Communication device data edge processing diagnosis method and system for 5g base station

Abstract

This invention relates to the field of data edge processing technology for communication equipment, specifically to a diagnostic method and system for data edge processing of communication equipment for 5G base stations. The method includes: collecting communication messages at the edge nodes of both the centralized and distributed units, extracting feature vectors and state change events; calculating a weighted anomaly score based on the feature vectors to generate suspicious event records; when cross-node collaboration is required, performing bidirectional verification using a state hash chain, obtaining a matching flag after deduplication using fixed-length request packets and a Bloom filter; using the weighted sum of the weighted anomaly score and historical success rate as the prior probability, and combining the matching flag with a Bayesian formula to calculate the posterior confidence level, selecting the conclusion with the highest confidence level as the preliminary diagnosis; when the conclusions on both sides conflict, outputting an arbitration conclusion based on the weighted result of the basic weight and timeliness factor. This invention solves the diagnostic conflict problem under the separate architecture of 5G base stations through dual-node collaborative verification and Bayesian arbitration.

Description

Technical Field

[0001] This invention relates to the field of data edge processing technology for communication equipment, and more specifically, to a diagnostic method and system for data edge processing of communication equipment for 5G base stations. Background Technology

[0002] Edge diagnostics is a core technology for the operation and maintenance of 5G base station communication equipment. By moving diagnostic functions from the central cloud to the edge nodes on the base station side, it relies on edge computing to collect and analyze base station protocol status, process communication messages and performance parameters in real time, and performs localized fault self-healing, effectively solving the pain points of high response latency and high backhaul bandwidth pressure of traditional cloud diagnostics.

[0003] Currently, 5G base stations generally adopt a centralized unit and distributed unit separation architecture. The centralized unit is responsible for high-level protocol processing, while the distributed unit is responsible for low-level real-time scheduling. The two work together to achieve user access and service interaction. When deploying an edge diagnostic system under this separation architecture, independent diagnostic nodes need to be set up on both sides to monitor the data of their respective units. However, protocol interaction spans both units, and any abnormality in either unit will affect the overall service quality.

[0004] To address the aforementioned cross-unit anomalies, existing technologies primarily aggregate the operational logs and alarm data of each unit to a central cloud platform, whereby the central cloud performs cross-unit correlation analysis and fault location, thus achieving a certain degree of fault root cause localization.

[0005] However, this solution has certain limitations: its diagnostic latency is relatively high and it is highly dependent on the stable backhaul link between the central cloud and the base station. At the same time, the two edge diagnostic nodes operate independently and make judgments based only on local data. They cannot know the status information of the other node, which can easily lead to contradictory diagnostic conclusions or repair actions for the same cross-unit event, affecting the stability of base station operation and diagnostic efficiency.

[0006] Therefore, there is an urgent need for a method that can achieve efficient collaboration between dual edge diagnostic nodes and ensure the reliability of cross-unit fault diagnosis and repair. Summary of the Invention

[0007] One objective of this invention is to provide a diagnostic method for data edge processing of communication equipment for 5G base stations. This method deploys edge diagnostic nodes on both sides of the centralized and distributed units. By establishing a bidirectional synchronous verification mechanism based on a state hash chain, the two nodes can obtain each other's key states in real time with minimal communication overhead. Simultaneously, an arbitration decision rule based on Bayesian probabilistic fusion is introduced. When diagnostic conclusions from both sides conflict, a unique repair instruction is output based on the node's historical reliability and response timing. This solves the problems mentioned in the background section, namely: In the architecture of 5G base stations with separate centralized and distributed units, the edge diagnostic nodes on both sides can only see the local state, which can easily lead to contradictory judgments on the same abnormal event. If repairs are performed at the same time, it may cause state oscillation.

[0008] To achieve the above objective, the method includes the following steps: S1. Collect inter-process communication messages of the protocol stack at the edge nodes of the centralized unit and the edge nodes of the distributed unit respectively, and extract the dimensionality-reduced feature vector and state change events from them; S2. Each edge node calculates a weighted anomaly score based on the dimensionality-reduced feature vector. If the score exceeds the dynamic threshold, a suspicious event record is generated. When cross-node collaboration is required based on the preset responsibility domain mapping table, a cross-node verification request containing user identifier and status type is constructed. S3. Each edge node updates its local state hash chain based on the state change event and stores the old and new hash values ​​together. After receiving the cross-node verification request, the requesting edge node encapsulates it into a fixed-length request packet, removes duplicates using a Bloom filter, and then sends it to the peer edge node. The peer edge node retrieves the current hash value from its local state hash chain based on the user identifier and returns it. The requesting edge node compares the hash value with the expected hash value to obtain a matching flag. S4. Obtain a candidate diagnosis list based on the suspicious event records, and iterate through each candidate conclusion in the candidate diagnosis list; The weighted sum of the weighted anomaly score and the historical execution success rate of the candidate conclusion is used as the prior probability. The likelihood probability is determined according to the matching indicator. The posterior confidence is calculated by substituting it into the Bayesian formula. The candidate conclusion with the highest posterior confidence is selected as the preliminary diagnostic conclusion. When the preliminary diagnostic conclusions of the two edge nodes conflict, the weighted result of the basic weight and the timeliness factor is used as the comprehensive score, and the conclusion of the party with the higher score is output as the arbitration result.

[0009] In the above technical solution, both the dimensionality-reduced feature vector and the state change event are extracted simultaneously because the dimensionality-reduced feature vector is used for local anomaly detection, and the state change event is used to maintain the queryable state hash chain on the other end. These two serve two different stages: anomaly determination and cross-node verification, respectively. The hash chain is used to store the old and new hash values ​​together, allowing the other end to complete state verification by returning only one hash value, without transmitting complete state information. A Bloom filter for deduplication avoids the same verification request being sent repeatedly in a short period. The prior probability considers both the local anomaly score and the historical execution success rate to reduce errors caused by single false alarms. The Bayesian formula transforms the matching flag into a likelihood probability and fuses it with the prior. If a simple linear weighting method is used, such as adding a fixed score to the confidence level when matching and subtracting a fixed score when not matching, it cannot reflect the relationship between the credibility of the other end's feedback and the strength of local information. Bayesian fusion can naturally adjust the posterior confidence level according to the ratio of prior to likelihood, making the impact of the other end's feedback smaller when local evidence is sufficient and playing a crucial corrective role when local information is insufficient. When adjudicating conflicts, a weighted result of basic weight and timeliness factor is used. The basic weight reflects the long-term diagnostic reliability of the node, while the timeliness factor penalizes nodes with slower responses. The combination of the two is more adaptable to the dynamically changing diagnostic environment than a fixed priority.

[0010] Based on this, the weighted anomaly score is calculated as follows: first, the anomaly score of the dimensionality-reduced feature vector is calculated using the isolated forest algorithm, and then the anomaly score is weighted and fused with the historical misjudgment rate to obtain the weighted anomaly score. The historical misjudgment rate is calculated according to the failure type, representing the proportion of failures in the most recent diagnosis.

[0011] In another technical solution, the state hash chain is updated as follows: the user identifier, state type, new state value and current timestamp in the state change event are substituted together with the previous hash value into the hash function to calculate the new hash value, the new hash value is stored as the current hash value, and the previous hash value is retained as a historical record.

[0012] In this technical solution, the weighted anomaly score is obtained by weighting the base score output by the Isolation Forest with the historical misclassification rate. The Isolation Forest only judges whether the current feature vector deviates from the normal distribution, while the historical misclassification rate records the proportion of similar faults correctly or incorrectly diagnosed in previous diagnoses. After the two are combined, fault types with high historical misclassification rates will be automatically downweighted in subsequent diagnoses, avoiding repeated triggering of cross-node verification by the same type of false alarms. The update of the state hash chain involves inputting the user identifier, state type, new state value, current timestamp, and previous hash value into a hash function to generate a new hash value, while retaining both the old and new values. With this design, the peer only needs to return the current hash value, and the current node can complete the state comparison. At the same time, because the previous hash value is retained, the current node can also request the peer to return two consecutive hash values, and determine whether the state has undergone an unexpected jump by comparing the changes between the two values. If only the current hash value is stored and the previous result is discarded, this traceability capability cannot be achieved.

[0013] The second objective of this invention is to provide a data edge processing diagnostic system for communication equipment for 5G base stations, including a first edge diagnostic node deployed on the centralized unit side and a second edge diagnostic node deployed on the distributed unit side. Each of the first and second edge diagnostic nodes includes a distributed feature acquisition module, an anomaly detection module, a cross-node verification module, a decision arbitration module, and a self-healing execution module. The distributed feature acquisition module is used to collect inter-process communication messages in the protocol stack and extract dimensionality-reduced feature vectors and state change events from them. The anomaly detection module is used to calculate a weighted anomaly score based on the dimensionality-reduced feature vector, generate a suspicious event record when the dynamic threshold is exceeded, and construct a cross-node verification request when cross-node collaboration is required based on the responsibility domain mapping table. The cross-node verification module is used to maintain a state hash chain based on state change events, and to process the sending and receiving of cross-node verification requests, deduplication, and hash value comparison to obtain a matching flag. The decision arbitration module is used to calculate the posterior confidence level and select the preliminary diagnostic conclusion based on the suspicious event records and matching flags using Bayes' formula, and to output the arbitration result in a weighted manner when the conclusions on both sides conflict. The self-healing execution module is used to execute the arbitration results and update the historical execution success rate and basic weights.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention addresses the information asymmetry between edge diagnostic nodes on both sides of a 5G base station architecture with separate centralized and distributed units by designing a bidirectional synchronous verification mechanism based on a state hash chain. This mechanism allows each edge node to maintain only the state hash value for each user, and the peer node only needs to return the current hash value during verification without transmitting complete state information. This achieves real-time cross-node state verification with minimal communication overhead, solving the diagnostic blind spots caused by missing information in traditional solutions.

[0015] 2. This invention employs a deduplication mechanism combining fixed-length request packets and Bloom filters during cross-node verification. Fixed-length packets help control latency fluctuations in each interaction, while Bloom filters quickly identify duplicate requests within limited memory, reducing inter-node traffic congestion caused by repeated verification of the same anomaly within a short period and lowering the risk of interference to the normal service channels of the base station.

[0016] 3. This invention uses a weighted sum of local anomaly scores and the historical execution success rates of candidate conclusions as the prior probability, and then uses Bayes' theorem to fuse the matching flags returned by the peer to obtain the posterior confidence. This design ensures that when local evidence is sufficient, peer feedback only plays a fine-tuning role, while when local evidence is insufficient, peer feedback becomes a key correction. Compared with simple addition and subtraction, this reduces the risk of misjudgment and improves the accuracy of cross-unit fault location. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the overall process of the communication equipment data edge processing diagnostic method for 5G base stations according to the present invention; Figure 2 This is a flowchart of step S3 of the present invention; Figure 3 This is a flowchart illustrating step S4 of the present invention; Figure 4 This is a schematic diagram of the overall structure of the communication equipment data edge processing diagnostic system for 5G base stations according to the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Currently, in the architecture of 5G base stations with separate centralized and distributed units, the edge diagnostic nodes on both sides can only see a local state, which can easily lead to contradictory judgments on the same abnormal event. If repairs are performed simultaneously, it may cause state oscillations. One of the objectives of this invention is to provide a data edge processing diagnostic method for communication equipment in 5G base stations. See [link to relevant documentation]. Figure 1 As shown, it includes the following steps: S1. Collect inter-process communication messages of the protocol stack at the edge nodes of the centralized unit and the edge nodes of the distributed unit respectively, and extract the dimensionality-reduced feature vector and state change events from them; S2. Each edge node calculates a weighted anomaly score based on the dimensionality-reduced feature vector. If the score exceeds the dynamic threshold, a suspicious event record is generated. When cross-node collaboration is required based on the preset responsibility domain mapping table, a cross-node verification request containing user identifier and status type is constructed. S3. Each edge node updates its local state hash chain based on the state change event and stores the old and new hash values ​​together. After receiving the cross-node verification request, the requesting edge node encapsulates it into a fixed-length request packet, removes duplicates using a Bloom filter, and then sends it to the peer edge node. The peer edge node retrieves the current hash value from its local state hash chain based on the user identifier and returns it. The requesting edge node compares the hash value with the expected hash value to obtain a matching flag. S4. Obtain a candidate diagnosis list based on the suspicious event records, and iterate through each candidate conclusion in the candidate diagnosis list; The weighted sum of the weighted anomaly score and the historical execution success rate of the candidate conclusion is used as the prior probability. The likelihood probability is determined according to the matching indicator. The posterior confidence is calculated by substituting it into the Bayesian formula. The candidate conclusion with the highest posterior confidence is selected as the preliminary diagnostic conclusion. When the preliminary diagnostic conclusions of the two edge nodes conflict, the weighted result of the basic weight and the timeliness factor is used as the comprehensive score, and the conclusion of the party with the higher score is output as the arbitration result.

[0020] By establishing a lightweight bidirectional synchronization mechanism for the two edge nodes, each node can obtain the key status information of the other node with a small communication cost before making a diagnosis, and output a unique repair instruction based on the node's credibility and time order when the conclusions conflict, thereby eliminating instruction conflicts and status oscillations in cross-unit diagnosis.

[0021] Ⅰ: First, collect the raw binary messages transmitted between the protocol stack processes within the centralized unit and the distributed unit, and perform structured parsing to generate raw message records.

[0022] Specifically, the 5G base station involved in this invention adopts an architecture that separates centralized units and distributed units. The centralized unit is responsible for high-level protocol processing such as radio resource control and packet data aggregation protocol, while the distributed unit is responsible for low-level real-time scheduling such as radio link control, media access control, and physical layer.

[0023] Both the centralized unit and the distributed unit run multiple independent protocol layer processes, including the radio resource control process, the packet data aggregation protocol process, the radio link control process, and the media access control process. These processes exchange control signaling and status data through the inter-process communication mechanism provided by the operating system.

[0024] To capture the aforementioned communication content, this step deploys acquisition agents on both the centralized unit edge node and the distributed unit edge node. Each acquisition agent uses the operating system kernel's dynamic tracing framework to set probes on the critical path of inter-process communication.

[0025] When a message is passed between any two protocol layer processes, the probe is triggered and copies the copy of the currently passed raw message to the user-space buffer of the acquisition agent. This buffer is located in the memory space of the edge node and is used to temporarily store the raw data that has not yet been processed.

[0026] Furthermore, the acquisition agent performs structured encapsulation on the binary message to generate a raw message record, which contains the following fields: Source process identifier, used to indicate the process that sent the message; The target process identifier is used to specify the process receiving the message; The message type identifier is used to distinguish whether the message belongs to radio resource control signaling, packet data aggregation protocol status report, radio link control status report or media access control scheduling command. Raw payload length, representing the number of bytes in the message payload portion; And the raw payload byte stream, i.e., the complete message content without modification.

[0027] After encapsulation, the acquisition agent pushes the original message record into the local message queue of the edge node, waiting for subsequent sub-steps to retrieve it from the queue for processing.

[0028] II: Extract events indicating state changes from the original message records and store them in the local state cache for use in subsequent cross-node verification.

[0029] Specifically, some of the original message records carry information about changes in key protocol layer states, such as the establishment or release of radio resource control connections, changes in packet data aggregation protocol sequence numbers, and the number of retransmissions requested by Hybrid Automatic Repeat Request exceeding a threshold.

[0030] This step determines whether the current record belongs to this type of state change based on the message type identifier and the source and target process numbers. If so, the user identifier, state type, and new state value are parsed from the original payload, and the current timestamp is recorded, assembling them into a state change event. This event does not participate in subsequent feature extraction and dimensionality reduction calculations, but is directly written to the local state cache for use in step S3 when updating the double-ended state hash chain.

[0031] III: Extract key fields closely related to the device's operating status from the original message records and convert them into numerical vectors with unified dimensions.

[0032] Specifically, based on the message type identifier in the original message record, it is determined which category the message belongs to among radio resource control signaling, packet data aggregation protocol status report, radio link control status report, or media access control scheduling command, and then the set of fields to be extracted is determined.

[0033] For records whose message type is Radio Resource Control (RRC) signaling, extract the number of currently established RRC connections, denoted as N. RRC This value reflects the user connection load carried by the base station.

[0034] For records whose message type is identified as Packet Data Convergence Protocol Status Report, extract the sequence number transition flag, denoted as F. SN_reset This flag, which takes the value 0 or 1, indicates whether the sequence number of the packet data aggregation protocol layer has undergone a non-continuous change. If F SN_reset =1 indicates that there may be packet loss or reordering anomalies.

[0035] For records with message type identifier "Media Access Control Scheduling Command", extract the retransmission count of the hybrid automatic repeat request, and record it as . And a list of temporary identifiers for the community's wireless network, which records the set of currently active users.

[0036] The extracted fields are concatenated in a fixed order to form an initial feature vector, denoted as X. raw The vector has a dimension of 32.

[0037] Because the original numerical units of different fields are different, for example, N RRC It could reach several hundred, and Typically, these are only single-digit numbers, and directly using these raw values ​​will cause fields with larger dimensions to dominate the results in subsequent calculations. Therefore, for X... raw Each dimension in the process is normalized independently.

[0038] Specifically, for the i-th feature, let its historical minimum value be... The historical maximum value is Then the normalized i-th dimension value Calculate using the following formula: ; In the formula, These are the original values ​​before normalization.

[0039] After the above transformation Mapped to the interval [0, 1], all dimensions acquire a unified dimension. Combining the normalized values ​​of all dimensions yields a normalized eigenvector, denoted as X. norm The normalized feature vector is directly used for subsequent dimensionality reduction and anomaly detection calculations.

[0040] IV: Perform online principal component analysis to incrementally reduce the dimensionality of the normalized eigenvectors, generate the dimensionality-reduced eigenvectors, and store them in a circular queue.

[0041] The normalized feature vector X generated by the above steps norm Due to the high dimensionality and information redundancy between dimensions, this step uses online principal component analysis to compress it into a 16-dimensional principal component eigenvector.

[0042] Specifically, each edge node maintains a historical covariance matrix C and a mean vector μ. Initially, C is set as the identity matrix and μ is set as the zero vector.

[0043] Whenever a new normalized feature vector X is generated norm Then, update the estimate of the covariance matrix according to the following recursive formula: ; In the formula, t is the number of samples processed; This is the normalized feature vector at the current moment; This is the mean vector of the previous time step; C t This is the updated covariance matrix.

[0044] The mean vector is updated synchronously according to the following formula: .

[0045] Furthermore, for the updated covariance matrix C t Perform eigenvalue decomposition to obtain eigenvalues. and its corresponding eigenvectors .

[0046] The projection matrix is ​​constructed by selecting the eigenvectors corresponding to the first 16 largest eigenvalues. .

[0047] Multiply the current normalized eigenvector by the projection matrix, that is, use each row of the projection matrix as a weighting coefficient to perform a weighted summation on the 32 dimensions of the normalized eigenvector, resulting in 16 new eigenvalues. Combine these 16 new eigenvalues ​​to form the dimensionality-reduced eigenvector FeatVec: ; Simultaneously, a 16-bit feature validity mask is generated based on the calculated feature values. Each bit of the mask corresponds to a principal component. If the feature value of a principal component is greater than a preset threshold (which is one-tenth of the average of all feature values), the bit is set to 1, indicating that the principal component carries enough information and is a valid feature; otherwise, it is set to 0, indicating that the principal component has little information and can be ignored in subsequent processing.

[0048] The dimensionality-reduced feature vector, feature validity mask, and current timestamp are packaged and stored in a circular queue, and then passed to step S2.

[0049] Step S2 of this invention involves calculating the anomaly level of the current data at each edge node based on the dimensionality-reduced feature vector and timestamp, and then determining whether it is necessary to query the status of another node according to the predefined responsibility division rules. Specifically, this includes the following steps: Ⅰ: First, extract the dimensionality-reduced feature vectors from the most recent time period from the circular queue to form a sliding window, and then use the improved isolated forest algorithm to calculate the anomaly score at the current time.

[0050] Specifically, the circular queue maintained in step S1 stores the 512 most recent dimensionality-reduced feature vectors and their corresponding timestamps. The most recent 128 records are taken out from it, and these 128 feature vectors are arranged into a sliding window in chronological order.

[0051] Let the oldest feature vector within the window correspond to time t-127, and the newest, i.e., the current time, be t. Let the feature vector at the current time be denoted as FeatVec. t .

[0052] Furthermore, the Isolation Forest algorithm is used to detect anomalies in these 128 feature vectors. The basic idea of ​​Isolation Forest is to randomly select a feature dimension, randomly select a split point between the maximum and minimum values ​​of that dimension, divide the data into left and right parts, and then recursively repeat this process until each data point is isolated.

[0053] Because outlier data is different from other data, it is easier to isolate it earlier, so its path in the tree is shorter; normal data, on the other hand, needs to be split multiple times before it can be isolated, so its path is longer.

[0054] It should be noted that in this step, 100 isolated trees are first constructed. For each tree, 256 feature vectors are randomly selected from a sliding window for training. For the feature vector at the current time step, FeatVec... t Calculate its path length in each isolated tree, then sum up the 100 path lengths and take the average, denoted as . .

[0055] Finally, convert this average into an outlier score between 0 and 1 using the following formula: ; In the formula, the base 2 is the standard setting of the isolated forest algorithm, which ensures that the score is 0.5 when the average path length is equal to the normalization factor c(n), and serves as a reference dividing point for whether it is an anomaly; c(n) is the normalization factor, which is related to the window size, and is calculated using the following formula: Here, n is taken as 128, and H(n-1) represents the (n-1)th harmonic number, i.e. .

[0056] The closer the anomaly score is to 1, the more abnormal the current data is; the closer it is to 0, the more normal it is.

[0057] II: The outlier scores are weighted and corrected by combining the historical misjudgment rate to obtain the weighted outlier scores.

[0058] Specifically, each edge node locally maintains a historical misclassification rate table, which records the proportion of diagnostic errors for various fault types over a recent period. Assuming the fault type initially identified based on the current feature vector is a certain type, the corresponding historical misclassification rate, denoted as ErrRate, is retrieved from the table, with a value between 0 and 1. The anomaly score (Score) and the historical misclassification rate are then weighted and fused using the following formula to obtain a weighted anomaly score. : ; In the formula, 1 represents the full weight coefficient of the original score; 0.5 is the preset error rate impact factor, used to control the correction strength of the historical error rate on the current score.

[0059] The principle behind this formula is as follows: when the historical misjudgment rate of a certain fault type is high, it indicates that the judgment basis for this type is not reliable enough, and the weight of the current anomaly score needs to be appropriately reduced so that its influence in subsequent decisions is weakened; conversely, if the historical misjudgment rate is low, it indicates that the judgment of this type is relatively stable, and most of the original anomaly score value is retained.

[0060] The weighted outlier score still ranges from 0 to 1. The larger the value, the greater the deviation of the current data from the normal pattern. The specific update method of the historical misclassification rate table will be explained in the subsequent step S5.

[0061] III: Determine whether the weighted anomaly score exceeds the preset dynamic threshold. If it does, generate a suspicious event record.

[0062] Specifically, a dynamic threshold is maintained at each edge node, denoted as . Its initial value is set to 0.65, and the weighted outlier score is calculated. and If a comparison is made, If the collected data is found to be abnormal, a suspicious event record needs to be generated for further processing; if If the current data is normal, no action will be taken, and the current testing process will end directly.

[0063] When an event is determined to be abnormal, a suspicious event log is generated. This suspicious event log contains the following information: The event number is used to uniquely identify this abnormal event and is generated using an incrementing integer. Weighted anomaly score, used to characterize the severity of anomalies, is directly taken as... The value; The dimensionality-reduced feature vector FeatVec at the current moment is used to record the state when the anomaly occurs; The current timestamp.

[0064] This suspicious event record will be sent to the next step for responsibility domain determination. Additionally, dynamic thresholds... The specific adjustment method will also be explained in the subsequent step S5.

[0065] IV: Determine the attribution of the suspicious event based on the responsibility domain mapping table. If it falls within the independent processing scope of the current node, proceed to step S5 to perform local self-healing. If information from the peer node is required for auxiliary judgment, generate a cross-node verification request.

[0066] Specifically, a responsibility domain mapping table is pre-set at each edge node. This responsibility domain mapping table is indexed by event type and specifies the main diagnostic node to which each type of event belongs.

[0067] The rules for dividing the responsibility domain mapping table are as follows: ① Events related to the physical layer and media access control layer. Physical layer events include a sudden drop in the signal-to-noise ratio of the uplink signal, abnormal fluctuations in physical resource block occupancy, and timing advances exceeding the normal range. Media access control layer events include the number of retransmissions for hybrid automatic repeat requests exceeding a preset threshold, continuous failures of random access attempts, and prolonged lack of response to uplink scheduling requests. The raw data for these anomalies can only be collected by the distributed unit; therefore, they can be handled independently by the edge nodes of the distributed unit as the primary diagnostic nodes. ② Events related to radio resource control connection management and packet data aggregation protocol. Radio resource control layer events include abnormal fluctuations in the number of established connections, excessively high connection release frequency, and connection reconfiguration failures; packet data aggregation protocol layer events include unexpected sequence number changes, consecutive integrity check failures, and header decompression failures. These events occur within the centralized unit and can be handled independently by the edge nodes of the centralized unit, which act as the primary diagnostic nodes. ③ User access transactions spanning both the centralized and distributed units. For example, after a user initiates random access, the distributed unit detects the preamble, but the centralized unit fails to send a connection establishment message; or during the radio resource control connection establishment process, the centralized unit has allocated resources, but the distributed unit fails to forward them correctly to the user; or during user handover, inconsistencies occur in the information exchange between the source and target sides. The complete process of such transactions requires cooperation between the centralized and distributed units; a single node cannot observe the entire process, therefore it is marked as requiring cross-node collaborative diagnosis.

[0068] This step uses the reduced-dimensional feature vector FeatVec from the suspicious event record, combined with the event type identification rules, to determine which of the three categories the event belongs to: If the determination result is that the event is handled independently by the current node, the suspicious event record is directly transmitted to step S5, and the current node performs local self-healing operation. If the determination result indicates that the event requires cross-node collaborative diagnosis, a cross-node verification request is constructed based on the user identifier and event type in the suspicious event record. This cross-node verification request includes the following fields: a transaction identifier, which is the user's temporary identifier for the cell's wireless network, used to uniquely identify the user experiencing the anomaly; a status type code, a predefined integer code indicating the specific status type that the peer node needs to verify, for example, code 01 indicates querying the Packet Data Convergence Protocol sequence number reset flag, and code 02 indicates querying whether the Radio Resource Control (RRC) connection exists; and a timestamp of the current moment, used to determine the freshness of the information during subsequent arbitration.

[0069] Input the completed cross-node verification request into step S3 to perform cross-node status verification.

[0070] like Figure 2As shown, step S3 of this invention is a lightweight cross-node verification based on a dual-end state hash chain. The purpose of this step is to quickly verify the critical state of the peer node through a pre-set hash chain when one edge node determines that the current abnormal event requires the state information of the peer node for accurate diagnosis, thereby obtaining cross-node information with minimal communication overhead. Specifically, it includes the following steps: Ⅰ: Each edge node uses the state change event generated in step S1 to maintain a state hash chain indexed by the user locally.

[0071] Specifically, each edge node allocates a fixed storage area in memory to build a hash table. This hash table uses a key-value pair structure, where the key is the user's temporary identifier for the cell's wireless network, used to uniquely identify a user; the value is a structure containing three fields: the current hash value, the previous hash value, and the last update timestamp.

[0072] When a new state change event is added to the state cache in step S1, the edge node parses three pieces of information from the event: user identifier, state type code, and new state value. The functions of these three types of information are as follows: The user identifier is a temporary identifier for the cell's wireless network, which is used as a key to look up the corresponding value in the hash table. The status type code is used to distinguish what type of status has changed. For example, 01 indicates the Radio Resource Control connection status, 02 indicates the Packet Data Convergence Protocol sequence number reset flag, and 03 indicates the number of retransmissions for the Hybrid Automatic Repeat Request. The new state value is the specific numerical value after the change.

[0073] First, the hash table is searched based on the user identifier. If no corresponding record is found, it means this is the user's first state change, so the current hash value is set to 0 as the initial value. If a record is found, the current hash value is retrieved as the old value. Then, the new hash value is calculated using the following formula: ; In the formula, It is the current hash value before the update; The type code is the integer corresponding to the status type code; The state value is the new state value; The timestamp is the time when this state change event occurred; symbol This means concatenating these fields into a single string in sequence.

[0074] The hash function used is SHA-256, but only the first 64 bits of the calculation result are taken as the final hash value. This ensures that the collision probability is low enough and that each hash value is kept within 8 bytes.

[0075] work out Next, use the user's key to find the corresponding value structure in the hash table, and update the current hash value field accordingly. The last time the hash value field was updated to the original value The last updated timestamp field is then updated to the current time. This creates a chain of status change history for each user: Each change generates a new hash value, which contains the hash value of the previous change, thus linking the two changes together.

[0076] If it is necessary to verify whether the state at a certain moment is consistent with that of the other end, it is only necessary to compare the current hash value corresponding to the current key of both parties, without having to send the complete state history.

[0077] Ⅱ: The initiating edge node constructs a fixed-length verification request packet based on the cross-node verification request generated in step S2.

[0078] The initiating edge node obtains three key pieces of information from the cross-node verification request: the transaction identifier (i.e., the user's cell wireless network temporary identifier), the status type code, and the request timestamp, and encapsulates them into a request packet suitable for transmission in the network.

[0079] To ensure parsing speed and transmission efficiency, this request packet adopts a fixed-length design, with a total length of 24 bytes. The specific field allocation is as follows: the first 8 bytes store the user's cell wireless network temporary identifier, the next 2 bytes store the status type code, the next 10 bytes store the request timestamp, and the last 4 bytes are reserved as extended fields.

[0080] After encapsulation, the request packet awaits delivery to the peer edge node.

[0081] Ⅲ: The initiating node checks whether the same transaction is repeatedly queried within a short period of time using a Bloom filter. If there is no repetition, it sends a request packet through a dedicated channel.

[0082] Specifically, each edge node maintains a Bloom filter to record request packets sent within the last 20 milliseconds. The fingerprint of each request packet is composed of a transaction identifier and a status type code, i.e., the user's cell radio network temporary identifier plus the status type code.

[0083] Before sending the request packet, the initiating node first uses the fingerprint of the request packet to query the Bloom filter: If the Bloom filter returns an existence, it means that a request packet for the same user and the same state type has been sent to the peer node within the last 20 milliseconds. In this case, the request packet is discarded and will not be sent again.

[0084] If the Bloom filter returns no result, the fingerprint is added to the Bloom filter, and then the request packet is sent to the peer edge node via a dedicated UDP channel. This UDP channel uses a separate port number and is isolated from the interface used by the base station for normal services, so that diagnostic verification traffic does not interfere with normal data transmission in the user plane and control plane.

[0085] The Bloom filter's window time is set to 20 milliseconds. If the same request packet is sent repeatedly within 20 milliseconds, it means that no response has been received since the previous transmission. In this case, the repeated transmission is because the same anomaly is being detected repeatedly, and there is no need to query again, so it is discarded directly. After 20 milliseconds, the previous record automatically expires. If the same request is received again at this time, it is allowed to be sent because the status of the other end may have changed after the time window has expired, and re-verification is required. This design can reduce invalid duplicate queries and avoid consuming too much communication resources in a short period of time.

[0086] IV: After receiving the request packet, the peer node looks up the corresponding hash value in the local state hash chain based on the user identifier in the request, and returns a response packet.

[0087] Specifically, after receiving the request packet, the peer node parses out the user's cell radio network temporary identifier, status type code, and request timestamp. Using this user identifier as the key, it looks up the corresponding record in its local status hash table.

[0088] If no record is found, the query result is set to 0; if a record is found, the last update timestamp is retrieved and compared with the request timestamp; if the difference is no more than 10 milliseconds, the current hash value in the record is used as the query result; if it exceeds 10 milliseconds, the query result is also set to 0.

[0089] Furthermore, the query results are encapsulated into a response packet with a length of 24 bytes: the first 8 bytes store the user identifier, the middle 8 bytes store the query result hash value, and the last 8 bytes store the response timestamp, which is then returned to the initiating node through a dedicated UDP channel.

[0090] V: The initiating node receives the response packet, compares the hash value with the expected value, and generates a verification response record for use in step S4.

[0091] Specifically, after receiving the response packet, the initiating node parses out the user identifier, the hash value returned by the peer, and the response timestamp. Simultaneously, based on the status type code in the cross-node verification request in step S2, the initiating node locally searches for the expected hash value of that status type under normal circumstances.

[0092] It should be noted that the calculation method for the expected hash value is the same as step I in step S3, that is, a normal state value is selected, substituted into the hash formula, pre-calculated, and stored. For example, for state type code 02, which indicates whether the radio resource control connection exists, this flag should be 1 under normal conditions. Substituting the state value 1 into the hash formula will yield the expected hash value.

[0093] Furthermore, the hash value returned by the peer is compared with the expected hash value. If they are equal, it means that the state of the peer node is consistent with the local expectation, and the matching flag is set to 1; if they are not equal or the hash value returned by the peer is 0, the matching flag is set to 0.

[0094] The initiating node compiles the verification results into a verification response record, which includes the following fields: the user's temporary identifier for the cell's wireless network, the matching flag, the response timestamp, and the hash value returned by the peer. This record is stored in the verification response cache, awaiting retrieval in step S4.

[0095] If no response packet is received within 5 milliseconds after sending the request packet, it is considered a timeout. A verification response record is generated directly, with the matching flag set to 0, the peer hash value set to 0, and the response timestamp filled with the current time. It is also stored in the verification response cache and handed over to step S4 for processing.

[0096] like Figure 3 As shown, step S4 of this invention is responsible for combining the weighted anomaly score in the suspicious event record generated in step S2 and the matching flag in the verification response record returned in step S3 to calculate the credibility of the diagnostic conclusion corresponding to the current anomaly event, and outputting a unique repair instruction according to predetermined rules when conflicting conclusions occur between the two nodes. Specifically, it includes the following steps: Ⅰ: Query the candidate diagnosis list based on the event type, then iterate through each candidate conclusion, calculate its posterior confidence using Bayes' theorem, and apply penalties based on the operation stack history.

[0097] Specifically, each edge node contains a table indexed by event type, with each item corresponding to a list of candidate diagnoses.

[0098] After step S2 generates a suspicious event record, the node looks up the candidate diagnosis list in a table based on the event type in the record, denoted as... N is typically between 2 and 4. For example, for events like random access timeout, possible diagnostics include resetting the Media Access Control layer, reconfiguring the physical random access channel parameters, and notifying the peer to check the radio resource control status.

[0099] At the same time, create an array C of length N to store the posterior confidence of each candidate conclusion.

[0100] Next, we iterate through each candidate conclusion D.i For each D i First determine the prior probability P i .

[0101] It should be noted that the prior probability P i Taking into account the weighted anomaly scores obtained in step S2 And the success rate R of the candidate conclusion over a past period. i The calculation formula is: ; In the formula, R i This is the success rate of the most recent 10 executions of this conclusion, retrieved from the local statistics table. If there is no historical record, then 0.5 is used. The coefficients 0.6 and 0.4 indicate that the impact of local anomaly scores is slightly greater than that of historical success rates.

[0102] Then determine the likelihood probability L. i The likelihood probability Q represents the probability of observing the matching flag M returned in step S3, assuming the current diagnostic conclusion is correct. A matching flag M of 1 indicates that the other end's state is consistent with the expectation, while a value of 0 indicates that it is inconsistent.

[0103] The value is determined based on whether the diagnostic conclusion depends on the state of the other end: if candidate conclusion D i If peer status information is needed, such as notifying the peer to check the radio resource control status, then when M=1, L is taken. i =0.8, when M=0, take L. i =0.2; if candidate conclusion D i If the state of the peer is not dependent, for example, if the media access control layer of the current node is reset, then L will be taken regardless of the value of the matching flag M. i =0.5.

[0104] Furthermore, the prior probability P i And likelihood probability L i Substituting into Bayes' formula, the posterior confidence level Q is calculated. i : ; Q i The value of is between 0 and 1, and the closer it is to 1, the more credible the conclusion is.

[0105] Finally, the operation stack is checked for penalties. Specifically, each node maintains an operation stack, recording the types of operations and target objects executed within the last 500 milliseconds. If the current candidate conclusion D... iIf the operation type is the same as the most recently executed operation type in the operation stack, and the target object is also the same, then it is considered that repeatedly executing the same operation within a short period of time may cause oscillations. Therefore, the confidence level of this conclusion is multiplied by a decay factor of 0.7, i.e.: .

[0106] The corrected Q i Store in array middle.

[0107] After iterating through all candidate conclusions, array C stores the final confidence score of each candidate conclusion.

[0108] II: Select the conclusion with the highest confidence level, and decide whether to adopt it directly, proceed to secondary verification, or abandon the diagnosis based on the confidence level.

[0109] Specifically, after iterating through all candidate conclusions, the maximum posterior confidence value is found from array C. and their corresponding candidate conclusions Then, based on the maximum posterior confidence level... The size is handled in the following ways: ①If If so, then adopt directly. The preliminary diagnostic conclusion for the current node is denoted as Prelim. This preliminary diagnostic conclusion Prelim includes the operation type, target object identifier, and maximum posterior confidence level. And the current timestamp. The operation type is divided into four types: reset, reconfigure parameters, rebuild connection, and record alarm only; the target object identifier is the user's cell wireless network temporary identifier or process ID.

[0110] ②If If the condition is met, the system proceeds to the secondary verification stage. Specifically, the node constructs an extended verification request, requiring the peer node to return the three most recent consecutive state hashes for the same user, not just the current value.

[0111] The extension request is sent through a dedicated UDP channel with a 5-millisecond timeout to wait for a response.

[0112] Upon receiving the response, the three hash values ​​returned by the peer are compared one by one with the pre-calculated expected hash value sequence locally, and the number of matches K is counted, where K ranges from 0 to 3. Then the likelihood probability is recalculated: If K≥2, then take If K=1, then take If K=0, then take .

[0113] Then, with the current As the prior probability, it is substituted into Bayes' formula to recalculate the posterior confidence.

[0114] If the newly calculated confidence level is still less than 0.85, the diagnosis is abandoned, the event is marked as pending observation, and the process ends; if the new confidence level reaches 0.85 or higher, the diagnosis is adopted. This is a preliminary diagnostic conclusion.

[0115] ③If If the diagnosis fails, the process will be abandoned without generating any repair instructions, and the process will end.

[0116] III: The two edge nodes exchange their preliminary diagnostic conclusions, conduct conflict detection and classification, and for first-level conflicts, a weighted voting arbitrator is activated to calculate a comprehensive score based on the basic weight, timeliness factor and confidence level, and the conclusion of the party with the higher score is taken as the arbitration result.

[0117] Specifically, the edge nodes of the centralized unit and the edge nodes of the distributed unit send their preliminary diagnostic conclusions to each other via a dedicated UDP channel. If one party abandons the diagnosis, it sends an empty packet to indicate that there is no conclusion. After receiving the conclusion from the other party, the node begins to check for conflicts.

[0118] First, determine the conflict level: If both parties operate in the same manner, or if one party abandons the diagnosis, it is considered that there is no conflict, and each party can proceed according to its own conclusion without the need for arbitration. If one party performs a reset operation and the other party performs parameter reconfiguration or connection rebuilding, it is considered a Level 1 conflict and will be decided by the arbitrator. If both operations are recovery-type but different, such as one reconfiguring parameters and the other rebuilding the connection, or one only logging alarms and the other performing any other operation, it is considered a level 2 conflict and will not proceed to arbitration. Instead, it will attempt to merge the operations: if the target objects are the same, the reconnection will be executed first and then the reconfiguration parameters will be executed; if the target objects are different, they will be executed in parallel. If both parties operate on the same type but with different specific parameters, such as different timer durations when reconfiguring, it is considered a level 3 conflict. The conservative value in the parameters, such as the larger timer duration, is directly taken and unified into a single instruction before execution, without the need for arbitration.

[0119] The weighted voting arbitrator is activated only when a Level 1 conflict occurs. The arbitrator calculates a comprehensive score S for each node, and the calculation formula is as follows: ; In the formula, W b The basic weight of the node is initially 1, and is dynamically adjusted by subsequent step S5 based on the historical arbitration accuracy. The weight of a node with a high accuracy will increase, and the weight of a node with many misjudgments will decrease. W tIt is the timeliness factor, and its calculation formula is: ; In the formula, It is the timestamp of the current node's conclusion; It is the earlier timestamp in both parties' conclusions, and the time unit is milliseconds.

[0120] If the current node's conclusion is more than 10 milliseconds later than the counterpart's, the timeliness factor will drop to 0.2.

[0121] Calculate the score S for each of the two nodes, and select the conclusion of the node with the higher score as the winning conclusion. If the scores of both nodes are the same, the decision is made according to the scope of influence of the operation type: reset operations have the lowest priority, recovery operations have medium priority, and only alarms are recorded with the highest priority.

[0122] The winning conclusion will be the final arbitration result.

[0123] Furthermore, the operation type, target object, and execution timestamp from the winning conclusion are encapsulated into a pre-execution confirmation packet, sent to the peer node, and a 1-millisecond response is awaited.

[0124] Upon receiving the message, if the peer node finds that it has already performed a conflicting operation, it will reply with a conflict response; otherwise, it will reply with an agreement response.

[0125] If a conflict is received, the arbitration result is cancelled without generating any instructions. If agreement is received or no response is received within the timeout period, the operation type, execution node identifier, target object, and number of retries from the winning decision are encapsulated into a repair action instruction and sent to step S5 for execution. Simultaneously, the arbitration process is written to the local collaboration log for use in step S5 when updating the weights.

[0126] Step S5 of this invention is responsible for executing the repair action instructions output in step S4 and feeding the execution results back to the local statistics table to update the historical misjudgment rate in step S2, the execution success rate in step S4, and the node arbitration weight. Specifically, it includes the following operations: First, based on the execution node identifier in the repair action command, determine whether the command should be executed by the current node or the peer node: If the execution node is the current node, the corresponding repair interface is called directly, and operations such as resetting the process, reconfiguring parameters, rebuilding the connection or recording alarms are performed according to the operation type. If the executing node is the peer node, the repair action command will be forwarded to the peer through a dedicated UDP channel, and the peer will perform the corresponding operation.

[0127] Upon completion, a completion notification is sent to the peer node, including the operation type and target object in the repair action command, as well as the execution result status. If the peer node receives the notification and discovers that it is also about to execute the same operation, it cancels its own operation to avoid duplicate execution.

[0128] Furthermore, update the local statistics table based on the results of this diagnosis.

[0129] It should be noted that after execution, continuous monitoring is performed for 10 milliseconds. If the same fault is not detected to recur within 10 milliseconds, the diagnosis is marked as successful; if the same fault recurs within 10 milliseconds, it is marked as a failure.

[0130] The success or failure result will be used to update the following parameters: Update the historical misdiagnosis rate table used in step S2, that is, calculate the proportion of failures in the most recent 10 diagnoses according to the fault type; Update the execution success rate R used in step S4 i That is, to calculate the success rate of the most recent 10 executions based on the operation type; Update the historical arbitration accuracy rate of the node, which is the proportion of the number of times the node was successfully executed after being adopted in the arbitration in step S4 to the total number of times it was adopted.

[0131] Each statistic is updated using a two-window weighted average: The short window method counts the most recent 10 data points, with a weight of 0.7. Long window statistics are used to analyze the most recent 100 data points, with a weight of 0.3. The actual parameter value used is a weighted sum of the two.

[0132] Furthermore, the value of the base weight is determined by the historical arbitration accuracy rate. Let the historical arbitration accuracy rate of the current node be A, then the base weight W is... b Calculate using the following formula: ; Therefore, when the historical arbitration accuracy rate is 0, the base weight is 0.2; when the historical arbitration accuracy rate is 1, the base weight is 1.4. The base weight is constrained to a range between 0.2 and 1.4. The historical arbitration accuracy rate A is updated using the same dual-window weighted average method as described above. Specifically, the short window calculates the proportion of successful executions after the conclusion of the relevant node was adopted in the last 10 arbitrations, and the long window calculates the proportion in the last 100 arbitrations. The weighted sum of the two values ​​is used as the actual value of A.

[0133] Meanwhile, the dynamic threshold is also adaptively adjusted based on the diagnostic results of the most recent period: The percentage of successful diagnoses in the last 10 diagnoses is calculated. If this percentage is higher than 0.8, the dynamic threshold is lowered by 0.01, but the lower limit is not lower than 0.5; if the percentage is lower than 0.4, the dynamic threshold is increased by 0.01, but the upper limit is not higher than 0.8; if the percentage is between 0.4 and 0.8, the current threshold remains unchanged. The initial value of the dynamic threshold is 0.65.

[0134] Finally, the entire diagnostic process, including suspicious event records, verification response records, confidence calculation process, arbitration results, execution results, and update timestamps, is packaged into a diagnostic summary record and reported to the central cloud platform. After receiving it, the central cloud platform can use it for long-term statistics and global model optimization.

[0135] like Figure 4 As shown, a second objective of this invention is to provide a data edge processing diagnostic system for communication equipment in 5G base stations. This system is used to execute the aforementioned method and includes a first edge diagnostic node deployed on the centralized unit side and a second edge diagnostic node deployed on the distributed unit side. The two nodes interact through an out-of-band communication channel. Each edge diagnostic node contains five modules: a distributed feature acquisition module, an anomaly detection module, a cross-node verification module, a decision arbitration module, and a self-healing execution module.

[0136] The distributed feature acquisition module is responsible for capturing inter-process communication messages of the protocol stack within the unit where the current node is located. It sets up probes on the inter-process communication path of the operating system kernel. When message passing occurs between the radio resource control process, packet data aggregation protocol process, radio link control process, or media access control process, the probes are triggered, copy the original message to the user-space buffer, and encapsulate it into the original message record.

[0137] The distributed feature acquisition module extracts key state fields from the original message records, performs normalization processing to generate a 32-dimensional normalized feature vector, and then uses online principal component analysis to compress it into a 16-dimensional reduced feature vector, which is then stored in a circular queue. Simultaneously, this module identifies state change events from the original message records and stores them in a local state cache.

[0138] The anomaly detection module retrieves the 128 most recent dimensionality-reduced feature vectors from the circular queue, calculates the anomaly score at the current moment using the isolated forest algorithm, and then weights and corrects the anomaly score by combining it with the locally maintained historical misclassification rate table to obtain the weighted anomaly score.

[0139] When the weighted anomaly score exceeds the dynamic threshold, the anomaly detection module generates a suspicious event record and determines whether the event should be handled independently by the current node or requires cross-node collaborative diagnosis based on the preset responsibility domain mapping table. If collaboration is required, a cross-node verification request is constructed and sent to the cross-node verification module.

[0140] The cross-node verification module receives the state change event sent by the first module and updates the local state hash chain according to the user identifier. The hash value of each user is updated in a chain manner. The new hash value is calculated by the hash function using the old hash value, the state type code, the new state value and the current timestamp.

[0141] When the cross-node verification request generated by the anomaly detection module is received, the cross-node verification module encapsulates the request into a fixed-length verification request packet, removes duplicates using a Bloom filter, and sends it to the peer node via a dedicated UDP channel.

[0142] Meanwhile, the cross-node verification module listens on a dedicated UDP port, receives verification requests from the peer, searches for the corresponding hash value in the local state hash chain based on the user identifier in the request, and encapsulates it into a response packet and returns it. For verification requests initiated by the current node, the cross-node verification module receives the response packet returned by the peer, parses out the matching flag, and stores it in the verification response cache.

[0143] The decision arbitration module receives suspicious event records from the anomaly detection module and verification response records from the cross-node verification module. It retrieves a list of candidate diagnoses based on the event type, iterates through each candidate conclusion, calculates the posterior confidence using Bayes' theorem, and applies a decay to the confidence based on the operation stack history.

[0144] The decision arbitration module selects the conclusion with the highest confidence level. If the confidence level reaches the high threshold, it is directly adopted; if it is in the medium range, secondary verification is triggered; if it is below the low threshold, the diagnosis is abandoned.

[0145] When both decision-making arbitration modules on both sides generate preliminary diagnostic conclusions and there is a primary conflict between the conclusions, the module activates a weighted voting arbitrator. This arbitrator calculates a comprehensive score for each node based on its base weight, timeliness factor, and confidence level, and the conclusion of the node with the higher score is used as the arbitration result. After pre-execution confirmation, the winning arbitration conclusion is encapsulated into a repair action instruction and transmitted to the self-healing execution module.

[0146] The self-healing execution module receives repair action instructions and determines whether the instructions should be executed by the current node or forwarded to the peer node. If executed by the current node, the corresponding repair interface is directly called to perform operations such as resetting the process, reconfiguring parameters, rebuilding the connection, or recording alarms, depending on the operation type. If executed by the peer node, the instructions are forwarded through a dedicated UDP channel.

[0147] After execution, the self-healing execution module sends an execution completion notification to the peer and updates the historical misjudgment rate, execution success rate and node arbitration weight in the local statistics table according to the execution results. At the same time, it asynchronously reports the diagnostic summary record to the central cloud platform.

[0148] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for diagnosing data edge processing of a communication device oriented to a 5G base station, the method comprising: Includes the following steps: S1. Collect inter-process communication messages of the protocol stack at the edge nodes of the centralized unit and the edge nodes of the distributed unit respectively, and extract the dimensionality-reduced feature vector and state change events from them; S2. Each edge node calculates a weighted anomaly score based on the dimensionality-reduced feature vector. If the score exceeds the dynamic threshold, a suspicious event record is generated. When cross-node collaboration is required based on the preset responsibility domain mapping table, a cross-node verification request containing user identifier and status type is constructed. S3. Each edge node updates its local state hash chain based on the state change event and stores the old and new hash values ​​together. After receiving the cross-node verification request, the requesting edge node encapsulates it into a fixed-length request packet, removes duplicates using a Bloom filter, and then sends it to the peer edge node. The peer edge node retrieves the current hash value from its local state hash chain based on the user identifier and returns it. The requesting edge node compares the hash value with the expected hash value to obtain a matching flag. S4. Obtain a candidate diagnosis list based on the suspicious event records, and iterate through each candidate conclusion in the candidate diagnosis list; The weighted sum of the weighted anomaly score and the historical execution success rate of the candidate conclusion is used as the prior probability. The likelihood probability is determined according to the matching indicator. The posterior confidence is calculated by substituting it into the Bayesian formula. The candidate conclusion with the highest posterior confidence is selected as the preliminary diagnostic conclusion. When the preliminary diagnostic conclusions of the two edge nodes conflict, the weighted result of the basic weight and the timeliness factor is used as the comprehensive score, and the conclusion of the party with the higher score is output as the arbitration result.

2. The data edge processing diagnostic method for communication equipment oriented towards 5G base stations according to claim 1, characterized in that: After collecting inter-process communication messages from the protocol stack, the original message records are obtained by parsing the communication messages. Key state fields are extracted from the original message records and normalized to obtain normalized feature vectors. Then, online principal component analysis is used to compress the normalized feature vectors into dimensionality-reduced feature vectors.

3. The data edge processing diagnostic method for communication equipment oriented towards 5G base stations according to claim 2, characterized in that: The weighted anomaly score is calculated as follows: first, the anomaly score of the dimensionality-reduced feature vector is calculated using the isolated forest algorithm; then, the anomaly score is weighted and fused with the historical misjudgment rate to obtain the weighted anomaly score. The historical misjudgment rate is calculated according to the failure type, representing the proportion of failures in the most recent diagnosis.

4. The data edge processing diagnostic method for communication equipment oriented towards 5G base stations according to claim 1, characterized in that: The state hash chain is updated as follows: the user identifier, state type, new state value, and current timestamp in the state change event are substituted together with the previous hash value into the hash function to calculate the new hash value, the new hash value is stored as the current hash value, and the previous hash value is retained as a historical record.

5. The data edge processing diagnostic method for communication equipment oriented towards 5G base stations according to claim 1, characterized in that: The Bloom filter is equipped with a deduplication time window, in which fingerprints of sent request packets are recorded. If the same fingerprint appears repeatedly within the time window, the request packet is discarded. The fingerprint automatically becomes invalid after the time window expires.

6. The data edge processing diagnostic method for communication equipment for 5G base stations according to claim 1, characterized in that: The historical execution success rate of the candidate conclusion is the proportion of successful executions in the most recent several executions, calculated according to the type of diagnostic conclusion. Successful execution means that the same type of failure does not reappear within a preset time observation window after execution.

7. The data edge processing diagnostic method for communication equipment oriented towards 5G base stations according to claim 1, characterized in that: The timeliness factor is calculated based on the difference between the generation time of the preliminary diagnostic conclusion of the current node and the generation time of the earlier conclusion of the nodes on both sides. The larger the difference, the smaller the timeliness factor. When the difference exceeds the preset time threshold, the timeliness factor decreases to the minimum value. The later the conclusion of the current node is compared with the conclusion of the counterpart node, the smaller the timeliness factor.

8. The data edge processing diagnostic method for communication equipment for 5G base stations according to claim 1, characterized in that: After executing the arbitration result, monitor the occurrence of similar faults within a preset time window. If no fault occurs, mark the diagnosis as successful and increase the historical execution success rate of the corresponding operation type and the basic weight of the corresponding edge node accordingly. If it occurs again, it is marked as a failure, and the success rate of the historical execution is reduced accordingly.

9. The data edge processing diagnostic method for communication equipment for 5G base stations according to claim 8, characterized in that: The historical execution success rate is updated using a dual-window weighted average method, where the short window counts the most recent data and assigns it a higher weight, while the long window counts more historical data and assigns it a lower weight.

10. A data edge processing diagnostic system for communication equipment targeting 5G base stations, used to execute the data edge processing diagnostic method for communication equipment targeting 5G base stations as described in any one of claims 1-9, characterized in that, It includes a first edge diagnostic node deployed on the centralized unit side and a second edge diagnostic node deployed on the distributed unit side. Each of the first and second edge diagnostic nodes includes a distributed feature acquisition module, an anomaly detection module, a cross-node verification module, a decision arbitration module, and a self-healing execution module. The distributed feature acquisition module is used to collect inter-process communication messages in the protocol stack and extract dimensionality-reduced feature vectors and state change events from them. The anomaly detection module is used to calculate a weighted anomaly score based on the dimensionality-reduced feature vector, generate a suspicious event record when the dynamic threshold is exceeded, and construct a cross-node verification request when cross-node collaboration is required based on the responsibility domain mapping table. The cross-node verification module is used to maintain a state hash chain based on state change events, and to process the sending and receiving of cross-node verification requests, deduplication, and hash value comparison to obtain a matching flag. The decision arbitration module is used to calculate the posterior confidence level and select the preliminary diagnostic conclusion based on the suspicious event record and matching flag using Bayes' formula, and to output the arbitration result in a weighted manner when the conclusions on both sides conflict. The self-healing execution module is used to execute the arbitration results and update the historical execution success rate and basic weights.

Images