A protocol-aware coding and logical constraint based domain adaptive network fault diagnosis model training method and system

Abstract

This invention relates to the field of network fault diagnosis and intelligent operation and maintenance technology, specifically to a training method and system for a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints. The method includes the following steps: acquiring raw network logs; mapping protocol symbol fragments in the raw network logs to protocol semantic tags using a protocol-aware mapping mechanism; generating a semantically enhanced lexical sequence based on the protocol semantic tags and standard lexical units; and inputting the semantically enhanced lexical sequence in parallel into a dual-path network architecture consisting of a parameter-frozen basic path and a domain-adaptive path with a low-rank adaptive module to obtain a first hidden state and a second hidden state. This invention constructs a causal logical loss by penalizing illegal state transitions, thereby enabling the model to not only possess semantic understanding capabilities but also logical consistency that conforms to protocol operating rules, significantly improving the reliability and interpretability of fault diagnosis results.

Description

Technical Field

[0001] This invention relates to the field of network fault diagnosis and intelligent operation and maintenance technology, and in particular to a method and system for training a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints. Background Technology

[0002] As network systems continue to expand in scale and business complexity continues to increase, the log data generated during network operation exhibits characteristics of high dimensionality, strong temporal sequence, and mixed multi-protocols. Network faults are usually implicitly reflected in the log sequence. Relying on manual analysis or rule-based diagnostic methods makes it difficult to identify complex fault modes in a timely and accurate manner. In particular, in scenarios involving multi-source protocol interaction and cross-system calls, traditional methods are prone to misjudgment or omission.

[0003] Existing network fault diagnosis methods based on machine learning or deep learning typically achieve automatic classification or anomaly detection by vectorizing log text. However, most of these methods rely on general semantic representations and do not make sufficient use of the protocol state information contained in the logs, making it difficult to effectively characterize the state evolution relationship at the protocol level. At the same time, there are significant differences between different network environments in terms of log format, protocol implementation, and fault distribution. Directly transferring models often leads to performance degradation and has limited cross-domain adaptability.

[0004] Furthermore, existing methods mainly rely on single-task loss for optimization during training, lacking constraints on the logical consistency of model output results. This can easily lead to state prediction results that do not conform to the protocol's operating rules, thus affecting the reliability of diagnosis. Therefore, how to fully utilize protocol semantic information, introduce cross-domain alignment mechanisms and logical constraints, and achieve lightweight parameter tuning has become a key technical problem that urgently needs to be solved in the current field of network fault diagnosis. Summary of the Invention

[0005] This invention provides a training method and system for a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints.

[0006] A method for training a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints includes the following steps:

[0007] Obtain the raw network logs and map the protocol symbol fragments in the raw network logs into protocol semantic tags through a protocol-aware mapping mechanism;

[0008] Generate semantically enhanced lexical sequences based on the protocol semantic tags and standard lexical units;

[0009] The semantically enhanced lexical sequence is input in parallel into a dual-path network architecture consisting of a base path with frozen parameters and a domain adaptive path with a low-rank adaptive module, to obtain the first hidden state and the second hidden state.

[0010] Calculate the task loss based on the second hidden state;

[0011] Calculate the cross-domain alignment loss based on the first hidden state and the second hidden state;

[0012] The causal logic loss is calculated based on the predicted output sequence of the second hidden state and the predefined protocol state transition legality matrix, and the three are weighted and summed to obtain the total loss.

[0013] With the goal of minimizing the total loss, the parameters of the low-rank adaptive modules in the domain adaptive path are iteratively updated only to obtain the trained network fault diagnosis model.

[0014] As a further technical solution of the present invention, the original network log is obtained, and all protocol symbol fragments in the original network log are extracted using a predefined regular expression. The protocol symbol fragments include hexadecimal status codes, specific error codes, or protocol status fields.

[0015] For each extracted protocol symbol fragment, a pre-built protocol mapping table is queried to map the entire protocol symbol fragment to the corresponding protocol semantic tag. The mapping function is expressed as follows: ;in, For protocol symbol fragments, This refers to the mapped protocol semantic tags.

[0016] As a further technical solution of the present invention, the remaining text in the original network log that was not extracted as protocol symbol fragments is segmented into standard tokens by a standard word segmenter, and the output of the standard word segmenter is represented as follows:

[0017] ;in, For text that was not extracted as protocol symbol fragments, These are the standard word units after segmentation. This indicates that a word segmenter is used to process the input text;

[0018] The protocol semantic tags and the standard lexical units are combined and aligned in the original order in the original network log to generate the semantically enhanced lexical unit sequence.

[0019] As a further technical solution of the present invention, the semantically enhanced lexical sequence is simultaneously and in parallel input to the base path and the domain adaptive path;

[0020] In the basic path, the word sequence is computed forward using the frozen original language model parameters to output the first hidden state. The parameters of the basic path remain unchanged throughout the training process. The forward computation of the basic path can be expressed as:

[0021] ; among which, L The original language model represents the frozen state. Given the input word sequence, It is the first hidden state of the output.

[0022] As a further technical solution of the present invention, in the domain adaptive path, the word sequence is sequentially passed through each network layer of the original language model, and a low-rank decomposition matrix is ​​inserted into each attention layer or feedforward network layer for bypass calculation, outputting the second hidden state. The low-rank decomposition matrix is ​​a trainable parameter and its parameter count is much smaller than the total number of parameters of the basic path. The second hidden state is represented as follows:

[0023] ;in, This represents a language model optimized through low-rank decomposition. It is a low-rank decomposition matrix. It is the second hidden state of the domain adaptive path output.

[0024] As a further technical solution of the present invention, the second hidden state is input to the output layer of the fault diagnosis task, and the cross-entropy loss between the second hidden state and the true labeled label is calculated as the task loss. The cross-entropy loss is expressed as: ;in, To ensure accurate labeling, To pass through the second hidden state The calculated prediction result, where N is the sample size;

[0025] The first hidden state and the second hidden state are softened respectively, and the KL divergence between their probability distributions is calculated as the cross-domain alignment loss, which is used to constrain the output of the domain adaptive path from deviating from the output of the base path. The formula for calculating the KL divergence is as follows:

[0026] ;in, This represents the probability distribution obtained from the first hidden state after passing through a mapping layer and softening processing. This represents the probability distribution obtained from the second hidden state after passing through the same mapping layer and softening process. To represent the probability distribution In the middle, the first The probability values ​​corresponding to each category To represent the probability distribution In the middle, the first The probability values ​​corresponding to each category Indicates the first There are several categories.

[0027] As a further technical solution of the present invention, the protocol state semantic label of each position is extracted from the predicted output sequence of the second hidden state in time step order, and for each pair of adjacent time steps, the previous state and the current state are queried from a predefined protocol state transition legality matrix. If the query result is an illegal transition, a corresponding penalty value is generated according to a preset penalty intensity coefficient, and the penalty values ​​corresponding to all illegal transitions are accumulated as the causal logic loss. Represented as: ;in, and These represent the protocol states at adjacent time steps. The function generates a penalty value based on the severity of the penalty for illegal transfers;

[0028] The task loss, the cross-domain alignment loss, and the causal logic loss are weighted and summed according to preset weighting coefficients to obtain the total loss. Represented as:

[0029] ;in, These are the weighting coefficients for task loss, cross-domain alignment loss, and causal logic loss, respectively.

[0030] As a further technical solution of the present invention, with minimizing the total loss as the optimization objective, the gradient is calculated by backpropagation along the adaptive path of the neighborhood, while keeping the gradient of the basic path frozen and not performing any gradient calculation or parameter update on it.

[0031] The calculated gradient is applied only to the trainable parameters in the low-rank adaptive module, and the parameters of the low-rank adaptive module are iteratively updated using a preset optimizer.

[0032] As a further technical solution of the present invention, the training process is iterated in multiple rounds, that is, the complete process from data processing, loss calculation and parameter update is repeatedly executed until the total loss converges to below a preset threshold or reaches the preset maximum number of training rounds, and the update is stopped. The model formed by the basic path and the updated domain adaptive path at this time is used as the network fault diagnosis model after the training is completed.

[0033] A domain-adaptive network fault diagnosis model training system based on protocol-aware coding and logical constraints includes the following modules:

[0034] The log acquisition and protocol awareness mapping module is used to acquire raw network logs and extract protocol symbol fragments, and map the protocol symbol fragments to protocol semantic tags.

[0035] A semantic enhancement construction module is used to generate a semantically enhanced lexical sequence based on the protocol semantic tags and standard lexical units;

[0036] A dual-path feature extraction module is used to input the semantically enhanced lexical sequence in parallel to the parameter-frozen base path and the domain adaptive path equipped with a low-rank adaptive module, and output the first hidden state and the second hidden state respectively.

[0037] The loss calculation module is used to calculate the task loss based on the second hidden state, calculate the cross-domain alignment loss based on the first hidden state and the second hidden state, calculate the causal logic loss based on the predicted output sequence of the second hidden state and the predefined protocol state transition legality matrix, and sum the three weighted values ​​to obtain the total loss.

[0038] The parameter update module is used to iteratively update the parameters of the low-rank adaptive modules in the domain adaptive path with the goal of minimizing the total loss, and output the trained network fault diagnosis model.

[0039] The beneficial effects of this invention are:

[0040] This invention introduces protocol-aware mapping in the log modeling stage, transforming protocol symbol fragments in the original network logs into protocol semantic labels with clear semantics, and aligning them with standard lexical units to construct a semantically enhanced lexical sequence. In the model training stage, a protocol state transition legality matrix is ​​further introduced to impose causal logic constraints on the predicted output sequence. Causal logic loss is constructed by penalizing illegal state transitions, so that the model not only has semantic understanding capabilities but also logical consistency that conforms to the protocol operation rules, significantly improving the reliability and interpretability of fault diagnosis results.

[0041] This invention constructs a dual-path network structure consisting of a frozen base path and a domain adaptive path. While keeping the original language model parameters unchanged, a low-rank adaptive module is introduced only in the domain adaptive path for lightweight optimization. The consistency of the outputs of the two paths is constrained by the cross-domain alignment loss, thereby achieving efficient adaptation to the features of the target domain. This approach significantly reduces the size of training parameters while ensuring model stability, and improves cross-domain transfer capability and training efficiency. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only for this invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a schematic diagram of the method flow of the present invention;

[0044] Figure 2 This is a schematic diagram of the S2 method flow of the present invention;

[0045] Figure 3 This is a schematic diagram of the S3 method flow of the present invention;

[0046] Figure 4 This is a schematic diagram of the system modules of the present invention. Detailed Implementation

[0047] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. For some well-known technologies, those skilled in the art may also use other alternative methods to implement the invention. Moreover, the accompanying drawings are only for more specific description of the embodiments and are not intended to specifically limit the present invention.

[0048] like Figure 1-3 As shown, a method for training a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints includes the following steps:

[0049] S1. Obtain the original network logs, map the protocol symbol fragments in the original network logs to protocol semantic tags through a protocol-aware mapping mechanism, and generate a semantically enhanced lexical sequence based on the protocol semantic tags and standard lexicals.

[0050] S11. Obtain network operation logs from devices such as servers, routers, and switches, and extract all protocol symbol fragments from the original network logs using predefined regular expressions. The predefined regular expressions are defined according to the types of protocol symbols to be extracted, and different regular expression patterns are defined. For example, for hexadecimal status codes, a regular expression matching hexadecimal numbers is defined.

[0051] Protocol symbol fragments may include: hexadecimal status codes, specific error codes, and protocol status fields.

[0052] Protocol symbol fragments serve to identify protocol status or fault types in network logs. By scanning the raw network logs using predefined regular expressions, the extracted fragments after a successful regular expression match will be used as protocol symbol fragments for subsequent analysis and mapping.

[0053] S12: Based on each extracted protocol symbol fragment, semantic tags are mapped by querying a pre-built protocol mapping table. The protocol mapping table is constructed according to protocol standards and historical data and contains the mapping relationship between symbol fragments and semantic tags. Each protocol symbol fragment corresponds to one or more protocol semantic tags. Semantic tags usually represent the state, type or operation of the protocol.

[0054] For each symbol fragment, it can be represented by the following mapping function: ;in, For protocol symbol fragments, The mapped protocol semantic label transforms the original meaning of symbol fragments into more explicit semantic information.

[0055] Table 1 is the protocol mapping table.

[0056]

[0057] S13, the remaining text in the original network log that was not extracted as protocol symbol fragments is segmented using a standard word segmenter to obtain standard tokens. The standard word segmenter segments the text according to predetermined rules, which are as follows:

[0058] Spaces separate words: In English, words are separated by spaces, and each word is a lexical unit;

[0059] Punctuation marks as separators: In English or other languages, punctuation marks are used as separators to separate sentences or words;

[0060] Case-sensitive separator: Separates word groups based on the capitalization of letters;

[0061] Special character handling separators: such as numbers, special symbols, dates, and proper nouns, will be recognized or processed separately.

[0062] Dictionary matching delimiter: In Chinese word segmentation, the segmenter usually relies on a dictionary to determine the boundaries of words. For example, network fault is treated as a single word element, while network and fault are treated as two separate words.

[0063] Break down continuous sequences of characters into the smallest comprehensible units, such as words, phrases, or other grammatical units, ensuring that all textual information can be transformed into the required standard lexical units.

[0064] The output of the standard word segmenter is represented as follows: ;in, For text that was not extracted as protocol symbol fragments, These are the standard word units after segmentation. This indicates that a word segmenter is used to process the input text, dividing it into a series of tokens.

[0065] S14. The obtained protocol semantic tags and standard lexical units are combined and aligned in the order of the original network log, thereby enhancing the information in the original network log at the semantic level.

[0066] The combined and aligned word sequence can be represented as: ;in, It is a standard word element. These are the corresponding protocol semantic tags. In this way, all network log information can be presented in the form of semantically enhanced lexical units, ready to be input into the subsequent network fault diagnosis model for training and inference.

[0067] S2, the semantically enhanced lexical sequence is input in parallel to a dual-path network architecture consisting of a base path with frozen parameters and a domain adaptive path with a low-rank adaptive module, and the first hidden state and the second hidden state are output respectively.

[0068] S21 takes the generated semantically enhanced lexical sequence as input and simultaneously feeds it into two paths in parallel: the base path and the domain adaptive path. The base path is computed using the frozen original language model parameters, while the domain adaptive path is optimized by inserting a low-rank decomposition matrix.

[0069] S22, in the basic path, uses the frozen original language model parameters to perform forward computation on the input semantically enhanced lexical sequence, and the parameters of this path remain unchanged throughout the training process.

[0070] The original language model uses the BERT language model based on the Transformer architecture. The BERT language model uses the Transformer encoder to understand contextual information and leverages its language understanding capabilities for text processing and feature extraction. The frozen language model is achieved by setting all trainable parameters in the model to be non-updatable, meaning they cannot be adjusted during training. Specifically, after loading the pre-trained original language model, all parameters in the model are iterated through, and their `requires_grad` attribute is set to `False`, ensuring that the model weights remain unchanged during training and are only used for feature extraction without being modified. In this way, the frozen original language model only performs forward propagation computation and does not update the model parameters through backpropagation. The parameters of the frozen original language model include the weights of all its layers, such as word vectors in the embedding layer, attention weights in each Transformer encoder layer, and weights in the feedforward network. Specifically, the parameters include:

[0071] Word embedding layer parameters: the word embedding matrix that maps lexical units to vectors;

[0072] Weights of the attention mechanism: used to calculate the query, key, and value matrix of the self-attention mechanism;

[0073] Weights of the feedforward neural network: The weights of the feedforward network in each Transformer encoder layer;

[0074] Layer normalization parameters: Normalization parameters for each encoder layer.

[0075] These weights remain unchanged during training and are therefore called frozen parameters. The model does not adjust the values ​​of these parameters during training.

[0076] In the basic path, when performing forward computation on the input word sequence using the frozen original language model, the input word sequence is first converted into word embedding vectors. These word embedding vectors are processed through the model's input embedding layer and then propagated forward through each Transformer encoder layer. Since the original language model has been frozen and its parameters are no longer updated, the model only utilizes the knowledge gained during pre-training for computation. Finally, the model outputs its first hidden state. The specific calculation process can be expressed as follows:

[0077] ; among which, L The original language model represents the frozen state. Given the input word sequence, It is the first hidden state of the output.

[0078] S23, in the domain adaptive path, the word sequence will sequentially pass through each network layer of the original language model. In each attention layer or feedforward network layer, a low-rank decomposition matrix will be inserted for bypass computation.

[0079] Specifically, in the domain adaptation path, the word sequence is first fed into each network layer of the original language model, namely the Transformer encoder layer. Unlike the basic path, the domain adaptation path inserts a low-rank factorization matrix into each encoder layer (including the attention layer and the feedforward network layer) to perform bypass computation to enhance the domain adaptation capability. In each layer, the word sequence is computed through the standard self-attention mechanism or the feedforward network. At the same time, the low-rank factorization matrix supplements the computation process of each layer, providing a low-computational-cost way to adapt to the characteristics of different domains.

[0080] The role of the low-rank factorization matrix is ​​to adjust the computation process of each layer by introducing a trainable low-rank matrix without significantly increasing computational complexity. The low-rank factorization matrix is ​​a low-dimensional matrix, much smaller than the original layer's weight matrix, and is typically obtained through matrix factorization. This matrix is ​​used in bypass computation with the original attention matrix or the weight matrix of the feedforward network. This allows the domain adaptation path to be fine-tuned with minimal computational overhead while keeping the original model parameters unchanged, effectively enhancing the model's cross-domain adaptability. Finally, after these calculations, the second hidden state is output. The sequence representation after domain-adaptive path processing is expressed as:

[0081] ;

[0082] in, This represents a language model optimized through low-rank decomposition. It is a low-rank decomposition matrix. It is the second hidden state of the domain adaptive path output.

[0083] Low-rank decomposition matrix As trainable parameters, they can be dynamically adjusted during training, effectively reducing computation while maintaining high expressive power.

[0084] S3. Calculate the task loss based on the second hidden state, calculate the cross-domain alignment loss based on the first and second hidden states, and calculate the causal logic loss based on the predicted output sequence of the second hidden state and the predefined protocol state transition legality matrix. Then, sum the three values ​​by weight to obtain the total loss.

[0085] S31 will output the second hidden state through the domain adaptive path. The input is given to the output layer of the fault diagnosis task. The output layer predicts the fault diagnosis result based on the second hidden state. Specifically, the second hidden state is input into a linear mapping structure. The linear mapping structure performs a weighted combination of the second hidden state, compressing the originally high-dimensional and abstract features and converting them into numerical representations that correspond one-to-one with the fault categories. The numerical values ​​are the scores for each fault category. Then, the scores are normalized to transform them into a probability distribution form, where each fault category corresponds to a probability value, and the sum of the probabilities of all categories is 1. This yields the prediction result for the current log belonging to each fault type. For example, outputting connection timeout 0.7, service unreachable 0.2, and normal 0.1 indicates that the... The log most likely corresponds to the connection timeout fault type. The category with the highest probability is ultimately selected as the diagnosis result, or the complete probability distribution is preserved for subsequent analysis. During the training phase, this prediction result is compared with the true labeled values. The difference between the prediction and the true value is measured using cross-entropy loss. If a higher probability is assigned to the true fault category, the prediction is more accurate and the loss is smaller; conversely, the loss is larger. This loss has a negative effect on the low-rank decomposition matrix in the domain adaptation path, causing the low-rank decomposition matrix to continuously adjust, making the second hidden state increasingly better at distinguishing different fault types, thereby improving the overall accuracy and stability of fault diagnosis. The cross-entropy loss is expressed as:

[0086] ;

[0087] in, To ensure accurate labeling, tags were obtained from existing maintenance records or manual labeling results. To pass through the second hidden state The calculated prediction result, where N is the number of samples, i.e. the number of fault types defined in the dataset.

[0088] Cross-entropy loss is used to guide the optimization of low-rank decomposition matrices to improve the accuracy of fault diagnosis.

[0089] S32, the first hidden state obtained through the basic path and the domain adaptive path. Second hidden state A softening process is performed, typically through temperature scaling. The probability distributions of the two distributions are calculated, and then the KL divergence between them is calculated to measure the difference between the two distributions. The formula for calculating the KL divergence is as follows:

[0090] ;

[0091] in, This represents the probability distribution obtained from the first hidden state after passing through a mapping layer and softening processing. This represents the probability distribution obtained from the second hidden state after passing through the same mapping layer and softening process. To represent the probability distribution In the middle, the first The probability values ​​corresponding to each category To represent the probability distribution In the middle, the first The probability values ​​corresponding to each category Indicates the first There are several categories.

[0092] Softening the first and second hidden states means first softening the first hidden state. Second hidden state The data are fed into the same mapping layer to obtain the corresponding category scores. Specifically, the first and second hidden states are taken as inputs and fed into a linear mapping structure with shared parameters. The linear mapping structure is essentially a fixed-dimensional transformation module to the category space. For each hidden state vector, the mapping layer performs a weighted combination of its features and adds a bias term to obtain a score vector with a length equal to the number of fault categories. Each value in the score vector represents the unnormalized confidence level of the current sample in the corresponding category. Then, a Softmax function with a temperature coefficient is used to smooth the score values. The larger the temperature coefficient, the smoother the output probability distribution; the smaller the temperature coefficient, the sharper the output probability distribution.

[0093] First, the scoring sequence of the basic path is obtained based on the first hidden state. Then, the scoring sequence of the domain-adaptive path is obtained based on the second hidden state. Softmax normalization is then applied to both scoring sequences to ensure that each category receives a probability value, and the sum of the probabilities of all categories is 1. The probability distribution corresponding to the first hidden state can be denoted as follows: The probability distribution corresponding to the second hidden state can be denoted as: .

[0094] The calculation of KL divergence involves a category-by-category comparison. and The difference, specifically, for each category, is to calculate the base path probability. Domain-Adaptive Path Probability The proportional relationship, then multiplied by Then, by summing the results, we obtain the overall degree of deviation between the two distributions. and The closer the paths are, the smaller the KL divergence. If the probability distribution of the domain adaptive path output deviates significantly from the base path, the KL divergence is larger. Therefore, KL divergence can be used as a cross-domain alignment loss. This is used to constrain the domain adaptive path to not deviate from the existing stable semantic expression of the original language model when learning features of the target domain.

[0095] S33. First, from the predicted output sequence of the second hidden state, extract the protocol state semantic label for each position in time step order. For each pair of adjacent time steps, query the predefined protocol state transition legality matrix. Specifically, the legality matrix is ​​first constructed based on the protocol standard. For TCP, it defines clear state transition rules, such as state changes during connection establishment, data transmission, and connection closure. All allowed state transition relationships can be directly compiled according to the standard document to form a two-dimensional matrix of allowed or disallowed states. Second, it is supplemented or corrected based on historical network log data statistics. By analyzing a large number of real operation logs, the actual transition frequency between different protocol states is statistically analyzed. High-frequency and reasonable transitions are marked as legal, while transitions that rarely occur or are highly correlated with anomalies are marked as illegal, thus making the matrix closer to the actual operating environment. Finally, it is verified and improved by combining the experience of operation and maintenance experts or rule bases. For some state changes that are not explicitly specified in the protocol specifications but have engineering experience significance in practice, experts can manually supplement them to further improve the accuracy and practicality of the matrix.

[0096] The legality matrix defines the rules for legal transitions between different states. If a state transition is considered illegal, such as a state that should not directly transition to failure after success, a corresponding penalty value is generated based on a preset penalty strength coefficient. The penalty strength coefficient is usually preset in the design phase or obtained through verification and optimization. It can be set empirically based on the importance of the protocol state transition. For example, a larger penalty coefficient is assigned to transitions that seriously violate the protocol logic, and a smaller coefficient is assigned to minor anomalies.

[0097] The algorithm sequentially extracts two adjacent protocol states from the predicted output sequence and determines whether the state transition is illegal in the legality matrix. If illegal, it triggers penalty calculation. Based on a preset penalty intensity coefficient, it uses this coefficient as a base weight to assign a fixed or confidence-related penalty value to the illegal transition. For example, the penalty intensity coefficient can be directly used as the penalty value for this illegal transition, or it can be further combined with the predicted probability corresponding to the transition, such as the predicted confidence of the current state, to weight the transition. This results in a larger penalty for illegal transitions with higher confidence. This process is repeated for all detected illegal transitions, and the penalty values ​​are accumulated to ultimately form the causal logical loss. Represented as:

[0098] ;

[0099] in, and These represent the protocol states at adjacent time steps. The function generates a penalty value based on the severity of the penalty for illegal transfers.

[0100] S34, mission loss Cross-domain alignment loss and causal logic loss The total loss is obtained by weighting and summing the results according to the preset weighting coefficients. The total loss is used to guide the entire optimization process, and the weighted summation formula is expressed as: ;in, These are the weight coefficients for task loss, cross-domain alignment loss, and causal logic loss, respectively. The optimal weight coefficients can be obtained through validation set tuning. During training, multiple different weight combinations are set, and the fault diagnosis accuracy and loss convergence are evaluated on the validation set. The set of weight coefficients with the best performance is selected as the final value.

[0101] S4, with the goal of minimizing the total loss, only the parameters of the low-rank adaptive modules in the domain adaptive path are iteratively updated to obtain the trained network fault diagnosis model.

[0102] S41, the total loss obtained As the objective function for optimization, the gradient is calculated through backpropagation. After completing the forward calculation and obtaining the total loss, the error signal is propagated layer by layer in reverse order of the network structure, starting from the total loss. Specifically, the partial derivative of the task loss function with respect to the output layer is calculated first, and then the chain rule is used to propagate the partial derivative to the next layer until it reaches the low-rank adaptive module in the domain adaptive path. In each layer, the partial derivative of the loss with respect to the parameters of that layer is calculated based on the dependence of the output of that layer on the input and parameters. Since the parameters of the base path are frozen, their gradients are not calculated or updated during backpropagation. The gradient flow is only preserved in the domain adaptive path, thus finally obtaining the gradient information for the parameters of the low-rank adaptive module.

[0103] This process can be represented as: ;in, This represents the trainable parameters of the low-rank adaptive module in the domain adaptation path. Low-rank decomposition structures are inserted into each attention layer or feedforward network layer of the original language model. The low-rank decomposition structure typically consists of two low-dimensional matrices, such as a reduced-dimensional matrix and an increased-dimensional matrix. The low-rank matrix is ​​explicitly defined as a trainable variable during initialization and registered as part of the parameters. After initialization, the low-rank matrix parameters are extracted separately using a parameter list filtering method. , This represents the total loss obtained by weighting the task loss, cross-domain alignment loss, and causal logic loss. This indicates the gradient calculation operation on the parameters;

[0104] The result is a gradient vector with the same dimension as the parameters. Each component represents the trend of the total loss when the corresponding parameter changes by a small amount. If the value is positive, it means that increasing the parameter will increase the loss; if it is negative, it means that increasing the parameter will decrease the loss. Therefore, the gradient is used to guide the parameter update direction and optimize in the direction of reducing the total loss.

[0105] This approach optimizes only the domain-adaptive part while maintaining the stability of the underlying path semantic representation.

[0106] S42, after obtaining the gradient, uses it only to update the parameters of the low-rank adaptive module. The update process is achieved through a pre-defined stochastic gradient descent, and the parameter update process can be expressed as:

[0107] ;

[0108] in, Indicates the first The parameters at the next iteration This indicates the updated parameters. This represents the learning rate. Through experimental tuning, multiple different learning rates are tried on the validation set, and the value that optimizes convergence speed and performance is selected to control the magnitude of parameter updates. This indicates the current iteration number. During training, a counter variable is set to record the number of training rounds that have been executed. Each time a complete training process is completed, i.e., one loop from S1 to S4 is executed, this counter is automatically incremented by 1.

[0109] This allows the low-rank adaptive module to gradually learn the features of the target domain, thereby improving the model's diagnostic capabilities in specific network environments.

[0110] S43, the above training process is iterated multiple times, that is, the complete process from data processing to loss calculation to parameter update is repeatedly executed until the termination condition is met. The termination condition includes:

[0111] 1. The total loss satisfies the convergence condition: ;

[0112] 2. Or reach the maximum number of training rounds: ;

[0113] in, This represents the preset loss convergence threshold. During actual training, the loss descent curve is observed. When the loss decreases to a certain level and then the change tends to level off, the value corresponding to that level is taken as the convergence threshold. This represents the maximum number of training epochs. By observing the performance changes of the model at different epochs through pre-experiments, a reasonable number of epochs before and after the performance tends to stabilize is selected as the upper limit. This indicates the current training round.

[0114] When any condition is met, the training process is stopped. At this point, the frozen base path is combined with the trained domain adaptive path to form the final network fault diagnosis model.

[0115] The network fault diagnosis model retains the general semantic expression capability of the original language model, while also possessing adaptive diagnostic capabilities for specific network environments, thereby achieving high-precision network fault identification and analysis.

[0116] like Figure 4 As shown, a domain-adaptive network fault diagnosis model training system based on protocol-aware coding and logical constraints includes the following modules:

[0117] The log acquisition and protocol awareness mapping module is used to acquire raw network logs and extract protocol symbol fragments, and map the protocol symbol fragments to protocol semantic tags.

[0118] A semantic enhancement construction module is used to generate a semantically enhanced lexical sequence based on the protocol semantic tags and standard lexical units;

[0119] A dual-path feature extraction module is used to input the semantically enhanced lexical sequence in parallel to the parameter-frozen base path and the domain adaptive path equipped with a low-rank adaptive module, and output the first hidden state and the second hidden state respectively.

[0120] The loss calculation module is used to calculate the task loss based on the second hidden state, calculate the cross-domain alignment loss based on the first hidden state and the second hidden state, calculate the causal logic loss based on the predicted output sequence of the second hidden state and the predefined protocol state transition legality matrix, and sum the three weighted values ​​to obtain the total loss.

[0121] The parameter update module is used to iteratively update the parameters of the low-rank adaptive modules in the domain adaptive path with the goal of minimizing the total loss, and output the trained network fault diagnosis model.

[0122] This invention encompasses any substitutions, modifications, equivalent methods, and solutions made within the spirit and scope of this invention. To provide the public with a thorough understanding of this invention, specific details are described in detail in the following preferred embodiments; however, those skilled in the art will fully understand the invention even without these details. Furthermore, to avoid unnecessary misunderstanding of the essence of this invention, well-known methods, processes, procedures, components, and circuits are not described in detail.

[0123] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A training method for a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints, characterized in that, Includes the following steps: Obtain the raw network logs and map the protocol symbol fragments in the raw network logs into protocol semantic tags through a protocol-aware mapping mechanism; Generate semantically enhanced lexical sequences based on the protocol semantic tags and standard lexical units; The semantically enhanced lexical sequence is input in parallel into a dual-path network architecture consisting of a base path with frozen parameters and a domain adaptive path with a low-rank adaptive module, to obtain the first hidden state and the second hidden state. Calculate the task loss based on the second hidden state; Calculate the cross-domain alignment loss based on the first hidden state and the second hidden state; The causal logic loss is calculated based on the predicted output sequence of the second hidden state and the predefined protocol state transition legality matrix, and the three are weighted and summed to obtain the total loss. With the goal of minimizing the total loss, the parameters of the low-rank adaptive modules in the domain adaptive path are iteratively updated only to obtain the trained network fault diagnosis model.

2. The method for training a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints according to claim 1, characterized in that, Obtain the raw network logs and use predefined regular expressions to extract all protocol symbol fragments from the raw network logs. The protocol symbol fragments include hexadecimal status codes, specific error codes, or protocol status fields. For each extracted protocol symbol fragment, a pre-built protocol mapping table is queried to map the entire protocol symbol fragment to the corresponding protocol semantic tag. The mapping function is expressed as follows: ;in, For protocol symbol fragments, This refers to the mapped protocol semantic tags.

3. The method for training a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints according to claim 2, characterized in that, The remaining text in the original network log that was not extracted as protocol symbol fragments is segmented into standard tokens using a standard tokenizer. The output of the standard tokenizer is as follows: ;in, For text that was not extracted as protocol symbol fragments, These are the standard word units after segmentation. This indicates that a word segmenter is used to process the input text; The protocol semantic tags and the standard lexical units are combined and aligned in the original order in the original network log to generate the semantically enhanced lexical unit sequence.

4. The method for training a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints according to claim 1, characterized in that, The semantically enhanced lexical sequence is simultaneously and in parallel input to the base path and the domain-adaptive path; In the basic path, the word sequence is computed forward using the frozen original language model parameters to output the first hidden state. The parameters of the basic path remain unchanged throughout the training process. The forward computation of the basic path can be expressed as: Among them, L The original language model represents the frozen state. Given the input word sequence, It is the first hidden state of the output.

5. The method for training a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints according to claim 4, characterized in that, In the domain-adaptive path, the word sequence is passed sequentially through each network layer of the original language model, and a low-rank factorization matrix is ​​inserted into each attention layer or feedforward network layer for bypass computation, outputting the second hidden state. The low-rank factorization matrix consists of trainable parameters, and its parameter count is much smaller than the total number of parameters in the base path. The second hidden state is represented as follows: ;in, This represents a language model optimized through low-rank decomposition. It is a low-rank decomposition matrix. It is the second hidden state of the domain adaptive path output.

6. The method for training a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints according to claim 1, characterized in that, The second hidden state is input into the output layer of the fault diagnosis task, and the cross-entropy loss between the second hidden state and the true labeled value is calculated as the task loss. The cross-entropy loss is expressed as follows: ;in, To ensure accurate labeling, To pass through the second hidden state The calculated prediction result, where N is the sample size; The first hidden state and the second hidden state are softened respectively, and the KL divergence between their probability distributions is calculated as the cross-domain alignment loss, which is used to constrain the output of the domain adaptive path from deviating from the output of the base path. The formula for calculating the KL divergence is as follows: ;in, This represents the probability distribution obtained from the first hidden state after passing through a mapping layer and softening processing. This represents the probability distribution obtained from the second hidden state after passing through the same mapping layer and softening process. To represent the probability distribution In the middle, the first The probability values ​​corresponding to each category To represent the probability distribution In the middle, the first The probability values ​​corresponding to each category Indicates the first There are several categories.

7. The method for training a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints according to claim 6, characterized in that, From the predicted output sequence of the second hidden state, the protocol state semantic label for each position is extracted in time step order. For each pair of adjacent time steps, the previous state and the current state are queried against a predefined protocol state transition legality matrix. If the query result is an illegal transition, a corresponding penalty value is generated according to a preset penalty intensity coefficient. The penalty values ​​corresponding to all illegal transitions are accumulated and used as the causal logic loss. Represented as: ;in, and These represent the protocol states at adjacent time steps. The function generates a penalty value based on the severity of the penalty for illegal transfers; The task loss, the cross-domain alignment loss, and the causal logic loss are weighted and summed according to preset weighting coefficients to obtain the total loss. Represented as: ;in, These are the weighting coefficients for task loss, cross-domain alignment loss, and causal logic loss, respectively.

8. The method for training a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints according to claim 1, characterized in that, With minimizing the total loss as the optimization objective, the gradient is calculated by backpropagation along the adaptive path of the neighborhood, while keeping the gradient of the base path frozen and not performing any gradient calculation or parameter update on it. The calculated gradient is applied only to the trainable parameters in the low-rank adaptive module, and the parameters of the low-rank adaptive module are iteratively updated using a preset optimizer.

9. The method for training a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints according to claim 8, characterized in that, The training process is iterated in multiple rounds, that is, the complete process from data processing, loss calculation and parameter update is repeatedly executed until the total loss converges to below a preset threshold or reaches the preset maximum number of training rounds, at which point the update stops, and the model formed by the basic path and the updated domain adaptive path at this time is used as the network fault diagnosis model after training is completed.

10. A training system for a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints, used to implement the training method for a domain-adaptive network fault diagnosis model based on protocol-aware coding and logical constraints as described in any one of claims 1-9, characterized in that, Includes the following modules: The log acquisition and protocol awareness mapping module is used to acquire raw network logs and extract protocol symbol fragments, and map the protocol symbol fragments to protocol semantic tags. A semantic enhancement construction module is used to generate a semantically enhanced lexical sequence based on the protocol semantic tags and standard lexical units; A dual-path feature extraction module is used to input the semantically enhanced lexical sequence in parallel to the parameter-frozen base path and the domain adaptive path equipped with a low-rank adaptive module, and output the first hidden state and the second hidden state respectively. The loss calculation module is used to calculate the task loss based on the second hidden state, calculate the cross-domain alignment loss based on the first hidden state and the second hidden state, calculate the causal logic loss based on the predicted output sequence of the second hidden state and the predefined protocol state transition legality matrix, and sum the three weighted values ​​to obtain the total loss. The parameter update module is used to iteratively update the parameters of the low-rank adaptive modules in the domain adaptive path with the goal of minimizing the total loss, and output the trained network fault diagnosis model.

Images