A communication network fault prediction method based on digital twinning

Abstract

The application discloses a communication network fault prediction method based on digital twinning, relates to the technical field of intelligent operation and maintenance of communication networks, and comprises the following steps: acquiring real-time operation states, historical logs and topology configuration data of a communication network, constructing a digital twin body of the communication network, and generating a virtual network state panoramic map; inputting the panoramic map into a pre-trained fault feature extraction network to synchronously identify a primary abnormal feature set matched with a known mode and atypical abnormal features beyond the range of the known mode; fusing the above features to construct a dynamically evolved abnormal feature spectrum; performing time sequence correlation matching on the spectrum and a fault knowledge spectrum to deduce potential fault evolution paths and occurrence probabilities, and generating a fault prediction report. The application can effectively identify unknown fault signs and predict fault propagation paths, and improves the accuracy and initiative of network fault early warning.

Description

Technical Field

[0001] This invention belongs to the field of intelligent operation and maintenance technology of communication networks, specifically a communication network fault prediction method based on digital twins. Background Technology

[0002] Fault prediction technology in modern communication networks is primarily based on the monitoring and analysis of operational status data. Existing methods generally rely on rules or models extracted from historical fault data, matching real-time indicators with a known fault characteristic database to provide early warnings. Their effectiveness depends entirely on the completeness of the historical data; such methods fail when the observed fault symptoms do not perfectly match any record in the database. The abnormal data generated during network operation is complex and diverse; a large number of weak signals or novel combinations of features in gray areas are difficult to capture by existing patterns. This constitutes a bottleneck in the current technology's ability to provide early warnings for unknown and atypical faults.

[0003] Existing early warning mechanisms mostly output discrete alarm events based on single-point thresholds. These alarms lack effective correlation analysis and fail to reflect the dynamic propagation of faults within the network topology. When multiple network elements successively experience anomalies, traditional systems can only provide a series of isolated point information, unable to reveal the temporal logic and causal chains between these points. This makes it difficult for operations and maintenance personnel to determine the root cause, propagation path, and scope of impact from a global perspective. The fragmented nature of early warning information hinders the efficiency of precise preventative intervention decisions.

[0004] Existing technologies have two major limitations: the scope of feature perception is fixed on historical experience and is not sensitive to unknown anomalies; the analytical dimension is limited to isolated nodes and lacks characterization of the dynamic relationships between anomalies. Therefore, a predictive method is needed that can simultaneously realize the discovery of atypical features and the deduction of dynamic fault propagation paths. Summary of the Invention

[0005] This invention aims to solve at least one of the technical problems existing in the prior art;

[0006] Therefore, this invention proposes a communication network fault prediction method based on digital twins, comprising:

[0007] Acquire real-time operational status data, historical operational log data, and network topology configuration data of physical entities in the communication network, and construct a digital twin of the communication network in virtual space based on the acquired data;

[0008] The real-time operating status data is simulated and calculated using the digital twin to generate a virtual network status panorama that includes device performance indicators, link load status, and signal quality parameters.

[0009] The virtual network state panorama is input into a pre-trained fault feature extraction network to identify a primary set of abnormal features that match known fault patterns and atypical abnormal features that exceed the range of known patterns.

[0010] By integrating the primary anomaly feature set with the atypical anomaly features, a dynamically evolving anomaly feature map is constructed.

[0011] The abnormal feature graph is matched with the fault knowledge graph in a time sequence to deduce potential fault evolution paths and corresponding fault occurrence probabilities, and a fault prediction report is generated.

[0012] Furthermore, the digital twin used to construct the communication network includes:

[0013] The network topology configuration data is parsed to determine the type, attribute parameters, and connection relationships of all physical entities in the communication network.

[0014] Based on the type and attribute parameters of the physical entity, a preset physical entity model library is called to instantiate and generate the corresponding virtual entity;

[0015] The virtual entities are logically connected according to the connection relationship to construct an initial static network twin structure;

[0016] A real-time data mapping channel is established between the virtual entity and the physical entity, and the parameters of the virtual entity are calibrated based on the historical operation log data so that the behavior response of the digital twin is consistent with the historical behavior of the physical entity.

[0017] Furthermore, the generation of a virtual network status panorama including device performance metrics, link load status, and signal quality parameters includes:

[0018] The real-time operating status data from the physical entity is continuously received through the real-time data mapping channel.

[0019] The real-time operating status data is used as input to drive the corresponding virtual entity in the digital twin to perform synchronous simulation operation;

[0020] During the simulation, the real-time performance metrics of each virtual entity are calculated, and the data traffic status and signal transmission quality on the links between virtual entities are monitored.

[0021] At a preset sampling period, the performance indicators of all virtual entities and the load and quality status of all links are recorded synchronously to form a network status snapshot on a time slice.

[0022] The network state snapshots on continuous time slices are overlaid and aligned in chronological order to generate the virtual network state panorama.

[0023] Furthermore, the step of inputting the virtual network state panorama into a pre-trained fault feature extraction network to identify a primary set of abnormal features matching known fault patterns and atypical abnormal features exceeding the range of known patterns includes:

[0024] The fault feature extraction network includes a rule matching layer for extracting known fault features and an anomaly detection layer for discovering unknown abnormal features;

[0025] The rule matching layer loads a preset fault feature rule library, compares the state parameters in the virtual network state panorama with the rules in the fault feature rule library one by one, and outputs the successfully matched features as the primary anomaly feature set.

[0026] The anomaly detection layer uses an unsupervised learning model to perform cluster analysis on the virtual network state panorama, identify abnormal data points that deviate from the cluster centers of the normal state, and mark the features exhibited by the abnormal data points as the atypical anomaly features.

[0027] Furthermore, the construction of the dynamically evolving anomaly feature map includes:

[0028] Assign an initial feature node to each feature in the primary anomaly feature set;

[0029] Assign an initial feature node to each of the atypical anomaly features;

[0030] Analyze the spatial topology correlation of network states corresponding to different feature nodes within the same time slice or adjacent time slices. If the correlation exceeds a preset threshold, establish an undirected edge between the corresponding feature nodes.

[0031] As new time slice data is input, the attributes of the feature nodes are dynamically updated, and new feature nodes are added or new edges are established.

[0032] The set of feature nodes and edges that are constantly updated over time is visualized as the dynamically evolving anomaly feature map.

[0033] Furthermore, the step of performing time-series correlation matching between the abnormal feature graph and the fault knowledge graph includes:

[0034] The fault knowledge graph stores fault entities, fault phenomena, fault causes, and causal relationships between them recorded in historical fault cases.

[0035] In the fault knowledge graph, search for fault phenomenon nodes that match the currently existing feature nodes in the dynamically evolving anomaly feature graph;

[0036] Once a fault phenomenon node is matched, the causal relationship edges in the fault knowledge graph are traversed to find all paths leading to different fault cause nodes.

[0037] Based on the time sequence of feature nodes and the weight of edges in the dynamically evolving anomaly feature map, the temporal consistency between each path and the current anomaly evolution process is calculated.

[0038] Furthermore, the deduction of potential fault evolution paths and corresponding fault occurrence probabilities includes:

[0039] Select one or more paths with a timing consistency exceeding a preset threshold as candidate fault evolution paths;

[0040] For each candidate fault evolution path, extract the sequence of fault cause nodes contained in the path;

[0041] By combining the current simulation state and real-time running state data of the corresponding virtual entity in the digital twin, the causal relationship strength between each cause node in the fault cause node sequence and the next stage phenomenon node is quantitatively evaluated to obtain the path stage confidence.

[0042] The overall probability of occurrence of a candidate fault evolution path is obtained by multiplying the path stage confidence scores of all stages along the path.

[0043] Furthermore, the generation of the fault prediction report includes:

[0044] Each candidate fault evolution path, its corresponding overall probability of occurrence, key fault cause nodes on the path, and expected fault phenomena are organized into structured prediction entries.

[0045] All predicted entries are sorted according to the overall probability of occurrence;

[0046] The sorted prediction entries, along with the timestamps for generating the report, the time range of the virtual network state panorama on which they are based, and key abnormal feature node information, are packaged into the fault prediction report.

[0047] Furthermore, the method also includes iterative updates of the digital twin model:

[0048] Once a fault actually occurs in the physical communication network and is confirmed, the actual fault evolution data corresponding to the fault event is obtained.

[0049] The actual fault evolution data is compared and analyzed with the prediction report generated by the digital twin before the fault occurred;

[0050] Based on the results of the comparative analysis, the parameters of the relevant models in the physical entity model library or the rules in the fault feature rule library are calibrated and corrected.

[0051] The calibrated model and rules are used to update the digital twin and the fault feature extraction network.

[0052] Furthermore, the method also includes transformative learning of atypical anomaly features:

[0053] When the atypical abnormal features identified by the anomaly detection layer are subsequently confirmed to be related to a specific fault, the atypical abnormal features and their associated fault information are recorded as new samples.

[0054] The unsupervised learning model of the anomaly detection layer is incrementally trained periodically using the accumulated new samples, enabling it to reclassify such features in the new clustering space.

[0055] Simultaneously, new feature rules are generated based on the new samples and added to the fault feature rule library loaded by the rule matching layer, so that subsequent identical abnormal features can be directly identified as primary abnormal features by the rule matching layer.

[0056] Compared with the prior art, the beneficial effects of the present invention are:

[0057] A fault feature extraction network that identifies atypical anomalies can effectively capture abnormal signals that deviate from existing fault patterns or are completely unrecorded by performing in-depth analysis of comprehensive state data generated by digital twins. This breaks through the perception boundaries of traditional methods that rely on fixed pattern libraries, shifting the early warning scope from passively waiting for unknown faults to actively detecting their early signs. This improves the early warning capability for new and complex latent faults, and reduces the probability of sudden business interruptions caused by the accumulation of unknown risks.

[0058] By constructing a dynamically evolving anomaly feature map, this method achieves structured integration and correlation modeling of multi-source, heterogeneous anomaly information within the network. It connects anomaly features occurring in different temporal and spatial dimensions into a semantically related network view, capable of depicting the interactions and evolution trends between anomaly states. Temporal correlation matching between this dynamic map and a static map containing prior fault knowledge allows for the inference of possible paths for anomalies to spread from their initial occurrence point through specific network links and devices. This outputs prediction results containing specific propagation sequences and evolution stage probabilities, enabling operational responses to shift from localized handling of discrete alarms to systemic proactive defense based on complete fault paths. Attached Figure Description

[0059] Figure 1This is a flowchart illustrating the steps of the communication network fault prediction method based on digital twins described in this invention.

[0060] Figure 2 A flowchart for generating a virtual network state panorama;

[0061] Figure 3 A biaxial composite analysis diagram showing the evolution of fault phenomenon node matching degree and the number of matching nodes over time;

[0062] Figure 4 A heatmap showing the correlation between the entire process and indicators for fault prediction in digital twin communication networks;

[0063] Figure 5 A bar chart comparing the fault prediction accuracy before and after the iteration of the digital twin model. Detailed Implementation

[0064] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] See Figure 1 The system acquires real-time operational status data, historical operational log data, and network topology configuration data describing the network structure from the physical entities of the communication network. Using this multi-source data, a dynamic mapping model, or digital twin, highly consistent with the physical communication network is created in virtual space. This digital twin is then used to simulate and calculate the input real-time operational status data, generating a comprehensive virtual network status panorama that reflects the current network operation. This panorama includes multi-dimensional information such as device performance indicators, link load status, and signal quality parameters. The generated virtual network status panorama is then input into a pre-trained fault feature extraction network for analysis. This network can identify primary anomaly feature sets that conform to historically known fault patterns, while also detecting atypical anomaly features that deviate from known patterns. These identified primary and atypical anomaly features are fused to construct an anomaly feature map that dynamically evolves over time. This dynamically evolving anomaly feature map is then temporally correlated and matched with a pre-constructed fault knowledge graph containing rich fault causal relationships. Through matching, potential fault evolution paths that the network state may take are deduced, and the probability of fault occurrence for each path is calculated. The simulation results generate a structured fault prediction report, providing forward-looking decision support for network operation and maintenance.

[0066] In one embodiment of the present invention, see [reference] Figure 2The network topology configuration data adopts a standardized network description file format, such as an XML file containing device identifiers, device types, and device interconnection port information. The parsing process of the network topology configuration data reads the file content through a parsing engine to determine the type, attribute parameters, and connection relationships of all physical entities in the communication network. The types of physical entities include core routers, aggregation switches, access switches, and wireless access points. Attribute parameters include the core router's device model, hardware configuration, and supported routing protocols. Connection relationships are stored in the form of an adjacency list, recording the corresponding connection between the uplink port of each aggregation switch and a specific port of the core router. Based on the parsed physical entity types and attribute parameters, a preset physical entity model library is called. This library defines the basic model of router virtual entities, the forwarding model of switch virtual entities, and the radio frequency propagation model of wireless access point virtual entities, instantiating the corresponding virtual entities. The virtual entities are logically connected according to the connection relationships. For example, in the simulation platform, the virtual entity representing the core router and the virtual entity representing the aggregation switch are connected through a virtual link object to construct the initial static network twin structure.

[0067] In practical implementation, a real-time data mapping channel is established between virtual and physical entities. This channel is based on a message queue telemetry transmission protocol. The physical entity periodically publishes its operational status messages, and the virtual entity subscribes to and receives the corresponding messages. Parameter calibration of the virtual entity is performed based on historical operational log data. For example, using historical traffic data from the aggregation switch ports over the past thirty days, the queue scheduling parameters of the switch's virtual entity forwarding model are adjusted by minimizing the mean square error between the simulated traffic and the historical traffic, ensuring that the behavior of the digital twin is consistent with the historical behavior of the physical entity.

[0068] In some embodiments, real-time operational status data from physical entities is continuously received via a real-time data mapping channel. This data is collected from a simple network management agent in the physical network at one-second intervals and includes the CPU utilization of the core router, the port inbound and outbound traffic of the aggregation switch, and the number of associated users and signal-to-noise ratio of the wireless access point. Using this real-time operational status data as input, the corresponding virtual entities in the digital twin are driven to perform synchronous simulation operations, with the simulation step size consistent with the data acquisition cycle. During the simulation, real-time performance metrics for each virtual entity are calculated, including the forwarding latency and packet loss rate of the core router virtual entity, the port buffer queue depth of the aggregation switch virtual entity, and the average user throughput of the wireless access point virtual entity. During the simulation, the data traffic status and signal transmission quality on the links between virtual entities are monitored. The data traffic status includes the bandwidth utilization of the virtual link, and the signal transmission quality for the wireless virtual link includes the signal strength indication of the virtual receiver. The performance metrics of all virtual entities and the load and quality status of all links are recorded synchronously at a preset sampling period of five minutes, forming a network state snapshot on a time slice. The network state snapshot is stored in matrix form, with rows corresponding to entities and links in the network and columns corresponding to various performance metrics. The network state snapshots on consecutive time slices are superimposed and aligned in chronological order to generate a virtual network state panorama. The virtual network state panorama is represented as a three-dimensional tensor, where two dimensions represent network entities and metrics, and the third dimension represents the time series.

[0069] In some embodiments, when generating a virtual network state panorama, a simplified path loss model is introduced to calculate the signal quality parameters of the wireless link between the wireless access point virtual entity and the user terminal virtual entity. Optionally, the path loss model is calculated using the following formula:

[0070]

[0071] in: Indicates distance Path loss value at that location. Indicates the reference distance The known path loss value at the location; This represents the path loss exponent, the value of which depends on the specific virtual environment model, such as in an open office virtual environment model. The value is 2.2, in the densely packed virtual environment model. The value is 3.0; This indicates the current simulated distance between the virtual entity of the wireless access point and the virtual entity of the user terminal; This indicates a reference distance, usually set to one meter. This represents a shadow fading variable that follows a zero-mean Gaussian distribution, used to simulate random fluctuations in signal reception strength.

[0072] In one embodiment of the present invention, the rule matching layer in the fault feature extraction network loads a preset fault feature rule base, which stores the state conditions corresponding to known fault modes in the form of "IF-THEN". In a specific implementation, a rule can be expressed as "IF the CPU utilization of the core router virtual entity is higher than 85% for five consecutive sampling periods AND the bandwidth utilization of a certain virtual link connected to it exceeds 95% THEN output feature 'router overload and concurrent link congestion'". The rule matching layer compares the state parameters in the virtual network state panorama with the rules in the fault feature rule base one by one. The comparison process traverses every slice of the panorama tensor in the time dimension, substitutes the values ​​of each indicator in the slice into the condition part of the rule for logical judgment, and outputs all successfully matched features to form a primary anomaly feature set. The anomaly detection layer in the fault feature extraction network uses an unsupervised learning model to perform cluster analysis on the virtual network state panorama. In a specific implementation, the unsupervised learning model adopts a Gaussian mixture model, and the model is trained using virtual network state panorama data from historical normal periods to establish normal state cluster centers. When the anomaly detection layer processes the current input virtual network state panorama, it calculates the degree of deviation of each data point in the panorama from the established normal state cluster center, identifies abnormal data points whose deviation exceeds a preset threshold, and marks the characteristics exhibited by the abnormal data points, such as "the virtual entity of the access switch exhibits abnormally high buffer jitter under low traffic load", as atypical anomaly features.

[0073] In some embodiments, when fusing primary anomaly feature sets and atypical anomaly features to construct a dynamically evolving anomaly feature map, an initial feature node is assigned to each feature in the primary anomaly feature set. The attributes of the feature node include the feature name, the timestamp of its first appearance, the identifier of the associated physical entity, and the feature strength value. Simultaneously, an initial feature node is assigned to each feature in the atypical anomaly feature set. In addition to the above information, the attributes of the atypical anomaly feature node also include a "pending confirmation" label. The correlation between the network states corresponding to different feature nodes in the same or adjacent time slices is analyzed in terms of spatial topology. The correlation analysis is based on the network connection relationships in the digital twin, calculating the shortest path distance between the physical entities associated with two feature nodes in the network topology graph. If the physical entities associated with two feature nodes are directly connected, or within a preset three-hop routing range, the correlation is considered to exceed a preset threshold. An undirected edge is then established between the corresponding feature nodes, and the undirected edge is assigned an initial weight. As new time slice data is input, the attributes of feature nodes are dynamically updated, such as updating feature intensity values ​​or timestamps; when new primary or atypical anomalies are identified, new feature nodes are added; when newly identified feature nodes satisfy spatial topological association conditions with existing nodes in the graph, new edges are established.

[0074] Optionally, a quantitative determination formula is used when calculating the spatial topological association between feature nodes. This formula objectively measures the proximity of the abnormal states represented by feature nodes in the physical network structure, providing a basis for edge establishment. The formula is expressed as follows:

[0075]

[0076] in: Represents feature nodes With feature nodes Topological distance between them; It is a function that calculates feature nodes. The associated physical entity With feature nodes The associated physical entity The shortest path hop count in a static network twin structure of a digital twin. When The value is less than or equal to the preset topological association threshold. When the correlation between two feature nodes exceeds a preset threshold, the feature node is... With feature nodes Establish an undirected edge between them.

[0077] In some embodiments, the construction of the dynamically evolving anomaly feature graph uses a graph database as the storage and computation carrier. Each feature node is a vertex in the graph database, and each undirected edge representing association is an edge connecting two vertices in the graph database. Graph update operations are performed through a graph query language, for example, periodically inserting newly identified feature nodes and edges into the graph database and querying existing nodes within a topological distance threshold to establish connections with the new nodes. The set of feature nodes and edges that are continuously updated over time is visualized as a dynamically evolving anomaly feature graph through the graph database's visualization interface or external rendering tools. Graph visualization can display the type and state of feature nodes, as well as the strength of edges between nodes.

[0078] In one embodiment of the present invention, when performing temporal correlation matching between a dynamically evolving anomaly feature graph and a fault knowledge graph, the fault knowledge graph stores fault entities, fault phenomena, fault causes, and causal relationships recorded in historical fault cases. In the fault knowledge graph, a fault phenomenon node that matches a currently existing feature node in the dynamically evolving anomaly feature graph is searched. The matching process is based on string similarity and semantic mapping. For example, a feature node named "Router CPU overload" in the dynamically evolving anomaly feature graph matches a fault phenomenon node named "Core router CPU utilization remains high" in the fault knowledge graph. After matching one or more fault phenomenon nodes, the causal relationship edges in the fault knowledge graph are traversed, and a graph traversal algorithm is used to find all directed paths that can start from the currently matched fault phenomenon node and reach different fault cause nodes. Based on the time sequence of feature nodes and the weight of connecting edges in the dynamically evolving anomaly feature graph, the temporal consistency between each path found from the fault knowledge graph and the current anomaly evolution process is calculated. The consistency calculation needs to consider whether the order in which feature nodes are activated in the dynamically evolving anomaly feature graph is consistent with the causal temporal logic implied by the path nodes in the fault knowledge graph.

[0079] In some embodiments, when deducing potential fault evolution paths and corresponding fault occurrence probabilities, one or more paths with a temporal fit exceeding a preset threshold are selected as candidate fault evolution paths. The preset threshold is set based on retrospective analysis of historical cases. For each candidate fault evolution path, the sequence of fault cause nodes contained in the path is extracted. Combining the current simulation state and real-time operating state data of the corresponding virtual entity in the digital twin, the causal relationship strength between each cause node in the fault cause node sequence and the phenomenon node of the next stage is quantitatively evaluated to obtain the path stage confidence. The path stage confidence of all stages on a candidate fault evolution path is multiplied together to obtain the overall occurrence probability of the candidate fault evolution path.

[0080] Optionally, a specific quantification formula is used to calculate the temporal fit between a path in the fault knowledge graph and the dynamically evolving anomaly feature graph. This formula is used to objectively evaluate the consistency between the fault evolution sequence described by the candidate path and the actual observed sequence of anomaly features. The formula is expressed as follows:

[0081]

[0082] in: Representing a path The time series fit score, with values ​​ranging from 0 to 1; Representing a path The number of nodes successfully mapped to the dynamically evolving anomaly feature map through matching; Representing a path Upper One successfully matched fault knowledge graph node; This indicates the relationship between nodes in the dynamically evolving anomaly feature graph and the fault knowledge graph. Matching feature nodes; It is a function that returns feature nodes. The time sequence number of the first activation is recorded in the dynamically evolving anomalous feature map; It is an indicator function, when the condition is met. Returns 1 if true, otherwise returns 0. The numerator of the formula calculates the path... The number of consecutive matching node pairs is the number of pairs whose actual feature node activation order conforms to the logical order of the path nodes. The denominator is the total number of pairs, used for normalization.

[0083] In some embodiments, the quantitative evaluation of path stage confidence is based on simulation data and real-time data from the digital twin. For example, for the stage "configuration error cause node -> routing loop phenomenon node", the configuration simulation logs and routing table simulation status of the relevant virtual router entities in the digital twin over a period of time are queried, and the existence of corresponding configuration change records in the real-time network management system is checked. A path stage confidence value between 0 and 1 is given by combining this information. The overall probability of occurrence of the candidate fault evolution path is obtained by multiplying the path stage confidence of each stage. For example, a path containing three stages with path stage confidences of 0.9, 0.7, and 0.8 respectively has an overall probability of occurrence of 0.504.

[0084] See Figure 3This is a dual-axis composite analysis chart showing the evolution of fault phenomenon node matching degree and the number of matched nodes over time. The matching degree of fault phenomenon nodes shows an upward trend from 0.2 to approximately 0.92 within 1-8 minutes, indicating that the matching degree between the dynamically evolving anomaly feature graph and the fault knowledge graph continuously improves over time, gradually locating highly correlated fault phenomenon nodes. After 8 minutes, the matching degree slowly decreases, reflecting a weakening of the correlation between anomaly features in the later stages. The number of matched nodes synchronously shows a change from first increasing to decreasing, reaching a peak of 10 at 8 minutes, indicating that the number of matched fault phenomenon nodes is the highest at this time, corresponding to the critical window period for fault location. This chart intuitively reflects the matching efficiency and coverage of anomaly features and historical fault knowledge in the digital twin system. The peak of the matching degree and the peak of the number of nodes are basically synchronized, verifying the effectiveness of the temporal correlation matching algorithm.

[0085] In one embodiment of the present invention, when generating a fault prediction report, each candidate fault evolution path, its corresponding overall probability of occurrence, key fault cause nodes on the path, and expected fault phenomena are organized into structured prediction entries. In specific implementation, a candidate fault evolution path is assigned a unique path identifier. The key fault cause nodes on the path have their descriptive text extracted from a fault knowledge graph, and the expected fault phenomena are also derived from the text descriptions of the corresponding nodes in the fault knowledge graph. The structured prediction entries are organized in list form, with each entry containing a path identifier field, an overall probability of occurrence numerical field, a key fault cause text field, and an expected fault phenomenon text field. All prediction entries are sorted in descending order according to the calculated overall probability of occurrence, with the prediction entry with the highest overall probability of occurrence placed at the top of the list. The sorted list of prediction entries, along with the timestamp of the generated report, the time range of the virtual network state panorama, and the key abnormal feature node information extracted from the dynamically evolving abnormal feature graph, are encapsulated into the final fault prediction report.

[0086] In some embodiments, the fault prediction report is encapsulated using a standardized document format, such as Extensible Markup Language (EXPLAIN) or Lightweight Data Interchange Format (LIFORM). The timestamp for generating the report is accurate to the second. The time range of the virtual network state panorama is recorded as a start and end timestamp. Key anomaly node information includes node identifiers, feature names, and their first activation timestamps. All this metadata, together with the sorted list of prediction entries, constitutes a complete data structure, which is the fault prediction report. This structured report facilitates parsing and processing by automated systems and helps maintenance personnel quickly locate key prediction information. Optionally, the structured prediction entries are presented in tabular form in the report to enhance readability. See Table 1, the table of prediction entries in the fault prediction report.

[0087] Table 1: Fault Prediction Item Table

[0088] Path ID Overall probability of occurrence Key Failure Causes Expected Failure Phenomena PATH_20231027_001 0.504 Core router static route configuration error Routing loops; periodic congestion of downstream links PATH_20231027_002 0.336 Access switch hardware cache failure The packet loss rate of users in certain network segments has increased sharply. PATH_20231027_003 0.245 The communication delay between the wireless controller and the access point has increased abnormally. User roaming failed; connection interrupted.

[0089] In some embodiments, the ranking of predicted entries is based not only on the overall probability of occurrence but also on other weighting factors. Optionally, a weighting factor based on the inherent risk level of the fault cause nodes in the fault knowledge graph is introduced. This weighting factor is understandable, used to consider the potential severity of the failure's impact during ranking. The final ranking weights... Based on the overall probability of occurrence Risk level weighting factor It was jointly decided that the following formula would be used for calculation:

[0090]

[0091] in: This represents the composite weights used for the final ranking; This represents the overall probability of occurrence of candidate failure evolution paths; This represents the numerical coefficient mapping to the inherent risk level associated with the critical failure cause node in the fault knowledge graph, as defined in the graph. Risk levels are categorized as high, medium, and low, mapped to values ​​of 1.5, 1.2, and 1.0, respectively. The composite weight of each prediction entry is calculated. and in accordance with The values ​​are sorted in descending order to obtain the final order of the predicted entries. The sorted list of entries, along with other metadata, is then encapsulated into the fault prediction report.

[0092] See Figure 4 This is a heatmap showing the correlation between stages and indicators in the entire process of fault prediction for a digital twin communication network. It uses color depth to quantify the correlation strength between five core stages and three evaluation indicators, providing a direct assessment of algorithm performance or stage contribution. The fault feature extraction stage, represented by off-white (approximately 0.1-0.2) for indicators 2 and 3, has the lowest correlation in the entire graph, indicating relatively weak performance on these two indicators and potentially a key bottleneck for algorithm optimization. The digital twin modeling stage, represented by deep red (approximately 0.7-0.8) for all three indicators, has the highest correlation, reflecting that this stage contributes the most to the indicators and exhibits the most stable performance. The data acquisition and anomaly feature fusion stages are generally in the deep red range (approximately 0.6-0.8), showing relatively balanced and stable performance. The fault prediction stage has a slightly lower correlation than the modeling and fusion stages, with indicator 1 performing well, while indicators 2 and 3 are relatively weak.

[0093] In one embodiment of the present invention, the model iterative update process of the digital twin is initiated after an actual fault occurs and is confirmed in the physical communication network, acquiring the actual fault evolution data corresponding to the fault event. In specific implementations, the actual fault evolution data originates from network management system alarm logs, performance monitoring historical records, and the final fault diagnosis report from maintenance personnel during the fault occurrence period. The data is organized into a structured event sequence containing a timeline, affected entities, observed phenomena, and root causes. The actual fault evolution data is compared and analyzed with the fault prediction report generated by the digital twin before the fault occurred. The comparative analysis focuses on the consistency between the candidate fault evolution paths listed in the fault prediction report and the actual fault evolution sequence in terms of key nodes, occurrence timing, and causal logic. Based on the differences in the comparative analysis, the parameters of relevant models in the physical entity model library or the rules in the fault feature rule library are calibrated and corrected. For example, if the actual fault is caused by a specific failure mode of an insufficiently modeled hardware cache, the cache failure parameters of the corresponding switch virtual entity model in the physical entity model library are adjusted; if the actual fault phenomenon matches a certain atypical feature but is not successfully predicted by the fault prediction report, the corresponding rule is added or corrected in the fault feature rule library. The digital twin and fault feature extraction network are updated using the calibrated model and rules. The update process includes loading new model parameters into the running digital twin simulation engine and loading new rule files into the rule matching layer of the fault feature extraction network.

[0094] In some embodiments, the transformation learning process for atypical anomaly features is triggered when an atypical anomaly feature identified by the anomaly detection layer is subsequently confirmed to be related to a specific fault. The atypical anomaly feature and its associated fault information are recorded as new samples. These new samples are stored in a structured format in a dedicated sample library, and the recorded content includes the original data fragments of the atypical anomaly feature, contextual information during feature extraction, associated confirmed fault identifiers, and a detailed description of the fault. The accumulated new samples are periodically used to incrementally train the unsupervised learning model of the anomaly detection layer. The incremental training process is executed within a preset maintenance time window. The new samples, along with some historical normal samples, form a training set. The internal clustering boundaries or decision functions of the unsupervised learning model are adjusted so that it can reclassify such features in a new clustering space. Subsequent similar anomaly patterns may be classified into known anomaly clusters. Simultaneously, new feature rules are generated based on the new samples. The generation process analyzes the stable correspondence between anomalous features and fault phenomena in the new samples, abstracts it into a logical expression of "IF condition THEN feature," and adds it to the fault feature rule library loaded by the rule matching layer. This allows subsequent identical anomalous features to be directly identified as primary anomaly features by the rule matching layer.

[0095] Optionally, during model iteration and updates, the calibration of model parameters in the physical entity model library employs an adjustment formula based on error feedback. This formula quantifies the difference between actual observation data and the digital twin simulation output, and calculates the parameter adjustment accordingly. The formula is expressed as follows:

[0096]

[0097] in: This represents the vector of model parameters that need to be adjusted. The increment; This represents a preset learning rate matrix, used to control the step size and direction of adjustment; Indicates the time point of failure evolution The vector of key performance indicators that are actually observed and relevant to the model; Indicates that digital twins are at the same point in time. The corresponding performance index vector output from the simulation. The calculated parameter increments. It is used to update the parameters of the corresponding model in the physical entity model library.

[0098] In some embodiments, periodic incremental training in the atypical anomaly feature transformation learning is performed on a monthly or quarterly basis. It is understood that accumulating a certain number of new samples is one of the conditions for triggering incremental training. During incremental training, the unsupervised learning model of the anomaly detection layer, such as an isolated forest model, updates its tree structure or path length calculation standard for the anomaly patterns represented by the new samples, while retaining its original detection capabilities. The addition of new feature rules requires a review process. This process evaluates the conflict between the new rule and existing rules in the fault feature rule base, the rule's confidence level, and the specificity of the triggering conditions. New rules that pass the review are officially merged into the main version of the fault feature rule base.

[0099] See Figure 5This is a bar chart comparing the fault prediction accuracy of the digital twin model before and after iteration, used to verify the effect of model iteration updates on improving the fault prediction capability of communication networks. The prediction accuracy for all fault types significantly improved after model iteration, indicating that the model calibration and rule correction strategy based on actual fault data is effective. The accuracy for hardware cache failure was approximately 0.62 before iteration, increasing to approximately 0.88 after iteration, representing the largest improvement (approximately 0.26), indicating that this type of fault mode, which was not previously fully modeled, was significantly optimized after model parameter calibration. Link congestion had the highest accuracy after iteration (approximately 0.95), and its baseline before iteration was also relatively good (approximately 0.80), reflecting that the matching degree of the feature rules for this type of fault further improved after iteration. This chart visually quantifies the business value of model iteration updates, providing data support for subsequent resource investment and optimization directions, such as continuing to focus on fault types with significant improvement potential, such as hardware cache failure.

[0100] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A method for predicting communication network faults based on digital twins, characterized in that, include: Acquire real-time operational status data, historical operational log data, and network topology configuration data of physical entities in the communication network, and construct a digital twin of the communication network in virtual space based on the acquired data; The real-time operating status data is simulated and calculated using the digital twin to generate a virtual network status panorama that includes device performance indicators, link load status, and signal quality parameters. The virtual network state panorama is input into a pre-trained fault feature extraction network to identify a primary set of abnormal features that match known fault patterns and atypical abnormal features that exceed the range of known patterns. By integrating the primary anomaly feature set with the atypical anomaly features, a dynamically evolving anomaly feature map is constructed. The abnormal feature graph is matched with the fault knowledge graph in a time sequence to deduce potential fault evolution paths and corresponding fault occurrence probabilities, and a fault prediction report is generated.

2. The communication network fault prediction method based on digital twin as described in claim 1, characterized in that, The digital twin used to construct the communication network includes: The network topology configuration data is parsed to determine the type, attribute parameters, and connection relationships of all physical entities in the communication network. Based on the type and attribute parameters of the physical entity, a preset physical entity model library is called to instantiate and generate the corresponding virtual entity; The virtual entities are logically connected according to the connection relationship to construct an initial static network twin structure; A real-time data mapping channel is established between the virtual entity and the physical entity, and the parameters of the virtual entity are calibrated based on the historical operation log data so that the behavior response of the digital twin is consistent with the historical behavior of the physical entity.

3. The communication network fault prediction method based on digital twin as described in claim 2, characterized in that, The generation of the virtual network status panorama, which includes device performance metrics, link load status, and signal quality parameters, includes: The real-time operating status data from the physical entity is continuously received through the real-time data mapping channel. The real-time operating status data is used as input to drive the corresponding virtual entity in the digital twin to perform synchronous simulation operation; During the simulation, the real-time performance metrics of each virtual entity are calculated, and the data traffic status and signal transmission quality on the links between virtual entities are monitored. At a preset sampling period, the performance indicators of all virtual entities and the load and quality status of all links are recorded synchronously to form a network status snapshot on a time slice. The network state snapshots on continuous time slices are overlaid and aligned in chronological order to generate the virtual network state panorama.

4. The communication network fault prediction method based on digital twin as described in claim 1, characterized in that, The step of inputting the virtual network state panorama into a pre-trained fault feature extraction network to identify a primary set of abnormal features matching known fault patterns and atypical abnormal features exceeding the range of known patterns includes: The fault feature extraction network includes a rule matching layer for extracting known fault features and an anomaly detection layer for discovering unknown abnormal features; The rule matching layer loads a preset fault feature rule library, compares the state parameters in the virtual network state panorama with the rules in the fault feature rule library one by one, and outputs the successfully matched features as the primary anomaly feature set. The anomaly detection layer uses an unsupervised learning model to perform cluster analysis on the virtual network state panorama, identify abnormal data points that deviate from the cluster centers of the normal state, and mark the features exhibited by the abnormal data points as the atypical anomaly features.

5. The communication network fault prediction method based on digital twin as described in claim 4, characterized in that, The construction of the dynamically evolving anomaly feature map includes: Assign an initial feature node to each feature in the primary anomaly feature set; Assign an initial feature node to each of the atypical anomaly features; Analyze the spatial topology correlation of network states corresponding to different feature nodes within the same time slice or adjacent time slices. If the correlation exceeds a preset threshold, establish an undirected edge between the corresponding feature nodes. As new time slice data is input, the attributes of the feature nodes are dynamically updated, and new feature nodes are added or new edges are established. The set of feature nodes and edges that are constantly updated over time is visualized as the dynamically evolving anomaly feature map.

6. The communication network fault prediction method based on digital twin as described in claim 5, characterized in that, The step of performing time-series association matching between the abnormal feature graph and the fault knowledge graph includes: The fault knowledge graph stores fault entities, fault phenomena, fault causes, and causal relationships between them recorded in historical fault cases. In the fault knowledge graph, search for fault phenomenon nodes that match the currently existing feature nodes in the dynamically evolving anomaly feature graph; Once a fault phenomenon node is matched, the causal relationship edges in the fault knowledge graph are traversed to find all paths leading to different fault cause nodes. Based on the time sequence of feature nodes and the weight of edges in the dynamically evolving anomaly feature map, the temporal consistency between each path and the current anomaly evolution process is calculated.

7. The communication network fault prediction method based on digital twin as described in claim 6, characterized in that, The deduced potential failure evolution paths and corresponding failure occurrence probabilities include: Select one or more paths with a timing consistency exceeding a preset threshold as candidate fault evolution paths; For each candidate fault evolution path, extract the sequence of fault cause nodes contained in the path; By combining the current simulation state and real-time running state data of the corresponding virtual entity in the digital twin, the causal relationship strength between each cause node in the fault cause node sequence and the next stage phenomenon node is quantitatively evaluated to obtain the path stage confidence. The overall probability of occurrence of a candidate fault evolution path is obtained by multiplying the path stage confidence scores of all stages along the path.

8. The communication network fault prediction method based on digital twin as described in claim 7, characterized in that, The generated fault prediction report includes: Each candidate fault evolution path, its corresponding overall probability of occurrence, key fault cause nodes on the path, and expected fault phenomena are organized into structured prediction entries. All predicted entries are sorted according to the overall probability of occurrence; The sorted prediction entries, along with the timestamps for generating the report, the time range of the virtual network state panorama on which they are based, and key abnormal feature node information, are packaged into the fault prediction report.

9. The communication network fault prediction method based on digital twin as described in claim 2, characterized in that, The method also includes iterative updates of the digital twin model: Once a fault actually occurs in the physical communication network and is confirmed, the actual fault evolution data corresponding to the fault event is obtained. The actual fault evolution data is compared and analyzed with the prediction report generated by the digital twin before the fault occurred; Based on the results of the comparative analysis, the parameters of the relevant models in the physical entity model library or the rules in the fault feature rule library are calibrated and corrected. The calibrated model and rules are used to update the digital twin and the fault feature extraction network.

10. The communication network fault prediction method based on digital twin as described in claim 1, characterized in that, The method also includes transformational learning of atypical anomaly features: When the atypical abnormal features identified by the anomaly detection layer are subsequently confirmed to be related to a specific fault, the atypical abnormal features and their associated fault information are recorded as new samples. The unsupervised learning model of the anomaly detection layer is incrementally trained periodically using the accumulated new samples, enabling it to reclassify such features in the new clustering space. Simultaneously, new feature rules are generated based on the new samples and added to the fault feature rule library loaded by the rule matching layer, so that subsequent identical abnormal features can be directly identified as primary abnormal features by the rule matching layer.

Images