A video stream active probing and abnormality attribution method and system

Abstract

The application discloses a video stream active probing and abnormality attribution method and system, and the method comprises the following steps: constructing a protocol quasipattern small flow probing template; calculating a probing priority according to the device metadata, video stream service characteristics, historical probing abnormality probability, metadata change weight and slice heat, and then determining a probing frequency and a probing depth; executing active small flow probing, and sending a probing packet in the protocol quasipattern small flow probing template; and executing abnormality attribution identification according to a probing result and the service quality twin score. Through the protocol quasipattern small flow probing template, the application can approximate the service behavior of a real video stream in terms of code rate, frame interval, packet length and session state, and reduce the monitoring deviation caused by general probing packets; through joint scheduling of a metadata risk model, a service fluctuation score, a historical probing abnormality probability, a metadata change weight and slice heat, fine allocation of probing resources can be realized.

Description

Technical Field

[0001] This invention relates to the field of intelligent video testing and scheduling technology, and more specifically, to a method and system for active testing and anomaly attribution of video streams. Background Technology

[0002] Most existing video network probing methods employ fixed-period, fixed-depth, and generic probe packet schemes. These schemes can roughly reflect link connectivity, latency, and packet loss rate. However, because the streaming media control protocols, media transmission protocols, and session signaling protocols used in video surveillance services have specific packet length distributions, frame interval patterns, keyframe burst behaviors, and session state changes, generic probe packets cannot accurately simulate video service load, leading to a significant discrepancy between probing results and actual playback experience.

[0003] At the same time, traditional fixed-point testing cannot allocate detection resources based on the risk status of cameras, scene popularity, and business fluctuations, resulting in insufficient testing of old equipment, key areas, and sudden dynamic scenarios, while new and stable equipment suffers unnecessary detection costs.

[0004] Furthermore, even if existing solutions detect packet loss, they often only report the presence of an anomaly, making it difficult to further distinguish whether the loss is due to the probe packet itself, actual packet loss in the video stream, network congestion, or protocol parsing issues. For the operations and maintenance team, simply noticing packet loss is insufficient to guide the handling process.

[0005] Therefore, how to adaptively generate protocol-mimicking low-traffic detection templates, dynamically adjust the testing cycle and testing depth, and achieve service quality twin diagnosis and anomaly attribution that approximates the real playback experience with a traffic overhead of a few KB has become a technical problem that urgently needs to be solved. Summary of the Invention

[0006] To address the aforementioned technical problems in related technologies, this invention proposes a method and system for proactive video stream probing and anomaly attribution. This method solves the problems of insufficient realism in video service detection, low resource utilization in fixed-period probing, unclear sources of historical anomaly probabilities, and poor ability to distinguish anomaly types in existing technologies. It overcomes the shortcomings of existing technologies.

[0007] To achieve the above-mentioned technical objectives, the technical solution of the present invention is implemented as follows: A method for proactively testing and attributing anomalies in video streams includes the following steps: S1 accesses the video stream to be tested and aggregates the corresponding device metadata; S2 extracts the protocol mimicry fingerprint of the video stream to be tested, parses the session state, and extracts the video stream service features; S3 constructs a protocol mimicry low-volume detection template based on the protocol mimicry fingerprint, protocol type, session state, and video stream service characteristics. S4 calculates the testing priority based on the device metadata, video stream service characteristics, historical testing anomaly probability, metadata change weight, and slice popularity, and then determines the testing frequency and testing depth. S5 performs active low-volume dialing based on the dialing frequency and dialing depth, and sends the probe packets in the protocol mimicking low-volume probe template; S6 calculates the service quality twin score based on the link return status, probe packet return trajectory and real video stream status collected after the dial-up test is performed; S7 performs anomaly attribution identification and distinguishes anomaly types based on the test results and the service quality twin score; The S8 outputs the test strategy results, twin quality scores, anomaly attribution results, and alarm information, and updates the historical records and strategy parameters relied upon by the next round of test based on the results of this round of test.

[0008] Furthermore, the device metadata in step S1 includes at least one or more of the following: camera model, installation location, number of historical failures, time of the most recent failure, device online duration, priority of the region to which it belongs, and time of the most recent configuration change.

[0009] Furthermore, the protocol mimicry fingerprint in step S2 includes at least one or more of control plane signaling fingerprints, media plane statistical fingerprints, and temporal behavior fingerprints; the video stream service features include at least one or more of bitrate sequences, frame interval sequences, data packet size sequences, keyframe periods, RTCP feedback features, RTP sequence number continuity features, and session state switching features.

[0010] Furthermore, the specific method for constructing the protocol mimicry low-flow detection template in step S3 is as follows: statistical modeling is performed on the frame interval sequence, data packet size sequence, and key frame period sequence of the real video stream to construct a state transition matrix, and a template generation strategy is selected according to the protocol type. For RTSP or RTMP protocols, a mimicry detection sequence is generated using a state transition matrix and keyframe period constraints; for GB28181 protocols, SIP keep-alive, registration state, and session state templates are superimposed on the media stream mimicry.

[0011] Furthermore, the process of determining the testing priority, testing frequency, and testing depth in step S4 specifically includes: The device risk score R is calculated based on the device metadata, the service fluctuation score V is calculated based on the video stream service characteristics, the historical call test anomaly probability P_h is calculated based on the historical call test records, and the metadata change weight C_m and slice popularity H are introduced. The priority score for dialing is calculated as G = η1·R + η2·V + η3·P_h + η4·C_m + η5·H, where η1, η2, η3, η4, and η5 are preset weight coefficients. Determine the probe frequency f_probe=clip(f_min+k1·G,f_min,f_max), where k1 represents the scaling factor from probe priority to probe frequency, and f_min and f_max represent the minimum and maximum allowed probe frequencies, respectively. Determine the probe depth d_probe=clip(d_min+k2·R+k3·P_h+k4·H,d_min,d_max), where k2, k3, and k4 represent the scaling coefficients when mapping the equipment risk score, historical probe anomaly probability, and slice heat to the probe depth, respectively, and d_min and d_max represent the minimum probe depth and the maximum probe depth, respectively.

[0012] Furthermore, the formula for calculating the service quality twin score Q_twin in step S6 is as follows: Q twin =ξ1·norm(D_p)+ξ2·L_p^rate+ξ3·G_rtp+ξ4·F_rtcp+ξ5·(1-S _sig ), Where D_p is the probe return delay, norm(D_p) is its normalized value; L_p^rate is the probe packet loss rate; G_rtp is the RTP sequence number tomography intensity; F_rtcp is the RTCP anomaly feedback intensity; S_sig is the signaling health; ξ1, ξ2, ξ3, ξ4, and ξ5 are the mapping weights of each observation.

[0013] Furthermore, the anomaly attribution identification in step S7 specifically includes: Define the probe packet loss indicator L_p, the real video stream RTP sequence number tortuosity indicator L_r, the RTCP anomaly feedback indicator L_c, and the protocol signaling anomaly indicator L_s; The determination is made according to preset rules: If L_p=1 and L_r=0, then the probe packet is determined to be lost; If L_p=1, L_r=1, L_c=1, and the link queuing delay increases, then it is determined to be an abnormal network congestion. If L_r=1, L_s=1, and L_c is lower than the preset threshold, then it is determined to be a protocol parsing error; If L_p=0 and L_r=1, then it is determined that the video stream has actually lost packets; When multiple conditions are met simultaneously, the main anomaly type and the secondary anomaly type are output based on the probability model.

[0014] Furthermore, the main anomaly type output based on the probabilistic model is specifically as follows: The probability of the main anomaly is defined as: P(C_j|Z)=exp(u_j(Z)) / Σexp(u_k(Z)). Where C_j represents the j-th candidate anomaly type; u_j(Z) represents the discrimination score of the joint feature vector Z for the j-th anomaly; u_k(Z) represents the discrimination score for the k-th anomaly; and Z=[L_p,L_r,L_c,L_s,R,V,H,Q_twin] is the joint feature vector.

[0015] Furthermore, step S8 updates the historical records and strategy parameters relied upon for the next round of testing based on the results of this round of testing, specifically as follows: Let the risk score after the t-th round of testing be R_t, and the new risk estimate generated in this round of testing be R_hat_t. Then the updated risk score is: R_(t+1)=ρ•R_t+(1-ρ)•R_hat_t, where ρ is the smoothing coefficient. If a certain point is abnormal for m consecutive rounds, its testing priority will be automatically increased; if it is stable for n consecutive rounds, its testing priority will be automatically decreased. At the same time, the service quality twin score, anomaly attribution result and final scheduling parameters obtained in this round of testing will be written back to refresh the historical testing anomaly probability, metadata change weight and scene popularity.

[0016] According to another aspect of the present invention, a video stream active probing and anomaly attribution system is provided, for performing the method, comprising: The metadata aggregation and fingerprint extraction module includes a metadata aggregation module and a protocol mimicry fingerprint extraction and status parsing module; the metadata aggregation module is used to access the video stream to be tested and aggregate the corresponding device metadata; the protocol mimicry fingerprint extraction and status parsing module is used to extract the protocol mimicry fingerprint of the video stream to be tested, parse the session status, and extract the video stream service features. The template generation and scheduling module includes a mimicry template generation module and a strategy scheduling module. The mimicry template generation module is used to construct a protocol mimicry low-traffic detection template based on the protocol mimicry fingerprint, protocol type, session state, and video stream service characteristics. The strategy scheduling module is used to calculate the testing priority based on the device metadata, video stream service characteristics, historical testing anomaly probability, metadata change weight, and slice popularity, thereby determining the testing frequency and testing depth. The active dialing test execution module is used to perform active low-volume dialing tests based on the dialing test frequency and dialing test depth, and send the probe packets in the protocol mimicry low-volume detection template; The twin quality mapping module is used to calculate the service quality twin score based on the link return status, probe packet return trajectory and real video stream status collected after the test is performed; The anomaly attribution module is used to perform anomaly attribution identification and distinguish anomaly types based on the test results and the service quality twin score. The alarm and policy update module is used to output the test policy results, twin quality scores, anomaly attribution results and alarm information, and update the historical records and policy parameters that the next round of test depends on based on the results of this round of test.

[0017] The beneficial effects of this invention are as follows: This invention, through a protocol-mimicking small-traffic probe template, can approximate the service behavior of real video streams in terms of bitrate, frame interval, packet length, and session state, reducing monitoring bias caused by general probe packets; through joint scheduling of metadata risk models, service fluctuation scores, historical probe anomaly probabilities, metadata change weights, and slice popularity, it can achieve refined allocation of probe resources; through service quality twin mapping, it can estimate the real playback experience within a few KB of traffic overhead, improving the service interpretability of probe results; through joint attribution of RTP faults, RTCP feedback, signaling status, and twin scores, it can distinguish between probe packet loss, real video stream packet loss, network congestion anomalies, and protocol parsing anomalies; through policy write-back and closed-loop update mechanisms, it can achieve continuous adaptive evolution of probe strategies, improving long-term operation and maintenance effectiveness. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the overall process of edge probe access, metadata aggregation and active probing of the video stream active probing and anomaly attribution method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the protocol mimicry fingerprint extraction, detection template generation, and risk scheduling process of the video stream active probing and anomaly attribution method according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the service quality twin mapping and anomaly attribution determination process of the video stream active probing and anomaly attribution method according to an embodiment of the present invention. Figure 4 This is a schematic diagram of the edge probe-controller-platform collaborative probing system architecture of the video stream active probing and anomaly attribution method according to an embodiment of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention are within the scope of protection of the present invention.

[0021] like Figure 1-3 As shown in the embodiment of the present invention, a video stream active probing and anomaly attribution method consists of eight sequential steps: "access and aggregation—fingerprint extraction—template generation—risk scheduling—active probing—twin mapping—anomaly attribution—policy update," wherein the output of the previous step serves as the input of the next step. The specific process is as follows.

[0022] Step S1: Video Stream Access and Device Metadata Aggregation. The video stream to be tested is accessed via active testing probes deployed at edge switching nodes, NVR bypass mirror ports, or platform access gateways. Simultaneously, the probes or scheduling controller obtain the corresponding device metadata through the device management platform interface, GB28181 registration information, RTSP DESCRIBE return information, ONVIF capability information, and the CMDB asset table. The device metadata includes at least one or more of the following: camera model, installation location, historical failure count, most recent failure time, device online duration, regional priority, and most recent configuration change time. The output of Step S1 is the test stream identifier, session context, and metadata feature vector, which are used in Steps S2 and S4.

[0023] Step S2: Protocol mimicry fingerprint extraction, session state parsing, and service feature extraction. First, the video stream protocol type is identified on the control plane. For the GB28181 scenario, signaling messages such as SIP REGISTER, MESSAGE, INVITE, BYE, and Keepalive are parsed. For the RTSP scenario, session messages such as OPTIONS, DESCRIBE, SETUP, PLAY, and TEARDOWN are parsed. For the RTMP scenario, the handshake phase and Chunk Stream header are parsed. Then, passive mirroring statistics are performed on the real video stream on the media plane to extract bitrate sequences, frame interval sequences, packet size sequences, keyframe periods, RTCP feedback features, RTP sequence number continuity features, and session state switching features. Step S2 outputs three types of results: control plane signaling fingerprint, media plane statistical fingerprint, and temporal behavior fingerprint. The protocol mimicry fingerprint and service features serve as direct inputs to the probe template generated in Step S3, and the service features also serve as inputs to the service fluctuation score calculated in Step S4.

[0024] Step S3: Generation of a small-volume detection template driven by protocol mimicry fingerprint. Based on the protocol mimicry fingerprint, protocol type, session state, and video stream service characteristics output in Step S2, a protocol mimicry small-volume detection template is constructed. This template at least constrains the sending rhythm, packet size distribution, keyframe burst mode, protocol header field characteristics, keep-alive packet insertion rhythm, and TCP congestion window variation trend, so that the detection stream approximates the behavior of the real video stream with an overhead of only a few KB. For RTSP / RTMP streams, a mimicry detection sequence is generated using a state transition matrix and keyframe period constraints; for GB28181 streams, in addition to media stream mimicry, a SIP / keep-alive state template is superimposed. The output of Step S3 is the mimicry detection packet set Q and its generation rules, which is actually sent in Step S5.

[0025] Within a window of length T, the following statistical sequences are extracted from the real video stream: I={Δt1,Δt2,…,Δtn} (frame interval sequence), P={p1,p2,…,pn} (packet length sequence), K={K_1,K_2,…,K_m} (keyframe period sequence). Δt is discretized into q interval states, and p is discretized into r packet length states, constructing a binary state s_t=(Δt_t,p_t), and further constructing the state transition matrix: T_ij=P(s_(t+1)=j|s_t=i).

[0026] The template is selected based on the protocol type: for RTSP / RTMP, a "state transition matrix + keyframe period constraint" is used to generate the mimicry probe sequence; for GB28181, in addition to media stream mimicry, SIP keep-alive, registration state, and session state templates are also superimposed. The final output mimicry probe sequence is encapsulated into the simulated probe packet set Q actually sent in step S5.

[0027] To enhance realism, a congestion simulation factor is further introduced in the TCP bearer scenario. Let the effective round-trip time (RTT_t) of the previous probe period be RTT_t. Then, the sending window for the next period is modified according to the following rule: cwnd_(t+1)=min(cwnd_max,cwnd_t+γ·AckRate_t-δ·Loss_t). Where cwnd_max represents the maximum allowed congestion window, cwnd_t represents the congestion window at the current moment, γ represents the acknowledgment feedback gain coefficient, AckRate_t represents the acknowledgment feedback rate in the current period, δ represents the packet loss penalty coefficient, and Loss_t represents the packet loss rate or packet loss penalty term in the current period. Finally, a simulated probe packet set Q={q1,q2,…,qm} is generated, where each q_i includes at least the sending time, packet length, protocol header features, sequence number, and corresponding session state label.

[0028] Step S4: Test scheduling driven by metadata risk, service fluctuations, and popularity. Based on the device metadata from Step S1, calculate the device risk score R; based on the service characteristics from Step S2, calculate the service fluctuation score V; based on historical test records, calculate the historical test anomaly probability P_h; and introduce metadata change weight C_m and slice popularity H to calculate the test priority score G, thereby determining the test frequency f_probe and test depth d_probe. The output of Step S4 is the test priority, test frequency, and test depth corresponding to the current flow, used to constrain the sending cycle, number of sending attempts, and probe packet size in Step S5.

[0029] (1) Metadata Risk Weighting Model Let the metadata feature vector of a certain camera device be: X=[M,L,F,A,S,C_m]. Where M represents the model risk factor, L represents the installation location risk factor, F represents the historical failure frequency factor, A represents the recent failure time decay factor, S represents the importance factor of the region, and C_m represents the metadata change weight factor.

[0030] The equipment risk score is defined as: R = w1·M + w2·L + w3·F + w4·A + w5·S + w6·C_m, where w1, w2, w3, w4, w5, and w6 are preset weight coefficients, and satisfy w1 + w2 + w3 + w4 + w5 + w6 = 1.

[0031] The most recent failure time decay term is: A = exp(-λΔt). Where exp represents the natural exponential function, Δt is the time difference from the most recent failure, and λ is the decay coefficient.

[0032] (2) Video stream fluctuation score model Let the video stream bitrate sequence be B={b1,b2,…,bn} within an observation window of length T, where b_t represents the average bitrate value at the t-th sampling time or the t-th statistical period, b_(t-1) represents the average bitrate value at the previous sampling time or the previous statistical period, and t represents the bitrate sampling sequence number.

[0033] The bitrate fluctuation score is defined as: V = α·σ(B) / μ(B) + β·max(|b_t-b_(t-1)|) / μ(B). Where μ(B) is the average bitrate, σ(B) is the bitrate standard deviation, and α and β are weighting parameters. This formula is used to simultaneously characterize the overall fluctuation intensity and the intensity of instantaneous changes.

[0034] (3) Historical call detection anomaly probability and call detection priority The probability of historical dialing anomalies is obtained by statistically analyzing the historical dialing records within the sliding window. Let y_i be the marker for whether a valid anomaly occurred in the i-th round of the most recent W rounds of dialing. Then, y_i is set to 1 when any of the following valid anomalies occurs: probe packet loss, real video stream packet loss, network congestion anomaly, or protocol parsing anomaly; otherwise, it is set to 0. Thus, P_h = (Σy_i) / W, where P_h represents the probability of historical dialing anomalies.

[0035] To further enhance scheduling sensitivity, a slice heat index H is introduced. H is used to characterize the importance of the time-series slice corresponding to the target stream in a recent period, and can be obtained by statistics of keyframe density, target motion intensity, capture event density, or alarm density. R represents the device risk score, V represents the video stream fluctuation score, P_h represents the probability of historical dialing anomalies, C_m represents the metadata change weight, and H represents the slice heat index.

[0036] The priority score for dialing is defined as: G=η1·R+η2·V+η3·P_h+η4·C_m+η5·H, where η1, η2, η3, η4, and η5 are preset weight coefficients, and G represents the comprehensive priority score for dialing.

[0037] The probe frequency is defined as: f_probe=clip(f_min+k1·G,f_min,f_max). Where f_probe represents the probe frequency of the current target flow, f_min and f_max represent the minimum and maximum allowed probe frequencies, respectively, and k1 represents the scaling factor from probe priority to probe frequency.

[0038] The probe depth is defined as: d_probe = clip(d_min + k2·R + k3·P_h + k4·H, d_min, d_max). Here, d_probe represents the probe depth of the current target flow, d_min and d_max represent the minimum and maximum probe depths, respectively, and k2, k3, and k4 represent the scaling factors when mapping device risk score, historical probe anomaly probability, and slice heat to probe depth. The clip function is used to restrict the results to a given interval.

[0039] Step S5: Execute proactive low-volume probe testing. Following the probe frequency f_probe and probe depth d_probe determined in Step S4, send the protocol-mimicking low-volume probe packet set Q generated in Step S3, and collect link return status, probe packet return trajectory, ACK / latency changes, real video stream RTP sequence number status, RTCP feedback messages, and protocol signaling status. The output of Step S5 is a probe observation result vector, which is used for service quality twin mapping in Step S6.

[0040] Step S6: Service Quality Twin Mapping. The link return status, probe trajectory, and actual video stream status collected in Step S5 are mapped to a service experience twin quality score Q_twin, which characterizes how closely the current test results approximate the actual playback experience. The service experience twin quality score Q_twin serves as an additional input for Step S7, distinguishing between probe-side anomalies and actual service anomalies; furthermore, it is used in Step S8 for alarm level mapping and priority correction for the next round of testing.

[0041] The link return status, probe packet return trajectory, and real video stream status collected in step S5 are the inputs to the service quality twin mapping. Let the probe return latency be D_p, the probe packet loss rate be L_p^rate, the RTP breakdown strength be G_rtp, the RTCP feedback strength be F_rtcp, and the signaling health be S_sig.

[0042] The business experience twin score is defined as: Q_twin = ξ1·norm(D_p) + ξ2·L_p^rate + ξ3·G_rtp + ξ4·F_rtcp + ξ5·(1-S_sig). Where ξ1, ξ2, ξ3, ξ4, and ξ5 are the mapping weights of each observation; norm(D_p) represents the result after normalizing the probe return delay D_p, which can be expressed as (D_p-D_min) / (D_max-D_min+ε); L_p^rate represents the probe packet loss rate; G_rtp represents the RTP sequence number fault strength; F_rtcp represents the RTCP anomaly feedback strength; and S_sig represents the health of the control plane or session signaling. A higher Q_twin indicates a higher experience risk for the current flow. This score is used both for anomaly attribution in step S7 and for alarm level mapping and the next round of policy correction in step S8.

[0043] Step S7: Anomaly Attribution and Identification. Based on the packet loss situation in step S5, the RTP sequence number gap in the actual video stream, RTCP feedback messages, protocol signaling status, link queuing delay changes, and the service experience twin quality score Q_twin in step S6, distinguish between probe packet loss, actual video stream packet loss, network congestion anomalies, and protocol parsing anomalies, and output the probability results of the primary and secondary anomaly types. These probability results are used in step S8 to generate alarm cause display, auxiliary troubleshooting suggestions, and historical anomaly record write-back.

[0044] Definitions: Probe packet loss indicator L_p, set to 1 if the probe packet does not return within the timeout window, otherwise set to 0; Real video stream RTP sequence number discontinuity indicator L_r, set to 1 if a non-retransmission transition exists; RTCP abnormal feedback indicator L_c, set to 1 if the NACK or RR packet loss feedback exceeds the threshold; Protocol signaling abnormal indicator L_s, set to 1 if SIP / GB28181 signaling experiences timeout, registration abnormality, or heartbeat abnormality.

[0045] The anomaly attribution rules include at least the following: if L_p=1 and L_r=0, then it is determined to be a probe packet loss; if L_p=1, L_r=1, L_c=1, and the link queuing delay increases, then it is determined to be a network congestion anomaly; if L_r=1, L_s=1, and L_c=0 or lower, then it is determined to be a protocol parsing anomaly; if L_p=0 and L_r=1, then it is determined to be an actual video stream packet loss; if multiple conditions are met simultaneously, then the primary anomaly type and secondary anomaly type are output according to the probability model.

[0046] In a preferred embodiment, the probability of the main anomaly is defined as: P(C_j|Z)=exp(u_j(Z)) / Σexp(u_k(Z)). Where C_j represents the j-th candidate anomaly type; u_j(Z) represents the discrimination score of the joint feature vector Z for the j-th anomaly; u_k(Z) represents the discrimination score of the k-th anomaly; and Z=[L_p,L_r,L_c,L_s,R,V,H,Q_twin] is the joint feature vector. This probability result is used in step S8 for alarm cause display and auxiliary troubleshooting suggestion output, respectively.

[0047] Step S8: Strategy Update and Result Output. Output the testing strategy results, twin quality scores, anomaly attribution results, probability of primary anomaly type, probability of secondary anomaly type, and alarm information. Write the results of this round of testing back to historical metadata and historical testing records to update the testing frequency and depth for the next round. Step S8 constitutes the closed-loop update mechanism of this invention, ensuring the continuous evolution of the historical testing anomaly probabilities and risk parameters upon which step S4 relies.

[0048] Let the risk score after the t-th round of testing be R_t, and the new risk estimate generated in this round of testing be R_hat_t. Then the updated risk score is: R_(t+1)=ρ·R_t+(1-ρ)·R_hat_t, where ρ is the smoothing coefficient. If a location is abnormal for m consecutive rounds, its testing priority is automatically increased; if it is stable for n consecutive rounds, its testing priority is automatically decreased. At the same time, Q_twin, the anomaly attribution result, and the final scheduling parameters obtained in this round of testing are written back to refresh P_h, C_m, and scene heat H.

[0049] like Figure 4As shown, a video stream active probing and anomaly attribution system is used to execute the method, including: The metadata aggregation and fingerprint extraction module includes a metadata aggregation module and a protocol mimicry fingerprint extraction and status parsing module; the metadata aggregation module is used to access the video stream to be tested and aggregate the corresponding device metadata; the protocol mimicry fingerprint extraction and status parsing module is used to extract the protocol mimicry fingerprint of the video stream to be tested, parse the session status, and extract the video stream service features. The template generation and scheduling module includes a mimicry template generation module and a strategy scheduling module. The mimicry template generation module is used to construct a protocol mimicry low-traffic detection template based on the protocol mimicry fingerprint, protocol type, session state, and video stream service characteristics. The strategy scheduling module is used to calculate the testing priority based on the device metadata, video stream service characteristics, historical testing anomaly probability, metadata change weight, and slice popularity, thereby determining the testing frequency and testing depth. The active dialing test execution module is used to perform active low-volume dialing tests based on the dialing test frequency and dialing test depth, and send the probe packets in the protocol mimicry low-volume detection template; The twin quality mapping module is used to calculate the service quality twin score based on the link return status, probe packet return trajectory and real video stream status collected after the test is performed; The anomaly attribution module is used to perform anomaly attribution identification and distinguish anomaly types based on the test results and the service quality twin score. The alarm and policy update module is used to output the test policy results, twin quality scores, anomaly attribution results and alarm information, and update the historical records and policy parameters that the next round of test depends on based on the results of this round of test.

[0050] To facilitate understanding of the above technical solutions of the present invention, the following detailed description of the above technical solutions of the present invention will be provided through specific usage methods.

[0051] Example 1: High-frequency depth measurement of high-risk old cameras An old outdoor camera installed at the main entrance experienced 5 network outages and 2 packet loss anomalies within the past three months. The system aggregated its device metadata and actual service flow status through the device management platform interface and probe bypass mirror port, obtaining the following results: model risk M=0.8, location risk L=0.9, failure frequency F=0.85, recent failure time attenuation A=0.72, and area importance S=0.95. Furthermore, the bitstream parameters at this location underwent adjustments after the two most recent firmware upgrades, resulting in a high metadata change weight C_m.

[0052] Within a 10-second observation window, the system detected significant fluctuations in the video bitrate, a high slice heat index (H), and a significantly higher historical anomaly probability (P_h) than normal locations. Therefore, the detection priority score (G) exceeded the high-frequency deep detection threshold. Based on this, the system generated a protocol mimicry detection sequence with a GB28181 status template and performed deep detection without preempting service bandwidth.

[0053] After the test was performed, the system found that the loss of probe packets and the RTP sequence number gap occurred simultaneously, and the NACK feedback in RTCP continued to increase and the link queuing delay increased. The cause was ultimately attributed to network congestion and an alarm was output with high priority.

[0054] Example 2: Low-frequency shallow tapping test of a newly installed stabilized camera A newly installed indoor camera is located in a regular corridor. It has no historical fault records, and its video stream bitrate has been consistently stable. The system calculates that its metadata risk score R is low, its business fluctuation score V is low, and its historical anomaly probability P_h is close to zero. Therefore, the system maintains the testing level for this location at a low-frequency, shallow testing level.

[0055] During the probing process, the system only sends RTSP mimicry probe packets at a low frequency, without significantly increasing the link load. After several rounds of probing results were normal, the system further lowered the probing priority for this location to save probing resources.

[0056] Example 3: Millisecond-level detection and anomaly differentiation in dynamic scenarios A certain video capture camera experienced a sudden change in bitrate when a vehicle passed by at high speed. After detecting a rapid increase in slice heat H and service fluctuation score V, the system increased the probe frequency to the millisecond level and constructed probe packets based on the packet length distribution, frame interval characteristics, and TCP congestion window trends of real RTSP services.

[0057] The test results showed occasional packet loss, but no RTP sequence number gaps, no significant packet loss feedback from RTCP, and only a slight increase in Q_twin. Therefore, the system classified this anomaly as a transient anomaly on the probe side and did not issue a high-level alarm for the actual video service. If subsequent RTP gaps and RTCP anomalies occur simultaneously, the system will automatically escalate the alarm to an actual video stream anomaly.

[0058] In summary, by utilizing the technical solutions described above, the protocol-mimicking small-traffic probe template can approximate the real video stream's business behavior in terms of bitrate, frame interval, packet length, and session state, reducing monitoring bias caused by general probe packets. Through joint scheduling of metadata risk models, business fluctuation scores, historical probe anomaly probabilities, metadata change weights, and slice popularity, refined allocation of probe resources can be achieved. Through service quality twin mapping, the real playback experience can be estimated within a few KB of traffic overhead, improving the business interpretability of probe results. Through joint attribution of RTP faults, RTCP feedback, signaling status, and twin scores, probe packet loss, real video stream packet loss, network congestion anomalies, and protocol parsing anomalies can be distinguished. Through policy write-back and closed-loop update mechanisms, continuous adaptive evolution of probe strategies can be achieved, improving long-term operation and maintenance effectiveness.

[0059] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for active detection and anomaly attribution of video streams, characterized in that, Includes the following steps: S1 accesses the video stream to be tested and aggregates the corresponding device metadata; S2 extracts the protocol mimicry fingerprint of the video stream to be tested, parses the session state, and extracts the video stream service features; S3 constructs a protocol mimicry low-volume detection template based on the protocol mimicry fingerprint, protocol type, session state, and video stream service characteristics. S4 calculates the testing priority based on the device metadata, video stream service characteristics, historical testing anomaly probability, metadata change weight, and slice popularity, and then determines the testing frequency and testing depth. S5 performs active low-volume dialing based on the dialing frequency and dialing depth, and sends the probe packets in the protocol mimicking low-volume probe template; S6 calculates the service quality twin score based on the link return status, probe packet return trajectory and real video stream status collected after the dial-up test is performed; S7 performs anomaly attribution identification and distinguishes anomaly types based on the test results and the service quality twin score; The S8 outputs the test strategy results, twin quality scores, anomaly attribution results, and alarm information, and updates the historical records and strategy parameters relied upon by the next round of test based on the results of this round of test.

2. The video stream active dialing and anomaly attribution method according to claim 1, characterized in that, The device metadata in step S1 includes at least one or more of the following: camera model, installation location, number of historical failures, time of the most recent failure, device online duration, priority of the region to which it belongs, and time of the most recent configuration change.

3. The video stream active dialing and anomaly attribution method according to claim 1, characterized in that, The protocol mimicry fingerprint in step S2 includes at least one or more of the following: control plane signaling fingerprint, media plane statistical fingerprint, and time behavior fingerprint; the video stream service features include at least one or more of the following: bitrate sequence, frame interval sequence, data packet size sequence, keyframe period, RTCP feedback feature, RTP sequence number continuity feature, and session state switching feature.

4. The video stream active dialing and anomaly attribution method according to claim 1, characterized in that, The specific method for constructing the protocol mimicry low-flow detection template in step S3 is as follows: statistical modeling is performed on the frame interval sequence, data packet size sequence, and key frame period sequence of the real video stream to construct a state transition matrix, and a template generation strategy is selected according to the protocol type. For RTSP or RTMP protocols, a mimicry detection sequence is generated using a state transition matrix and keyframe period constraints; for GB28181 protocols, SIP keep-alive, registration state, and session state templates are superimposed on the media stream mimicry.

5. The video stream active dialing and anomaly attribution method according to claim 1, characterized in that, The process of determining the testing priority, testing frequency, and testing depth in step S4 specifically includes: The device risk score R is calculated based on the device metadata, the service fluctuation score V is calculated based on the video stream service characteristics, the historical call test anomaly probability P_h is calculated based on the historical call test records, and the metadata change weight C_m and slice popularity H are introduced. The priority score for dialing is calculated as G = η1·R + η2·V + η3·P_h + η4·C_m + η5·H, where η1, η2, η3, η4, and η5 are preset weight coefficients. Determine the probe frequency f_probe=clip(f_min+k1·G,f_min,f_max), where k1 represents the scaling factor from probe priority to probe frequency, and f_min and f_max represent the minimum and maximum allowed probe frequencies, respectively. Determine the probe depth d_probe=clip(d_min+k2·R+k3·P_h+k4·H,d_min,d_max), where k2, k3, and k4 represent the scaling coefficients when mapping the equipment risk score, historical probe anomaly probability, and slice heat to the probe depth, respectively, and d_min and d_max represent the minimum probe depth and the maximum probe depth, respectively.

6. The video stream active dialing and anomaly attribution method according to claim 1, characterized in that, The formula for calculating the service quality twin score Q_twin in step S6 is as follows: Q twin =ξ1·norm(D_p)+ξ2·L_p^rate+ξ3·G_rtp+ξ4·F_rtcp+ξ5·(1-S _sig ), Where D_p is the probe return delay, norm(D_p) is its normalized value; L_p^rate is the probe packet loss rate; G_rtp is the RTP sequence number tomography intensity; F_rtcp is the RTCP anomaly feedback intensity; S_sig is the signaling health; ξ1, ξ2, ξ3, ξ4, and ξ5 are the mapping weights of each observation.

7. The video stream active dialing and anomaly attribution method according to claim 1, characterized in that, The anomaly attribution identification in step S7 specifically includes: Define the probe packet loss indicator L_p, the real video stream RTP sequence number tortuosity indicator L_r, the RTCP anomaly feedback indicator L_c, and the protocol signaling anomaly indicator L_s; The determination is made according to preset rules: If L_p=1 and L_r=0, then the probe packet is determined to be lost; If L_p=1, L_r=1, L_c=1, and the link queuing delay increases, then it is determined to be an abnormal network congestion. If L_r=1, L_s=1, and L_c is lower than the preset threshold, then it is determined to be a protocol parsing error; If L_p=0 and L_r=1, then it is determined that the video stream has actually lost packets; When multiple conditions are met simultaneously, the main anomaly type and the secondary anomaly type are output based on the probability model.

8. The video stream active dialing and anomaly attribution method according to claim 7, characterized in that, in, The main anomaly type output based on the probabilistic model is as follows: The probability of the main anomaly is defined as: P(C_j|Z)=exp(u_j(Z)) / Σexp(u_k(Z)), where C_j represents the j-th candidate anomaly type; u_j(Z) represents the discrimination score of the joint feature vector Z for the j-th anomaly; u_k(Z) represents the discrimination score of the k-th anomaly; and Z=[L_p,L_r,L_c,L_s,R,V,H,Q_twin] is the joint feature vector.

9. The video stream active dialing and anomaly attribution method according to claim 1, characterized in that, Step S8 updates the historical records and strategy parameters relied upon for the next round of testing based on the results of this round of testing, specifically as follows: Let the risk score after the t-th round of testing be R_t, and the new risk estimate generated in this round of testing be R_hat_t. Then the updated risk score is: R_(t+1)=ρ•R_t+(1-ρ)•R_hat_t, where ρ is the smoothing coefficient. If a certain point is abnormal for m consecutive rounds, its testing priority will be automatically increased; if it is stable for n consecutive rounds, its testing priority will be automatically decreased. At the same time, the service quality twin score, anomaly attribution result and final scheduling parameters obtained in this round of testing will be written back to refresh the historical testing anomaly probability, metadata change weight and scene popularity.

10. A video stream active detection and anomaly attribution system, characterized in that, For performing the method according to any one of claims 1 to 9, comprising: The metadata aggregation and fingerprint extraction module includes a metadata aggregation module and a protocol mimicry fingerprint extraction and status parsing module; the metadata aggregation module is used to access the video stream to be tested and aggregate the corresponding device metadata; the protocol mimicry fingerprint extraction and status parsing module is used to extract the protocol mimicry fingerprint of the video stream to be tested, parse the session status, and extract the video stream service features. The template generation and scheduling module includes a mimicry template generation module and a strategy scheduling module. The mimicry template generation module is used to construct a protocol mimicry low-traffic detection template based on the protocol mimicry fingerprint, protocol type, session state, and video stream service characteristics. The strategy scheduling module is used to calculate the testing priority based on the device metadata, video stream service characteristics, historical testing anomaly probability, metadata change weight, and slice popularity, thereby determining the testing frequency and testing depth. The active dialing test execution module is used to perform active low-volume dialing tests based on the dialing test frequency and dialing test depth, and send the probe packets in the protocol mimicry low-volume detection template; The twin quality mapping module is used to calculate the service quality twin score based on the link return status, probe packet return trajectory and real video stream status collected after the test is performed; The anomaly attribution module is used to perform anomaly attribution identification and distinguish anomaly types based on the test results and the service quality twin score. The alarm and policy update module is used to output the test policy results, twin quality scores, anomaly attribution results and alarm information, and update the historical records and policy parameters that the next round of test depends on based on the results of this round of test.

Images