Video abnormal link micro-segmentation positioning method and system

Abstract

The application discloses a video abnormal link micro-segmentation positioning method and system, the method comprises the following steps: combining the consistency of the network slice identifier, the link delay feature, and the transmission topology path, and mapping the abnormal mode matching result to the target link micro-segmentation. The application can cover short-time jitter, medium-time mutation and long-time trend by constructing hierarchical traffic fingerprints through three time windows, can strengthen the expression ability of video-specific fingerprints by calculating I / P frame proportion mutation through exponential sliding baseline and robust deviation score, and refining the RTP packet interval mean, standard deviation, quantile and jitter intensity statistical method, and can realize accurate locking of abnormal link micro-segmentation in cross-domain and multi-level forwarding scenes by combining network slice identifier and link delay probe for tracing, and can output more stable root cause probability ranking in complex composite fault and rare abnormal scenes by using Bayesian causal diagram and small sample transfer learning.

Description

Technical Field

[0001] This invention relates to the field of intelligent fault diagnosis technology for video surveillance networks. Specifically, it relates to a method and system for locating abnormal video links through micro-segmentation, applicable to carrier-dedicated video surveillance networks, campus Ethernet video surveillance networks, and other video network scenarios that support RTP / RTCP feature extraction. Background Technology

[0002] In carrier-dedicated lines or campus network environments, video surveillance services frequently experience hidden faults such as "video stuttering despite normal network ping." These faults often cannot be directly detected through ordinary connectivity tests, yet they significantly impact the continuity and availability of video surveillance. Video streams possess unique characteristics that distinguish them from ordinary data streams, such as RTP packet interval distribution, I / P frame ratio variations, RTCP packet loss feedback patterns, out-of-order delivery rates, and bitrate drift. These characteristics can be used to construct a unique traffic fingerprint for video streams, thereby aiding in the location of abnormal links.

[0003] However, most existing solutions still rely on a general framework of "collecting service features—matching with a fingerprint database—outputting abnormal links." On the one hand, using only a single time window or fixed threshold makes it difficult to simultaneously reflect short-term jitter, medium-term abrupt changes, and long-term drift. On the other hand, relying solely on static paths and coverage relationships for location can easily lead to fuzzy location of abnormal segments in cross-domain, multi-level forwarding, and slice-based concurrent carrying scenarios. Furthermore, relying solely on feature combinations for rule inference often suffers from weak generalization, unclear logical relationships, and difficulty in identifying rare anomalies when facing complex faults such as congestion, out-of-order delivery, continuous packet loss, and device queue anomalies.

[0004] Therefore, how to solve the problems of weak single-window fingerprint expression capability, static non-updating of normal / abnormal fingerprint database, ambiguity in locating abnormal link segments in cross-domain multi-level forwarding scenarios, difficulty in inferring the root cause of complex composite faults, and non-standard formula expression in existing technologies has become an urgent technical problem to be solved. Summary of the Invention

[0005] To address the aforementioned technical problems in related technologies, this invention proposes a video anomaly link micro-segmentation localization method and system, which can overcome the above-mentioned shortcomings of the prior art.

[0006] To achieve the above-mentioned technical objectives, the technical solution of the present invention is implemented as follows: A method for locating abnormal video links using micro-segmentation includes the following steps: S1 obtains the video stream to be analyzed, the corresponding network slice identifier, and the transmission topology path, and simultaneously constructs a short time window, a medium time window, and a long time window; S2 extracts the service features and link delay features of the video stream within each of the time windows; the service features are used to construct short window fingerprints, medium window fingerprints and long window fingerprints, and the link delay features are used for link micro-segmentation location scoring calculation and root cause inference; S3 constructs the short-window fingerprint, medium-window fingerprint, and long-window fingerprint based on the short-time window, medium-time window, and long-time window respectively, and merges the three into a unified traffic fingerprint vector; S4 performs distance matching between the unified traffic fingerprint vector and the pre-built normal fingerprint database and abnormal fingerprint database to obtain abnormal pattern matching results; S5 combines the consistency of the network slice identifier, the delay probe results in the link delay characteristics, and the transmission topology path to map the abnormal pattern matching result to the target link micro-segment; S6 constructs a Bayesian causal graph based on the unified traffic fingerprint vector, the link delay features, and the context information of the target link micro-segment, calculates the posterior probability of the abnormal root cause corresponding to the target link segment, and infers the type of abnormal root cause corresponding to the target link micro-segment by combining small sample transfer learning. S7 adaptively updates the normal fingerprint database and the abnormal fingerprint database based on the posterior confirmation result of the abnormal root cause type. S8 outputs the target link micro-segment, the anomaly root cause type, and its confidence level.

[0007] Furthermore, the video stream service features extracted in step S2 include one or more of the following: RTP packet interval distribution features, I / P frame ratio abrupt change features, RTCP packet loss feedback mode features, packet out-of-order features, and bitrate change features; the link delay features include: single-segment delay, adjacent probe delay increment, and slice drift features.

[0008] Further, in step S3, the short window fingerprint is mainly composed of RTP packet interval distribution features, which include at least the average packet interval, packet interval standard deviation, packet interval quantile, and short-term jitter intensity statistics; the medium window fingerprint is mainly composed of I / P frame ratio mutation features and RTCP feedback features, which are calculated using an exponential sliding baseline and robust bias scoring algorithm; the long window fingerprint is mainly composed of bitrate variation features and out-of-order ratio features; the unified traffic fingerprint vector is obtained by configuring fusion weights for the short window fingerprint, medium window fingerprint, and long window fingerprint respectively and then weighted and fused to simultaneously characterize short-term jitter, medium-term mutations, and long-term trends.

[0009] Furthermore, the normal fingerprint database and abnormal fingerprint database in step S4 are established offline from normal video samples and abnormal video samples that have been manually confirmed or confirmed by the system closed loop in the past, and are classified and maintained according to at least one of scene type, encoding method, bandwidth level and topology type. The specific steps to obtain the abnormal pattern matching result are as follows: Let the center of the j-th fingerprint be C_j, then the distance from the current fingerprint to the center of this class is defined as: D(F, C_j) = Σ_{k=1}^{3} ω_k × d(F_k, C_{j,k}), where F_k represents the short, medium, and long window components respectively, C_{j,k} is the corresponding class center component, ω_k is the hierarchical distance weight, and d(·) can be Mahalanobis distance or weighted Euclidean distance; compare the current fingerprint with the normal class center and the abnormal class center respectively, and select the class with the smallest distance as the initial pattern judgment result.

[0010] Further, in step S5, a location score is defined for each link micro-segment in the transmission topology path: S_loc(e_i) = a × Cov(e_i) + b × Δd_i + c ×Drift_σ(e_i), and the abnormal pattern matching result is mapped to the target link micro-segment based on the location score; where Cov(e_i) represents the coverage degree of the abnormal flow on the micro-segment, Δd_i represents the delay increment between adjacent probes of the micro-segment, and Drift_σ(e_i) represents the degree of inconsistency between the expected slice identifier of the micro-segment and the measured slice identifier of the adjacent probe.

[0011] Furthermore, the positioning rules in step S5 include: when a single path is abnormal, the access micro-segment is used as the target link micro-segment; when multiple points share the same aggregation node and the scores of the corresponding micro-segments increase in a concentrated manner, the aggregation micro-segment is used as the target link micro-segment; when the micro-segment scores increase synchronously across regions and multiple aggregation nodes, the core micro-segment is used as the target link micro-segment; when the scores of each micro-segment within the core are normal but the boundary exit micro-segment and slice drift are significant, the operator micro-segment is used as the target link micro-segment.

[0012] Furthermore, in step S6, the set of nodes in the Bayesian causal graph includes at least: congestion, continuous packet loss, out-of-order packets, switch queue anomalies, slice mismatch, and physical attenuation as root cause nodes, and short-term jitter intensity, I / P frame ratio mutation score, RTCP NACK feedback ratio, RTCP receive report anomaly ratio, average out-of-order ratio, adjacent probe delay increment, and slice drift degree as observable feature nodes.

[0013] Furthermore, the few-shot transfer learning in step S6 includes: when the number of samples of the target anomaly is insufficient, retrieving the K known scenarios from the historical scenario library that are most similar to the current network in terms of topology, encoding method, bandwidth level and slicing strategy, constructing a few-shot transfer prototype vector, and using it to correct the prior probability of each root cause node in the Bayesian causal graph.

[0014] Furthermore, the adaptive update in step S7 includes: when the current sample is confirmed as normal for multiple consecutive periods and the distance to the normal class center is less than a threshold, the current sample is merged into the normal fingerprint database; when multiple consecutive abnormal events are confirmed as the same type of abnormality, the center of the abnormality is updated based on the mean of the abnormal samples of the same type in this round.

[0015] A video anomaly link micro-segmentation localization system, comprising: The multi-window feature extraction module is used to obtain the video stream to be analyzed, network slice identifiers and transmission topology paths, construct multiple time windows, and extract video stream service features and link latency features; The hierarchical fingerprint construction module is used to construct short-window fingerprints, medium-window fingerprints, and long-window fingerprints based on the multiple time windows, and merge the three into a unified traffic fingerprint vector. The fingerprint database management module is used to maintain the normal fingerprint database and the abnormal fingerprint database, and to perform dynamic updates based on the post-verification results. The slicing and latency joint tracing module performs distance matching between the unified traffic fingerprint vector and the pre-built normal fingerprint database and abnormal fingerprint database to obtain abnormal pattern matching results; The link micro-segment mapping module is used to map the abnormal pattern matching result to the target link micro-segment based on the consistency of the network slice identifier, the delay probe result in the link delay characteristics, and the transmission topology path. The causal attribution module is used to infer the abnormal root cause type corresponding to the target link micro-segment based on Bayesian causal graphs and few-shot transfer learning; The output alarm module is used to output the target link micro-segment, the type of abnormal root cause, and its confidence level.

[0016] The beneficial effects of this invention are as follows: This invention constructs a hierarchical traffic fingerprint using short, medium, and long time windows, simultaneously covering short-term jitter, medium-term abrupt changes, and long-term trends, which is superior to single-time-window solutions. It calculates I / P frame ratio abrupt changes using exponential sliding baseline and robust deviation scoring, and refines the statistical methods for RTP packet interval mean, standard deviation, quantiles, and jitter intensity, enhancing the expressive power of video-specific fingerprints. Through joint tracing of network slice identification and link latency probes, it can achieve precise micro-segmentation locking of abnormal links in cross-domain and multi-level forwarding scenarios. Through Bayesian causal graphs and few-sample transfer learning, it can output more stable root cause probability rankings in complex composite faults and rare anomaly scenarios. Through adaptive updates of the normal / abnormal fingerprint database, the system can continuously optimize in response to long-term changes in the network environment. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is an overall flowchart of the video anomaly link micro-segmentation localization method according to an embodiment of the present invention; Figure 2 This is a diagram of the multi-time-window hierarchical traffic fingerprint and slice delay joint observation structure according to an embodiment of the present invention; Figure 3 This is a flowchart of fingerprint database dynamic update, link micro-segmentation mapping, and causal attribution as described in an embodiment of the present invention; Figure 4 This is a block diagram of a video anomaly link micro-segmentation localization system according to an embodiment of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention are within the scope of protection of the present invention.

[0020] like Figure 1-3 As shown, a video anomaly link micro-segmentation localization method according to an embodiment of the present invention includes the following steps: Step S1: Video stream access, slice information acquisition, and multi-time window construction. The video stream to be analyzed is acquired through edge mirroring probes, RTP / RTCP parsing modules, and device management interfaces; the corresponding slice identifier is obtained from the packet header, VLAN tag, SRv6 path segment, QoS identifier, or operator slice orchestration interface; during video stream operation, short, medium, and long time windows are simultaneously constructed in a sliding manner.

[0021] Let the current analysis time be t, and construct three sliding time windows: W_s = [t - Δ_s, t], W_m = [t - Δ_m,t], W_l = [t - Δ_l, t], Where W_s is a short time window, used to reflect short-term jitter; W_m is a medium time window, used to reflect sudden changes in frame structure; and W_l is a long time window, used to reflect trend drift, satisfying Δ_s < Δ_m < Δ_l. Here, Δ_s represents the window duration of the short time window, Δ_m represents the window duration of the medium time window, and Δ_l represents the window duration of the long time window. In one embodiment, Δ_s can be 2 s, Δ_m can be 10 s, and Δ_l can be 60 s.

[0022] Step S2: Extraction of video stream service features and link delay features. Within each time window, extract RTP packet interval distribution features, I / P frame ratio abrupt change features, RTCP packet loss feedback pattern features, packet out-of-order features, and bitrate variation features; simultaneously, collect single-segment delay, adjacent probe delay increment, and slice drift features along the path for each delay probe. The video stream service features are used to construct the short-window, medium-window, and long-window fingerprints in Step S3, and serve as observable nodes in the Bayesian causal graph in Step S6; the link delay features are used for link micro-segment location scoring calculation in Step S5, and serve as input features for root cause posterior inference in Step S6.

[0023] Step S3: Hierarchical Traffic Fingerprint Construction. Short-window fingerprints, medium-window fingerprints, and long-window fingerprints are constructed based on short, medium, and long time windows respectively, and then merged into a unified traffic fingerprint vector. The short-window fingerprint mainly consists of the RTP packet interval distribution features extracted in Step S2; the medium-window fingerprint mainly consists of I / P frame ratio abrupt change features and RTCP feedback features; and the long-window fingerprint mainly consists of bitrate variation features and out-of-order ratio features.

[0024] (1) Statistics on RTP packet interval distribution Let the arrival time series of RTP packets within the short window be T = {t_1, t_2, …, t_n}, then the packet interval sequence is I = {t_2 - t_1, …, t_n - t_(n-1)}. The following statistic is calculated for I: μ_I = (1 / |I|) × Σ I_k σ_I = sqrt[(1 / |I|) × Σ (I_k - μ_I)^2] Q_25(I) is the first quartile, and Q_75(I) is the third quartile.

[0025] J_s = (Q_75(I) - Q_25(I)) / (μ_I + ε), where ε is a minimal constant to prevent the denominator from being zero.

[0026] Therefore, the short-window fingerprint is defined as F_s = [μ_I, σ_I, Q_25(I), Q_75(I), J_s]. Here, μ_I represents the average packet interval, σ_I represents the standard deviation of the packet interval, and J_s represents the short-time jitter intensity.

[0027] (2) Dynamic threshold algorithm for sudden changes in I / P frame ratio Let N_I be the number of I-frames and N_P be the number of P-frames within the window. Then the I / P ratio of the current window is: R_IP(t) = N_I / (N_P + ε).

[0028] To avoid using a fixed threshold, this invention uses a combination of an exponential moving baseline and a deviation score for judgment. Let the moving baseline be: ρ_IP(t) = β × ρ_IP(t-1) + (1 - β) × R_IP(t), where β is the smoothing coefficient.

[0029] Then, using the median absolute deviation (MAD_IP) of the most recent M reference windows as a robustness measure, a mutation score is defined: S_IP(t) = |R_IP(t) - ρ_IP(t)| / (MAD_IP + ε).

[0030] When S_IP(t) > θ_IP, it is determined to be a sudden change in the I / P frame ratio. Compared with directly using a fixed threshold or a simple mean plus standard deviation method, the above method is more sensitive to short-term bursts and more robust to occasional noise. The window fingerprint is defined as F_m = [S_IP, R_NACK, R_RR], where R_NACK represents the RTCP NACK feedback ratio and R_RR represents the RTCP receive report anomaly ratio.

[0031] (3) Long window trend fingerprint Let the bitrate sequence within a long window be B = {b_1, b_2, …, b_m}, where b_k represents the average bitrate value in the k-th statistical period within the long window; let the out-of-order proportion sequence be O = {o_1, o_2, …, o_m}, where o_k represents the proportion of packets out of order in the k-th statistical period. Definition: T_drift = (b_m - b_1) / m B_var = (1 / m) × Σ (b_k - μ_B)^2 O_ratio = (1 / m) × Σ o_k Where μ_B represents the average value of the bitrate sequence B within the long window, T_drift represents the bitrate trend drift strength, B_var represents the bitrate variance, and O_ratio represents the average out-of-order ratio. Thus, the long window fingerprint is F_l = [T_drift, B_var, O_ratio].

[0032] (4) Layered traffic fingerprint fusion The unified traffic fingerprint vector is defined as: F = [λ_1 × F_s, λ_2 × F_m, λ_3 × F_l], where λ_1, λ_2, and λ_3 represent the fusion weights of short-window fingerprint, medium-window fingerprint, and long-window fingerprint in the unified traffic fingerprint vector, respectively, and λ_1 + λ_2 + λ_3 = 1.

[0033] In one embodiment, if the scenario focuses more on short-term stuttering, λ_1 = 0.45, λ_2 = 0.35, and λ_3 = 0.20 can be chosen; if the scenario focuses more on continuous degradation, λ_3 can be increased. This can simultaneously represent short-term jitter, medium-term abrupt changes, and long-term trends.

[0034] Step S4: Fingerprint matching and initial pattern determination. The current unified traffic fingerprint vector is matched against the normal fingerprint database and the abnormal fingerprint database to obtain the abnormal pattern matching result. The current unified traffic fingerprint vector is formed from real-time acquired video stream samples. The normal and abnormal fingerprint databases are established offline from historical normal / abnormal samples confirmed manually or by the system, and are continuously updated based on posterior results during operation.

[0035] The current unified traffic fingerprint vector F is derived from the RTP / RTCP packets, bitrate statistics, and latency probe observations collected by the edge mirror probe on the real-time service flow; the normal fingerprint database N and the abnormal fingerprint database A are derived from the historical sample database. The historical samples are marked as normal or abnormal after being confirmed by manual work orders or system closed-loop confirmation, and then stored according to scenario, encoding method, bandwidth level, and topology type.

[0036] Let C_j be the center of the j-th fingerprint class. Then the distance from the current fingerprint to the center of that class is defined as: D(F, C_j) = Σ_{k=1}^{3} ω_k × d(F_k, C_{j,k}) Where F_k represents the short, medium, and long window components, respectively, C_{j,k} is the corresponding class center component, ω_k is the hierarchical distance weight, and d(·) can be Mahalanobis distance or weighted Euclidean distance. The current fingerprint is compared with the normal class center and the abnormal class center respectively, and the class with the smallest distance is selected as the initial pattern judgment result.

[0037] Step S5: Joint tracing of slice identifiers and link delay probes. Combining the transmission topology path of the video stream in the network, slice identifier consistency, and segment delay increment, the abnormal pattern matching results are micro-segmented and mapped to the target link segment in the access micro-segment, aggregation micro-segment, core micro-segment, or operator micro-segment.

[0038] To avoid ambiguity in location tracking during cross-domain and multi-level forwarding scenarios due to reliance solely on static paths, this invention introduces a network slice identifier σ and an adjacent probe delay increment Δd_i. Here, σ represents the service bearer slice identifier observed in the link micro-segment, which can be obtained from packet header fields, VLAN tags, SRv6 path segments, QoS tags, or the operator's slice orchestration interface. Let the topology path of a video stream be P = [v_0, v_1, …, v_n], and the link micro-segments between nodes be e_i = (v_i, v_(i+1)). A location score is defined for each link micro-segment: S_loc(e_i) = a × Cov(e_i) + b × Δd_i + c × Drift_σ(e_i) Where Cov(e_i) represents the coverage degree of the abnormal flow on the micro-segment, Δd_i represents the latency increment between adjacent probes of the micro-segment, Drift_σ(e_i) represents the degree of inconsistency between the expected slice identifier of the micro-segment and the measured slice identifier of the adjacent probes, which can be a 0 / 1 indicator or a normalized mismatch ratio, and a, b, and c are the positioning weights. If S_loc(e_i) is the maximum value on the path, then e_i is taken as the target abnormal micro-segment. The positioning rules are as follows: single path anomalies are preferentially pointed to the access micro-segment; when multiple points share the same aggregation node and the corresponding micro-segment scores increase in a concentrated manner, the focus is on the aggregation micro-segment; when the micro-segment scores increase synchronously across regions and multiple aggregation nodes, the focus is on the core micro-segment; if the scores of each micro-segment within the core are normal but the boundary exit micro-segment and slice drift are significant, the focus is on the operator micro-segment.

[0039] Step S6: Bayesian Causal Graph and Few-Sample Transfer Root Cause Inference. A Bayesian causal graph is constructed based on hierarchical traffic fingerprints, sliced ​​latency features, and the target link segment context. The posterior probability of the anomaly root cause corresponding to the target link segment is calculated. For anomaly types with few samples, a few-sample transfer model from similar network scenarios is invoked to complete adaptive inference and prediction of unknown faults.

[0040] To address the challenge of attributing complex, compound faults to their causes, this invention defines a Bayesian causal graph G = (V, E). The node set V includes at least: congestion C, persistent packet loss L, out-of-order packet loss O, switch queue anomaly Q, slice mismatch S, physical degradation P, and observable feature nodes {J_s, S_IP, R_NACK, R_RR, O_ratio, Δd_i, Drift_σ}. The edge set E represents causal dependencies; for example, congestion causes a simultaneous increase in J_s, R_NACK, and Δd_i, while slice mismatch causes a sudden increase in Drift_σ and cross-domain latency.

[0041] Let the feature observation vector be X, then the root cause posterior probability can be written as: P(cause_i | X) ∝ P(X | cause_i) × P(cause_i).

[0042] When there are few samples of a certain anomaly type, the system retrieves the K known scenarios from the historical scenario database that are most similar to the current network in terms of topology, encoding method, bandwidth level, and slicing strategy, constructs a small-sample transfer prototype vector Z_ref, and uses it to correct the prior: P'(cause_i) = α × P(cause_i) + (1 - α) × Sim(Z_cur, Z_ref).

[0043] Where Z_cur is the current scene embedding representation, and Sim(·) is the similarity function. The final output is the posterior probability ranking of the primary and secondary anomaly types, thereby achieving adaptive inference of the root causes of rare composite network anomalies and prediction of unknown faults.

[0044] Step S7: Dynamic fingerprint database update. Adaptive updates are performed on both the normal and abnormal fingerprint databases based on the post-hoc verification results to adapt to long-term changes in the network environment.

[0045] Suppose that the current sample is confirmed to be normal within k consecutive periods, and its distance from the current normal class center satisfies D(F, C_N)<θ_n, then the current sample is merged into the normal fingerprint database: N_(t+1) = N_t ∪ {F}.

[0046] If an anomaly category is confirmed to belong to the same anomaly class in m consecutive events, then the anomaly class center is updated as follows: C_(A,j)^(t+1) = ρ × C_(A,j)^t + (1- ρ) × F̄_j, where F̄_j is the mean of the same anomaly samples in this round, and ρ is the smoothing coefficient. This mechanism ensures that the normal / anomaly fingerprint database can be continuously optimized as the network environment changes over a long period.

[0047] Step S8: Output Results. Output the target link segment, root cause type, confidence level, slice correlation results, and alarm results.

[0048] like Figure 4 As shown, a video anomaly link micro-segmentation localization system includes: The multi-window feature extraction module is used to obtain the video stream to be analyzed, network slice identifiers and transmission topology paths, construct multiple time windows, and extract video stream service features and link latency features; The hierarchical fingerprint construction module is used to construct short-window fingerprints, medium-window fingerprints, and long-window fingerprints based on the multiple time windows, and merge the three into a unified traffic fingerprint vector. The fingerprint database management module is used to maintain the normal fingerprint database and the abnormal fingerprint database, and to perform dynamic updates based on the post-verification results. The slicing and latency joint tracing module performs distance matching between the unified traffic fingerprint vector and the pre-built normal fingerprint database and abnormal fingerprint database to obtain abnormal pattern matching results; The link micro-segment mapping module is used to map the abnormal pattern matching result to the target link micro-segment based on the consistency of the network slice identifier, the delay probe result in the link delay characteristics, and the transmission topology path. The causal attribution module is used to infer the abnormal root cause type corresponding to the target link micro-segment based on Bayesian causal graphs and few-shot transfer learning; The output alarm module is used to output the target link micro-segment, the type of abnormal root cause, and its confidence level.

[0049] To facilitate understanding of the above technical solutions of the present invention, the following detailed description of the above technical solutions of the present invention will be provided through specific usage methods.

[0050] Example 1: Access Micro-segment Location in Carrier Leased Line Scenarios In a dedicated video network of a certain operator, the Cam-17 camera experienced intermittent stuttering, but regular Ping connectivity remained normal. The system triggered analysis at t = 10:15:00 using an edge mirroring probe. Short windows were taken for 2 seconds, medium windows for 10 seconds, and long windows for 60 seconds. Within the short window, 120 RTP packets were collected, yielding μ_I = 16.8 ms, σ_I = 7.1 ms, Q_25 = 12.1 ms, Q_75 = 23.4 ms, and J_s = 0.67. Compared to the average μ_I^N = 16.5 ms and σ_I^N = 1.9 ms in a normal database for similar scenarios, significant short-term jitter is evident. Within the medium window, N_I = 36, N_P = 404, current R_IP(t) = 0.089, sliding baseline ρ_IP(t) = 0.051, MAD_IP = 0.011, resulting in S_IP = 3.45, which is greater than the threshold θ_IP = 2.20, indicating a sudden change in the I / P ratio. Within the long window, T_drift = 0.03Mbps / s, B_var = 0.12, and O_ratio = 0.004, indicating that the long-term trend is basically stable.

[0051] Subsequently, the system matches the current unified fingerprint F with the abnormal fingerprint database and finds that it has the smallest distance to the center of the "short-term congestion anomaly". Adjacent probes deployed along the path P = [Cam-17, Access-SW-3, Agg-SW-1, Core-R1, Platform] observe the following: access micro-segment latency increment Δd_0 = 11.4 ms, aggregation micro-segment Δd_1 = 1.2 ms, core micro-segment Δd_2 = 0.8 ms, and operator boundary micro-segment Δd_3 = 0.6 ms; the slice identifier remains consistent throughout the entire path, and Drift_σ is essentially 0. The calculated S_loc(e_0) is the highest, therefore the location result is the access micro-segment. The Bayesian causal graph outputs a congestion probability of 0.71, a physical attenuation probability of 0.18, and an out-of-order probability of 0.06, with other types below 0.05. The root cause is ultimately determined to be "instantaneous congestion of the access link," and the secondary anomaly is output as possibly "fiber micro-bend".

[0052] Example 2: Location of Aggregation Micro-segments and Queues in a Campus Network Scenario In the campus network, four cameras (Cam-05, Cam-06, Cam-07, and Cam-08) simultaneously experienced video stuttering. Within a 10-second window, the system detected S_IP values ​​of 2.81, 2.95, 2.77, and 2.88 for the four video streams, and R_NACK values ​​of 0.043, 0.047, 0.045, and 0.041, respectively. The RTCP receive report anomaly rate exceeded 0.08 for all four streams. Within a longer window, the O_ratio for all four video streams ranged from 0.021 to 0.027, significantly higher than the normal level of 0.006. The path topology showed that the four video streams shared the same aggregation switch, Agg-SW-2. Adjacent probe results indicated that the Δd_i of multiple access micro-segments was below 1.5 ms, while the aggregated Δd of the aggregation micro-segments from Agg-SW-2 to Core-R2 reached 9.6 ms, and this micro-segment covered all abnormal flows.

[0053] Based on this, the system identifies the anomaly as an aggregation micro-segment anomaly. Since the "queue anomaly" node in the Bayesian causal graph is simultaneously supported by high O_ratio, high R_RR, low long-term bit rate drift, and multi-point shared coverage relationships, its posterior probability reaches 0.64, higher than the 0.21 for congestion and 0.09 for continuous packet loss, ultimately determining it as an "aggregation switch queue anomaly." This embodiment illustrates that using slice delay probes and topology coverage relationships for joint tracing can more stably pinpoint shared link segments than simple static path mapping.

[0054] Example 3: Location of Operator Micro-segment and Slice Mismatch in Cross-Regional Networking Scenarios In cross-regional video networking scenarios, multiple locations in Beijing, Shijiazhuang, and Tianjin simultaneously experienced screen flickering and stuttering. The system detected significant anomalies in short, medium, and long window fingerprints, with some flows exhibiting J_s exceeding 0.75 and an average O_ratio of 0.031. Furthermore, the latency increment of the egress boundary probe fluctuated between 18 ms and 26 ms. More critically, the system discovered through packet headers and operator slice orchestration interfaces that the slice identifier for some service flows at the core entry and exit points changed from slice identifier A to slice identifier C, indicating a change in the service-bearing slice, resulting in a significant increase in Drift_σ.

[0055] The system first identifies the anomaly as a micro-segment at the core or operator boundary. Then, using a cause-effect graph, it combines slice drift, cross-regional synchronization anomalies, and sudden increases in egress latency to increase the probability of "slice mismatch / cross-domain scheduling anomaly" to 0.58, assess "operator congestion" at 0.29, and reduce the probability of "platform-side anomaly" to 0.07. Since the current scenario represents a rare cross-domain anomaly, the system selects two similar cross-regional slice handover cases from the historical sample library for small-sample migration correction. After correction, the probability of "slice mismatch / cross-domain scheduling anomaly" further increases to 0.66. The final output shows the primary anomaly type as "cross-domain link degradation caused by operator micro-segment slice mismatch" and the secondary anomaly type as "egress micro-segment congestion."

[0056] In summary, by utilizing the technical solutions described above, a hierarchical traffic fingerprint is constructed using short, medium, and long time windows, simultaneously covering short-term jitter, medium-term abrupt changes, and long-term trends, which is superior to single-time-window solutions. The exponential sliding baseline and robust deviation scoring are used to calculate I / P frame ratio abrupt changes, and the statistical methods for RTP packet interval mean, standard deviation, quantiles, and jitter intensity are refined, enhancing the expressive power of video-specific fingerprints. Joint tracing using network slice identification and link latency probes enables precise micro-segmentation of abnormal links in cross-domain and multi-level forwarding scenarios. Bayesian causal graphs and few-shot transfer learning provide a more stable root cause probability ranking in complex composite faults and rare anomaly scenarios. Adaptive updates to the normal / abnormal fingerprint database allow the system to continuously optimize in response to long-term changes in the network environment.

[0057] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for locating abnormal video links using micro-segmentation, characterized in that, Includes the following steps: S1 obtains the video stream to be analyzed, the corresponding network slice identifier, and the transmission topology path, and simultaneously constructs a short time window, a medium time window, and a long time window; S2 extracts the service features and link delay features of the video stream within each of the time windows; the service features are used to construct short window fingerprints, medium window fingerprints and long window fingerprints, and the link delay features are used for link micro-segmentation location scoring calculation and root cause inference; S3 constructs the short-window fingerprint, medium-window fingerprint, and long-window fingerprint based on the short-time window, medium-time window, and long-time window respectively, and merges the three into a unified traffic fingerprint vector; S4 performs distance matching between the unified traffic fingerprint vector and the pre-built normal fingerprint database and abnormal fingerprint database to obtain abnormal pattern matching results; S5 combines the consistency of the network slice identifier, the delay probe results in the link delay characteristics, and the transmission topology path to map the abnormal pattern matching result to the target link micro-segment; S6 constructs a Bayesian causal graph based on the unified traffic fingerprint vector, the link delay features, and the context information of the target link micro-segment, calculates the posterior probability of the abnormal root cause corresponding to the target link micro-segment, and infers the type of abnormal root cause corresponding to the target link micro-segment by combining small sample transfer learning. S7 adaptively updates the normal fingerprint database and the abnormal fingerprint database based on the posterior confirmation result of the abnormal root cause type. S8 outputs the target link micro-segment, the anomaly root cause type, and its confidence level.

2. The video anomaly link micro-segmentation localization method according to claim 1, characterized in that, The video stream service features extracted in step S2 include one or more of the following: RTP packet interval distribution features, I / P frame ratio abrupt change features, RTCP packet loss feedback mode features, out-of-order ratio features, and bitrate change features; the link delay features include: single-segment delay, adjacent probe delay increment, and slice drift features.

3. The video anomaly link micro-segmentation localization method according to claim 1, characterized in that, In step S3, the short-window fingerprint is mainly composed of RTP packet interval distribution features, which include at least the average packet interval, packet interval standard deviation, packet interval quantile, and short-term jitter intensity statistics; the medium-window fingerprint is mainly composed of I / P frame ratio mutation features and RTCP packet loss feedback mode features, which are calculated using an exponential sliding baseline and robust deviation scoring algorithm; the long-window fingerprint is mainly composed of bitrate variation features and out-of-order ratio features; the unified traffic fingerprint vector is obtained by configuring fusion weights for the short-window, medium-window, and long-window fingerprints and then weighted and fused to simultaneously characterize short-term jitter, medium-term mutations, and long-term trends.

4. The video anomaly link micro-segmentation localization method according to claim 1, characterized in that, The normal fingerprint database and abnormal fingerprint database in step S4 are established offline from normal video samples and abnormal video samples that have been manually confirmed or confirmed by the system closed loop in the past, and are classified and maintained according to at least one of scene type, encoding method, bandwidth level and topology type. The specific steps to obtain the abnormal pattern matching result are as follows: Let the center of the j-th fingerprint be C_j, then the distance from the current fingerprint to the center of this class is defined as: D(F, C_j) = Σ_{k=1}^{3} ω_k × d(F_k, C_{j,k}), where F is the current unified traffic fingerprint vector, F_k represents the short, medium, and long window components respectively, C_{j,k} is the corresponding class center component, ω_k is the hierarchical distance weight, and d(·) adopts Mahalanobis distance or weighted Euclidean distance; the current fingerprint is compared with the normal class center and the abnormal class center respectively, and the class with the smallest distance is selected as the initial pattern judgment result.

5. The video anomaly link micro-segmentation localization method according to claim 1, characterized in that, In step S5, a location score is defined for each link micro-segment in the transmission topology path: S_loc(e_i) = a × Cov(e_i) + b × Δd_i + c × Drift_σ(e_i), and the abnormal pattern matching result is mapped to the target link micro-segment based on the location score; where Cov(e_i) represents the coverage degree of the abnormal flow on the micro-segment, Δd_i represents the delay increment between adjacent probes of the micro-segment, Drift_σ(e_i) represents the degree of inconsistency between the expected slice identifier of the micro-segment and the measured slice identifier of the adjacent probe, and a, b, and c are the corresponding location weights.

6. The video anomaly link micro-segmentation localization method according to claim 5, characterized in that, In step S5: When a single path is abnormal, the access micro-segment is used as the target link micro-segment; When multiple points share the same aggregation node and the scores of the corresponding micro segments increase in a concentrated manner, the aggregation micro segment is taken as the target link micro segment. When the scores of core-side micro-segments increase synchronously across regions and multiple aggregation nodes, the core micro-segment will be used as the target link micro-segment. When the scores of each micro-segment within the core are normal, but the boundary exit micro-segment and slice drift are significant, the operator micro-segment will be used as the target link micro-segment.

7. The video anomaly link micro-segmentation localization method according to claim 1, characterized in that, In step S6, the set of nodes in the Bayesian causal graph includes at least: congestion, continuous packet loss, out-of-order packets, switch queue anomalies, slice mismatch, and physical attenuation as root cause nodes, and short-term jitter intensity, I / P frame ratio mutation score, RTCP NACK feedback ratio, RTCP receive report anomaly ratio, average out-of-order ratio, adjacent probe delay increment, and slice drift degree as observable feature nodes.

8. The video anomaly link micro-segmentation localization method according to claim 1, characterized in that, The few-shot transfer learning in step S6 includes: when the number of samples of the target anomaly is insufficient, retrieving the K known scenarios from the historical scenario library that are most similar to the current network in terms of topology, encoding method, bandwidth level and slicing strategy, constructing a few-shot transfer prototype vector, and using it to correct the prior probability of each root cause node in the Bayesian causal graph.

9. The video anomaly link micro-segmentation localization method according to claim 1, characterized in that, The adaptive update in step S7 includes: when the current sample is confirmed as normal for multiple consecutive periods and the distance to the normal class center is less than a threshold, the current sample is merged into the normal fingerprint database; when multiple consecutive abnormal events are confirmed as the same type of abnormality, the center of the abnormality is updated based on the mean of the abnormal samples of the same type in this round.

10. A video anomaly link micro-segmentation localization system, characterized in that, include: The multi-window feature extraction module is used to obtain the video stream to be analyzed, network slice identifiers and transmission topology paths, construct multiple time windows, and extract video stream service features and link latency features; The hierarchical fingerprint construction module is used to construct short-window fingerprints, medium-window fingerprints, and long-window fingerprints based on the multiple time windows, and merge the three into a unified traffic fingerprint vector. The fingerprint database management module is used to maintain the normal fingerprint database and the abnormal fingerprint database, and to perform dynamic updates based on the post-verification results. The slicing and latency joint tracing module performs distance matching between the unified traffic fingerprint vector and the pre-built normal fingerprint database and abnormal fingerprint database to obtain abnormal pattern matching results; The link micro-segment mapping module is used to map the abnormal pattern matching result to the target link micro-segment based on the consistency of the network slice identifier, the delay probe result in the link delay characteristics, and the transmission topology path. The causal attribution module is used to infer the abnormal root cause type corresponding to the target link differential segment based on Bayesian causal graphs and few-shot transfer learning; The output alarm module is used to output the target link micro-segment, the type of abnormal root cause, and its confidence level.

Images