adjacent trajectories in the state space. By calculating the Lyapunov exponents of attractors in the network system's state space, the stability of the system's behavior can be identified, and potential network anomalies can be predicted. The Lyapunov exponent can be determined using the following formula:

[0085] in, This represents the local segregation rate of the state space between time t and t+k. Let represent the Lyapunov exponent of the state space of the i-th detection point, and represent the average exponential separation rate of adjacent trajectories, used to measure the system's dynamic sensitivity (whether it is chaotic) and stability; m is the embedding dimension of the state space. It should be noted that a detection point can have multiple Lyapunov exponents calculated, that is, a detection point will correspond to a number of Lyapunov exponents equal to the dimension of the state space, and these exponents together characterize the dynamic behavior of the detection point.

[0086] Furthermore, the dynamic stability value of a detection point can be determined by using multiple Lyapunov exponents at that detection point. The dynamic stability value is a quantitative indicator of the stability of network behavior at a single detection point, transforming the complex combination of Lyapunov exponents into an intuitive judgment criterion. The dynamic stability value can be determined using the following formula:

[0087] in, Denotes the Lyapunov exponent in the nth dimension. It is the weight of that dimension. It is a sigmoid non-linear activation function used to map a weighted Lyapunov exponent onto a stability index, where N is the dimension of the state space. As can be seen from the above formula, the dynamic stability value is obtained by weighted summation of the Lyapunov exponents in each dimension and then mapping using the sigmoid function. If the dynamic stability value is close to 1, it indicates that the system's trajectory converges in most dimensions (the Lyapunov exponents are mostly negative), and the network behavior is more stable; if the dynamic stability value is close to 0, it indicates that the system's dimensional trajectory diverges (the Lyapunov exponents are positive), and the network behavior is more chaotic and unstable.

[0088] According to embodiments of this disclosure, calculating the Lyapunov exponents of state-space attractors helps overcome the limitations of traditional techniques that can only detect anomalies retrospectively and cannot provide early warnings: if all Lyapunov exponents are negative, the system is stable; if at least one exponent is positive, the system is unstable (trajectory divergence, corresponding to chaotic behavior). Thus, the network state can be dynamically determined using multiple Lyapunov exponents. Furthermore, before a network anomaly occurs, the system's Lyapunov exponents may gradually approach 0 from negative and then turn positive. Therefore, by monitoring the exponent change trend in real time, a timely warning can be issued when the exponent changes, rather than waiting until the anomaly occurs before detection.

[0089] Furthermore, after calculating the dynamic stability value for each detection point, the network system behavior can be classified based on the magnitude of the dynamic stability value and the preset stability value, identifying dynamic instability indices that may lead to network anomalies. Dynamic instability indices refer to the lack of stable evolutionary patterns in the network system's behavior, exhibiting chaotic, volatile, or unpredictable states. These are typically signals of anomalies or risks, thus requiring identification of dynamic instability indices within the network system. Dynamic instability indices can be determined using the following formula:

[0090] in, It is a preset stability value. The dynamic instability index is a binary indicator. It takes a value of 1 when the system exhibits instability (the dynamic stability value is greater than the preset stability value), indicating that the system's dynamic behavior is unstable and may be chaotic. Otherwise, it takes a value of 0, indicating that the system is relatively stable (the dynamic stability value is less than the preset stability value).

[0091] According to embodiments of this disclosure, chaos score, dynamic fluctuation index, chaos metric, threshold abnormal state index, and dynamic instability index can evaluate the degree of chaos / abnormality of detection points from different aspects and with different emphases, thereby providing guidance for identifying abnormal network states.

[0092] According to embodiments of this disclosure, by reconstructing the state space of detection points, a one-dimensional time series can be upgraded to a multi-dimensional state space. This facilitates the reconstruction of the dynamic evolution trajectory of the network system and uncovers hidden intrinsic patterns beyond the time series alone, providing a foundation for the mining of deep features (chaotic metrics, threshold abnormal state indices, and dynamic instability indices). Simultaneously, the state trajectory of normal network behavior evolves around a "normal attractor," while abnormal behavior causes the trajectory to detach from the attractor or form a new chaotic trajectory. Through this "structural mutation," the distinguishability of abnormal patterns can be improved, and the false positive rate can be reduced.

[0093] S203. Generate an anomaly root cause prediction model. The anomaly root cause prediction model is determined based at least on chaos score, dynamic fluctuation index, chaos metric value, threshold anomaly state index, and dynamic instability index. The anomaly root cause prediction model is used to predict network anomaly root causes at least.

[0094] In S203, network anomaly patterns identified based on chaos theory and corresponding root cause analysis are used to train an improved machine learning model and generate an anomaly root cause prediction model, which can automatically identify network anomalies when similar patterns are detected.

[0095] According to embodiments of this disclosure, by determining the time-series format of the detection point data set, the state space is further determined based on the time-series format data. Thus, based on the time-series format data and the state space, evaluation parameters for assessing the chaotic state of network behavior at multiple detection points are determined. This allows for early identification of network anomalies before they develop into severe stages. Simultaneously, combining this with anomaly root cause prediction models for root cause analysis improves the identification of complex network behaviors and allows for more accurate localization of the root causes of network anomalies.

[0096] Figure 5 A flowchart illustrating the generation of anomaly root cause prediction models according to embodiments of the present disclosure is shown.

[0097] like Figure 5 As shown, the above S203 includes S501, S502 and S503: S501. Use chaos score, dynamic fluctuation index, chaos metric, threshold abnormal state index, and dynamic instability index as training feature data.

[0098] In S501, the chaotic score, chaotic metric, dynamic fluctuation index, threshold abnormal state index, and dynamic instability index of the network time series data of each detection point after processing and evaluation are used as training feature data.

[0099] S502. Determine the normal mode label and the abnormal mode label. The abnormal mode label includes one or more of the following: dynamic fluctuation index, chaos metric value, threshold abnormal state index, and dynamic instability index, which are not within the preset range.

[0100] In S502, normal mode labels and abnormal mode labels can be defined. Normal mode occurs when all indicators (dynamic fluctuation index, chaos metric, threshold abnormal state index, and dynamic instability index) are within the baseline range; abnormal mode occurs when one or more indicators are outside the baseline range. For example, if the dynamic instability index and dynamic fluctuation index of data packet transmission delay are outside the baseline range, it is an abnormal mode, which can be considered a link failure. Normal mode labels and abnormal mode labels can be defined using the following formula: ; Where y represents the label value, used to distinguish between abnormal and normal modes. S503. Train a supervised learning model based on training feature data to generate an anomaly root cause prediction model.

[0101] Using training feature data, supervised learning models, such as Random Forest (to evaluate feature importance) and Long Short-Term Memory (LSTM) algorithms (to capture temporal dependencies), are trained and their loss functions are optimized to generate anomaly root cause prediction models. Specifically, the Random Forest algorithm sets the number of decision trees to n, the maximum depth of a single tree to m, takes the feature matrix X and labels y as input, and outputs a ranking of feature importance (e.g., the dynamic volatility index has the highest weight). The LSTM algorithm selects the top three features based on their importance output from the Random Forest algorithm and optimizes the binary entropy loss function, which is:

[0102] in, It is a loss function used to quantify the model's predicted values. Compared with the true value The difference between them, where N is the number of training samples.

[0103] According to embodiments of this disclosure, an anomaly root cause prediction model is generated by fusing chaotic features and improving the model. On the one hand, chaotic theory can be used to capture the nonlinear dynamic nature of the network and improve the accuracy of anomaly classification. On the other hand, the model structure and training strategy can be optimized to achieve the automation and real-time nature of root cause analysis, significantly reduce the manual cost of network operation and maintenance, and improve the efficiency of anomaly handling.

[0104] Figure 6 The flowchart of another network anomaly root cause localization method according to an embodiment of the present disclosure is illustrated.

[0105] like Figure 6 As shown, another network anomaly root cause localization method according to an embodiment of this disclosure includes S601, S602, and S603: S601. Obtain real-time data parameters for each detection point. The real-time data parameters shall include at least one or more of the following: small fluctuation mode parameters, short delay change parameters, encrypted traffic statistical characteristic parameters, irregular data packet interval time parameters, and system status information data parameters.

[0106] In the production environment, real-time data parameters for each detection point are continuously acquired.

[0107] S602. Based on real-time data parameters, determine one or more of the following for each detection point: chaos score, dynamic fluctuation index, chaos metric value, threshold abnormal state index, and dynamic instability index.

[0108] Based on the real-time data parameters of each detection point, characteristic indicators such as chaos score, chaos metric, dynamic fluctuation index, threshold abnormal state, and dynamic unstable state are continuously generated.

[0109] S603. Utilize real-time data parameters and anomaly root cause prediction models to predict network anomaly root causes in real time.

[0110] Furthermore, the preprocessed data metrics are fed into the deployed anomaly root cause prediction model, with parameter settings consistent with the model training process. The prediction results of the anomaly root cause prediction model can be expressed by the following formula:

[0111] in, It is the model's prediction result. It is an eigenvalue. 'b' is the feature weight, and 'b' is the bias term.

[0112] For example, setting If the value is greater than 0.5, it is considered an abnormal mode, and a classification label is matched according to the characteristic indicators. For example, if the dynamic instability index and dynamic fluctuation index of data packet transmission delay are not within the baseline range, it is considered a link failure.

[0113] In the embodiments of this disclosure, S603 includes: determining the root cause result of the prediction result based on real-time data parameters, prediction results, root cause set, and root cause probability, wherein the root cause set includes multiple root cause information; and generating a root cause anomaly report based on the root cause result, wherein the root cause anomaly report includes at least the anomaly type, root cause information, scope of impact, and response measures.

[0114] A trained anomaly root cause prediction model is used to analyze network behavior data in real time. When the model identifies network behavior matching a known anomaly pattern, such as a link failure, the anomaly root cause analysis process is automatically triggered. For example, by combining real-time network behavior data and the prediction results of the anomaly root cause prediction model, the possible root causes of anomaly events are inferred. The inference process can consider network topology, service dependencies, and historical anomaly event data. The possible root causes of anomaly events can be inferred using the following formula:

[0115] in, C is the most likely root cause information, and C is the set of all possible root cause information. These are observed anomalous events. This indicates that an abnormal event was observed. Under the given conditions, the posterior probability of root cause c is calculated, and the most probable root cause outcome is obtained. For example, for link failure, the posterior probability of optical module / fiber damage is 89%, and the posterior probability of misconfiguration is 11%. Therefore, optical module / fiber damage is the most probable root cause outcome of link failure.

[0116] Furthermore, based on the root cause results, a root cause anomaly report can be generated and sent to relevant personnel for timely adjustments. The root cause anomaly report can include the anomaly type, possible root cause information, scope of impact, and recommended response measures. The root cause anomaly report can satisfy the following formula:

[0117] in, This indicates the complexity of the root cause anomaly report. It is the complexity of the i-th element in the root cause anomaly report. is the corresponding weighting factor, and K is the total number of elements in the root cause anomaly report.

[0118] Figure 7 A block diagram illustrating a non-transitory computer-readable storage medium according to an embodiment of the present disclosure is shown schematically. like Figure 7 As shown, a non-transitory computer-readable storage medium 700 of this disclosure embodiment is used to store computer-readable instructions 701. When the computer-readable instructions 701 are executed by a processor, the processor performs the network anomaly root cause localization method as described above.

[0119] Figure 8 A block diagram illustrating a computer program product according to an embodiment of the present disclosure is shown schematically. like Figure 8 As shown, a computer program product 800 according to an embodiment of this disclosure includes a computer program 801, which, when executed by a processor, implements the network anomaly root cause localization method as described above.

[0120] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0121] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0122] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0123] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0124] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described above can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0125] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0126] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A method for locating the root cause of network anomalies, characterized in that, The method includes: Determine a time series format for the data set of each of the multiple detection points, wherein the time series format is used to determine at least one or more of the chaos score and dynamic fluctuation index; Attractor reconstruction is performed on the time series format of each of the detection point datasets to determine the state space of each detection point, wherein the state space is used to determine at least one or more of the following: a chaos metric, a threshold anomaly index, and a dynamic instability index; and An anomaly root cause prediction model is generated, which is determined at least based on the chaos score, the dynamic fluctuation index, the chaos metric, the threshold anomaly state index, and the dynamic instability index. The anomaly root cause prediction model is used at least to predict the root causes of network anomalies.

2. The network anomaly root cause localization method according to claim 1, characterized in that, Also includes: Acquire data parameters for each detection point, wherein the data parameters include at least one or more of the following: micro-fluctuation mode parameters, short-delay change parameters, encrypted traffic statistical characteristic parameters, irregular data packet interval time parameters, and system status information data parameters; as well as Based on the data parameters, a dataset is constructed for each detection point.

3. The network anomaly root cause localization method according to claim 2, characterized in that, The determination of the time series format of the data set for each of the multiple detection points includes: Extract the data set of all the detection points at each time point to form an initial time series set; Based on the initial time series set, determine the changes in the data parameters at adjacent time points; and The time series format of each detection point is determined based on the changes in the data set at multiple adjacent time points.

4. The network anomaly root cause localization method according to claim 1, characterized in that, The step of performing attractor reconstruction on the time series format of each detection point data set to determine the state space of each detection point includes: Determine the embedding dimension and latency; Based on the embedding dimension and the delay time, determine multiple state space reconstruction vectors in the time-series format for each detection point; and Based on the multiple state space reconstruction vectors of each detection point, the state space of each detection point is determined, wherein the threshold abnormal state index is determined at least by the degree of deviation of the state space from the set of normal behavior patterns.

5. The network anomaly root cause localization method according to claim 1, characterized in that, Also includes: Based on the state space, multiple Lyapunov feature indices are determined for each detection point; Based on the aforementioned multiple Lyapunov characteristic indices, the dynamic stability value is determined; as well as The dynamic instability index is determined based on the magnitude of the dynamic stability value and the preset stability value.

6. The network anomaly root cause localization method according to claim 2, characterized in that, The model for generating abnormal root cause prediction includes: The chaos score, the dynamic fluctuation index, the chaos metric, the threshold abnormal state index, and the dynamic instability index are used as training feature data. Determine normal mode labels and abnormal mode labels, wherein the abnormal mode labels include one or more of the following: the dynamic fluctuation index, the chaos metric, the threshold abnormal state index, and the dynamic instability index, which are outside a preset range; and A supervised learning model is trained based on the training feature data to generate the anomaly root cause prediction model.

7. The network anomaly root cause localization method according to claim 1, characterized in that, Also includes: Acquire real-time data parameters for each of the detection points. The real-time data parameters include at least one or more of the following: micro-fluctuation mode parameters, short-delay change parameters, encrypted traffic statistical characteristic parameters, irregular data packet interval time parameters, and system status information data parameters. Based on the real-time data parameters, determine one or more of the following for each detection point: the chaos score, the dynamic fluctuation index, the chaos metric, the threshold abnormal state index, and the dynamic instability index; as well as Using the real-time data parameters and the anomaly root cause prediction model, the root causes of network anomalies are predicted in real time.

8. The network anomaly root cause localization method according to claim 7, characterized in that, The method of predicting network anomaly root causes in real time using the real-time data parameters and the anomaly root cause prediction model includes: Based on the real-time data parameters, prediction results, root cause set, and root cause probability, the root cause result of the prediction result is determined, wherein the root cause set includes multiple root cause information; and Based on the root cause results, a root cause anomaly report is generated, which includes at least the anomaly type, root cause information, scope of impact, and response measures.

9. A non-transitory computer-readable storage medium for storing computer-readable instructions, characterized in that, When computer-readable instructions are executed by a processor, the processor performs the network anomaly root cause localization method as described in any one of claims 1 to 8.

10. A computer program product, comprising a computer program, characterized in that, When a computer program is executed by a processor, it implements the network anomaly root cause localization method as described in any one of claims 1 to 8.

Images