Network device running state real-time monitoring method and system based on multi-source log fusion

Abstract

The application relates to the technical field of device monitoring, and discloses a network device running state real-time monitoring method and system based on multi-source log fusion. The method obtains multi-source log data of a network device and constructs a fusion window sample, performs hidden state soft distribution and time sequence smoothing correction based on device state transition graph constraints, executes differentiated feature enhancement according to characteristic physical semantics and generates a global time context signal, further constructs a time sequence decomposition convolutional neural network, extracts trend and pulse information through a trend path and a pulse path respectively, fuses double-path information by using a state transition memory gate vector, finally performs state probability guided attention pooling and classification output, and obtains a device state recognition result, so that the network device running state real-time monitoring accuracy is significantly improved.

Description

Technical Field

[0001] This invention relates to the field of equipment monitoring technology, specifically to a method and system for real-time monitoring of the operating status of network devices based on multi-source log fusion. Background Technology

[0002] With the continuous expansion of data centers, carrier backbone networks, and large enterprise campus networks, the types and numbers of network devices have increased dramatically. Each device generates massive amounts of diverse monitoring data during operation, including device performance monitoring data primarily in numerical metrics, semi-structured system log text statistics, and discrete event-coded reporting data. These multi-source data sources are inherently inconsistent in sampling granularity, timestamp precision, and representation. Traditional operation and maintenance methods often rely on setting fixed thresholds or separately viewing different log panels to determine device status, making it difficult to efficiently integrate heterogeneous information. This results in a large number of potential risks being buried in complex information silos.

[0003] The existing technical solutions have the following problems that still need to be addressed:

[0004] 1. For multi-source logs of different granularities and formats, a uniform full normalization and rigid splicing are often used, without fully considering the continuity constraints of equipment operating status. Single-point anomalies or acquisition noise are easily amplified into state switching signals, resulting in frequent jumps in state estimation.

[0005] 2. Logarithmic, textual, and encoded features are often processed using the same numerical methods without distinction. Discrete class codes are directly treated as continuous quantities and the mean and standard deviation are subtracted, which destroys the semantic information of the encoded features and makes it difficult to accurately reflect the true state anomalies.

[0006] 3. Typically, it relies solely on the model itself to learn long-range dependencies through attention or recursive structures, lacking the injection of window-level contextual signals representing the overall trend of change at the input stage. This makes the model susceptible to lag or information being masked by local fluctuations when perceiving slowly evolving system-level drift.

[0007] 4. Traditional time series models or state monitoring methods are difficult to effectively handle both slow trend drift and sudden short-term pulse time patterns at the same time. They lack modeling and closed-loop utilization of historical state evolution memory, and cannot adaptively adjust the sensitivity to instantaneous anomalies according to the current risk stage. This can easily generate a large number of invalid alarms or miss early fault signs. Summary of the Invention

[0008] To address the aforementioned shortcomings in the existing technology, this invention provides a method and system for real-time monitoring of network device operating status based on multi-source log fusion.

[0009] To achieve the above-mentioned objectives, the technical solution adopted by this invention is as follows:

[0010] In a first aspect, this invention proposes a method for real-time monitoring of the operating status of network devices based on multi-source log fusion, comprising the following steps:

[0011] Acquire multi-source log data and device operating status tags during the operation of network devices; the multi-source log data includes at least numerical measurement data, system log data, and event reporting data.

[0012] Based on the multi-source log data, an original fusion window sample is constructed, and all features in the original fusion window sample are divided into numerical metric features, sparse counting features, and coded index features according to their physical meaning.

[0013] Based on the constraints of the device state transition diagram, implicit state soft assignment is performed at each time step, and temporal smoothing correction is performed on the state probabilities to obtain a smooth state probability sequence.

[0014] Differential feature enhancement is performed on the smooth state probability sequence according to feature type to obtain an enhanced feature matrix, and a global time context signal is generated based on the enhanced feature matrix to obtain the final time series feature matrix;

[0015] A temporal decomposition convolutional neural network is constructed. Trend information is extracted from the final temporal feature matrix through the trend path and pulse information is extracted through the pulse path. The trend information and pulse information are fused using the state transition memory gating vector. Then, the device status recognition result is obtained by state probability-guided attention pooling and classification output.

[0016] Secondly, this invention proposes a real-time monitoring system for the operating status of network devices based on multi-source log fusion, which applies the aforementioned real-time monitoring method for the operating status of network devices based on multi-source log fusion, including:

[0017] The data acquisition module is used to acquire multi-source log data and device operating status tags during the operation of network devices; the multi-source log data includes at least numerical measurement data, system log data, and event reporting data;

[0018] The sample construction module is used to construct an original fusion window sample based on the multi-source log data, and to divide all features in the original fusion window sample into numerical metric features, sparse counting features and coded index features according to their physical meaning.

[0019] The smoothing correction module is used to perform implicit state soft allocation for each time step based on the constraints of the device state transition diagram, and to perform temporal smoothing correction on the state probabilities to obtain a smooth state probability sequence.

[0020] The feature enhancement module is used to perform differentiated feature enhancement on the smoothed state probability sequence according to feature type to obtain an enhanced feature matrix, and generate a global time context signal based on the enhanced feature matrix to obtain the final time series feature matrix;

[0021] The state recognition module is used to construct a temporal decomposition convolutional neural network, extract trend information from the final temporal feature matrix through the trend path and extract pulse information through the pulse path, and fuse the trend information and pulse information using the state transition memory gating vector. Then, after state probability-guided attention pooling and classification output, the device state recognition result is obtained.

[0022] The present invention has the following beneficial effects:

[0023] This invention acquires multi-source log data from network devices and constructs fusion window samples. Based on the constraints of the device state transition graph, it performs latent state soft allocation and temporal smoothing correction, performs differential feature enhancement according to the physical semantics of features, and generates a global temporal context signal. Then, it constructs a temporal decomposition convolutional neural network, extracts trend and impulse information through trend paths and impulse paths respectively, and fuses the dual-path information using state transition memory gating vectors. Finally, it obtains the device state recognition result through state probability-guided attention pooling and classification output, thereby significantly improving the accuracy of real-time monitoring of network device operating status. Attached Figure Description

[0024] Figure 1 This is a schematic diagram of a method for real-time monitoring of network device operating status based on multi-source log fusion according to the present invention;

[0025] Figure 2 A bar chart comparing the performance of network device status monitoring;

[0026] Figure 3 Comparison of kernel density plots before and after enhancement of CPU utilization characteristics;

[0027] Figure 4 A comparison chart of attention weights and the smoothed probability distribution of fault precursors;

[0028] Figure 5 This is a schematic diagram of the structure of a real-time monitoring system for the operating status of network devices based on multi-source log fusion according to the present invention. Detailed Implementation

[0029] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.

[0030] like Figure 1 As shown in the figure, an embodiment of the present invention provides a method for real-time monitoring of network device operating status based on multi-source log fusion, comprising the following steps S1 to S5:

[0031] S1. Obtain multi-source log data and device operation status tags during the operation of network devices; the multi-source log data includes at least numerical measurement data, system log data, and event reporting data.

[0032] In an optional embodiment of the present invention, network devices simultaneously generate numerical measurement data, text log statistical data, and event-coded data during operation. The sampling granularity, representation format, and timestamp precision of data from different sources are typically inconsistent. This step first performs unified sampling, feature processing, and window segmentation on the multi-source logs, and then combines this with maintenance records to complete status labeling, obtaining raw fusion window samples that can be directly used for training and inference. The specific steps are as follows:

[0033] Multi-source log data is collected from the network device side. The collected data includes device performance monitoring data, system log data, and event reporting data. Device performance monitoring data includes CPU utilization, memory usage, cache hit rate, port inbound traffic rate, port outbound traffic rate, packet loss rate, retransmission rate, and latency jitter. System log data includes counts of different log levels, the number of occurrences of key fault keywords, and the number of process restarts. Event reporting data includes Simple Network Management Protocol (SMMP) trap object identifiers, event type codes, port status codes, and board status codes.

[0034] In one embodiment, for example, a sample is a multi-dimensional feature matrix within a fixed-length time window. For instance, if 64 consecutive sampling times (i.e., 64 minutes) are taken, and 128-dimensional features are collected at each time point (such as 32-dimensional performance data, 80-dimensional log counts, and 16-dimensional state codes), then the sample is a... A matrix that corresponds to a state label, such as "normal state".

[0035] S2. Construct an original fusion window sample based on the multi-source log data, and divide all features in the original fusion window sample into numerical metric features, sparse counting features, and coded index features according to their physical meaning;

[0036] In an optional embodiment of the present invention, step S2 constructs an original fusion window sample based on the multi-source log data, and divides all features in the original fusion window sample into numerical metric features, sparse counting features, and coded index features according to their physical meaning, including:

[0037] Perform unified alignment on the timestamps of the multi-source log data;

[0038] A single sample is constructed using a sliding time window of fixed length.

[0039] All features are classified into numerical metric features, sparse counting features, and coded index features according to their physical meaning.

[0040] This embodiment uses 60 seconds as a uniform sampling interval, takes the average value of the device performance monitoring data falling within the same minute, counts the occurrences of system logs within the same minute according to the keyword dictionary, and retains the last valid code value of the event reporting data within the same minute, so that data from different sources are organized onto a unified timeline.

[0041] In one embodiment, as an example, assuming that CPU utilization data is collected three times within the minute from 10:00:00 to 10:00:59 at 60-second intervals: 50%, 52%, and 54%, then the CPU utilization at that moment after alignment is taken as the average of 52%; if the "link disconnected" log keyword appears twice within that minute, then the "link disconnected" count at that moment after alignment is 2; if the port status changes to "up" multiple times within that minute, then only the encoded value after the last change is retained.

[0042] In this embodiment, a single sample is constructed using a fixed-length sliding time window. The original fusion window matrix corresponding to a single sample is denoted as... Original fusion window matrix This represents the feature matrix after fusing multiple source logs within a time window, with a size of [value missing]. ,in, This indicates the number of time steps; for example, 64 can be used to represent 64 consecutive sampling times. This represents the total dimension of the features, for example, 128. Original fusion window matrix. The Travelogue , Indicates the first The feature vectors at each time step have a dimension of . .

[0043] This embodiment divides all features into three categories according to their physical meaning: numerical metric features, sparse counting features, and coded index features. Specifically, the index set of numerical metric features is denoted as... The set of indices for sparse counting features is denoted as . The set of indexes encoding index features is denoted as . .when It includes 32-dimensional numerical metric features, 80-dimensional sparse counting features, and 16-dimensional coded index features.

[0044] For example, based on the physical meaning and numerical properties of the features, the 128-dimensional features are divided into three categories: a> Numerical metric features ( ): A total of 32 dimensions, for example, the first dimension is "CPU utilization", the second dimension is "memory usage", and the fifth dimension is "port inbound traffic rate". b>Sparse counting features ( ): A total of 80 dimensions, for example, the 33rd dimension is the "number of occurrences of the critical fault keyword 'link disconnection'", and the 34th dimension is the "number of process restarts". c> Encoding Index Features ( ): There are 16 dimensions in total. For example, the 113th dimension is the "event type encoding" and the 114th dimension is the "port status encoding".

[0045] This embodiment labels all time window samples with status tags, which are divided into three categories: normal state, overload state, and pre-fault state. The normal state indicates that the device is in a stable operating range, without continuous performance degradation or high-risk alarms. The overload state indicates that the device's resource utilization or link load is consistently high, but it has not yet entered a significant fault evolution stage. The pre-fault state indicates an early abnormal stage before the device experiences link interruption, board malfunction, repeated protocol session oscillations, or a significant decline in service quality within a preset future time range. In specific implementation, the labeling can be completed by combining maintenance work orders, alarm closed-loop records, manual troubleshooting records, and historical fault backtracking results. For example, if within 30 minutes after a certain time window, there is a continuous interface downtime (referring to the physical or protocol-level shutdown or failure of the network interface, i.e., "continuous interface interruption"), repeated protocol adjacency reconstruction, abnormal board temperature rise, and ultimately triggering a fault handling work order, then this time window can be labeled as a pre-fault state.

[0046] In this embodiment, all individual samples are organized into the original fusion window sample tensor. Original fusion window sample tensor Represents the set of all samples during the training phase, with a size of ,in, This indicates the number of samples. Additionally, the state label for each sample is saved for subsequent supervised training.

[0047] For example, the final sample consists of two parts: one The original fusion window matrix And a status label; for example, a matrix of all 128 features of a core router during the 64 minutes from 14:30:00 to 15:34:00, corresponding to the label "precursor state of failure".

[0048] S3. Based on the constraints of the device state transition diagram, perform soft assignment of hidden states for each time step, and perform temporal smoothing correction on the state probabilities to obtain a smooth state probability sequence.

[0049] In an optional embodiment of the present invention, step S3 performs implicit state soft allocation for each time step based on the constraints of the device state transition diagram, and performs temporal smoothing correction on the state probabilities to obtain a smoothed state probability sequence, including:

[0050] Calculate the heterogeneous distance between the feature vector at the current time step and the representative pattern vectors of each hidden state, and convert it into the initial soft assignment probability using a normalized exponential mapping based on negative distance.

[0051] Forward and backward smoothing are performed on the initial soft assignment probability based on the state transition probability matrix;

[0052] The forward smoothing probability vector and the backward smoothing probability vector are averaged and fused to obtain the smoothed state probability sequence.

[0053] Because the three types of features in multi-source logs differ significantly in numerical range, statistical distribution, and physical semantics, directly applying a uniform global mean-variance normalization method can easily mix the slow drift of numerical metric features, the long-tail distribution of sparse counting features, and the discrete category attributes of coded index features, making it difficult to distinguish between normal jitter and true fault precursors. Therefore, this embodiment first calculates the implicit state soft allocation for each time step based on the device state transition diagram, then performs time-series smoothing on the soft allocation results, followed by enhancement according to feature type, and finally generates the final time-series feature matrix containing the global time context signal. It also outputs a smooth state probability sequence for subsequent models.

[0054] Since equipment states are typically continuous between adjacent time steps, a normal state will not jump directly to a pre-fault state within a single time step without any basis. To incorporate this operational prior into the preprocessing, this embodiment first defines a small number of macroscopic hidden states, and then estimates the initial probability of the current time step belonging to each hidden state by utilizing the proximity between the current time step's feature vector and the representative pattern vectors of each hidden state. The specific steps are as follows:

[0055] (1) The hidden states are divided into three categories: normal state, overload state, and fault precursor state. Specifically, the hidden state index is denoted as... ,in, Indicates a normal state. Indicates an overload condition. This indicates a precursory state to a fault.

[0056] (2) Establish equipment state transition diagrams based on operation and maintenance experience, and write the equipment state transition diagrams as state transition probability matrices. State transition probability matrix Represents the hidden state transition prior between adjacent time steps, with size . , of which Line number Column elements represent starting from the first... The hidden state transitions to the first... The prior probability of each hidden state.

[0057] In one implementation, one can take , among which, the Line number Column elements represent starting from the first... The hidden state transitions to the first... The prior probability of a hidden state, for example, the value in the 1st row and 3rd column is 0.02, which means that the probability of directly jumping from the normal state (v=1) to the fault precursor state (v=3) is extremely low, which is 0.02; the equipment is likely to remain normal in the normal state, has a small probability of transitioning to the overload state, and a very small probability of directly transitioning to the fault precursor state; once the equipment enters the fault precursor state, it usually lasts for a period of time and will not immediately return to the normal state.

[0058] (3) Construct representative pattern vectors for the three hidden states respectively. , and , representing the pattern vector Indicates the first Typical feature patterns in each hidden state, with dimension . In practical implementation, different statistical methods can be used to construct the corresponding components in the representative pattern vector for the three types of features. Specifically, for numerical measurement features, the historical mean of the corresponding state label samples is used as the representative value; for sparse counting features, the count is first processed... The values ​​are compressed, and the average value of the corresponding state samples is taken as the representative value. For the encoded index features, the encoded value that appears most frequently in the corresponding state samples is used as the representative value.

[0059] In one implementation, if there are insufficient historical samples on-site, the current original fusion window matrix can also be used. The system internally constructs temporary representative pattern vectors. For example, segments with low CPU utilization, low error log counts, and infrequent encoding changes are used as normal state references; segments with high CPU utilization but relatively stable event encodings are used as overload state references; and segments with continuously increasing error logs and frequent port status encoding changes are used as fault precursor state references.

[0060] For example, for the numerical metric feature "CPU utilization", if the average CPU utilization value of a window marked as "normal" in historical samples is 35% across all time steps, then it represents a pattern vector. The corresponding component for "CPU utilization" is set to 35%. For the sparse counting feature "number of occurrences of the critical fault keyword 'link disconnection'", the count values ​​within all historical "overload state" sample windows are first calculated. conduct The transformation is performed, and then the mean of the transformed values ​​is calculated. If the calculated mean is 1.5, it represents the pattern vector. The component corresponding to the number of "link disconnections" takes a value of 1.5. For the "port status encoding" encoding index feature, if the encoded value 3 (e.g., representing the down state) appears most frequently within the window marked as "precursor state" in historical samples, then it represents the pattern vector. The component corresponding to "port status code" has a value of 3. It should be noted that... Represents the original count value Adding 1 first and then taking the natural logarithm is a common transformation used to compress the dynamic range of counting data and handle zero values. In machine learning tasks, the base of the logarithmic function is the natural constant by default.

[0061] (4) For the original fusion window matrix Each time step in Calculate the current feature vector Heterogeneous distance between the three representative pattern vectors This is used to allow three types of features to participate in similarity calculations in a manner suitable for their respective physical semantics. In specific implementation, the normalized absolute difference mean is first calculated for the numerical metric features to obtain the numerical metric distance; then the cosine distance is calculated for the sparse counting features to obtain the sparse counting distance; next, the mismatch ratio is calculated for the encoded index features to obtain the encoded index distance; finally, the total heterogeneous distance is obtained by weighted summation. In a convenient implementation method, the weights of the three parts can be set to 0.5, 0.3, and 0.2 respectively, corresponding to... ,in, This represents a numerical distance metric. Represents the sparse counting distance. This represents the encoded index distance.

[0062] (5) Convert the three heterogeneous distances into initial soft assignment probabilities for the current time step. The initial soft assignment probabilities are denoted as... , Indicates the first The time step belongs to the first The initial probability of each hidden state ranges from 0 to 1. One implementation uses a normalized exponential mapping based on negative distance to map distance to probability; the smaller the distance, the higher the probability, expressed as... ,in, This represents the sharpness adjustment parameter, used to control the degree of concentration of the probability distribution. The larger the value, the more concentrated the probability distribution is in the hidden state with the smallest distance. In one implementation, The current original fusion window matrix can be retrieved. The coefficient of variation is the reciprocal of the mean of all numerical metrics. It should be noted that the coefficient of variation for a single feature is defined as the ratio of its standard deviation to its mean within the window; if the mean is 0, the coefficient of variation for that feature is 0.

[0063] For example, if at a certain time step the CPU utilization increases significantly, the interface traffic rate remains high, the error log count increases moderately, and the port status coding remains stable, then this time step is closer to the representative pattern vector of the overload state. It will be significantly larger than and If both rapid accumulation of error logs and frequent switching of encoded indexes occur simultaneously, then It will rise further.

[0064] Since the initial soft-assignment probability of a single time step is easily affected by instantaneous jitter, isolated outliers, and acquisition errors, judging the state solely based on single-point similarity can easily misjudge a brief peak in the error log as a real precursor to a fault. Therefore, this step combines the state transition probability matrix to perform forward and backward smoothing on the initial soft-assignment probability, and then fuses them to obtain a smoothed state probability vector. The specific steps are as follows:

[0065] (1) The first The initial soft-assignment probabilities at each time step are written as a probability vector. Meanwhile, the forward smoothing probability vector is defined as follows: The backward smoothing probability vector is ; Indicates the first The forward smoothing probability vector at each time step incorporates the values ​​from time step 1 to time step 2. Historical information; Indicates the first The backward smoothing probability vector at each time step is incorporated from time step [number]. Time to step Future information. Forward smoothing is performed starting from time step 1, resulting in the forward smoothing probability vector. .when At that time, directly ordered ;when First, the forward smoothing probability vector from the previous time step is propagated to the current time step using the state transition probability matrix. Then, it is multiplied element-wise with the initial soft-assignment probability vector of the current time step. Finally, normalization is performed, represented as follows: ,in, This represents element-wise multiplication. This represents the transpose of the state transition probability matrix. This represents the normalization operation, which divides each element of a vector by the sum of its elements. Indicates the first Each time step forward smoothed probability vector. From time step Start performing backward smoothing and obtain the backward smoothing probability vector. .when At that time, directly ordered ;when First, the backward smoothing probability vector of the next time step is backpropagated to the current time step using the state transition probability matrix. Then, it is multiplied element-wise with the initial soft-assignment probability vector of the current time step. Finally, normalization is performed, represented as follows: ,in, Indicates the first The backward smoothed probability vector for each time step. Based on this, information from subsequent segments can be used to correct the current judgment, avoiding misjudging isolated anomalies lasting only one time step as real state transitions.

[0066] (2) The forward smoothing probability vector and the backward smoothing probability vector are averaged and fused to obtain the smoothed state probability vector. Smooth state probability vector This indicates that after comprehensively considering the current features, the previous time step, and the subsequent time steps, the th... The final confidence level of each time step belonging to one of the three hidden states.

[0067] For example, if at a certain time step, a sudden increase in the error log count due to a data acquisition jitter temporarily biases the initial soft allocation probability towards a pre-fault state, but the time steps before and after it are closer to the normal state, then after forward and backward smoothing, the probability of that time step... The values ​​will be suppressed, thus reducing the probability of misjudgment. It should be noted that this step does not directly perform a simple time average on the original features, but first estimates the probability of hidden states, and then performs a smooth correction according to the device state transition rules. Based on this, while retaining the instantaneous anomaly information of the original features, the state switching is limited to a range consistent with operational experience. This effectively improves the stability of overload state and fault precursor state determination.

[0068] This embodiment encodes the state continuity prior in the operation and maintenance field into a transition probability matrix, and performs forward-backward smoothing on the initial state probability of each time step, thereby using global sequence information to correct the instantaneous misjudgment that may be caused by single-point calculation, making the state probability estimation robust to acquisition jitter and isolated anomalies.

[0069] S4. Perform differential feature enhancement on the smoothed state probability sequence according to feature type to obtain the enhanced feature matrix, and generate a global time context signal based on the enhanced feature matrix to obtain the final time series feature matrix;

[0070] In an optional embodiment of the present invention, step S4 performs differential feature enhancement on the smoothed state probability sequence according to feature type, including:

[0071] Perform deviation-enhanced standardization on numerical metric features;

[0072] Log-compression is performed on sparse counting features, followed by weighted standardization based on the normal state conditional distribution;

[0073] Calculate the state inconsistency score for the encoded index features.

[0074] The smoothed state probability can be used as a soft weight to indicate "which running state the current time step is closer to". Since the three types of features have different indication methods, the same enhancement strategy cannot be used. Therefore, this embodiment uses the smoothed probability of the normal state as a reference weight, estimates the normal state conditional distribution for each feature, and then performs enhancement processing according to feature type to obtain the enhanced feature matrix. The specific steps are as follows:

[0075] (1) For each feature dimension Using the smoothed probability of the normal state As a weight, the conditional mean of this feature under normal conditions is calculated. Conditional standard deviation .in, Indicates the first The baseline level of each feature under normal conditions is calculated as follows: ,in, Represents the original fusion window matrix In the middle, the first The time step, the first The original values ​​of each feature; Indicates the first The smoothed state probabilities belonging to the "normal state" (hidden state 1) at each time step are used as weights for calculating the conditional distribution of the normal state. Furthermore, Indicates the first The fluctuation range of each characteristic under normal conditions is calculated as follows: ,in, Indicates the first The weighted conditional variance of each feature under "normal conditions"; Indicates the first The weighted conditional standard deviation of each feature under "normal conditions" is the positive square root of the conditional variance. Further, the weighted conditional standard deviation of this feature within the current original fusion window matrix is ​​calculated. global mean in and global standard deviation Based on this, we can obtain two reference values ​​at the same time: the "normal state baseline" and the "current window overall level".

[0076] (2) Perform deviation-enhanced standardization on numerical metrics, and denote the enhancement value of the numerical metrics as . The calculation method is as follows: First, subtract the mean of the normal state conditions from the current value and divide by the standard deviation of the normal state conditions to achieve standardization relative to the normal baseline; then multiply by an amplification factor consisting of the "degree of deviation between the normal state mean and the current window global mean" to detect slow-drifting anomalies in advance, expressed as... ,in, Represents the original fusion window matrix In the The time step, the first The original values ​​of each feature; This represents a very small positive constant, used to prevent the denominator from being zero. For example, it can be taken as... ; Indicates the first The anomaly sensitivity coefficient for a numerical metric can be directly set to 1 when sufficient historical statistics are lacking. It should be noted that this calculation method decouples and fuses the "instantaneous deviation from the normal baseline" and the "overall drift from the normal baseline." This measure assesses the instantaneous deviation of the current point from the normal baseline. This item reflects whether the normal baseline of the entire window has shifted overall, making "slow-drift" anomalies, which have not yet formed peaks but whose average level has been rising, visible.

[0077] For example, if a numerical metric has a conditional mean of 40 and a conditional standard deviation of 5 under normal conditions, a global mean of 55 and a global standard deviation of 10 in the current window, and an original value of 70 at the current time step, then the standardized term is: Amplification factor is The final enhancement value was 15. Based on this, even if the feature does not show a momentary spike, it will be significantly enhanced as long as it continues to rise relative to the normal baseline.

[0078] (3) Perform enhancement processing on sparse count features by "compression followed by normalization". Specifically, first compress the original counts... Transform into ,Right now To compress extremely large counts, among which, Indicates the first The time step, the first The sparse counting features are log-compressed values; then weighted and standardized using the conditional mean and conditional standard deviation associated with the normal state. ,in, Indicates the first The time step, the first The standardized value of a sparse counting feature; Indicates compression value The weighted conditional mean under "normal conditions" is calculated in the same way as... Similarly, only the original value is... Replace with compressed value ; Indicates compression value The weighted conditional standard deviation under "normal conditions" is calculated; finally, the results are cropped to a preset range, for example, cropped to... This prevents extreme peak values ​​from affecting the stability of subsequent neural network training. It should be noted that while sparse counting features are also numerical, they essentially represent how many times a certain type of event occurs at the current time step, typically exhibiting a long-tailed distribution. By first performing logarithmic compression and then scaling based on a normal-state reference distribution, we can simultaneously preserve the visibility of moderate-intensity anomalies and the consistency of the overall scale.

[0079] (4) Encoded index features are merely category identifiers; there is no reliable magnitude relationship between encoded values. For example, codes 1001 and 1002 are numerically similar, but this does not mean they are physically closer. This invention performs state inconsistency score calculation on encoded index features, without directly treating the encoded values ​​as continuous variables for subtraction of the mean and division of the standard deviation. In this embodiment, a representative code is first determined for each encoded index feature in three hidden states, denoted as... , and Then, for the first The current encoded value at each time step Calculate the state consistency score , Indicates the first The time step, the first The state consistency score of each encoded index feature represents the degree of consistency between the current encoding and the expected encodings of each hidden state. The calculation method is expressed as follows: ,in, This indicates an indicator function; it takes the value 1 if the condition within the square brackets is true, and 0 if the condition is false. Indicates the first In the hidden state, the first The representative encoded value of each encoded index feature; Indicates the first The time step belongs to the first The smooth state probability of each hidden state. Furthermore, the encoding index feature enhancement value is defined as... ,Right now, It is a separate definition of the encoded class features, which serves as the final enhanced feature matrix. The value of the encoded part. It should be noted that for the encoded index feature ( ), its final enhancement value Defined as The larger this value, the more inconsistent the current encoding is with the representative encoding of the current high-probability hidden state, indicating a higher degree of anomalousness. For example, when they are completely consistent... Enhancement value , indicates no abnormality; when completely inconsistent Enhancement value This indicates an extreme anomaly. Based on this, when the current encoded value is consistent with the representative encoding corresponding to the high-probability hidden state, the encoding index feature enhancement value is close to 0; when the current encoded value is inconsistent with neither the current high-probability hidden state nor the current encoding index, the encoding index feature enhancement value is close to 1, indicating that the encoding index is even more anomalous.

[0080] For example, if the smooth state probability at a certain time step satisfies , , This indicates that the time step is closer to the pre-fault state; if the current event type code is exactly equal to the representative code of the pre-fault state. ,but A value close to 0.7 corresponds to a feature enhancement value of approximately 0.3 for the encoded index; if the current encoded value is inconsistent with all three representative codes, then... The corresponding encoding index feature enhancement value is 1.

[0081] (5) Reassemble the enhanced results of numerical metric features, sparse counting features, and coded index features in the original feature order to obtain the enhanced feature matrix. Enhanced feature matrix This represents the time-series feature matrix after differential enhancement, with the size still being [size missing]. It should be noted that this step does not simply scale all features to the same interval, but rather constructs enhancement methods according to the physical semantics of the features. In particular, for the encoded index features, state inconsistency scores are used instead of direct numerical normalization, which can avoid treating discrete category codes as continuous quantities, thereby reducing representation distortion.

[0082] This embodiment adopts a differentiated enhancement strategy based on the physical semantics of the features. It standardizes numerical measurement features that deviate from the normal baseline and superimposes an overall drift amplification factor. It performs weighted standardization on sparse counting features after logarithmic compression and calculates the consistency score between the encoded index features and the hidden state representative encoding to avoid treating discrete categories as continuous values ​​and causing representation distortion.

[0083] In an optional embodiment of the present invention, step S4 generates a global time context signal based on the enhanced feature matrix to obtain the final time series feature matrix, including:

[0084] For each feature dimension in the enhanced feature matrix, calculate the first-order difference between adjacent time steps;

[0085] For each feature dimension, the absolute value of the first-order difference is weighted and averaged using the smoothed probability of the fault precursor state to obtain the global time context signal.

[0086] For each time step, the global time context signal is concatenated with the enhanced feature matrix to obtain the final time series feature matrix.

[0087] Enhanced feature matrix While the static anomaly level at each time step has been reflected, a window-level characterization of "which features change most drastically during the fault precursor period" is still lacking. Therefore, this embodiment calculates the first-order difference of the enhanced feature matrix and uses the smoothing probability of the fault precursor state as weights to generate a global time context signal, which is then concatenated with the enhanced feature vector of each time step to form the final time-series feature matrix. The specific steps are as follows:

[0088] (1) Enhanced feature matrix Each feature dimension Calculate the first-order difference between adjacent time steps. The difference value is denoted as Its calculation method is the first The enhancement value at the first time step minus the first time step The enhancement value at each time step. If If so, all differences are set to 0 by default.

[0089] For example, if the probability of a fault precursor is within 64 steps in a window... The value is high between steps 20 and 30 (average 0.8), while it is close to 0 at other time steps; for the "interface error count" feature, its absolute difference is... If the value is large only during this period (e.g., an average of 3.0), and small during other periods (e.g., an average of 0.1), then the weighted average is obtained as follows: It will be very large, approximately Conversely, if a feature fluctuates drastically at all time steps, but never at any time step... Within the high segment, then its It will be very small.

[0090] (2) For each feature dimension Utilizing the smoothing probability of fault precursor states The context-enhanced scalar of this feature is obtained by taking a weighted average of the absolute values ​​of the first-order differences. This indicates the intensity of the change in this feature related to fault precursors within the current window. If a feature only fluctuates drastically during normal conditions and remains relatively stable during fault precursor periods, the corresponding value will not be significant; if a feature changes continuously precisely during segments with a high probability of fault precursors, the corresponding value will be significant. It will increase significantly.

[0091] For example, for a feature The absolute value of the first-order difference of its enhancement value at each time step Probability of early signs of failure The calculation method is as follows: assuming time step It is 10 o'clock. and Time step When it is 30, and The absolute value of the difference and the probability of fault precursors at the remaining time steps are close to 0; therefore, its context-enhanced scalar... Mainly affected The influence of the vicinity is approximately equal to much larger Contribution at the time This indicates that the characteristic changes drastically during the pre-fault period. The value is very high.

[0092] (3) The global context signal is obtained by averaging the context enhancement scalars of all features. Global context signals It represents the overall dynamic change intensity related to the precursory symptoms of a fault within the current time window, and is a scalar.

[0093] For example, for all features Calculate the arithmetic mean. For example, if a system has three characteristics, their... The values ​​are 2.4, 0.3, and 0.1 respectively. scalar value This indicates that within the current window, the overall dynamic changes related to the precursors of a fault are of high intensity.

[0094] (4) For each time step This will enhance the feature matrix. The first in Row-enhanced feature vectors and global context signals The components are concatenated to obtain the final time-series feature matrix. The size is The newly added 1D feature is a single global context signal, used to inform the subsequent model whether "the current entire window is in an overall change phase related to the precursors of a fault".

[0095] In this embodiment, a global time context signal is generated by smoothing the probability of fault precursors and weighting the first-order difference during the preprocessing stage. This signal is then used as an additional dimension to be concatenated into the feature vector of each time step, enabling the network to perceive the fault evolution intensity of the entire time window during point-by-point inference.

[0096] S5. Construct a temporal decomposition convolutional neural network, extract trend information from the final temporal feature matrix through the trend path and extract pulse information through the pulse path, and fuse the trend information and pulse information using the state transition memory gating vector. Then, through state probability-guided attention pooling and classification output, the device status recognition result is obtained.

[0097] In an optional embodiment of the present invention, step S5 constructs a temporal decomposition convolutional neural network, extracts trend information from the final temporal feature matrix through a trend path and extracts pulse information through a pulse path, and fuses the trend information and pulse information using a state transition memory gating vector. Then, after state probability-guided attention pooling and classification output, the device state recognition result is obtained, including:

[0098] The final temporal feature matrix is ​​mapped to the hidden space through a linear projection layer to obtain the network input matrix;

[0099] Trend information is extracted by performing one-dimensional causal convolution along the time axis through the trend path, and pulse candidate information is extracted by performing one-dimensional dilated convolution along the time axis through the pulse path. Finally, pulse information is obtained by performing threshold shrinkage on the pulse candidate information.

[0100] The pulse information is adjusted channel by channel using a state transition memory gating vector, and then fused with the trend information to obtain fused output information;

[0101] Update the state memory vector based on the fused output information;

[0102] A state probability-guided attention pooling layer is used to perform weighted summation on the fused output information to obtain a global feature vector;

[0103] The global feature vector is classified and output to obtain the device status recognition result.

[0104] Step S5, constructing the temporal decomposition convolutional neural network, includes:

[0105] A linear projection layer is constructed to map the final temporal feature matrix to the hidden space;

[0106] Construct multiple cascaded time series decomposition blocks, each containing trend path, impulse path, state transition memory gating fusion, and state memory update;

[0107] Construct an attention pooling layer guided by state probabilities;

[0108] Construct a classification output layer.

[0109] Final time series feature matrix Having already integrated state transition constraints, differential normalization, and temporal context information, further 3-class classification recognition is required via an end-to-end neural network. Addressing the issue of network device logs exhibiting both slow drift and short-duration pulse patterns, this embodiment constructs a temporal decomposition convolutional neural network. This network first decomposes trend and pulse components, then uses state memory vectors to control the intensity of pulse information injection, and finally combines the smoothing probability of fault precursor states for attention pooling and classification. The specific steps are as follows:

[0110] (1) In order to project input features from different sources and with different dimensions into a unified hidden space to facilitate subsequent convolution processing, the final temporal feature matrix is... By inputting the linear projection layer step by step over time, the network input matrix is ​​obtained. Network input matrix This represents the initial hidden representation entering the temporal decomposition convolutional neural network, with a size of [size missing]. ,in, This indicates the number of hidden channels, for example, 64.

[0111] (2) Construction A series of cascaded time-series decomposition blocks. The input matrix of each time series decomposition block is denoted as... The output matrix is ​​denoted as ,in, This represents a block index, with values ​​ranging from 1 to... In one implementation, The value can be 4, and the number of channels in each time series decomposition block remains constant. In each time series decomposition block, the input matrix will be... Simultaneously, the trend path and impulse path are input. The trend path undergoes a one-dimensional causal convolution along the time axis, with a kernel width of 7, a stride of 1, and a dilation rate of 1. Following the convolution, normalization and non-linear activation are applied to obtain the trend path output matrix. Trend path output matrix This indicates trends such as slow changes, continuous rises, and long-term drift. It should be noted that causal convolution means that the output of the current time step depends only on the data of the current and previous time steps, and does not depend on the data of future time steps. In order to keep the time step length constant, zero padding or copying the first frame for padding can be done on the left side of the time axis.

[0112] Using the same input matrix The pulse path is input. A one-dimensional dilated convolution is performed along the time axis on the pulse path. The kernel width can be 3, and the dilation rate can be 4, resulting in a pulse candidate matrix. This matrix is ​​used to capture pulse information such as rapidly occurring log spikes, sudden alarms, and abnormal code switching within a short period. In the specific implementation, the pulse path is implemented using a one-dimensional dilated convolution with a kernel size of 3 and a dilation rate of 4. That is, the convolution kernel samples the input sequence with a stride of 4. For example, for a time step... The position involved in the convolution calculation is This allows the output neuron to capture burst patterns spanning up to eight time steps, rather than just changes between adjacent moments, thus effectively capturing short-duration pulses.

[0113] Threshold shrinkage is performed on the pulse candidate matrix to obtain the pulse path output matrix. In the actual implementation, the learnable threshold vector is first subtracted from each channel. Then set any result less than or equal to 0 to 0; after that, you can continue to subtract the fixed small amount of shrinkage. ,For example A value of 0.01 can be used to further suppress low-amplitude noise response.

[0114] For example, suppose the output value of the pulse candidate matrix at a certain time step and a certain channel is The learnable threshold corresponding to this channel is (Right now (corresponding component in the text), fixed shrinkage amount is First, calculate the soft threshold: if The result is ;like If the result is 0, then a fixed-amount contraction is performed: if the result of the previous step is greater than... The final pulse path output If the result of the previous step is less than or equal to The final output will be... .For example: , , The first step is to obtain... The second step yielded The final pulse output is 0.19.

[0115] (3) Trend path output matrix and pulse path output matrix After generation, they cannot be simply added together because, under normal conditions, some short-duration pulses are merely harmless jitter, and, in the pre-fault state, pulses of the same amplitude often carry a stronger risk connotation. Therefore, this embodiment records the evolution of the preceding state using a state memory vector, and then uses a state transition memory gating vector to control when the pulse information should be amplified. The specific steps are as follows:

[0116] (31) Regarding the first Each time step of a time-series decomposition block Take the trend path output vector respectively and pulse path output vector .in, Output matrix representing trend path The Rows, dimensions are ; Represents the pulse path output matrix The Okay, the dimension is also... .

[0117] (32) is the first Each time series decomposition block sets a state memory vector. State memory vector Indicates as of the date The accumulated state evolution information at each time step is denoted by dimension . For example, 32 can be taken. And, the first... Initial state memory vector of each time-series decomposition block Set it to a vector of all zeros.

[0118] (33) will , and the state memory vector of the previous time step Common input gating computation yields the state transition memory gating vector. State transition memory gate vector This indicates how much pulse information from each channel should be retained at the current time step, with the dimension being... Each element takes values ​​from 0 to 1, and the calculation method is expressed as follows: ,in, This indicates vector concatenation; This represents the Sigmoid activation function; The gating weight matrix, representing the features at the current time step, is a trainable parameter; The gating weight matrix representing the memory of historical states is a trainable parameter; This represents the bias vector, which are trainable parameters. It should be noted that the input matrix... Each row is arranged by time step Arranged in order, That is, the historical positions selected at equal intervals along the time axis.

[0119] (34) Using state transition memory gating vector Output vector for pulse path Perform channel-by-channel adjustments, then combine with the trend path output vector. Add them together to obtain the fused output vector at the current time step. Based on this, when the state memory vector display device is in a stage of continuous risk accumulation, the gate value will be larger and the pulse information will be injected more strongly; when the device is generally stable, short-term pulses are easier to suppress.

[0120] In one implementation, for each channel Using gating values The pulse information is scaled proportionally and then overlaid with trend information; the calculation method is expressed as follows: ,in, This represents the fusion output vector at the current time step, which is the first... The fused output of each channel; Output matrix representing trend path The Line number Column elements; Represents the pulse path output matrix The Line number Column elements; Represents the state transition memory gating vector The The nth element is the nth element. The gate value for each channel; when the gate value When the pulse is close to 0, the pulse information is suppressed; when it is close to 1, the pulse information is fully injected.

[0121] (35) Based on the fusion output vector of the current time step Update state memory vector Specifically, it is implemented using a smooth update method with an inertia coefficient, represented as follows: ,in, This represents the fixed inertia coefficient, which ranges from 0 to 1, for example, it can be 0.9; The state memory update matrix represents trainable parameters. The larger the value, the slower the state memory changes, which better meets the constraint that the device state will not change drastically between adjacent time steps.

[0122] (36) Traverse all time steps to obtain the first time step. The fusion output matrix of each time-series decomposition block This embodiment will fuse the output matrix. With input matrix Perform residual join to obtain the first... The final output matrix of each time series decomposition block In practical implementation, when the number of channels is the same, they can be added element-wise directly; when the number of channels is different, a linear projection layer is first used to apply the input matrix. Perform dimensional matching.

[0123] For example, if the first The input matrix of each block The number of channels is The fused output matrix The number of channels is ,and To make residual joins feasible, it is necessary to first... Perform a linear projection, i.e., multiply by a size of Trainable weight matrix The number of channels in the projected matrix becomes At this time, you can... Perform element-by-element addition to obtain the final output of this block. .

[0124] It should be noted that this step encodes "whether the equipment has entered a continuous risk stage" into the state memory vector, and then uses the state memory vector to adjust the injection intensity of pulse information, thereby significantly reducing the interference of meaningless pulses on the classification results, and improving the model's ability to identify precursors of continuously evolving faults.

[0125] (4) After After decomposing the time series into blocks, the final time series feature matrix is ​​obtained. The final time series feature matrix The system already incorporates trend information, impulse information, and state memory fusion results, but it still needs to aggregate the entire time window into a single global representation before outputting the device state. Therefore, this embodiment introduces the smoothing probability of the fault precursor state as a prior bias in attention pooling, making the model pay more attention to time segments that have already been identified as high-risk in the preprocessing stage. The specific steps are as follows:

[0126] (41) For the final time series feature matrix Each time step in Take the corresponding output vector (i.e., the first of the final time series feature matrices) Row vector, dimension ), and combined with the smoothing probability of the pre-fault state. Calculate the attention score for this time step, expressed as follows: ,in, Indicates the first The attention weights for each time step are equal to 1, and the sum of the attention weights for all time steps is 1. The attention projection matrix is ​​a trainable parameter. The attention query vector is a trainable parameter. This represents the prior scaling factor for the state probability, used to control the bias strength of the fault precursor smoothing probability on the attention score; for example, it can be set to 0.5. It should be noted that the final temporal feature matrix... It is input After input projection layer and The output matrix obtained after processing a series of cascaded temporal decomposition blocks contains deep temporal features extracted by the network.

[0127] (42) The output vectors of all time steps are weighted and summed according to the attention weights to obtain the global feature vector. ,Right now global feature vector This represents the overall state of the current time window, with dimensions of [missing information]. For example, suppose , The output vectors at the three time steps are The attention weights are respectively Then the global feature vector Calculated as .

[0128] This embodiment will use global feature vectors Inputting into a linear classification layer yields a 3D classification score vector. Classification score vector The three elements in the vector correspond to the unnormalized scores of the normal state, overload state, and pre-fault state, respectively. This is used to classify the score vector. A softmax transform is performed to obtain three predicted probabilities. The category with the highest predicted probability is selected as the device state recognition result for the current time window. For example, if only two short time periods within a certain time window have a high probability of smoothing out pre-fault states, then the result will be determined because the attention score is superimposed with... Attention pooling makes it easier to allocate higher weights to these two time periods, thereby improving the ability to detect early warnings.

[0129] This embodiment constructs a temporal dual-path network with state memory gating, uses different convolutional structures to separate trends and impulses, and adjusts the injection intensity of impulse information by combining trainable gating vectors with historical state memory, so that short-term fluctuations of the same amplitude are amplified during the continuous risk accumulation stage and suppressed when the overall situation is stable. At the same time, attention pooling guided by state probability focuses on high-risk segments.

[0130] In an optional embodiment of the present invention, the training method for a temporally decomposed convolutional neural network includes the following steps:

[0131] (1) Construct training batches. Specifically, each training sample consists of an original fusion window matrix. It consists of a real status label; the real status label adopts one-hot encoding, and the category index is 1 to 3, which correspond to the normal state, overload state and fault precursor state respectively.

[0132] (2) For all samples in each training batch, first execute step S2 to obtain the final temporal feature matrix. And smooth the state probability sequence; then the final time series feature matrix Input the temporal decomposition convolutional neural network to obtain the classification score vector. And the state memory sequence of the last temporal decomposition block .

[0133] (3) The network is trained using a joint loss of “cross-entropy loss + state memory smoothing regularization term”. The first part of the joint loss is used to ensure correct classification, and the second part is used to suppress drastic changes in the state memory vector between adjacent time steps, thereby further strengthening the prior constraint of continuous evolution of equipment state.

[0134] In practical implementation, the joint loss function Classification loss based on cross-entropy and state memory smoothing regularization The weighted summation is represented as ,in, Let represent the weight of the regularization term, denoted as , for example, it can be 0.01; and . The calculation method is as follows: for the last time-series decomposition block Calculate the mean of the sum of squares of the differences between the state memory vectors of all adjacent time steps, expressed as: ;in, Represents the state memory vector The dimension; Indicates the last timing decomposition block In the middle, the first The state memory vector at time step n is at the nth time step n. Component values ​​on each channel; Indicates the last timing decomposition block In the middle, the first The state memory vector at time step n is at the nth time step n. Component values ​​on each channel; The term represents the squared difference between the state memory vectors of adjacent time steps on the same channel, penalizing excessive jumps.

[0135] (4) Update all trainable parameters using the backpropagation algorithm and the adaptive moment estimation optimizer. In one implementation, the learning rate can be set to... The batch size can be 32, and the total number of training rounds can be 100 to 200. To avoid overfitting, early stopping can be performed when the macro-average F1 score on the validation set no longer improves for several consecutive rounds.

[0136] (5) After each round of training, the F1 score of the three categories of normal state, overload state and fault precursor state is calculated using the validation set. The arithmetic mean of the F1 scores of the three categories is then taken to obtain the macro average F1 score. The model parameters corresponding to the highest macro average F1 score are saved as the final output state recognition model.

[0137] It should be noted that the structure of a temporal decomposition convolutional neural network includes:

[0138] Input projection layer, reduce feature dimensions from Mapping to hidden dimensions .

[0139] The time-series decomposition blocks are cascaded, and the internal structure of each block is as follows:

[0140] Two-path decomposition: Input By entering the trend path (causal convolution) and the impulse path (dilation convolution + threshold shrinkage) respectively, we obtain... and ;

[0141] State transition memory gating: utilizing state memory vectors Calculate the gating vector using historical information. ,right Adjustments were made;

[0142] Gating Integration and Updates: Integration and after adjustment get and update ;

[0143] Residual connection: .

[0144] Attention pooling layer, using fault precursors to smooth probabilities As a bias, the output vector at all time steps Perform a weighted summation to obtain a global vector. .

[0145] The classification output layer uses a linear layer to... The result is mapped to a 3D score, and the output probability is obtained through Softmax.

[0146] After completing the model training in this embodiment, the trained state recognition model is deployed to the online monitoring system for network devices to achieve continuous identification of device operating status and early warning of faults. The specific steps are as follows:

[0147] (1) Collect multi-source log data in real time from the same data source as the training phase, maintaining a consistent sampling interval as the training phase, for example, still using 60 seconds; the system continuously receives device performance monitoring data, system log data, and event reporting data. The system maintains a fixed-length sliding time window, with the window length consistent with the training phase, for example, 64 time steps; whenever new sampled data arrives, the sliding time window moves forward by 1 time step, removes the data from the earliest time step, and adds the data from the latest time step, forming the original fusion window matrix to be identified. .

[0148] (2) For the original fusion window matrix to be identified Perform the same steps as in the training phase, S2. Specifically, this includes: calculating the initial soft assignment probability for each time step based on the representative pattern vector; performing forward and backward smoothing based on the state transition probability matrix; performing feature enhancement for numerical metrics, sparse counting, and encoded indexing features according to feature type; and then calculating and concatenating the global temporal context signal to obtain the final temporal feature matrix. It should be noted that the representative pattern vectors, normal state condition mean, normal state condition standard deviation, and other statistical references used in the online phase are all derived from historical statistical tables saved during the training phase and are not retrained during online inference.

[0149] (3) The final time series feature matrix Input the trained temporal decomposition convolutional neural network to obtain three predicted probabilities: normal state, overload state, and fault precursor state. The system uses the category with the highest predicted probability as the device state identification result for the current time window.

[0150] Furthermore, this embodiment may also include triggering operation and maintenance prompts or alarms based on predicted probabilities and preset rules. For example, if the predicted probability of a fault precursor state is greater than 0.7, a level one warning is triggered; if the predicted probability of a fault precursor state is greater than 0.7 for three consecutive sliding time windows, a persistent high-risk alarm is triggered, and the attention weight sequence and smoothed state probability sequence for the corresponding time window are output simultaneously for operation and maintenance personnel to locate key time segments. When a core switching device experiences a continuous increase in CPU utilization, a gradual increase in interface error log counts, and repeated switching of event type codes within multiple consecutive sliding time windows, step S2 will gradually increase the smoothed probability of the fault precursor state at the corresponding time step, and the state memory vector in step S3 will accumulate risk information, ultimately causing the predicted probability of the fault precursor state to remain above the threshold, thereby issuing an alarm before the device actually experiences link interruption or session oscillation. Based on this, unified modeling of multi-source logs of network devices, dynamic feature enhancement under state continuity constraints, and stable identification of normal states, overload states, and fault precursor states can be achieved.

[0151] The method of the present invention will be analyzed and verified below based on experimental data.

[0152] Figure 2This is a bar chart analysis comparing the performance of network device status monitoring using the method of this invention. It verifies the advantages of the proposed method based on multi-source log fusion and state transition memory gating in overall classification performance compared to other technical approaches. The chart compares four different monitoring methods: "This method" fully implements the entire processing flow of steps S2, S3, and S4 in the technical solution, including heterogeneous feature dynamic normalization, state transition probability smoothing correction, differentiated feature enhancement, and state memory gating fusion; "Conventional multi-source fusion" uses all three types of multi-source logs, but only uses a unified global normalization method to standardize all features, then directly feeds them into a regular temporal convolutional network for classification, without introducing state transition constraints or feature enhancement; "Single performance data" uses only numerical features such as device performance monitoring data, discarding system logs and event reporting data, simplifying the model to a single-source temporal classifier; "No state transition constraints" eliminates hidden state soft assignment and forward / backward smoothing based on the state transition probability matrix based on multi-source fusion, with the initial probability directly used as state weights for enhancement. The horizontal axis identifies the four methods, and the vertical axis represents the performance metrics in percentage terms. Below each method are four bars corresponding to macro-average accuracy, macro-average precision, macro-average recall, and macro-average F1 score. These four metrics are macro-average results across three categories: normal state, overload state, and pre-fault state, comprehensively reflecting the model's ability to identify imbalanced samples across multiple classes. Experimental results show that the proposed method's four bars are all at the highest height, indicating that it significantly outperforms the comparison methods in all macro-average metrics. This method, through smoothing correction of the state transition matrix and differential enhancement, reduces the impact of harmless jitter on the one hand, and reveals slowly drifting anomalies earlier on the other, thus maintaining optimal performance across all metrics. This macroscopically demonstrates the comprehensive advantages of this invention in integrating multi-source heterogeneous logs and introducing prior operational states.

[0153] Figure 3This invention uses a kernel density map analysis to compare the distribution of CPU utilization features before and after enhancement, demonstrating the effect of deviation-enhanced standardization performed on numerical metrics. The experiment selected the most representative numerical feature, "CPU utilization," as the analysis object. The horizontal axis in the left graph represents the original utilization value in "percentage," while the horizontal axis in the right graph represents the enhanced value after enhancement from the normal baseline, a dimensionless quantity. The vertical axis represents the probability density obtained from kernel density estimation, reflecting the concentration of feature values ​​in the samples. The left graph corresponds to the distribution in the original feature space, while the right graph shows the enhanced feature space distribution. The density curves for normal state samples and fault precursor state samples are plotted in two colors, with a semi-transparent fill below the curves to clearly distinguish the two states. By comparing the two sub-graphs, the key changes brought about by the enhancement operation can be analyzed. In the original feature distribution, the CPU utilization in the normal state is concentrated in a medium-level area, while the overall utilization in the fault precursor state is significantly higher. However, there is a large overlap between the two density curves, indicating that if the original values ​​are used directly for classification, many samples near the boundary are easily misclassified. After enhancement, the density curve of the normal state shrinks to a low-value region close to zero, while the density curve of the fault precursor state is significantly stretched to the right, with its center moving far away from zero. Experimental results demonstrate the effectiveness of the differential feature enhancement strategy of this invention, enabling subsequent neural networks to identify early fault precursors with clearer feature boundaries.

[0154] Figure 4This paper presents a comparative analysis of the attention weights and the smoothing probability distribution of fault precursors using the method of this invention, verifying the advantages of the state probability-guided attention pooling mechanism compared to the ordinary attention mechanism. The graph has two vertical axes: the left axis represents the numerical value of the attention weights, a dimensionless quantity, with the sum of weights across all time steps equal to 1; the right axis represents the smoothing probability of the fault precursor state, also dimensionless, ranging from 0 to 1. The horizontal axis represents the 64 time step numbers arranged chronologically. The graph uses continuously filled areas and broken lines to depict the change in the smoothing probability of fault precursors within the entire window. It shows two distinct high-value segments, located in the early and late stages of the window, respectively, consistent with the typical pattern of intermittently aggravated device state anomalies in real-world networks. Simultaneously, two scatter lines are superimposed on the graph, representing the attention weights of this invention and the ordinary attention weights without prior state probability bias, respectively. Comparing the two attention weight curves reveals that the fluctuations in ordinary attention weights are very gradual, with minimal differences between time steps. This makes it difficult to actively focus on high-risk segments, and its distribution is approximately uniform with a slight low-frequency trend. Consequently, the time steps that truly carry fault precursor information are diluted by a large number of irrelevant time steps. In contrast, the trend of the attention weight curve in this invention closely matches the high-value region of the fault precursor smoothing probability. The weight significantly increases within two high-risk segments, while remaining at a low level in other low-risk time steps.

[0155] Figure 5 As shown, a real-time monitoring system for the operational status of network devices based on multi-source log fusion, applying the aforementioned real-time monitoring method for the operational status of network devices based on multi-source log fusion, includes: The data acquisition module is used to acquire multi-source log data and device operating status tags during the operation of network devices; the multi-source log data includes at least numerical measurement data, system log data, and event reporting data; The sample construction module is used to construct an original fusion window sample based on the multi-source log data, and to divide all features in the original fusion window sample into numerical metric features, sparse counting features and coded index features according to their physical meaning. The smoothing correction module is used to perform implicit state soft allocation for each time step based on the constraints of the device state transition diagram, and to perform temporal smoothing correction on the state probabilities to obtain a smooth state probability sequence. The feature enhancement module is used to perform differentiated feature enhancement on the smoothed state probability sequence according to feature type to obtain an enhanced feature matrix, and generate a global time context signal based on the enhanced feature matrix to obtain the final time series feature matrix; The state recognition module is used to construct a temporal decomposition convolutional neural network, extract trend information from the final temporal feature matrix through the trend path and extract pulse information through the pulse path, and fuse the trend information and pulse information using the state transition memory gating vector. Then, after state probability-guided attention pooling and classification output, the device state recognition result is obtained.

[0156] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0157] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0158] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0159] Specific embodiments have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

[0160] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of this invention.

Claims

1. A method for real-time monitoring of network device operating status based on multi-source log fusion, characterized in that, Includes the following steps: Acquire multi-source log data and device operating status tags during the operation of network devices; the multi-source log data includes at least numerical measurement data, system log data, and event reporting data. Based on the multi-source log data, an original fusion window sample is constructed, and all features in the original fusion window sample are divided into numerical metric features, sparse counting features, and coded index features according to their physical meaning. Based on the constraints of the device state transition diagram, implicit state soft assignment is performed at each time step, and temporal smoothing correction is performed on the state probabilities to obtain a smooth state probability sequence. Differential feature enhancement is performed on the smooth state probability sequence according to feature type to obtain an enhanced feature matrix, and a global time context signal is generated based on the enhanced feature matrix to obtain the final time series feature matrix; A temporal decomposition convolutional neural network is constructed. Trend information is extracted from the final temporal feature matrix through the trend path and pulse information is extracted from the pulse path. The trend information and pulse information are fused using the state transition memory gating vector. Then, the device status recognition result is obtained by state probability-guided attention pooling and classification output. The process involves soft allocation of hidden states at each time step based on device state transition diagram constraints, followed by temporal smoothing correction of state probabilities to obtain a smoothed state probability sequence, including: Calculate the heterogeneous distance between the feature vector at the current time step and the representative pattern vectors of each hidden state, and convert it into the initial soft assignment probability using a normalized exponential mapping based on negative distance. Forward and backward smoothing are performed on the initial soft assignment probability based on the state transition probability matrix; The forward smoothing probability vector and the backward smoothing probability vector are averaged and fused to obtain the smoothed state probability sequence; The construction of a temporal decomposition convolutional neural network extracts trend information from the final temporal feature matrix through trend paths and pulse information through pulse paths. It then fuses the trend and pulse information using state transition memory gating vectors, followed by state probability-guided attention pooling and classification output to obtain the device state recognition result, including: The final temporal feature matrix is ​​mapped to the hidden space through a linear projection layer to obtain the network input matrix; Trend information is extracted by performing one-dimensional causal convolution along the time axis through the trend path, and pulse candidate information is extracted by performing one-dimensional dilated convolution along the time axis through the pulse path. Finally, pulse information is obtained by performing threshold shrinkage on the pulse candidate information. The pulse information is adjusted channel by channel using a state transition memory gating vector, and then fused with the trend information to obtain fused output information; Update the state memory vector based on the fused output information; A state probability-guided attention pooling layer is used to perform weighted summation on the fused output information to obtain a global feature vector; The global feature vector is classified and output to obtain the device status recognition result.

2. The method for real-time monitoring of network device operating status based on multi-source log fusion according to claim 1, characterized in that, Based on the multi-source log data, an original fusion window sample is constructed. All features in the original fusion window sample are then categorized according to their physical meaning into numerical metric features, sparse counting features, and coded index features, including: Perform unified alignment on the timestamps of the multi-source log data; A single sample is constructed using a sliding time window of fixed length. All features are classified into numerical metric features, sparse counting features, and coded index features according to their physical meaning.

3. The method for real-time monitoring of network device operating status based on multi-source log fusion according to claim 1, characterized in that, Differential feature enhancement is performed on the smoothed state probability sequence according to feature type, including: Perform deviation-enhanced standardization on numerical metric features; Log-compression is performed on sparse counting features, followed by weighted standardization based on the normal state conditional distribution; Calculate the state inconsistency score for the encoded index features.

4. The method for real-time monitoring of network device operating status based on multi-source log fusion according to claim 1, characterized in that, A global time context signal is generated based on the enhanced feature matrix, resulting in a final time-series feature matrix, including: For each feature dimension in the enhanced feature matrix, calculate the first-order difference between adjacent time steps; For each feature dimension, the absolute value of the first-order difference is weighted and averaged using the smoothed probability of the fault precursor state to obtain the global time context signal. For each time step, the global time context signal is concatenated with the enhanced feature matrix to obtain the final time series feature matrix.

5. The method for real-time monitoring of network device operating status based on multi-source log fusion according to claim 1, characterized in that, Constructing a temporal decomposition convolutional neural network includes: A linear projection layer is constructed to map the final temporal feature matrix to the hidden space; Construct multiple cascaded time series decomposition blocks, each containing trend path, impulse path, state transition memory gating fusion, and state memory update; Construct an attention pooling layer guided by state probability; Construct a classification output layer.

6. The method for real-time monitoring of network device operating status based on multi-source log fusion according to claim 5, characterized in that, State transition memory gating fusion includes: Trend path output vector based on the current time step Pulse path output vector and the state memory vector of the previous time step , According to the formula Calculate the state transition memory gating vector ,in This represents the Sigmoid activation function. For the gated weight matrix, For bias vectors, This indicates vector concatenation; Using the state transition memory gating vector according to the formula The pulse path output vector is adjusted channel by channel and then added to and fused with the trend path output vector to obtain a fused output vector. ; using the fused output vector according to the formula Update state memory vector ,in The inertia coefficient, Update the state memory matrix; This represents the fusion output vector at the current time step, which is the first... The fused output of each channel; Output matrix representing trend path The Line 1 Column elements; Represents the pulse path output matrix The Line 1 Column elements; Represents the state transition memory gating vector The The nth element is the nth element. The gate value for each channel.

7. The method for real-time monitoring of network device operating status based on multi-source log fusion according to claim 6, characterized in that, Using formula Train the temporal decomposition convolutional neural network, wherein Cross-entropy classification loss, For state memory smoothing regularization, Weights for regularization terms; The state memory smoothing regularization term is defined according to the formula: Calculation, where For the state memory vector dimension, For the last timing decomposition block The state memory vector at time step n is the first One portion, This represents the number of time steps.

8. A real-time monitoring system for the operating status of network devices based on multi-source log fusion, employing the real-time monitoring method for the operating status of network devices based on multi-source log fusion as described in any one of claims 1 to 7, characterized in that, include: The data acquisition module is used to acquire multi-source log data and device operating status tags during the operation of network devices; The multi-source log data includes at least numerical metric data, system log data, and event reporting data; The sample construction module is used to construct an original fusion window sample based on the multi-source log data, and to divide all features in the original fusion window sample into numerical metric features, sparse counting features and coded index features according to their physical meaning. The smoothing correction module is used to perform implicit state soft allocation for each time step based on the constraints of the device state transition diagram, and to perform temporal smoothing correction on the state probabilities to obtain a smooth state probability sequence. The feature enhancement module is used to perform differentiated feature enhancement on the smoothed state probability sequence according to feature type to obtain an enhanced feature matrix, and generate a global time context signal based on the enhanced feature matrix to obtain the final time series feature matrix; The state recognition module is used to construct a temporal decomposition convolutional neural network, extract trend information from the final temporal feature matrix through the trend path and extract pulse information through the pulse path, and fuse the trend information and pulse information using the state transition memory gating vector. Then, after state probability-guided attention pooling and classification output, the device state recognition result is obtained.

Images