Network cloud fault positioning method and device, electronic equipment, storage medium and product
By combining feature processing of log, performance, resource, and topology data with graph neural networks, the problem of low fault location accuracy in existing technologies is solved, achieving higher location accuracy and generalization.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA MOBILE COMM GRP CO LTD
- Filing Date
- 2026-03-03
- Publication Date
- 2026-07-14
AI Technical Summary
Existing network cloud fault location technologies mainly rely on a few performance indicators, ignoring the influence of other factors, resulting in low fault location accuracy and inability to effectively locate faults in scenarios where some device data is missing.
By acquiring log data, performance data, resource data, and topology data from network cloud devices, performing feature processing, and inputting the data into a pre-trained graph neural network, the graph neural network deep learning framework is used to locate faults by combining virtual and physical topology relationships.
It achieves more comprehensive fault location reference data, improves model generalization and fault location accuracy, can effectively locate faulty devices even in scenarios where some device data is missing, and makes full use of network topology relationships.
Smart Images
Figure CN122395031A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of fault location technology, and in particular to a network cloud fault location method, device, electronic device, storage medium and product. Background Technology
[0002] In network cloud operation and maintenance scenarios, the number of network cloud resource pool networking devices is large and complex. Different devices are connected through direct or indirect links. This causes a large number of alarms to be generated by devices around the faulty device, interfering with the judgment of operation and maintenance personnel and making it impossible to locate the correct faulty device in a timely manner during network operation.
[0003] Current network cloud fault location technology solutions mainly rely on a single performance indicator of the device for fault location diagnosis. They rely on only a few performance indicators and other parameters for diagnosis, ignoring the impact of other factors on the final fault location result, resulting in a low fault location accuracy. Summary of the Invention
[0004] This invention provides a network cloud fault location method, device, electronic device, storage medium, and product to address the shortcomings of existing technologies that rely solely on a few performance indicators and other parameters for diagnosis, ignoring the influence of other factors on the final fault location result, thereby achieving accurate fault location of network cloud devices.
[0005] This invention provides a method for locating network cloud faults, comprising: Obtain fault location indicator data for network cloud devices; the fault location indicator data includes at least one of log data, performance data, resource data, topology data, and alarm data. Based on the aforementioned topology data, generate network cloud topology map data; The log data, performance data, resource data, and alarm data are subjected to feature processing to determine the node characteristics of each device node in the network cloud topology map data; The network cloud topology data and the node features of each device node are input into a pre-trained graph neural network to obtain the fault device location result.
[0006] According to a network cloud fault location method provided by the present invention, the network cloud topology map data includes the topological connection relationships between device nodes; the step of generating network cloud topology map data based on the topology data includes: Obtain protocol heartbeat connection parameters from the underlying configuration parameter information of the local network cloud device; the protocol heartbeat connection parameters include the address of the remote device that establishes a communication connection with the local network cloud device. Based on the remote device address, obtain the device type of the remote device; Establish a virtual topology relationship based on the local network cloud device type and the remote device type; Establish physical topology relationships based on the port description information of the local network cloud devices; Based on the virtual topology relationship and the physical topology relationship, the topological connection relationship between device nodes is determined.
[0007] According to a network cloud fault location method provided by the present invention, the network cloud topology map data further includes the node weight of each device node and the edge weight between adjacent device nodes; the node weight of the device node is determined based on the device type of the device node, and the edge weight between adjacent device nodes is determined based on the device type of the adjacent device nodes; the node weight of the bottom layer device node is less than the node weight of the egress layer device node.
[0008] According to a network cloud fault location method provided by the present invention, the performance data includes various types of performance indicators and corresponding performance values, the resource data includes manufacturer information of network cloud devices, and the alarm data includes alarm titles; the method involves performing feature processing on the log data, the performance data, the resource data, and the alarm data to determine the node characteristics of each device node in the network cloud topology data, including: One-hot encoding is used to identify the performance metrics and their corresponding performance data to obtain performance characteristics. The manufacturer information of network cloud devices is identified by one-hot encoding to obtain resource characteristics; Based on a pre-defined standard alarm library, alarm titles are identified by one-hot encoding to obtain alarm features; Based on a pre-trained natural language processing model, feature extraction is performed on log data to obtain fault probabilities, and the fault probabilities are identified by one-hot encoding to obtain log features. The log features, performance features, resource features, and alarm features are subjected to dimensionality-upgrading operations and splicing processes to obtain the node features of each device node in the network cloud topology map data.
[0009] According to a network cloud fault location method provided by the present invention, the graph neural network includes a graph neural network module and a feature fusion module; the step of inputting the network cloud topology graph data and the node features of each device node into a pre-trained graph neural network to obtain the fault device location result includes: The network cloud topology data and the node features of each device node are input into the graph neural network module for feature extraction to obtain the weighted features of each device node. The weighted features of each device node are input into the feature fusion module for feature extraction and feature fusion to obtain the fault device location result.
[0010] According to a network cloud fault location method provided by the present invention, the graph neural network module includes an LSTM module and multiple graph convolutional layers; the step of inputting the network cloud topology graph data and the node features of each device node into the graph neural network module for feature extraction to obtain the weighted features of each device node includes: The node features of each device node are input into the LSTM module to obtain the initial features of each device node; The initial features of each device node are input into a multi-layer graph convolutional layer to obtain the preset dimension features of each device node. Based on the preset dimensional features of each device node and the learnable node weights of each device node, the weighted features of each device node are determined; the learnable node weights of each device node are the node weights of the device node.
[0011] According to a network cloud fault location method provided by the present invention, the feature fusion module includes multiple feature extraction layers and a fully connected layer; the step of inputting the weighted features of each device node into the feature fusion module for feature extraction and feature fusion to obtain the fault device location result includes: The weighted features of each device node are input into each feature extraction layer to obtain the features output by each feature extraction layer. The features output from each feature extraction layer are input into a fully connected layer and weighted and fused to obtain the fault location result.
[0012] According to the network cloud fault location method provided by the present invention, the pre-trained graph neural network is trained in the following manner: Obtain training samples; the training samples include fault samples and normal samples; The training samples are input into the graph neural network to be trained to obtain the fault location training results output by the graph neural network to be trained. Based on the training results of the faulty equipment location and the sample labels, calculate the value of the focal-loss-based loss function; The graph neural network to be trained is trained based on the loss function value to obtain a pre-trained graph neural network.
[0013] The present invention also provides a network cloud fault location device, comprising: The data acquisition module is used to acquire fault location indicator data of network cloud devices; the fault location indicator data includes at least one of log data, performance data, resource data, topology data and alarm data. The graph data generation module is used to generate network cloud topology graph data based on the topology data; The node feature determination module is used to perform feature processing on the log data, performance data, resource data and alarm data to determine the node features of each device node in the network cloud topology map data; The fault location module is used to input the network cloud topology map data and the node features of each device node into a pre-trained graph neural network to obtain the fault device location result.
[0014] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the network cloud fault location method as described above.
[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network cloud fault location method as described above.
[0016] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the network cloud fault location method as described above.
[0017] The network cloud fault location method, device, electronic device, storage medium, and product provided by this invention simultaneously consider information such as device performance data, resource data, log data, alarm data, and topology correlation. It adaptively combines data collected from different perspectives to form the node characteristics of each device node in the network cloud topology graph for fault location. This results in more comprehensive and abundant fault location reference data, better model generalization, and higher fault location accuracy. Furthermore, it can be used in scenarios where some device data is missing, demonstrating even better generalization. By inputting the network cloud topology graph data and the node characteristics of each device node into a pre-trained graph neural network, and using a graph neural network deep learning framework to achieve network cloud fault location, compared to machine learning-based methods, the model has more parameters, better performance, and higher fault location accuracy. Moreover, graph neural networks can fully utilize network topology relationships, making them more suitable for network fault location scenarios. Attached Figure Description
[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0019] Figure 1 This is a flowchart illustrating the network cloud fault location method provided in this embodiment of the invention.
[0020] Figure 2 This is a schematic diagram of the overall architecture of the network cloud fault location solution provided in this embodiment of the invention.
[0021] Figure 3 This is a schematic diagram of the data processing flow provided in an embodiment of the present invention.
[0022] Figure 4 This is a schematic diagram of the GCN feature extraction and localization process provided in an embodiment of the present invention.
[0023] Figure 5 This is a schematic diagram of the processing flow of the GCN module provided in an embodiment of the present invention.
[0024] Figure 6 This is a schematic diagram of the processing flow of the feature fusion module provided in an embodiment of the present invention.
[0025] Figure 7 This is a schematic diagram of the network cloud fault location device provided in an embodiment of the present invention.
[0026] Figure 8 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation
[0027] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0028] In the description of embodiments of the present invention, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Those skilled in the art will understand the specific meaning of the above terms in this invention according to the specific circumstances.
[0029] The current network cloud fault location technology solutions include the following: (1) Option 1: Location based on equipment fault alarm. When the equipment triggers the performance index threshold or the equipment hardware or software fails, an alarm notification is issued. Based on the collected alarm fields, it is determined whether the equipment has failed or whether the failure is a derivative fault caused by the failure of the peer equipment.
[0030] (2) Option 2: Collect the logs of all devices that triggered the alarm, and check whether the device was faulty or whether the alarm was caused by a fault in other devices.
[0031] (3) Option 3: Based on the dial-up testing system, periodically send probe messages to the device, periodically obtain device data and network connectivity, and then locate the fault based on the dial-up testing information.
[0032] (4) Option 4: Collect various information data of the equipment through the management system, and then judge the information data of each equipment based on machine learning to determine whether it is a faulty equipment and realize fault location.
[0033] (5) Option 5: Considering the equipment connection topology and the equipment data information, fault location is achieved by comprehensively implementing relevant graph neural network algorithms.
[0034] However, Solution 1 has the following drawbacks: alarms triggered by performance indicator thresholds and device hardware / software may be caused by faults in the peer device or upper-layer virtualization software. Different faults can lead to the same alarm, resulting in incorrect judgments. For example, if the peer device's CPU is damaged or the local device's network cable is loose, the local device will report a "port down" alarm. Relying solely on the alarm information cannot determine whether the fault is local or peer-related.
[0035] Option 2 has the following drawbacks: it relies on manual collection and viewing of log information from the devices that generated the alarms, and on locating the faulty devices based on the system-reported log records. This requires a thorough understanding of the identifiers and indicators in the log information of various devices, and front-line maintenance personnel have limited log analysis capabilities, necessitating feedback to second-line R&D personnel, resulting in significant time consumption for fault location. While log reading based on NLP (Natural Language Processing) algorithms can effectively achieve log parsing capabilities and determine the root cause of faults, this method cannot be used for fault location in scenarios where some alarms cannot be interpreted from the logs or where device log information is unavailable, thus exhibiting certain limitations.
[0036] Option 3 has the following drawbacks: While the dial-up testing system can periodically obtain information such as device connectivity and acquire device performance and log data through methods like SNMP traps, allowing for fault location and judgment, the system only establishes testing paths based on the existing network routing table. This fails to effectively establish a comprehensive network topology, making it difficult to accurately pinpoint fault locations when topology-related faults occur.
[0037] Option 4 has the following drawbacks: Machine learning algorithms are currently a commonly used fault location method. Machine learning solutions primarily use collected device performance data and historical tag data to determine anomalies in current device performance indicators, thus concluding whether the device is faulty. However, machine learning algorithms cannot effectively incorporate network topology information for fault location, focusing more on individual devices and neglecting the global relationships between devices. For example, if a switch continuously sends packets to a server, causing port congestion, relying solely on a single device indicator cannot determine that the fault originates from the peer device; instead, it might be attributed to a faulty server port, leading to inaccurate fault location. However, by considering the global network topology, the root cause can be identified as the peer switch continuously sending a large number of packets.
[0038] Scheme 5 has the following drawbacks: While graph convolutional neural network (GCNN) algorithms are emerging, combining the powerful fitting capabilities of deep learning with the excellent representation performance of graph algorithms for structured data, fusing topology with data from various devices to achieve fault location, demonstrating excellent problem-solving capabilities, existing GCNN fault location algorithms suffer from limited reference data, resulting in low fault location accuracy.
[0039] Therefore, this embodiment of the invention simultaneously considers information such as device performance data, resource data, log data, alarm data, and topology correlation, adaptively combining data collected from different angles to form the node features of each device node in the network cloud topology graph data for fault location. The fault location reference data is more comprehensive and richer, the model has better generalization, and the fault location accuracy is higher. It can also be used in scenarios where some device data is missing, with better generalization. By inputting the network cloud topology graph data and the node features of each device node into a pre-trained graph neural network, the graph neural network deep learning framework is used to realize network cloud fault location. Compared with machine learning-based methods, the model has more parameters, better model performance, and higher fault location accuracy. Moreover, the graph neural network can make full use of network topology relationships, making it more suitable for network fault location scenarios.
[0040] Figure 1 This is a flowchart illustrating the network cloud fault location method provided in an embodiment of the present invention. (Refer to...) Figure 1 This invention provides a method for locating network cloud faults, which may specifically include the following steps: Step 101: Obtain fault location indicator data for network cloud devices; the fault location indicator data includes at least one of log data, performance data, resource data, topology data, and alarm data.
[0041] It should be noted that the execution subject of the network cloud fault location method provided in this embodiment of the invention can be an electronic device, a component in the electronic device, an integrated circuit, or a chip. The electronic device can be a mobile electronic device or a non-mobile electronic device. For example, a mobile electronic device can be a mobile phone, tablet computer, laptop computer, PDA, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc., while a non-mobile electronic device can be a server, network attached storage (NAS), personal computer (PC), television (TV), ATM, or self-service machine, etc. This embodiment of the invention does not specifically limit the specific implementation of these devices. The following embodiments of the invention describe the execution subject using a server as the execution subject.
[0042] Log data can be event sequence information automatically recorded by network cloud devices during operation, including text-based or structured records of system operations, application behaviors, and abnormal events. Performance data is a set of quantitative indicators characterizing the operational efficiency of network cloud devices, reflecting system processing capacity and service quality. Resource data can be used to describe the static and dynamic information of the hardware and software resource configuration and usage status of network cloud devices. Topology data can be used to describe the spatial configuration information of the connection relationships and hierarchical structure between network cloud devices and their associated components. Alarm data refers to the warning information proactively generated by network cloud devices when abnormal states or threshold exceedances are detected.
[0043] Compared to other graph neural network fault location algorithms, this invention simultaneously considers information such as device performance data, resource data, log data, alarm data, and topology correlation. It adaptively combines data collected from different perspectives to form graph node features (i.e., the node features of each device node in the network cloud topology graph data) for fault location. This results in more comprehensive and abundant fault location reference data, better model generalization, and higher fault location accuracy. Furthermore, this invention can support fault location using only one or a few device data sets, thus enabling its use in scenarios where some device data is missing, further enhancing its generalization ability.
[0044] Step 102: Based on the topology data, generate network cloud topology map data.
[0045] Network cloud topology data can record the topological connections between device nodes, which can include virtual and physical topology relationships. In this embodiment of the invention, network cloud topology data can be generated by analyzing the connections between devices based on the topology data.
[0046] Step 103: Perform feature processing on the log data, performance data, resource data, and alarm data to determine the node characteristics of each device node in the network cloud topology map data.
[0047] Figure 2 This is a schematic diagram of the overall architecture of the network cloud fault location solution provided in this embodiment of the invention. (Refer to...) Figure 2 In some embodiments, the network cloud fault location scheme may include a data processing section and a GCN (Graph Convolutional Network) feature extraction and location section. In the data processing section, fault location index data for network cloud devices can be processed for data featureization. The feature-processed alarm data, performance data, resource data, and device log data (i.e., the node features of each device node in the network cloud topology graph data) are then input into the GCN network along with the network cloud topology graph data to complete the fault device location.
[0048] Step 104: Input the network cloud topology map data and the node features of each device node into a pre-trained graph neural network to obtain the fault device location result.
[0049] In this embodiment of the invention, by inputting network cloud topology data and node features of each device node into a pre-trained graph neural network, the processed data is propagated forward in a deep learning model, thereby obtaining the fault location of the device output by the graph neural network.
[0050] This invention, by simultaneously considering information such as device performance data, resource data, log data, alarm data, and topology correlation, adaptively combines data collected from different perspectives to form a network cloud topology graph. This graph then uses the node characteristics of each device node for fault location, resulting in more comprehensive and abundant fault location reference data, better model generalization, and higher fault location accuracy. Furthermore, it can be used in scenarios where some device data is missing, demonstrating even better generalization. By inputting the network cloud topology graph data and the node characteristics of each device node into a pre-trained graph neural network, and using a graph neural network deep learning framework to achieve network cloud fault location, compared to machine learning-based methods, this approach has more model parameters, better model performance, and higher fault location accuracy. Moreover, graph neural networks can fully utilize network topology relationships, making them more suitable for network fault location scenarios.
[0051] Based on any of the above embodiments, the network cloud topology map data includes the topological connection relationships between device nodes; generating network cloud topology map data based on the topology data specifically includes: obtaining protocol heartbeat connection parameters from the underlying configuration parameter information of the local network cloud device; the protocol heartbeat connection parameters include the address of the remote device that has established a communication connection with the local network cloud device; obtaining the device type of the remote device based on the remote device address; establishing a virtual topology relationship based on the device type of the local network cloud device and the device type of the remote device; establishing a physical topology relationship based on the port description information of the local network cloud device; and determining the topological connection relationships between device nodes based on the virtual topology relationship and the physical topology relationship.
[0052] Figure 3 This is a schematic diagram of the data processing flow provided in an embodiment of the present invention. (Refer to...) Figure 3 It can process network topology data, performance data, resource data, alarm data, and log information of network cloud devices to obtain corresponding characteristics.
[0053] Existing network fault location solutions primarily rely on device port descriptions and fixed link relationships to generate topological relationships between different devices. However, this method overlooks the fact that many devices in the network establish virtual connections through various protocols, lacking actual physical connections. This leads to inaccurate location of alarms closely related to virtual connections. Therefore, this invention utilizes heartbeat connections via protocols such as BFD, Redfish, and SNMP to represent devices without actual physical link connections through virtual topological relationships, thereby improving the accuracy of fault device location.
[0054] Topology data may include connection data between devices recorded in the underlying configuration parameters of the devices. In this embodiment of the invention, the topology data can be processed to generate topological connection relationships between device nodes, thereby generating network cloud topology map data.
[0055] Specifically, it can read the underlying configuration parameters of each network cloud device, such as the SNMP, BFD (Bidirectional Forwarding Detection), and Redfish protocol heartbeat connections established with a remote virtual machine or managed device, and locate the specific remote device type and ID (Identification) number by obtaining the remote device address.
[0056] Specifically, a virtual topology relationship can be established based on the type of local network cloud device and the type of remote device; if the connection is not established through a protocol, a physical topology relationship can be directly constructed based on port description information or design drawings. Finally, the two types of topology data (i.e., virtual topology relationship and physical topology relationship) are converted into graph data format to facilitate subsequent graph convolution operations.
[0057] Device types can include virtual machines, hosts, switches, routers, and firewall devices. The network cloud topology map data can contain topology connection information of virtual machines, hosts, switches, routers, and firewall devices. The device numbers can be as follows: virtual machine [1], host [2], switch [3], router [4], firewall [5]. The corresponding topology data can be various device connection combinations such as [1, 2] (connection between virtual machine and host), [2, 3] (connection between host and switch), [3, 4] (connection between switch and router), [1, 4] (connection between virtual machine and router). However, in the existing network fault location GCN algorithm, the topology relationship is established only based on the physical connection relationship. This weakens the correlation of alarms of many devices and makes it difficult for the model to discover the correlation between devices and faults, thus reducing the accuracy of fault location.
[0058] Current fault location methods do not consider virtual topology relationships when establishing network topology connections, relying mainly on physical connections for topology establishment. This results in missing topology relationship information, affecting fault location accuracy. This invention implements new topology relationship establishment based on heartbeat connections using protocols such as BFD, SNMP (Simple Network Management Protocol), and Redfish, making the topology relationships between devices more comprehensive and enriching the topology information. Furthermore, the establishment of virtual connection topology allows for clearer and more precise location of faults caused by remote device failures, without needing to traverse multiple physical connection topologies. This reduces model training difficulty and improves fault location accuracy.
[0059] Based on any of the above embodiments, the network cloud topology graph data also includes the node weight of each device node and the edge weight between adjacent device nodes; the node weight of the device node is determined based on the device type of the device node, and the edge weight between adjacent device nodes is determined based on the device type of the adjacent device nodes; the node weight of the bottom layer device node is less than the node weight of the egress layer device node.
[0060] Existing fault location algorithms based on graph neural networks mainly establish graph topology relationships based on equally weighted edges and nodes. However, in actual operation and maintenance, the weights of topological edges between different devices should be different. This is because virtual machines are at the lower layer, with a large number of devices and a higher probability of failure, and their failures do not cause significant business impact, resulting in fewer alarm nodes. Conversely, when an upper-layer device fails, such as an EOR (End of Row) failure, multiple downstream TOR (Top of Rack) devices will simultaneously report alarms, resulting in alarms for a large number of topological nodes in the network topology, and the resulting business impact is significant. Therefore, it is necessary to apply different levels of attention to different edges and nodes to enable the graph neural network model to better locate faults based on the topology. In view of the above problems, this embodiment of the invention sets different weights for edges and nodes between different nodes, so that the graph neural network model can apply different levels of attention to different nodes during feature extraction, thereby better locating faulty devices based on the topology.
[0061] Network cloud topology data can also include node weights for each device node and edge weights between adjacent device nodes. Specifically, weights can be assigned to different edges and different nodes as follows: ; ; Where i represents the local device type and j represents the remote device type; Let i be the edge weight between device type i at this end and device type j at the other end (i.e., adjacent device nodes); It is the node weight of local device type i. It is the node weight of the peer device type j. It is the node weight of the virtual machine. It is the node weight of the host. It is the node weight of the switch. It is the node weight of the router. This refers to the node weight of the firewall; The node weight for local device type i; , The learnable parameter is only related to the device type and not to the specific device, so there can be 25 edge combinations and 5 node classes. That is, the closer the device is to the exit layer, the greater its edge weight and node weight values; the lower the level of the device, the lower the importance of its nodes.
[0062] Existing network fault location algorithms primarily establish topology relationships based on equally weighted edge nodes. This fails to consider the varying locations and connections of network devices at different levels, leading to different fault impacts. Fault location accuracy decreases when based on unreasonable device topology relationships. To address these issues, this invention proposes an adaptive edge weighting method to construct weight relationships between different devices. This allows the model to automatically learn appropriate node and edge weights, improving fault location accuracy based on more reasonable weights. Furthermore, the adaptive weighting method generalizes the model's application scenarios, eliminating the need for manual weight setting and resolving the drawbacks of inappropriate manual weight settings.
[0063] Based on any of the above embodiments, the performance data includes various types of performance indicators and corresponding performance values, the resource data includes manufacturer information of network cloud devices, and the alarm data includes alarm titles. The step of performing feature processing on the log data, performance data, resource data, and alarm data to determine the node features of each device node in the network cloud topology data can specifically include: performing one-hot encoding on the performance indicators and corresponding performance data to obtain performance features; performing one-hot encoding on the manufacturer information of the network cloud devices to obtain resource features; performing one-hot encoding on the alarm titles based on a preset standard alarm library to obtain alarm features; performing feature extraction on the log data based on a pre-trained natural language processing model to obtain fault probabilities, and performing one-hot encoding on the fault probabilities to obtain log features; and performing dimensionality upscaling and concatenation processing on the log features, performance features, resource features, and alarm features to obtain the node features of each device node in the network cloud topology data.
[0064] Specifically, performance metrics may include CPU (Central Processing Unit) utilization, memory utilization, etc. Performance data can be identified using one-hot encoding, with CPU utilization and memory utilization encoded separately to obtain performance characteristics. For example, if the device's CPU utilization is 95%, the encoding is 1001011111 (10 represents CPU data, and 01011111 decimal is 95), with the first two digits indicating performance and the last few digits indicating the specific value; if the memory utilization is 100%, the encoding is 0101100100 (01 represents memory data, and 01100100 decimal is 100).
[0065] Specifically, resource data can be identified based on one-hot encoding, which can identify the manufacturer information of each type of equipment and obtain resource characteristics. For example, manufacturer A can be identified as 1000001, manufacturer B can be identified as 1000010, manufacturer C can be identified as 1000011, and manufacturer D can be identified as 1000100.
[0066] Specifically, based on a unified network-wide standard alarm database (i.e., a preset standard alarm database), each alarm title can be one-hot encoded to obtain alarm characteristics. For example, "Port down" can be identified as 100000000000000001, "BFD (Bidirectional Forwarding Detection) session down" as 10000000000000010, and "Link disconnection" as 100000000000000011, where the first digit identifies the alarm data, and the following digits identify the specific alarm number. The number of alarm titles for all network devices is fixed; all alarm titles can be sorted alphabetically by uppercase and lowercase letters and assigned fixed values.
[0067] Specifically, features can be extracted from the log information input by the device based on a pre-trained NLP (Natural Language Processing) model, with the log extraction range being one day. The NLP model can output relevant auxiliary judgment information. Based on the log text information read by the NLP model, the system can determine whether the device is faulty. The NLP model will identify key fields in the log information, output the fault probability, and label them with one-hot encoding to obtain log features. For example, if the NLP model identifies the hardware fault field "hardware error", it will output a fault probability of 100%, labeled as 10000001100100; if it identifies the "port down" field, it may output a fault probability of 80%, labeled as 10000001010000.
[0068] Existing solutions mainly rely on data from certain devices for network fault location. This makes it impossible for many alarms unrelated to the data anomaly to be reflected in the relevant data, leading to errors in alarm location. To solve this problem, the embodiments of this invention integrate various data information from devices in the network to achieve comprehensive fault location, thereby effectively improving the accuracy of fault device location.
[0069] In this embodiment of the invention, network cloud topology graph data, alarm data, performance data, resource data, and log data can be integrated together to achieve adaptive data splicing and obtain the combined features of each graph node in the network cloud topology graph data.
[0070] Specifically, the alarm data identifier can be vectorized into 1. The data has 17 dimensions (e.g., "port down" is vectorized as 10000000000000001), and the performance data is also vectorized to 1 based on the encoding. 10-dimensional data, resource pool data vectorized into 1 7-dimensional data, log data vectorized into 1 14-dimensional data. After these four types of data are vectorized, each undergoes a dimensionality upscaling operation through a fully connected module, starting from 1... 17.1 10, 1 7 and 1 14 to 1 100 then combined to become 1 The feature vector of 400, that is, in the graph topology, each node has a feature value of 1. 400 is used to represent the node characteristics of this node. In a more general case, where it is necessary to locate the node based on data from multiple time points, the node characteristics are represented as Δt. 400, a single time point is represented as 1. 400.
[0071] Based on any of the above embodiments, the graph neural network includes a graph neural network module and a feature fusion module; the step of inputting the network cloud topology graph data and the node features of each device node into the pre-trained graph neural network to obtain the fault device location result may specifically include: inputting the network cloud topology graph data and the node features of each device node into the graph neural network module for feature extraction to obtain the weighted features of each device node; and inputting the weighted features of each device node into the feature fusion module for feature extraction and feature fusion to obtain the fault device location result.
[0072] Figure 4 This is a schematic diagram of the GCN feature extraction and localization process provided in an embodiment of the present invention. (Refer to...) Figure 4 In this embodiment of the invention, the organized data (including performance characteristics and their weights, resource characteristics and their weights, log characteristics and their weights, alarm characteristics and their weights, and network cloud topology data and its node weights and edge weights) can be input into a graph neural network deep learning model for forward propagation to obtain the fault device location result.
[0073] Graph neural networks can include a graph neural network module and a feature fusion module. Specifically, network cloud topology data, node features of each device node, and related weight information can be input into the graph neural network module for feature extraction to obtain weighted features of each device node. The weighted features of each device node are then input into the feature fusion module for feature extraction and feature fusion to obtain the fault device location result.
[0074] Current algorithms primarily rely on single performance indicators for device health diagnosis, neglecting the impact of other factors on the final location result due to limited performance metrics and parameters. In view of these problems, this invention combines five elements: commonly used performance indicators of network cloud resource pool devices, device resource data, alarm titles, topology connections, and device log information. This allows the fault location model (i.e., the graph neural network used for fault location) to adaptively combine different data, fully and freely utilizing various data points, improving model generalization, and expanding the application scenarios of the solution. Compared to using only one or a few data points, this provides a more comprehensive basis for fault location and improves accuracy. Furthermore, this invention is not constrained by the data of the deployment scenario; it can still perform fault location based on this method even when one or a few data points are lacking, demonstrating better generalization and applicability.
[0075] Current network fault location algorithms do not prioritize feature importance or implement self-learning weighted fusion of features. This invention combines multiple feature fusion methods, using learnable weighted parameters to obtain fused features, achieving feature extraction. The extracted features exhibit good generalization and strong representational properties, improving the fault location accuracy of graph neural network models.
[0076] This invention implements network cloud fault location by inputting network cloud topology data and node features of each device node into a pre-trained graph neural network and using a graph neural network deep learning framework. Compared with machine learning-based methods, this method has more model parameters, better model performance, and higher fault location accuracy. Furthermore, graph neural networks can make full use of network topology relationships, making them more suitable for network fault location scenarios.
[0077] Based on any of the above embodiments, the graph neural network module includes an LSTM module and a multi-layer graph convolutional layer; the step of inputting the network cloud topology graph data and the node features of each device node into the graph neural network module for feature extraction to obtain the weighted features of each device node includes: inputting the node features of each device node into the LSTM module to obtain the initial features of each device node; inputting the initial features of each device node into the multi-layer graph convolutional layer to obtain the preset dimension features of each device node; determining the weighted features of each device node based on the preset dimension features of each device node and the learnable node weights of each device node; the learnable node weights of the device nodes are the node weights of the device nodes.
[0078] Figure 5 This is a schematic diagram of the processing flow of the GCN module provided in an embodiment of the present invention. (Refer to...) Figure 5 The input data (i.e., the node characteristics of each device node) has a dimension of Δt. 400, time series processing can be achieved using the LSTM model. The LSTM module outputs data with a dimension of 1. F (i.e., the initial characteristics of each device node). Where N is the number of nodes, i.e., the number of devices.
[0079] Next, the GCN module can input the processed graph data into the graph convolutional layer to extract features of a preset dimension. The graph convolutional layer can have ten layers, each with the same structure, consisting of GCN, an activation function, and dropout.
[0080] In this embodiment of the invention, since nodes and edges with unequal weights are used, the adjacency matrix can be obtained using learnable parameter weights. The specific GCN calculation formula is as follows: ; ; in, The adjacency matrix represents the connection relationship between the x-th device and the y-th device. If there is a topological connection between two devices, the edge weight is... If it is a self-loop connection, then If the two devices are not connected, then The output characteristics of the GCN network are as follows: ; in, This represents the feature of the l-th layer node in the graph convolutional network, with a maximum value of 10 layers. A is the adjacency matrix. For degree matrix, For the parameters of the l-th layer graph convolutional network, is the activation function. Due to the complex network cloud topology, ten-layer graph convolution ensures that multi-level topology features from virtual machines to egress routers can be aggregated into a single graph node, giving each node global features. The features extracted by GCN ultimately become m. Output an image of size m, and finally multiply the N nodes by the learnable node weights according to their importance. This allows us to obtain the weighted features output by each node.
[0081] Based on any of the above embodiments, the feature fusion module includes multiple feature extraction layers and a fully connected layer; the step of inputting the weighted features of each device node into the feature fusion module for feature extraction and feature fusion to obtain the fault device location result includes: inputting the weighted features of each device node into each feature extraction layer to obtain the features output by each feature extraction layer; inputting the features output by each feature extraction layer into the fully connected layer for weighted fusion to obtain the fault device location result.
[0082] Current algorithms mainly locate faulty equipment based on features extracted from single modules of the model. This invention combines commonly used feature extraction modules in current AI data feature scenarios to achieve feature extraction and weighted fusion, thereby strengthening feature representation and improving the accuracy of fault location.
[0083] Figure 6 This is a schematic diagram of the processing flow of the feature fusion module provided in an embodiment of the present invention. (Refer to...) Figure 6 The feature fusion module can extract input features based on each specific feature extraction layer, and finally perform weighted fusion of the features extracted by each feature extraction layer to obtain the fault device localization result. Feature extraction layers can include modules such as SCCconv, DenseNet, and ResNet.
[0084] The SCCconv module can include spatial reconstruction units and channel reconstruction units to handle spatial and channel redundancy, respectively. In this embodiment of the invention, its spatial reconstruction unit can be used for feature extraction, which can improve model performance while reducing complexity and computational cost.
[0085] The DenseNet module utilizes all the features extracted from the preceding convolutional layers through dense connections, thereby enabling better model training.
[0086] The ResNet module uses the skip method to obtain features from previous layers, which can avoid gradient vanishing and other issues, thus enabling the training of a better model.
[0087] Assume the features obtained from the three feature extraction modules are as follows: , , The final fusion feature is Where a, b, and c are all learnable weights. The input features of the feature fusion module are the output features of the GCN module, i.e., the input data dimension is N. 128 128 1. After being processed by three different feature extraction modules, it becomes three N... 128 128 1. Feature map, i.e. , , Finally, the features are reshaped into N. 16384, then output the data through a fully connected layer, with the data format being N. 1. Complete fault location and determine the probability of failure for N devices.
[0088] Based on any of the above embodiments, the pre-trained graph neural network is trained in the following manner: acquiring training samples; the training samples include fault samples and normal samples; inputting the training samples into the graph neural network to be trained to obtain the fault equipment location training result output by the graph neural network to be trained; calculating the focal-loss-based loss function value based on the fault equipment location training result and sample labels; training the graph neural network to be trained based on the loss function value to obtain the pre-trained graph neural network.
[0089] In this embodiment of the invention, the graph neural network to be trained can be trained based on fault samples and normal samples to obtain a pre-trained graph neural network for fault device localization.
[0090] In real-world scenarios, the number of faulty devices is relatively small, and most nodes in the topology are operating normally, leading to imbalanced data within the samples. Furthermore, each batch of training data contains fewer faulty samples than normal operating samples because many alarms are caused by manual operation or network fluctuations, rather than actual device failures, further contributing to imbalance between samples. Therefore, this imbalance, both within and between samples, can lead to overfitting during model training. Thus, this embodiment of the invention uses a focal-loss-based loss function for model training to prevent overfitting in the graph neural network model. The loss function formula is as follows: ; Where N is the number of training batches and M is the number of topology nodes. Let γ be the probability that the i-th node is correctly identified, γ be an adjustment parameter used to adjust the loss weight (set to 3 in this embodiment), and L be the loss function value. The more accurate the model's identification of a node, the closer its loss is to 0, and vice versa.
[0091] The fault location training results include the predicted probability of the graph neural network under training determining whether the i-th device node is faulty, and the sample labels include the true probability of whether the i-th device node is faulty. The probability of correctly identifying the i-th node can be determined based on the fault location training results and the sample labels. .
[0092] The model (i.e., the graph neural network) is trained in an end-to-end manner. Model training can be identified as follows: ; in, Let L be the model parameters to be optimized, L be the training loss, and the optimization objective be to find a set of parameters. Make L the minimum.
[0093] In some embodiments, the training parameters can be set as follows: The model is built using the PyTorch AI framework, with Python version 3.9.6. During the training phase, the training batch size is set to 100; the Adam optimizer is used for model parameter fitting, with a fixed learning rate of 0.002 and weight decay of 0.0001. It is 0.99. The value is 0.99; the number of training loops is 50,000.
[0094] In summary, the embodiments of the present invention have the following technical advantages: (1) Compared with the previous method of network fault location based on equal weight graphs, the present invention constructs learnable weight parameters of edges and nodes based on the importance of each level of network topology, and obtains the optimal weights through model training methods. The graph data information is richer and more reasonable, which improves the model location accuracy.
[0095] (2) In the past, the main method was to establish topological relationships based on the physical connection relationship of the devices. The embodiments of the present invention construct a more comprehensive topological relationship based on the communication protocols between devices such as BFD, SNMP, and Redfish, so that the graph neural network can realize fault location based on more topological relationships. In particular, it can more accurately locate faults caused by the disconnection of many protocols. The embodiments of the present invention make the topological information in network fault location richer and more comprehensive, and improve the model location accuracy.
[0096] (3) Current network fault location algorithms do not focus on the importance of features or achieve self-learning weighted fusion of features. This embodiment of the invention combines multiple feature fusion modules and uses learnable weighted parameters to obtain fused features, thereby achieving feature extraction. The extracted features have good generalization and strong representation, improving the model's localization accuracy. In addition, the feature modules used can be replaced as needed, making them plug-and-play and highly scalable.
[0097] (4) The embodiments of the present invention adopt an end-to-end fault location method, which can realize fault location automatically and quickly, and is efficient and simple.
[0098] The network cloud fault location device provided by the present invention is described below. The network cloud fault location device described below can be referred to in correspondence with the network cloud fault location method described above.
[0099] Figure 7 This is a schematic diagram of the network cloud fault location device provided in an embodiment of the present invention. (Refer to...) Figure 7 This invention provides a network cloud fault location device, which may specifically include the following modules: The data acquisition module 710 is used to acquire fault location indicator data of network cloud devices; the fault location indicator data includes at least one of log data, performance data, resource data, topology data and alarm data. The graph data generation module 720 is used to generate network cloud topology graph data based on the topology data; The node feature determination module 730 is used to perform feature processing on the log data, the performance data, the resource data and the alarm data to determine the node features of each device node in the network cloud topology map data; The fault location module 740 is used to input the network cloud topology map data and the node features of each device node into a pre-trained graph neural network to obtain the fault device location result.
[0100] This invention, by simultaneously considering information such as device performance data, resource data, log data, alarm data, and topology correlation, adaptively combines data collected from different perspectives to form a network cloud topology graph. This graph then uses the node characteristics of each device node for fault location, resulting in more comprehensive and abundant fault location reference data, better model generalization, and higher fault location accuracy. Furthermore, it can be used in scenarios where some device data is missing, demonstrating even better generalization. By inputting the network cloud topology graph data and the node characteristics of each device node into a pre-trained graph neural network, and using a graph neural network deep learning framework to achieve network cloud fault location, compared to machine learning-based methods, this approach has more model parameters, better model performance, and higher fault location accuracy. Moreover, graph neural networks can fully utilize network topology relationships, making them more suitable for network fault location scenarios.
[0101] Figure 8 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 8 As shown, the electronic device may include a processor 810, a communications interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communications interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute a network cloud fault location method. This method includes: acquiring fault location indicator data of the network cloud device; the fault location indicator data includes at least one of log data, performance data, resource data, topology data, and alarm data; generating network cloud topology map data based on the topology data; performing feature processing on the log data, performance data, resource data, and alarm data to determine the node features of each device node in the network cloud topology map data; and inputting the network cloud topology map data and the node features of each device node into a pre-trained graph neural network to obtain the fault device location result.
[0102] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0103] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the network cloud fault location method provided by the above methods. The method includes: acquiring fault location indicator data of network cloud devices; the fault location indicator data includes at least one of log data, performance data, resource data, topology data, and alarm data; generating network cloud topology map data based on the topology data; performing feature processing on the log data, performance data, resource data, and alarm data to determine the node features of each device node in the network cloud topology map data; and inputting the network cloud topology map data and the node features of each device node into a pre-trained graph neural network to obtain the fault device location result.
[0104] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the network cloud fault location method provided by the above methods. The method includes: acquiring fault location indicator data of network cloud devices; the fault location indicator data including at least one of log data, performance data, resource data, topology data, and alarm data; generating network cloud topology map data based on the topology data; performing feature processing on the log data, performance data, resource data, and alarm data to determine the node features of each device node in the network cloud topology map data; and inputting the network cloud topology map data and the node features of each device node into a pre-trained graph neural network to obtain fault device location results.
[0105] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0106] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0107] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for locating network cloud faults, characterized in that, include: Obtain fault location index data for network cloud devices; The fault location indicator data includes at least one of log data, performance data, resource data, topology data, and alarm data; Based on the aforementioned topology data, generate network cloud topology map data; The log data, performance data, resource data, and alarm data are subjected to feature processing to determine the node characteristics of each device node in the network cloud topology map data; The network cloud topology data and the node features of each device node are input into a pre-trained graph neural network to obtain the fault device location result.
2. The network cloud fault location method according to claim 1, characterized in that, The network cloud topology map data includes the topological connection relationships between device nodes; The process of generating network cloud topology map data based on the topology data includes: Obtain protocol heartbeat connection parameters from the underlying configuration parameter information of the local network cloud device; the protocol heartbeat connection parameters include the address of the remote device that establishes a communication connection with the local network cloud device. Based on the remote device address, obtain the device type of the remote device; Establish a virtual topology relationship based on the local network cloud device type and the remote device type; Establish physical topology relationships based on the port description information of the local network cloud devices; Based on the virtual topology relationship and the physical topology relationship, the topological connection relationship between device nodes is determined.
3. The network cloud fault location method according to claim 2, characterized in that, The network cloud topology data also includes the node weights of each device node and the edge weights between adjacent device nodes; the node weights of the device nodes are determined based on the device type of the device node, and the edge weights between adjacent device nodes are determined based on the device type of the adjacent device nodes; the node weights of the bottom layer device nodes are less than the node weights of the egress layer device nodes.
4. The network cloud fault location method according to claim 1, characterized in that, The performance data includes various types of performance indicators and corresponding performance values; the resource data includes manufacturer information for network cloud devices; and the alarm data includes alarm titles. The process of performing feature processing on the log data, performance data, resource data, and alarm data to determine the node characteristics of each device node in the network cloud topology data includes: One-hot encoding is used to identify the performance metrics and their corresponding performance data to obtain performance characteristics. The manufacturer information of network cloud devices is identified by one-hot encoding to obtain resource characteristics; Based on a pre-defined standard alarm library, alarm titles are identified by one-hot encoding to obtain alarm features; Based on a pre-trained natural language processing model, feature extraction is performed on log data to obtain fault probabilities, and the fault probabilities are identified by one-hot encoding to obtain log features. The log features, performance features, resource features, and alarm features are subjected to dimensionality-upgrading operations and splicing processes to obtain the node features of each device node in the network cloud topology map data.
5. The network cloud fault location method according to claim 1, characterized in that, The graph neural network includes a graph neural network module and a feature fusion module; the step of inputting the network cloud topology data and the node features of each device node into the pre-trained graph neural network to obtain the fault device location result includes: The network cloud topology data and the node features of each device node are input into the graph neural network module for feature extraction to obtain the weighted features of each device node. The weighted features of each device node are input into the feature fusion module for feature extraction and feature fusion to obtain the fault device location result.
6. The network cloud fault location method according to claim 5, characterized in that, The graph neural network module includes an LSTM module and multiple graph convolutional layers; the process of inputting the network cloud topology graph data and the node features of each device node into the graph neural network module for feature extraction to obtain the weighted features of each device node includes: The node features of each device node are input into the LSTM module to obtain the initial features of each device node; The initial features of each device node are input into a multi-layer graph convolutional layer to obtain the preset dimension features of each device node. Based on the preset dimensional features of each device node and the learnable node weights of each device node, the weighted features of each device node are determined; the learnable node weights of each device node are the node weights of the device node.
7. The network cloud fault location method according to claim 5, characterized in that, The feature fusion module includes multiple feature extraction layers and a fully connected layer; the step of inputting the weighted features of each device node into the feature fusion module for feature extraction and feature fusion to obtain the fault device location result includes: The weighted features of each device node are input into each feature extraction layer to obtain the features output by each feature extraction layer. The features output from each feature extraction layer are input into a fully connected layer and weighted and fused to obtain the fault location result.
8. The network cloud fault location method according to claim 1, characterized in that, The pre-trained graph neural network is trained in the following way: Obtain training samples; the training samples include fault samples and normal samples; The training samples are input into the graph neural network to be trained to obtain the fault location training results output by the graph neural network to be trained. Based on the training results of the faulty equipment location and the sample labels, calculate the value of the focal-loss-based loss function; The graph neural network to be trained is trained based on the loss function value to obtain a pre-trained graph neural network.
9. A network cloud fault location device, characterized in that, include: The data acquisition module is used to acquire fault location indicator data of network cloud devices; The fault location indicator data includes at least one of log data, performance data, resource data, topology data, and alarm data; The graph data generation module is used to generate network cloud topology graph data based on the topology data; The node feature determination module is used to perform feature processing on the log data, performance data, resource data and alarm data to determine the node features of each device node in the network cloud topology map data; The fault location module is used to input the network cloud topology map data and the node features of each device node into a pre-trained graph neural network to obtain the fault device location result.
10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the network cloud fault location method as described in any one of claims 1 to 8.
11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the network cloud fault location method as described in any one of claims 1 to 8.
12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the network cloud fault location method as described in any one of claims 1 to 8.