An artificial intelligence-based network operation state intelligent analysis system and method

Abstract

The application discloses an intelligent analysis system and method for network operation state based on artificial intelligence, and relates to the technical field of network operation and maintenance.The method comprises the following steps: a network graph comprising a network node set, a link set and a topology adjacency matrix is constructed; operation indexes of each network node are collected to form an original observation data set; time sequence regulation processing is performed on the original observation data set to obtain aligned index data under a unified time axis; a historical baseline is constructed based on historical data of the network nodes, the aligned index data is compared with the historical baseline and is standardized to obtain a node comprehensive abnormal intensity and a network node abnormal intensity vector; a graph Laplacian matrix is calculated based on the topology adjacency matrix, a graph heat diffusion model is constructed to simulate an abnormal conduction process, and core propagation features are calculated; after normalization, root cause scores are obtained by weighting the core propagation features, root cause nodes are screened according to a root cause score threshold, and an abnormal propagation chain is combed and output.

Description

Technical Field

[0001] This invention relates to the field of network operation and maintenance technology, specifically to an intelligent analysis system and method for network operation status based on artificial intelligence. Background Technology

[0002] With the acceleration of digital transformation, the scale of modern complex networks such as data centers and industrial ring networks is constantly expanding, the number of nodes is surging, and the topological connections between nodes exhibit strong coupling characteristics. The complexity and dynamism of network operation status have significantly increased, resulting in an explosive growth in the amount of operational indicator data generated. Traditional manual operation and maintenance and simple data processing methods can no longer meet the needs of efficient operation and maintenance. Network operation status monitoring is the core of ensuring stable network operation. It mainly involves collecting operational indicators such as CPU utilization, bandwidth utilization, and packet loss rate of network nodes, and combining them with time-series data processing, graph theory analysis, and other technologies to achieve real-time perception of network operation status.

[0003] In modern complex networks, such as data centers or industrial ring networks, when a core node experiences momentary congestion or a minor hardware failure, the pressure rapidly spreads throughout the network due to the strong coupling of the network topology, resulting in an "alarm storm." A large number of downstream nodes report cascading performance fluctuations, including but not limited to packet loss and increased latency, causing significant difficulties for maintenance personnel in troubleshooting. Existing network anomaly analysis technologies have significant technical bottlenecks: they struggle to accurately distinguish between "original causes" and "derived consequences," leading to slow and inefficient root cause localization. Furthermore, they are prone to high false alarm rates due to data interference, hindering the rapid location of core faulty nodes, delaying fault repair, and impacting network stability and reliability. Summary of the Invention

[0004] The purpose of this invention is to provide an intelligent analysis system and method for network operation status based on artificial intelligence, so as to solve the problems raised in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: an intelligent analysis method for network operation status based on artificial intelligence, the method comprising the following steps: Step 1: Construct a network graph containing a set of network nodes, a set of links, and a topological adjacency matrix; collect operational metrics of each network node and summarize them to form the original observation dataset; Step 2: Perform time-series normalization on the original observation dataset to obtain alignment index data under a unified time axis; Step 3: Construct a historical baseline based on historical data of network nodes, compare the alignment index data with the historical baseline and standardize it to obtain the comprehensive anomaly intensity of nodes and the anomaly intensity vector of all nodes in the network. Step 4: Calculate the graph Laplacian matrix based on the topological adjacency matrix, construct a graph heat diffusion model to simulate the abnormal propagation process, and calculate the core propagation characteristics; after normalizing the core propagation characteristics, weight them to obtain the root cause score, filter the root cause nodes according to the root cause score threshold, and sort out and output the abnormal propagation chain.

[0006] In step 1, the purpose is to provide basic data support and topology framework for the analysis of the overall network operation status, so as to ensure that subsequent anomaly detection and root cause analysis have clear analysis objects and data sources, and avoid subsequent analysis deviations due to missing basic data or ambiguous topology. Based on the direct physical or logical connections between network nodes, construct a network graph G=(V,E,A); where V represents the set of network nodes, E represents the set of links between network nodes, and A=[a ij ] represents the topological adjacency matrix, a ij This represents the connection weight between network node i and its neighboring network node j; a ij The value of a can be set according to factors such as connection bandwidth and transmission delay. For example, when node i and node j are connected via Gigabit Ethernet, a ij It can be set to 1.0, or 0.5 for a 100Mbps connection, and a for no direct connection. ij =0, with a value range of 0 to 1. The larger the weight, the tighter the connection between nodes and the higher the data transmission efficiency. The network node refers to a device unit in the network that has independent operating indicators and can be monitored; specifically, it may include routers, switches, servers, gateways, etc. For example, the core switch, access router, and application server in an enterprise local area network are all network nodes in this solution, and their operating status directly affects the stability of the entire network. For each network node, operational metrics are collected. The measured value of the operational metrics recorded at a specific point in time is recorded as an observation point for that network node. The operational metrics of the network node can refer to conventional operation and maintenance monitoring standards, including CPU utilization, memory usage, bandwidth utilization, packet loss rate, TCP connection count, etc. By aggregating all network nodes and observation points at all times, the original observation dataset is obtained.

[0007] Step 2 aims to address the issues of asynchronous sampling times for operational metrics across different network nodes and missing data at certain time points. It ensures that the metric data from all nodes are on the same timeline, providing a unified data foundation for subsequent comparisons with historical baselines and anomaly analysis, thus preventing misjudgments of anomalies due to time-series inconsistencies. The timing warping includes handling asynchronous sampling and missing data, specifically including: For the target time point τ0 where data needs to be generated, filter the valid observation points N that can be called before and after the time point, and dynamically select the alignment method according to the number of N; the target time point can be set according to the actual analysis needs, for example, a target time point can be set every 1 minute to ensure that the analysis granularity meets the network operation and maintenance needs. Asynchronous sampling refers to the inconsistent sampling times of operational metrics across different network nodes; missing data refers to the absence of valid observations at certain time points. The effective observation points refer to the observation points that are actually recorded and can be used in the calculation; When N ≥ 3, spatiotemporal weighted interpolation is used; when N = 2, linear interpolation fitting is used; the linear interpolation fitting is a conventional data completion method, that is, fitting the value of the target time point based on the values ​​of two effective observation points and the time interval; when N = 1, the operational index data of the effective observation point is used. When the number of effective observation points N=0, there is no available measured data. The historical normal mean of the index for that node is directly used. The historical normal mean can be extracted in advance from the historical baseline data in step 3 to ensure that the supplemented data fits the normal operating status of the node and avoids the interruption of subsequent analysis due to lack of data. The spatiotemporal joint weighted interpolation specifically includes: x i m (τ0)=Σ r=1 N w i,r (τ0)·x i m (t i,r By integrating the weights of both time and space factors, the interpolation results are made to better reflect the actual network operating state. Where, x i m (τ0) represents the alignment and reconstruction value of the m-th operational metric of network node i at the target time τ0; w i,r (τ0) represents the spatiotemporal joint weight of the r-th effective observation point, which is calculated from the temporal distance, the centroid interpolation coefficient, and the topological correlation strength; x i m (t i,r ) represents network node i at time t i,r The original value of the m-th operational indicator on the t; i,r This represents the time of network node i at the r-th valid observation point; w i,r (τ0)=(ρ i,r ·λ i,r ·|τ0-t i,r | -1 ) / (Σ s=1 N ρ i,s ·λi,s ·|τ0-t i,s | -1 ); Where the denominator is the weighted sum of all valid observations; λ i,r =1 / ∏ s=1,s≠r N (t i,r -t i,s ), representing the barycentric interpolation coefficient; s represents the s-th effective observation point; |τ0-t i,r | represents the time distance between the target time τ0 and the time of the r-th valid observation point; the closer the distance, the greater the weight. ρ i,r The topological correlation coefficient is obtained by determining the neighboring nodes of node i based on the topological adjacency matrix A=[a] constructed in the scheme. ij ] Filter out the neighboring nodes that are connected to node i; calculate the correlation between the historical indicators of node i and each neighboring node: select the historical stable operation indicator data of node i and all its neighboring nodes, which is consistent with the data source for building the historical baseline in step 3. For the m-th type of operation indicator, calculate the correlation between the historical indicators of node i and each neighboring node j; optionally, use the Pearson correlation coefficient to quantify the synchronicity of the changes in the indicators of the two, with a value of -1 to 1, and the stronger the synchronicity, the larger the absolute value. Combine the adjacency matrix weights a ij Weighted fusion: The historical correlation of each neighboring node j is combined with the corresponding adjacency matrix weight a. ij Multiplying them together yields the weighted correlation between node i and its neighboring node j, with weight a. ij The larger the value, the greater the corresponding neighborhood node pair ρ. i,r The greater the impact.

[0008] Normalization yields ρ i,r The weighted correlations of all neighboring nodes are summed, then divided by the sum of the adjacency matrix weights of all neighboring nodes to complete the normalization process, finally yielding the topological correlation coefficient ρ. i,r Ensure that its value is between 0 and 1, and directly use it for subsequent spatiotemporal joint weight ω. i,r Calculation of (τ0); In step 3, the goal is to establish a reference standard for the normal operating status of network nodes. By comparing the real-time aligned indicator data with historical baselines, abnormal situations deviating from the normal state can be accurately identified. Historical data from network nodes during periods of stable operation without faults or congestion are selected, such as stable operation data from the past 3-6 months or low-load periods in the early morning of each day, when the network is fault-free, congestion-free, and the data is highly stable. Statistical calculations are performed on each network node and each type of operational indicator to form a historical baseline: the historical normal average μ of the m-th type of operational indicator for network node i. im The historical normal standard deviation σ of the m-th type of operating metric of network node i i m ; By comparing the alignment index data with the historical baseline, differences in the units and magnitudes of different indices are eliminated, resulting in standardized outliers. Optionally, the formula for calculating standardized outliers is: x i m '(τ)=(x i m (τ)-μ i m ) / σ i m +ε, where ε is a minimal number to prevent the denominator from being zero; the standardized outliers are weighted and summed to obtain the node comprehensive outlier intensity s in a single numerical form. i (τ); where s i (τ) represents the overall anomaly intensity of the network node i at time τ; the weights corresponding to different operating indicators are determined based on manual preset. The anomaly intensities of all nodes are integrated to form a network-wide node anomaly intensity vector S(τ)=[s1(τ),s2(τ),…,s |V| (τ)] T The larger the value in the vector, the more severe the node anomaly; where |V| represents the total number of elements in set V; In step 4, by simulating the propagation process of anomalies among network nodes, the core propagation characteristics of the anomalies are explored, the root cause nodes of the anomalies are accurately identified, and the propagation paths of the anomalies are analyzed. This provides precise guidance for network fault diagnosis and repair, shortens the fault diagnosis time, and improves network operation and maintenance efficiency. The graph Laplacian matrix can be calculated using common graph theory tools such as NetworkX, simplifying the calculation process. The degree matrix D and the graph Laplacian matrix L are calculated based on the topological adjacency matrix A. The degree matrix and the graph Laplacian matrix are the core foundation of the graph heat diffusion model, used to characterize the connection relationships between network nodes and the laws of anomalous diffusion. They are common applications of graph theory in network anomaly analysis. The degree matrix D is a diagonal matrix, and the diagonal elements d i =∑ j=1 |V| a ij , representing the total number of connections to node i; The graph Laplacian matrix L=D−A is used to characterize the anomalous diffusion relationships between nodes; A graph-based heat diffusion model is constructed to simulate the anomaly propagation process. The anomaly intensity vector of all network nodes is regarded as the diffusion state vector T(τ) on the graph. The continuous form of the anomaly diffusion equation is defined as: dT(τ) / dτ=−αLT(τ)+S(τ). The graph-based heat diffusion model is the core model for simulating anomaly propagation. It draws on the physical principle of heat diffusion, treating anomalies as "heat" that is conducted between network nodes. The continuous form of the diffusion equation is suitable for theoretical analysis, but it needs to be converted into a discrete form in actual calculations to adapt to the discrete characteristics of time series data. The discretization of the diffusion model can refer to the discretization idea of ​​the DDIM model, which discretizes the continuous diffusion process into several steps. Where dT(τ) / dτ refers to the first derivative of the abnormal state quantity T(τ) with respect to time, representing the instantaneous rate of change of the abnormality over time; α represents the abnormality diffusion coefficient, which controls the propagation speed of the abnormality among network nodes; L represents the graph Laplace matrix; T(τ) represents the abnormality diffusion state vector of the network node at time τ; and S(τ) represents the abnormality intensity vector of all network nodes, serving as an external abnormality injection term.

[0009] The calculation employs a discrete iterative approach, adapted to time-series data: T k+1 =T k −α⋅Δτ⋅LT k +Δτ⋅S k The discrete iterative form transforms the continuous diffusion equation into a computable form, adapting to the discrete sampling characteristics of time series data. Through multiple iterations, it simulates the propagation process of anomalies at different time steps. The number of iterations can be set according to the network size and analysis requirements, typically 10 to 50 rounds. Among them, T k Let S represent the anomaly diffusion state vector at the k-th discrete time step; Δτ represents the discrete time step size, the interval between adjacent analysis times; S k This represents the anomaly intensity vector of all nodes in the network at the k-th discrete time step; The core propagation features of computation specifically include: Abnormal net diffusion p i This is used to determine whether a network node's outward diffusion or reception is abnormal; the calculation formula is p. i =∑ j=1 |V| a ij (T i -T j By comparing the abnormal states of node i with those of its neighboring nodes, the ability of node i to spread abnormalities is quantified, which is the core indicator for determining whether a node is the originating node. p i When the value is >0: The abnormal state of network node i is higher than that of its neighboring nodes, the abnormality spreads outward, and it has the characteristics of the originating node; p iWhen <0: Network node i is in an abnormal state lower than its neighboring nodes, receives externally transmitted abnormalities, and exhibits characteristics of a derived node; Among them, T i T represents the abnormal state after propagation by network node i; j T represents the abnormal state of network node i after propagation to its neighboring network node j; i and T j All are normalized abnormal state values ​​obtained after discrete iterative calculation of the graph heat diffusion model. The values ​​range from 0 to 1. The larger the value, the more severe the abnormality of the corresponding node. The calculation process depends on the anomaly intensity vector of all nodes in the network and the graph Laplacian matrix in the previous steps. They are the core parameters for calculating the net anomaly diffusion. Abnormal growth rate g i The discrete realization of the diffusion derivative represents the rate of deterioration of nodal anomalies, and is calculated using the formula g. i =(T i k -T i k−1 ) / Δτ; By comparing the abnormal state of node i in two adjacent discrete time steps, the rate of deterioration of the anomaly is quantified. The faster the node deteriorates, the more likely it is to be the root cause node or the key anomaly node. Among them, T i k T represents the abnormal state of network node i after propagation at step k; i k−1 This indicates the abnormal state of network node i after propagation in the previous step (k-1); T i k and T i k−1 These are the abnormal diffusion state values ​​at different time steps during the discrete iteration process, corresponding to the calculation results at the k-th and (k-1)-th steps, respectively, and are related to the abnormal diffusion state vector T. k T k-1 One-to-one correspondence, i.e., T i k It is T k The element corresponding to node i in the vector, T i k−1 It is T k-1 The changes in the values ​​of the elements corresponding to node i in the vector directly reflect the dynamic evolution trend of node anomalies. Bidirectional time delay q ij It is used to determine the order in which anomalies propagate between network nodes, and the calculation formula is q. ij =argmax q∈[−qmax,qmax] corr(T i (τ),T j(τ+q)); This formula determines the order of anomaly propagation by calculating the correlation between nodes i and j under different time delays, providing a core basis for sorting out the anomaly propagation chain. corr(·) can be calculated using the Pearson correlation coefficient to ensure the accuracy of the correlation judgment, which is consistent with the calculation method of the topological correlation coefficient in step 2. q ij A value greater than 0 indicates that node j lags behind node i, and the anomaly is propagated from i to j; q ij A value less than 0 indicates that node i is lagging behind node j, and the exception is transmitted from j to i. Where, q ij The anomalous propagation delay between node i and node j is represented by qmax; the preset maximum delay threshold is represented by corr(·); and the correlation calculation function is represented by T. i (τ) represents the abnormal state of network node i after propagation at time τ; T j (τ+q) represents the abnormal state of network node j after propagation at time τ, offset by q time units; T i (τ) and T j (τ+q) are both continuous nodal anomaly diffusion state values, which can be obtained through discrete iteration. k The vector interpolation fitting is used to adapt the correlation calculation to the continuous time dimension; where T i (τ) represents the real-time abnormal state of node i at time τ, where T j (τ+q) is the abnormal state of node j after shifting by q time units from time τ. The sign of q directly determines the direction of abnormal propagation and is a key parameter for sorting out the abnormal propagation chain. The core propagation features are used to characterize the transmission characteristics of anomalies between nodes, reflecting the anomalous role of nodes from different dimensions, providing a basis for root cause node screening. The three core features complement each other to ensure the accuracy of root cause localization. The three types of propagation characteristics were normalized and weighted to obtain the root cause score: R i =β1⋅p' i +β2⋅g' i −β3⋅q' i The purpose of normalization is to eliminate the dimensional differences among the three types of propagation characteristics, so that the weighted summation of root cause scores is comparable. Among them, R i p' represents the root cause score of node i; β1, β2, and β3 represent manually set feature weight coefficients; i g' represents the normalized net anomalous diffusion at node i; i q' represents the normalized abnormal growth rate of node i; i This represents the normalized mean of the abnormal propagation delay at node i; q ijIt is the time delay between node i and a single neighbor j; a node i can have multiple neighbors j, and therefore multiple q. ij When calculating the root cause score, what is needed is the time delay characteristic of node i itself; therefore, for all q... ij Take the average value and then normalize it to get q' i The subscript j disappears because the time delay between node pairs has changed to the average time delay of node i. By setting a root cause scoring threshold, the agent autonomously selects root cause nodes and simultaneously outputs a complete anomaly propagation chain as a reference; the anomaly propagation chain analysis can be combined with q ij The sign and magnitude of the nodes are arranged in the order of propagation, for example, node i → node j → node k, clearly showing the abnormal diffusion path.

[0010] An intelligent analysis system for network operation status based on artificial intelligence, the system includes a data acquisition module, a time series processing module, an anomaly assessment module, and a root cause analysis module; The data acquisition module is used to construct a network graph that includes a set of network nodes, a set of links, and a topological adjacency matrix; collect the operating indicators of each network node, and summarize them to form the original observation dataset; The time series processing module is used to perform time series normalization on the original observation dataset to obtain alignment index data under a unified time axis. The anomaly assessment module is used to construct a historical baseline based on historical data of network nodes, compare and standardize the alignment index data with the historical baseline, and obtain the comprehensive anomaly intensity of nodes and the anomaly intensity vector of all network nodes. The root cause analysis module is used to calculate the graph Laplacian matrix based on the topological adjacency matrix, construct a graph heat diffusion model to simulate the abnormal transmission process, calculate the core propagation characteristics, obtain the root cause score after normalization and weighting of the core propagation characteristics, filter the root cause nodes according to the root cause score threshold, and sort out and output the abnormal propagation chain.

[0011] The data acquisition module includes a network modeling unit and an indicator acquisition unit; The network modeling unit is used to construct a network topology diagram containing network nodes, links, and adjacency matrices based on the physical or logical connection relationships between network devices; the indicator acquisition unit is used to monitor each device unit in the network in real time, collect its various operating indicators, and summarize the monitoring data of all nodes to form the original observation dataset.

[0012] The time series processing module includes an observation point filtering unit and an adaptive interpolation unit. The observation point filtering unit is used to filter valid observation points from the original observation dataset at the target time point where data needs to be generated; the adaptive interpolation unit is used to dynamically select the alignment method based on the number of valid observation points.

[0013] The anomaly assessment module includes a baseline construction unit, an anomaly quantification unit, and an intensity integration unit; The baseline construction unit is used to select historical data from stable network operation periods, calculate each node and each type of operation indicator, and form a historical baseline reflecting the normal state. The anomaly quantification unit is used to compare the aligned real-time indicator data with the corresponding historical baseline, eliminate the difference in dimensions through standardization, and then perform weighted summation on different indicators to calculate the comprehensive anomaly intensity of the node. The intensity integration unit is used to summarize the comprehensive anomaly intensity of all nodes to form a network-wide node anomaly intensity vector.

[0014] The root cause analysis module includes a thermal diffusion modeling unit, a propagation feature extraction unit, and a root cause scoring unit. The heat diffusion modeling unit is used to construct a graph heat diffusion model based on the Laplacian matrix of the network topology to simulate the transmission and diffusion process of anomalies between network nodes; the propagation feature extraction unit is used to analyze the key behavioral features of network nodes during the anomaly diffusion process. The root cause scoring unit is used to normalize the extracted core propagation features and perform weighted summation according to preset weights to obtain the root cause score of each node; based on a set threshold, root cause nodes are screened and abnormal propagation chains are sorted out and output.

[0015] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention calculates the graph Laplace matrix based on the topological adjacency matrix, constructs a graph heat diffusion model to simulate the anomaly propagation process, calculates three core propagation characteristics—net anomaly diffusion, anomaly growth rate, and bidirectional time delay—and weights them to obtain a root cause score. This can accurately distinguish between the original causes and derivative results in network anomalies, quickly locate the root cause node, avoid delays in repair due to root cause misjudgment, and effectively address the problem of network-wide anomaly propagation caused by core node failures. This invention performs time-series normalization on the original observation dataset, uses adaptive alignment methods such as spatiotemporal joint weighted interpolation to solve data asynchrony and missing data problems, and combines standardized outlier calculation and weighted summation to obtain the comprehensive anomaly intensity of nodes. This can effectively filter invalid data and redundant alarms, reduce the generation of alarm storms, and alleviate the operational difficulties caused by cascading performance fluctuations of downstream nodes, such as packet loss and increased latency. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating an intelligent network operation status analysis system based on artificial intelligence, according to the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example: Figure 1 As shown, the present invention provides a technical solution, an intelligent analysis method for network operation status based on artificial intelligence, the method comprising the following steps: Step 1: Construct a network graph containing a set of network nodes, a set of links, and a topological adjacency matrix; collect operational metrics of each network node and summarize them to form the original observation dataset; Step 2: Perform time-series normalization on the original observation dataset to obtain alignment index data under a unified time axis; Step 3: Construct a historical baseline based on historical data of network nodes, compare the alignment index data with the historical baseline and standardize it to obtain the comprehensive anomaly intensity of nodes and the anomaly intensity vector of all nodes in the network. Step 4: Calculate the graph Laplacian matrix based on the topological adjacency matrix, construct a graph heat diffusion model to simulate the abnormal propagation process, and calculate the core propagation characteristics; after normalizing the core propagation characteristics, weight them to obtain the root cause score, filter the root cause nodes according to the root cause score threshold, and sort out and output the abnormal propagation chain.

[0019] In step 1, the purpose is to provide basic data support and topology framework for the analysis of the overall network operation status, so as to ensure that subsequent anomaly detection and root cause analysis have clear analysis objects and data sources, and avoid subsequent analysis deviations due to missing basic data or ambiguous topology. Based on the direct physical or logical connections between network nodes, construct a network graph G=(V,E,A); where V represents the set of network nodes, E represents the set of links between network nodes, and A=[a ij ] represents the topological adjacency matrix, a ij This represents the connection weight between network node i and its neighboring network node j; a ij The value of a can be set according to factors such as connection bandwidth and transmission delay. For example, when node i and node j are connected via Gigabit Ethernet, a ij It can be set to 1.0, or 0.5 for a 100Mbps connection, and a for no direct connection. ij =0, with a value range of 0 to 1. The larger the weight, the tighter the connection between nodes and the higher the data transmission efficiency. The network node refers to a device unit in the network that has independent operating indicators and can be monitored; specifically, it may include routers, switches, servers, gateways, etc. For example, the core switch, access router, and application server in an enterprise local area network are all network nodes in this solution, and their operating status directly affects the stability of the entire network. For each network node, operational metrics are collected. The measured value of the operational metrics recorded at a specific point in time is recorded as an observation point for that network node. The operational metrics of the network node can refer to conventional operation and maintenance monitoring standards, including CPU utilization, memory usage, bandwidth utilization, packet loss rate, TCP connection count, etc. By aggregating all network nodes and observation points at all times, the original observation dataset is obtained.

[0020] Step 2 aims to address the issues of asynchronous sampling times for operational metrics across different network nodes and missing data at certain time points. It ensures that the metric data from all nodes are on the same timeline, providing a unified data foundation for subsequent comparisons with historical baselines and anomaly analysis, thus preventing misjudgments of anomalies due to time-series inconsistencies. The timing warping includes handling asynchronous sampling and missing data, specifically including: For the target time point τ0 where data needs to be generated, filter the valid observation points N that can be called before and after the time point, and dynamically select the alignment method according to the number of N; the target time point can be set according to the actual analysis needs, for example, a target time point can be set every 1 minute to ensure that the analysis granularity meets the network operation and maintenance needs. Asynchronous sampling refers to the inconsistent sampling times of operational metrics across different network nodes; missing data refers to the absence of valid observations at certain time points. The effective observation points refer to the observation points that are actually recorded and can be used in the calculation; When N ≥ 3, spatiotemporal weighted interpolation is used; when N = 2, linear interpolation fitting is used; the linear interpolation fitting is a conventional data completion method, that is, fitting the value of the target time point based on the values ​​of two effective observation points and the time interval; when N = 1, the operational index data of the effective observation point is used. When the number of effective observation points N=0, there is no available measured data. The historical normal mean of the index for that node is directly used. The historical normal mean can be extracted in advance from the historical baseline data in step 3 to ensure that the supplemented data fits the normal operating status of the node and avoids the interruption of subsequent analysis due to lack of data. The spatiotemporal joint weighted interpolation specifically includes: x i m (τ0)=Σ r=1 N w i,r (τ0)·x i m (ti,r By integrating the weights of both time and space factors, the interpolation results are made to better reflect the actual network operating state. Where, x i m (τ0) represents the alignment and reconstruction value of the m-th operational metric of network node i at the target time τ0; w i,r (τ0) represents the spatiotemporal joint weight of the r-th effective observation point, which is calculated from the temporal distance, the centroid interpolation coefficient, and the topological correlation strength; x i m (t i,r ) represents network node i at time t i,r The original value of the m-th operational indicator on the t; i,r This represents the time of network node i at the r-th valid observation point; w i,r (τ0)=(ρ i,r ·λ i,r ·|τ0-t i,r | -1 ) / (Σ s=1 N ρ i,s ·λ i,s ·|τ0-t i,s | -1 ); Where the denominator is the weighted sum of all valid observations; λ i,r =1 / ∏ s=1,s≠r N (t i,r -t i,s ), representing the barycentric interpolation coefficient; s represents the s-th effective observation point; |τ0-t i,r | represents the time distance between the target time τ0 and the time of the r-th valid observation point; the closer the distance, the greater the weight. ρ i,r The topological correlation coefficient is obtained by determining the neighboring nodes of node i based on the topological adjacency matrix A=[a] constructed in the scheme. ij ] Filter out neighboring nodes that are connected to node i; calculate the correlation between the historical indicators of node i and each neighboring node: select the historical stable operation indicator data of node i and all its neighboring nodes, which is consistent with the data source for constructing the historical baseline in step 3; for the m-th type of operation indicator, calculate the correlation between the historical indicators of node i and each neighboring node j; optionally, use the Pearson correlation coefficient to quantify the synchronicity of the changes in the indicators of the two, with a value of -1 to 1, the stronger the synchronicity, the larger the absolute value; Combine the adjacency matrix weights a ij Weighted fusion: The historical correlation of each neighboring node j is combined with the corresponding adjacency matrix weight a. ijMultiplying them together yields the weighted correlation between node i and its neighboring node j (weight a). ij The larger the value, the greater the corresponding neighborhood node pair ρ. i,r The greater the impact.

[0021] Normalization yields ρ i,r The weighted correlations of all neighboring nodes are summed, then divided by the sum of the adjacency matrix weights of all neighboring nodes to complete the normalization process, finally yielding the topological correlation coefficient ρ. i,r Ensure that its value is between 0 and 1, and directly use it for subsequent spatiotemporal joint weight ω. i,r Calculation of (τ0); In step 3, the goal is to establish a reference standard for the normal operating status of network nodes. By comparing the real-time aligned indicator data with historical baselines, abnormal situations deviating from the normal state can be accurately identified. Historical data from network nodes during periods of stable operation without faults or congestion are selected, such as stable operation data from the past 3-6 months, or low-load periods in the early morning of each day, when the network is fault-free, congestion-free, and the data is highly stable. Statistical calculations are performed on each network node and each type of operational metric to form a historical baseline: the historical normal average μ of the m-th type of operational metric for network node i. i m The historical normal standard deviation σ of the m-th type of operating metric of network node i i m ; By comparing the alignment index data with the historical baseline, differences in the units and magnitudes of different indices are eliminated, resulting in standardized outliers. Optionally, the formula for calculating standardized outliers is: x i m '(τ)=(x i m (τ)-μ i m ) / σ i m +ε, where ε is a minimal number to prevent the denominator from being zero; the standardized outliers are weighted and summed to obtain the node comprehensive outlier intensity s in a single numerical form. i (τ); where s i (τ) represents the overall anomaly intensity of the network node i at time τ; the weights corresponding to different operating indicators are determined based on manual preset. The anomaly intensities of all nodes are integrated to form a network-wide node anomaly intensity vector S(τ)=[s1(τ),s2(τ),…,s |V| (τ)] T The larger the value in the vector, the more severe the node anomaly; where |V| represents the total number of elements in set V; In step 4, by simulating the propagation process of anomalies among network nodes, the core propagation characteristics of the anomalies are explored, the root cause nodes of the anomalies are accurately identified, and the propagation paths of the anomalies are analyzed. This provides precise guidance for network fault diagnosis and repair, shortens the fault diagnosis time, and improves network operation and maintenance efficiency. The graph Laplacian matrix can be calculated using common graph theory tools such as NetworkX, simplifying the calculation process. The degree matrix D and the graph Laplacian matrix L are calculated based on the topological adjacency matrix A. The degree matrix and the graph Laplacian matrix are the core foundation of the graph heat diffusion model, used to characterize the connection relationships between network nodes and the laws of anomalous diffusion. They are common applications of graph theory in network anomaly analysis. The degree matrix D is a diagonal matrix, and the diagonal elements d i =∑ j=1 |V| a ij , representing the total number of connections to node i; The graph Laplacian matrix L=D−A is used to characterize the anomalous diffusion relationships between nodes; A graph-based heat diffusion model is constructed to simulate the anomaly propagation process. The anomaly intensity vector of all network nodes is regarded as the diffusion state vector T(τ) on the graph. The continuous form of the anomaly diffusion equation is defined as: dT(τ) / dτ=−αLT(τ)+S(τ). The graph-based heat diffusion model is the core model for simulating anomaly propagation. It draws on the physical principle of heat diffusion, treating anomalies as "heat" that is conducted between network nodes. The continuous form of the diffusion equation is suitable for theoretical analysis, but it needs to be converted into a discrete form in actual calculations to adapt to the discrete characteristics of time series data. The discretization of the diffusion model can refer to the discretization idea of ​​the DDIM model, which discretizes the continuous diffusion process into several steps. Where dT(τ) / dτ refers to the first derivative of the abnormal state quantity T(τ) with respect to time, representing the instantaneous rate of change of the abnormality over time; α represents the abnormality diffusion coefficient, which controls the propagation speed of the abnormality among network nodes; L represents the graph Laplace matrix; T(τ) represents the abnormality diffusion state vector of the network node at time τ; and S(τ) represents the abnormality intensity vector of all network nodes, serving as an external abnormality injection term.

[0022] The calculation employs a discrete iterative approach, adapted to time-series data: T k+1 =T k −α⋅Δτ⋅LT k +Δτ⋅S k The discrete iterative form transforms the continuous diffusion equation into a computable form, adapting to the discrete sampling characteristics of time series data. Through multiple iterations, it simulates the propagation process of anomalies at different time steps. The number of iterations can be set according to the network size and analysis requirements, typically 10 to 50 rounds. Among them, T kLet S represent the anomaly diffusion state vector at the k-th discrete time step; Δτ represents the discrete time step size, the interval between adjacent analysis times; S k This represents the anomaly intensity vector of all nodes in the network at the k-th discrete time step; The core propagation features for computation specifically include: Abnormal net diffusion p i This is used to determine whether a network node's outward diffusion anomaly or its receiving anomaly is caused by p. i =∑ j=1 |V| a ij (T i -T j By comparing the abnormal states of node i with those of its neighboring nodes, the ability of node i to spread abnormalities is quantified, which is the core indicator for determining whether a node is the originating node. p i When the value is >0: The abnormal state of network node i is higher than that of its neighboring nodes, the abnormality spreads outward, and it has the characteristics of the originating node; p i When <0: Network node i is in an abnormal state lower than its neighboring nodes, receives abnormal external inputs, and exhibits characteristics of a derived node; Among them, T i T represents the abnormal state after propagation by network node i; j T represents the abnormal state of network node i after propagation to its neighboring network node j; i and T j All are normalized abnormal state values ​​obtained after discrete iterative calculation of the graph heat diffusion model. The values ​​range from 0 to 1. The larger the value, the more severe the abnormality of the corresponding node. The calculation process depends on the anomaly intensity vector of all nodes in the network and the graph Laplacian matrix in the previous steps. They are the core parameters for calculating the net anomaly diffusion. Abnormal growth rate g i The discrete realization of the diffusion derivative represents the rate of deterioration of nodal anomalies, and is calculated using the formula g. i =(T i k -T i k−1 ) / Δτ; By comparing the abnormal state of node i in two adjacent discrete time steps, the rate of deterioration of the anomaly is quantified. The faster the node deteriorates, the more likely it is to be the root cause node or the key anomaly node. Among them, T i k T represents the abnormal state of network node i after propagation at step k; i k−1 This represents the abnormal state of network node i after propagation in the previous step (k-1); T i k and T ik−1 These are the abnormal diffusion state values ​​at different time steps during the discrete iteration process, corresponding to the calculation results at the k-th and (k-1)-th steps, respectively, and are related to the abnormal diffusion state vector T. k T k-1 One-to-one correspondence, i.e., T i k It is T k The element corresponding to node i in the vector, T i k−1 It is T k-1 The changes in the values ​​of the elements corresponding to node i in the vector directly reflect the dynamic evolution trend of node anomalies. Bidirectional time delay q ij It is used to determine the order in which anomalies propagate between network nodes, and the calculation formula is q. ij =argmax q∈[−qmax,qmax] corr(T i (τ),T j (τ+q)); This formula determines the order of anomaly propagation by calculating the correlation between nodes i and j under different time delays, providing a core basis for sorting out the anomaly propagation chain. corr(·) can be calculated using the Pearson correlation coefficient to ensure the accuracy of the correlation judgment, which is consistent with the calculation method of the topological correlation coefficient in step 2. q ij A value greater than 0 indicates that node j lags behind node i, and the anomaly is propagated from i to j; q ij A value less than 0 indicates that node i is lagging behind node j, and the exception is transmitted from j to i. Where, q ij The anomalous propagation delay between node i and node j is represented by qmax; the preset maximum delay threshold is represented by corr(·); and the correlation calculation function is represented by T. i (τ) represents the abnormal state of network node i after propagation at time τ; T j (τ+q) represents the abnormal state of network node j after propagation at time τ, offset by q time units; T i (τ) and T j (τ+q) are both continuous nodal anomaly diffusion state values, which can be obtained through discrete iteration. k The vector interpolation fitting is used to adapt the correlation calculation to the continuous time dimension; where T i (τ) represents the real-time abnormal state of node i at time τ, where T j (τ+q) is the abnormal state of node j after shifting by q time units from time τ. The sign of q directly determines the direction of abnormal propagation and is a key parameter for sorting out the abnormal propagation chain. The core propagation features are used to characterize the transmission characteristics of anomalies between nodes, reflecting the anomalous role of nodes from different dimensions, providing a basis for root cause node screening. The three core features complement each other to ensure the accuracy of root cause localization. The three types of propagation characteristics were normalized and weighted to obtain the root cause score: R i =β1⋅p' i +β2⋅g' i −β3⋅q' i The purpose of normalization is to eliminate the dimensional differences among the three types of propagation characteristics, so that the weighted summation of root cause scores is comparable. Among them, R i p' represents the root cause score of node i; β1, β2, and β3 represent manually set feature weight coefficients; i g' represents the normalized net anomalous diffusion at node i; i q' represents the normalized abnormal growth rate of node i; i This represents the normalized mean of the abnormal propagation delay at node i; q ij It is the time delay between node i and a single neighbor j; a node i can have multiple neighbors j, and therefore multiple q. ij When calculating the root cause score, what is needed is the time delay characteristic of node i itself; therefore, for all q... ij Take the average value and then normalize it to get q' i The subscript j disappears because the time delay between node pairs has changed to the average time delay of node i. Set a root cause scoring threshold to filter out root cause nodes, and simultaneously trace the complete anomaly propagation chain for output as a reference; the anomaly propagation chain tracing can be combined with q ij The sign and magnitude of the nodes are arranged in the order of propagation, for example, node i → node j → node k, clearly showing the abnormal diffusion path.

[0023] An intelligent analysis system for network operation status based on artificial intelligence, the system includes a data acquisition module, a time series processing module, an anomaly assessment module, and a root cause analysis module; The data acquisition module is used to construct a network graph that includes a set of network nodes, a set of links, and a topological adjacency matrix; collect the operating indicators of each network node, and summarize them to form the original observation dataset; The time series processing module is used to perform time series normalization on the original observation dataset to obtain alignment index data under a unified time axis. The anomaly assessment module is used to construct a historical baseline based on historical data of network nodes, compare and standardize the alignment index data with the historical baseline, and obtain the comprehensive anomaly intensity of nodes and the anomaly intensity vector of all network nodes. The root cause analysis module is used to calculate the graph Laplacian matrix based on the topological adjacency matrix, construct a graph heat diffusion model to simulate the abnormal transmission process, calculate the core propagation characteristics, obtain the root cause score after normalization and weighting of the core propagation characteristics, filter the root cause nodes according to the root cause score threshold, and sort out and output the abnormal propagation chain.

[0024] The data acquisition module includes a network modeling unit and an indicator acquisition unit; The network modeling unit is used to construct a network topology diagram containing network nodes, links, and adjacency matrices based on the physical or logical connection relationships between network devices; the indicator acquisition unit is used to monitor each device unit in the network in real time, collect its various operating indicators, and summarize the monitoring data of all nodes to form the original observation dataset.

[0025] The time series processing module includes an observation point filtering unit and an adaptive interpolation unit. The observation point filtering unit is used to filter valid observation points from the original observation dataset at the target time point where data needs to be generated; the adaptive interpolation unit is used to dynamically select the alignment method based on the number of valid observation points.

[0026] The anomaly assessment module includes a baseline construction unit, an anomaly quantification unit, and an intensity integration unit; The baseline construction unit is used to select historical data from stable network operation periods, calculate each node and each type of operation indicator, and form a historical baseline reflecting the normal state. The anomaly quantification unit is used to compare the aligned real-time indicator data with the corresponding historical baseline, eliminate the difference in dimensions through standardization, and then perform weighted summation on different indicators to calculate the comprehensive anomaly intensity of the node. The intensity integration unit is used to summarize the comprehensive anomaly intensity of all nodes to form a network-wide node anomaly intensity vector.

[0027] The root cause analysis module includes a thermal diffusion modeling unit, a propagation feature extraction unit, and a root cause scoring unit. The heat diffusion modeling unit is used to construct a graph heat diffusion model based on the Laplacian matrix of the network topology to simulate the transmission and diffusion process of anomalies between network nodes; the propagation feature extraction unit is used to analyze the key behavioral features of network nodes during the anomaly diffusion process. The root cause scoring unit is used to normalize the extracted core propagation features and perform weighted summation according to preset weights to obtain the root cause score of each node; based on a set threshold, root cause nodes are screened and abnormal propagation chains are sorted out and output.

[0028] In this embodiment, a data center network for a small and medium-sized enterprise includes 5 core network nodes: V1 core switch, V2 access switch 1, V3 access switch 2, V4 service server, and V5 egress gateway. Topology: V1 is directly connected to V2 / V3 / V5; V2 is directly connected to V4, with no other cross-node connections; When the core switch V1 experiences minor congestion, it triggers a network-wide alarm storm, with V2 / V3 / V4 / V5 all reporting anomalies. Construct a network graph G=(V,E,A), with node set V{V1,V2,V3,V4,V5} and link set E{(V1,V2), (V1,V3), (V1,V5), (V2,V4)}; and a topological adjacency matrix A with weights of 1.0 for gigabit connections, 0.5 for 100 Mbps connections, and 0 for no connections. ; Four core metrics are collected, including CPU utilization, bandwidth utilization, packet loss rate, and latency. The original data has issues: V1 / V5 has a sampling frequency of 1 minute / time; V2 / V3 has a sampling frequency of 2 minutes / time; V4 has occasional sampling interruptions and missing data. The target analysis time is τ0=14:00. Some nodes do not have actual measured values ​​at this time, indicating asynchronous sampling and data loss. Using 1 minute as the unified target time point τ0, adaptive interpolation is performed based on the number of effective observation points N: Filter valid observation points, the number of valid observation points for each node before and after τ0=14:00; V1, N=3, uses spatiotemporal weighted interpolation; V2, N=2, uses linear interpolation; V4, N=0, uses historical mean for completion. All node metrics are unified to the 14:00 timeline, with no missing or asynchronous data, resulting in aligned metric data; We selected fault-free data from 2:00 AM to 4:00 AM daily for the past three months and calculated the historical mean μ for each node and each indicator. im Standard deviation σ im : Calculate standardized outliers x' im (τ)=((x im (τ)-μ im ) / σ im )+ε; The four indicators were manually weighted and summed, with CPU at 0.3, bandwidth at 0.3, packet loss at 0.2, and latency at 0.2, to obtain the overall node anomaly strength s. i(τ); V1, s1=9.2, severe abnormality; V2, s2=2.8, moderate abnormality; V3, s3=2.5, moderate abnormality; V4, s4=1.1, slight abnormality; V5, s5=2.6, moderate abnormality; Generate the anomaly strength vector S(τ) = [9.2, 2.8, 2.5, 1.1, 2.6] for all nodes in the network. T ; Step 4: Calculate the degree matrix D, where the diagonal elements equal the total connection weights of the nodes, and D = diag[3.0, 1.5, 1.0, 0.5, 1.0]. The graphical Laplacian matrix L=DA, ; Simulation was performed using a discrete iterative formula, with a diffusion coefficient α = 0.1, and 20 iterations were performed. k+1 =T k −α·Δτ·LT k +Δτ·S k ; Obtain the normalized abnormal state T after propagation at each node i , T1=0.98, T2=0.32, T3=0.29, T4=0.12, T5=0.30; Calculate the three types of core propagation features; Abnormal net diffusion p i Used to determine diffusion / reception, formula p i =Σa ij (T i -T j ); V1, p1=0.65, greater than 0, outward diffusion anomaly, characteristic of the originating node; V2, p2=-0.21, less than 0, reception anomaly, derived node; Abnormal growth rate g i Used to determine the rate of deterioration, formula g i =(T ik -T i(k-1) V1, g1=0.42, which is much higher than other nodes, indicating the fastest deterioration; Bidirectional time delay q ij Used to determine the conduction order, formula q ij =argmaxcorr(T i (τ),T j (τ+q));-q 12 =+2、q 13 =+2、q 15 =+1、q 24 =+3, a positive number indicates that the subsequent node is lagging behind, and the anomaly is propagated from front to back; After feature normalization, a weighted calculation is performed, R i=0.4·p' i +0.4·g' i −0.2·q' i The threshold was set at 5.0, and a score ≥ 5.0 was considered the root cause; V1 had an R1 = 8.6, which far exceeded the threshold; for other nodes, R < 3.0. Output the anomaly propagation chain, combined with the time delay q. ij The unique transmission path is identified as follows: V1 (root cause) → V2 → V4, V1 (root cause) → V3, V1 (root cause) → V5.

[0029] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A network operation status intelligent analysis method based on artificial intelligence, characterized in that: The method includes the following steps: Step 1: Construct a network graph containing a set of network nodes, a set of links, and a topological adjacency matrix; collect operational metrics of each network node and summarize them to form the original observation dataset; Step 2: Perform time-series normalization on the original observation dataset to obtain alignment index data under a unified time axis; Step 3: Construct a historical baseline based on historical data of network nodes, compare the alignment index data with the historical baseline and standardize it to obtain the comprehensive anomaly intensity of nodes and the anomaly intensity vector of all nodes in the network. Step 4: Calculate the graph Laplacian matrix based on the topological adjacency matrix, construct a graph heat diffusion model to simulate the abnormal propagation process, and calculate the core propagation characteristics; after normalizing the core propagation characteristics, weight them to obtain the root cause score, filter the root cause nodes according to the root cause score threshold, and sort out and output the abnormal propagation chain.

2. The intelligent analysis method for network operation status based on artificial intelligence according to claim 1, characterized in that: Step 1 specifically includes: Based on the direct physical or logical connections between network nodes, construct a network graph G=(V,E,A); where V represents the set of network nodes, E represents the set of links between network nodes, and A=[a ij ] represents the topological adjacency matrix, a ij This represents the connection weight between network node i and its neighboring network node j; The network node refers to a device unit in the network that has independent operating indicators and can be monitored. For each network node, operational metrics are collected. The measured value of the operational metrics recorded at a specific point in time is recorded as an observation point for that network node. By aggregating all network nodes and observation points at all times, the original observation dataset is obtained.

3. The intelligent analysis method for network operation status based on artificial intelligence according to claim 2, characterized in that: Step 2 specifically includes: The timing warping includes handling asynchronous sampling and missing data, specifically including: For the target time point τ0 where data needs to be generated, filter the valid observation points N that can be called before and after the time point, and dynamically select the alignment method according to the number of N. The effective observation points refer to the observation points that are actually recorded and can be used in the calculation; When N ≥ 3, spatiotemporal weighted interpolation is used; when N = 2, linear interpolation fitting is used; when N = 1, the operational index data of the effective observation point is used. The spatiotemporal joint weighted interpolation specifically includes: x i m (τ0)=Σ r=1 N w i,r (τ0)·x i m (t i,r ); Where, x i m (τ0) represents the alignment and reconstruction value of the m-th operational metric of network node i at the target time τ0; w i,r (τ0) represents the spatiotemporal joint weight of the r-th effective observation point; x i m (t i,r ) represents network node i at time t i,r The original value of the m-th operational indicator on the t; i,r This represents the time of network node i at the r-th valid observation point.

4. The intelligent analysis method for network operation status based on artificial intelligence according to claim 3, characterized in that: Step 3 specifically includes: We select historical data from network nodes during periods of no faults, no congestion, and stable operation, and perform statistical calculations for each network node and each type of operational indicator to form a historical baseline: the historical normal mean μ of the m-th type of operational indicator for network node i. i m The historical normal standard deviation σ of the m-th type of operating metric of network node i i m ; By comparing the alignment index data with historical baselines to eliminate differences in the dimensions and numerical magnitudes of different indicators, standardized outliers are obtained. These standardized outliers are then weighted and summed to obtain the node comprehensive outlier intensity s in a single numerical form. i (τ); where s i (τ) represents the overall anomaly intensity of the network node i at time τ; the weights corresponding to different operating indicators are determined based on manual preset. The anomaly intensities of all nodes are integrated to form a network-wide node anomaly intensity vector: S(τ) = [s1(τ), s2(τ), ..., s |V| (τ)] T ; where |V| represents the total number of elements in set V.

5. The intelligent analysis method for network operation status based on artificial intelligence according to claim 4, characterized in that: Step 4 specifically includes: Calculate the degree matrix D and the graph Laplacian matrix L based on the topological adjacency matrix A: Degree matrix D: a diagonal matrix, with diagonal elements d i =∑ j=1 |V| a ij , representing the total number of connections to node i; The graph Laplacian matrix L=D−A is used to characterize the anomalous diffusion relationships between nodes; A graph-based heat diffusion model is constructed to simulate the anomaly propagation process. The anomaly intensity vector of all nodes in the network is regarded as the diffusion state vector T(τ) on the graph. The continuous form of the anomaly diffusion equation is defined as: dT(τ) / dτ=−αLT(τ)+S(τ); Where dT(τ) / dτ refers to the first derivative of the abnormal state quantity T(τ) with respect to time, representing the instantaneous rate of change of the abnormality over time; α represents the abnormality diffusion coefficient, which controls the propagation speed of the abnormality between network nodes; L represents the graph Laplace matrix; T(τ) represents the abnormality diffusion state vector of the network node at time τ; S(τ) represents the abnormality intensity vector of all network nodes, serving as an external abnormality injection term. The calculation employs a discrete iterative approach, adapted to time-series data: T k+1 =T k −α⋅Δτ⋅LT k +Δτ⋅S k ; Among them, T k Let S represent the anomaly diffusion state vector at the k-th discrete time step; Δτ represents the discrete time step size, the interval between adjacent analysis times; S k This represents the anomaly intensity vector of all nodes in the network at the k-th discrete time step; The core propagation features of computation specifically include: Abnormal net diffusion p i This is used to determine whether a network node's outward diffusion anomaly or its receiving anomaly is due to an error. The calculation formula is: p i =∑ j=1 |V| a ij (T i -T j ); Among them, T i T represents the abnormal state after propagation by network node i; j This represents the abnormal state of network node i after propagation to its neighboring network node j; Abnormal growth rate g i The discrete realization of the diffusion derivative represents the rate of deterioration of nodal anomalies, calculated using the formula: g i =(T i k -T i k−1 ) / Δτ; Among them, T i k T represents the abnormal state of network node i after propagation at step k; i k−1 This indicates the abnormal state of network node i after propagation in the previous step (k-1); Bidirectional time delay q ij Used to determine the order in which anomalies propagate between network nodes, the calculation formula is: q ij =argmax q∈[−qmax,qmax] corr(T i (τ),T j (τ+q)); Where, q ij The anomalous propagation delay between node i and node j is represented by qmax; the preset maximum delay threshold is represented by corr(·); and the correlation calculation function is represented by T. i (τ) represents the abnormal state of network node i after propagation at time τ; T j (τ+q) represents the abnormal state of network node j after propagation at time τ, offset by q time units. The three types of propagation characteristics were normalized and weighted to obtain the root cause score: R i =β1⋅p' i +β2⋅g' i −β3⋅q' i ; Among them, R i p' represents the root cause score of node i; β1, β2, and β3 represent manually set feature weight coefficients; i g' represents the normalized net anomalous diffusion at node i; i q' represents the normalized abnormal growth rate of node i; i This represents the normalized mean of the abnormal propagation delay at node i; Set a root cause scoring threshold to filter out root cause nodes, and at the same time sort out the abnormal propagation chain for output.

6. An intelligent network operation status analysis system based on artificial intelligence, applied to the intelligent network operation status analysis method based on artificial intelligence as described in any one of claims 1-5, characterized in that: The system includes a data acquisition module, a time series processing module, an anomaly assessment module, and a root cause analysis module; The data acquisition module is used to construct a network graph that includes a set of network nodes, a set of links, and a topological adjacency matrix; collect the operating indicators of each network node, and summarize them to form the original observation dataset; The time series processing module is used to perform time series normalization on the original observation dataset to obtain alignment index data under a unified time axis. The anomaly assessment module is used to construct a historical baseline based on historical data of network nodes, compare and standardize the alignment index data with the historical baseline, and obtain the comprehensive anomaly intensity of nodes and the anomaly intensity vector of all network nodes. The root cause analysis module is used to calculate the graph Laplacian matrix based on the topological adjacency matrix, construct a graph heat diffusion model to simulate the abnormal transmission process, calculate the core propagation characteristics, obtain the root cause score after normalization and weighting of the core propagation characteristics, filter the root cause nodes according to the root cause score threshold, and sort out and output the abnormal propagation chain.

7. The intelligent network operation status analysis system based on artificial intelligence according to claim 6, characterized in that: The data acquisition module includes a network modeling unit and an indicator acquisition unit; The network modeling unit is used to construct a network topology diagram containing network nodes, links, and adjacency matrices based on the physical or logical connection relationships between network devices; the indicator acquisition unit is used to monitor each device unit in the network in real time, collect its various operating indicators, and summarize the monitoring data of all nodes to form the original observation dataset.

8. The intelligent network operation status analysis system based on artificial intelligence according to claim 7, characterized in that: The time series processing module includes an observation point filtering unit and an adaptive interpolation unit. The observation point filtering unit is used to filter valid observation points from the original observation dataset at the target time point where data needs to be generated; the adaptive interpolation unit is used to dynamically select the alignment method based on the number of valid observation points.

9. The intelligent network operation status analysis system based on artificial intelligence according to claim 8, characterized in that: The anomaly assessment module includes a baseline construction unit, an anomaly quantification unit, and an intensity integration unit; The baseline construction unit is used to select historical data from stable network operation periods, calculate each node and each type of operation indicator, and form a historical baseline reflecting the normal state. The anomaly quantification unit is used to compare the aligned real-time indicator data with the corresponding historical baseline, eliminate the difference in dimensions through standardization, and then perform weighted summation on different indicators to calculate the comprehensive anomaly intensity of the node. The intensity integration unit is used to summarize the comprehensive anomaly intensity of all nodes to form a network-wide node anomaly intensity vector.

10. The intelligent network operation status analysis system based on artificial intelligence according to claim 9, characterized in that: The root cause analysis module includes a thermal diffusion modeling unit, a propagation feature extraction unit, and a root cause scoring unit. The heat diffusion modeling unit is used to construct a graph heat diffusion model based on the Laplacian matrix of the network topology to simulate the transmission and diffusion process of anomalies between network nodes; the propagation feature extraction unit is used to analyze the key behavioral features of network nodes during the anomaly diffusion process. The root cause scoring unit is used to normalize the extracted core propagation features and perform weighted summation according to preset weights to obtain the root cause score of each node. Based on the set threshold, root cause nodes are filtered out, and the abnormal propagation chain is sorted out and output.

Images