Communication network abnormal traffic detection and root cause positioning method based on graph neural network

Abstract

This invention discloses a method for abnormal traffic detection and root cause localization in communication networks based on graph neural networks. The method includes: unifying the network hierarchy, port location, and forwarding adjacency relationships of communication network devices through hierarchical port indexing, and merging communication session features, forwarding adjacency features, and communication connection state features to form a port session matrix, expanding the anomaly analysis object from single traffic statistics to a session state expression under port connection relationships; generating an anomaly propagation phase matrix by comparing upstream and downstream sequence port mutation locations, enabling the identification of the propagation sequence of abnormal traffic between ports; eliminating overlapping phase segments caused by routing path switching using a scheduling phase matrix, reducing false alarms caused by normal scheduling disturbances; and performing root cause localization by combining a physical precedence matrix with a candidate propagation matrix, distinguishing between physical root causes of communication connections and root causes of traffic behavior, thereby improving the accuracy of anomaly detection and the precision of root cause localization.

Description

Technical Field

[0001] This invention relates to the technical fields of communication network security monitoring, abnormal traffic detection, and root cause localization of communication network faults, and particularly to a method for abnormal traffic detection and root cause localization of communication networks based on graph neural networks. Background Technology

[0002] As communication networks evolve towards cloud-network convergence, data center interconnection, edge computing, and multi-service support, more complex coupling relationships have formed between the number of network devices, port connection relationships, routing path switching relationships, and communication session behavior. Abnormal traffic is no longer just a sudden increase in traffic on a single port; it may also be accompanied by abnormal upstream and downstream port handling, local redistribution after routing switching, changes in physical parameters of communication connections, and cross-layer propagation phenomena. Existing abnormal traffic detection technologies typically establish detection models based on packet statistical characteristics, session behavior characteristics, device alarm information, or network topology relationships, and identify abnormal traffic through machine learning, deep learning, or graph neural networks. These methods have a certain detection effect in scenarios with known attack types, fixed network topologies, or single data centers. However, in actual communication networks, normal routing path switching, load balancing scheduling, port status fluctuations, and physical degradation of communication connections can all cause similar abnormal traffic behaviors, making it difficult for existing methods to accurately distinguish between normal scheduling disturbances, physical causes of communication connections, and root causes of traffic behavior, thus affecting the accuracy of anomaly detection results and root cause location results.

[0003] For example, CN119583187A discloses a network abnormal traffic detection method based on dynamic heterogeneous attribute graph representation learning. This method represents network traffic objects and their associated attributes through dynamic heterogeneous attribute graphs and uses representation learning to complete abnormal traffic detection. However, its technical focus is still on graph representation learning of network traffic attributes and abnormal category identification. It does not establish hierarchical port indexes for the network level, port location, and forwarding adjacency relationship of communication network devices, nor does it compare the port change position along the upstream and downstream port acceptance order. Therefore, it is difficult to reflect the propagation phase of abnormal traffic between ports. Especially when routing path switching, port acceptance relationship changes, or normal traffic scheduling occurs, this method is difficult to remove the phase segment caused by routing scheduling from the abnormal propagation process and easily identifies normal scheduling disturbances as part of the abnormal propagation process.

[0004] CN120729756A discloses a method for detecting abnormal traffic in data center switches. This method is mainly aimed at data center switch scenarios, focusing on detecting abnormal traffic status, port forwarding status, or device-side behavior. However, this method is more focused on the internal scope of the data center switch or a local area of ​​the switching network, and does not adequately consider the hierarchical relationship of communication network devices across the access layer, aggregation layer, and core layer. It also lacks collaborative analysis of port acceptance relationships, scheduling phase segments, and the pre-existing relationships of communication connection physical parameters before and after routing path switching. For abnormal behavior caused by port signal quality, port bit error status, port connection hold status, or the operating status of the device to which the port belongs, this method also has difficulty in further determining whether the root cause of the abnormality is a physical cause of the communication connection or a root cause of traffic behavior. This leads to the root cause localization results easily remaining at the level of switch or port abnormality, lacking a fine distinction of the type of abnormality source.

[0005] In summary, given that existing network abnormal traffic detection technologies suffer from problems such as difficulty in distinguishing between normal routing scheduling disturbances and real abnormal propagation, insufficient utilization of upstream and downstream mutation relationships at ports, and confusion between communication connection physical parameters and the root causes of traffic behavior, this invention is proposed.

[0006] Therefore, the problem to be solved by this invention is how to identify the propagation phase of abnormal traffic in the hierarchical port structure of a communication network, and exclude scheduling phase segments caused by routing path switching from the abnormal propagation process, while determining the root cause type in combination with the physical parameters of the communication connection. To address the above problems, this invention provides a method for abnormal traffic detection and root cause localization in communication networks based on graph neural networks. It generates a port session matrix by merging communication session features, forwarding adjacency features, and communication connection state features through hierarchical port indexing; it generates an abnormal propagation phase matrix by comparing the abrupt change positions of upstream and downstream ports; it generates a candidate propagation matrix by eliminating normal routing scheduling segments through the scheduling phase matrix; and it then uses the physical precedence matrix and the candidate propagation matrix to form the model input matrix. The abnormal propagation root cause localization model based on graph neural networks outputs the abnormal detection results, root cause location, and root cause type. Summary of the Invention

[0007] The purpose of this section is to outline some aspects of the embodiments of the present invention and to briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section, as well as in the abstract and title of the present application, to avoid obscuring the purpose of this section, the abstract and title of the invention. Such simplifications or omissions shall not be used to limit the scope of the present invention.

[0008] In view of the aforementioned existing problems, the present invention is proposed.

[0009] To solve the above-mentioned technical problems, the present invention provides the following technical solution: As a preferred embodiment of the abnormal traffic detection and root cause localization method for communication networks based on graph neural networks described in this invention, a hierarchical port index is generated according to the network level, port location, and forwarding adjacency relationship of the communication network device, and the communication session features, forwarding adjacency features, and communication connection status features are merged according to the hierarchical port index to generate a port session matrix; By comparing the port mutation positions of the port session matrix along the upstream and downstream order of the hierarchical port index, an anomaly propagation phase matrix is ​​generated. A scheduling phase matrix is ​​generated based on the port acceptance relationship before and after the routing path switch, and phase segments that overlap with the scheduling phase matrix are removed from the abnormal propagation phase matrix to generate a candidate propagation matrix. A physical precedence matrix is ​​generated based on the physical parameters of the communication connection. The candidate propagation matrix and the physical precedence matrix are combined into a model input matrix. The model input matrix is ​​then input into an anomaly propagation root cause localization model constructed based on a graph neural network. The anomaly propagation root cause localization model outputs the anomaly detection result, root cause location, and root cause type.

[0010] The beneficial effects of this invention are as follows: This invention unifies the constraints of network hierarchy, port location, and forwarding adjacency relationships of communication network devices through hierarchical port indexing, and merges communication session characteristics, forwarding adjacency characteristics, and communication connection state characteristics to form a port session matrix. This expands the anomaly analysis object from single traffic statistics to a session state expression under port connection relationships. By comparing the port mutation locations in the upstream and downstream order, an anomaly propagation phase matrix is ​​generated, which can identify the propagation sequence of abnormal traffic between ports. By eliminating overlapping phase segments caused by routing path switching through the scheduling phase matrix, false alarms caused by normal scheduling disturbances are reduced. By combining the physical precedence matrix with the candidate propagation matrix for root cause localization, the physical root cause of communication connection and the root cause of traffic behavior are distinguished, thereby improving the accuracy of anomaly detection, the precision of root cause localization, and the targeted nature of network operation and maintenance. Attached Figure Description

[0011] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 This is a flowchart illustrating the abnormal traffic detection and root cause localization method for communication networks based on graph neural networks as shown in this invention. Detailed Implementation

[0012] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0013] Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without inventive effort should fall within the scope of protection of this invention.

[0014] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0015] According to an embodiment of the present invention, in combination Figure 1 The flowchart shown illustrates a method for detecting abnormal traffic and locating the root cause in communication networks based on graph neural networks, which specifically includes the following steps: S1. Generate a hierarchical port index according to the network level, port location, and forwarding adjacency relationship of the communication network equipment. Then, merge the communication session characteristics, forwarding adjacency characteristics, and communication connection state characteristics according to the hierarchical port index to generate a port session matrix. Note that the following should be noted in this step: S1.1 According to the position of the communication network equipment in the access layer, aggregation layer and core layer, label the communication network equipment with hierarchical labels and generate network hierarchical identifier groups; S1.2. According to the device affiliation, port direction, and port connection object of the port in the communication network equipment, mark the port location and generate port location identifier group; S1.3. Based on the message forwarding direction and port connection relationship between adjacent communication network devices, the network layer identifier group and the port location identifier group are sequentially combined to generate a forwarding adjacency relationship group; S1.4 Arrange the network hierarchy identifier group, port location identifier group, and forwarding adjacency relationship group according to the hierarchy and forwarding order to generate a hierarchical port index; S1.5. Based on the hierarchical port index, merge the communication session features under the same port location to generate port session feature groups; S1.6. Based on the hierarchical port index, merge the forwarding adjacency features under the same forwarding adjacency relationship to generate port forwarding feature groups; S1.7. Based on the hierarchical port index, merge the communication connection status features under the same port location to generate a port connection status feature group. S1.8 Combine the port session feature group, port forwarding feature group, and port connection status feature group according to the port arrangement order in the hierarchical port index to generate a port session matrix.

[0016] Specifically, communication session characteristics include session identifier, protocol type, message length distribution, and session persistence state; forwarding adjacency characteristics include forwarding direction, adjacent port relationship, and path connection relationship; and communication connection state characteristics include connection hold state, forwarding congestion state, and port abnormal state.

[0017] It should be noted that the communication network devices in this embodiment include access switches, aggregation switches, core switches, routers, firewalls, load balancers, and gateway devices; the access layer is the layer where communication network devices directly connect to servers, user terminals, camera terminals, wireless access devices, or IoT terminals reside; the aggregation layer is the layer where communication network devices aggregate and forward packets from multiple access layer communication network devices, perform policy control, or forward packets from regional exits; the core layer is the layer where communication network devices undertake cross-regional packet forwarding, cross-network segment routing forwarding, or data center backbone forwarding; the position of a communication network device in the access layer, aggregation layer, and core layer can be obtained based on the device role, device uplink relationship, device downlink relationship, routing table, and switch neighbor discovery information in the network topology management system; in scenarios without a network topology management system, it can be obtained based on the number of uplink ports, the number of downlink terminals, the routing range, and the device naming rules of the communication network device.

[0018] Specifically, when a communication network device is directly connected to a terminal-side device and has an uplink aggregation switch port, the communication network device is labeled as an access layer device; when a communication network device is connected to multiple access layer devices and has an uplink port pointing to a core layer device, the communication network device is labeled as an aggregation layer device; when a communication network device is connected to multiple aggregation layer devices and undertakes cross-regional routing and forwarding, the communication network device is labeled as a core layer device.

[0019] In a preferred embodiment, when performing hierarchical labeling, the access layer is labeled as L1, the aggregation layer as L2, and the core layer as L3. The device name, device management address, device type, and hierarchical labeling results of the communication network devices are combined in a fixed order to generate a network hierarchical identifier group. The network hierarchical identifier group includes device identifier, device management address, device type, network hierarchical identifier, and hierarchical sequence number.

[0020] Preferably, taking a communication network as an example, the device management address of access switch ASW01 is 10.1.1.11, the device type is access switch, the network layer identifier is L1, and the intra-layer sequence number is 001. Then, the network layer identifier item corresponding to this device can be represented as ASW01, 10.1.1.11, access switch, L1, 001; the network layer identifier item of aggregation switch DSW01 can be represented as DSW01, 10.1.2.11, aggregation switch, L2, 001; the network layer identifier item of core switch CSW01 can be represented as CSW01, 10.1.3.11, core switch, L3, 001; multiple network layer identifier items are arranged in the order of L1, L2, L3 to form a network layer identifier group.

[0021] Furthermore, the device attribution of a port includes the device identifier, device management address, and device type of the communication network device to which the port belongs; port direction includes uplink, downlink, horizontal interconnection, and external connection. Uplink is the direction from the access layer to the aggregation layer or from the aggregation layer to the core layer; downlink is the direction from the core layer to the aggregation layer or from the aggregation layer to the access layer; horizontal interconnection is the direction between adjacent communication network devices within the same network layer; and external connection is the direction where a communication network device connects to the Internet egress, firewall, or leased gateway; port connection objects include the peer device identifier, peer port identifier, connection medium type, VLAN identifier, Layer 3 interface address, and neighbor device information; connection medium types include fiber optic, twisted pair, direct-connect copper cable, and virtual tunnel interface.

[0022] Specifically, when labeling port locations, the process begins by matching the port with device identifiers in the network layer identifier group to determine the port's device affiliation. Next, the port's direction is determined based on its uplink, downlink, lateral interconnection, and outbound connections. Then, the port's connection object is determined based on neighbor discovery messages, ARP entries, MAC address entries, interface description information, and next-hop routing information. Finally, the device affiliation, port direction, and port connection object are combined in the following order: device identifier, port identifier, port direction, peer device identifier, and peer port identifier, to generate the port location identifier. The port location identifier group includes device identifier, port identifier, network layer identifier, port direction, peer device identifier, peer port identifier, connection medium type, and service partition identifier. For example, if port GE1 / 0 / 48 of ASW01 is connected to port GE1 / 0 / 1 of DSW01, the port direction is uplink, the connection medium type is fiber optic, and the service partition identifier is VLAN100, then this port location identifier item can be represented as ASW01, GE1 / 0 / 48, L1, uplink, DSW01, GE1 / 0 / 1, fiber optic, VLAN100.

[0023] In a preferred embodiment, the packet forwarding direction includes the access layer to aggregation layer direction, the aggregation layer to core layer direction, the core layer to aggregation layer direction, the aggregation layer to access layer direction, the same-layer lateral direction, and the egress direction; the port connection relationship includes the direct connection port relationship, the Layer 3 next-hop relationship, the VLAN forwarding relationship, the aggregation port membership relationship, and the tunnel bearer relationship; when generating a forwarding adjacency relationship group, first determine two port location identifiers with peer connection relationships in the port location identifier group; then determine the packet forwarding direction according to the packet entry port, the packet exit port, the routing next hop, and the switching forwarding table; then, according to the order of the packet entering from the source side and leaving from the destination side, combine the upstream port location identifier, the downstream port location identifier, and the forwarding direction into a forwarding adjacency relationship item; the order is first arranged according to the network layer from L1 to L2, from L2 to L3, and then arranged according to the forwarding order within the same network layer; for return packets, they are arranged from L3 to L2 and from L2 to L1.

[0024] Specifically, the forwarding adjacency group includes the upstream device identifier, upstream port identifier, downstream device identifier, downstream port identifier, packet forwarding direction, port connection relationship, and path acceptance sequence number; for example, if ASW01's GE1 / 0 / 48 forwards a packet to DSW01's GE1 / 0 / 1, the corresponding forwarding adjacency item includes ASW01, GE1 / 0 / 48, DSW01, GE1 / 0 / 1, access layer to aggregation layer direction, direct port relationship, and 001.

[0025] When generating the hierarchical port index, the network layer identifier groups are first arranged in the order of L1, L2, and L3; then, the communication network devices under each network layer are arranged according to their intra-layer sequence number; then, the port location identifiers under each communication network device are arranged according to their port direction, with the uplink direction taking precedence over the horizontal interconnection direction, the horizontal interconnection direction taking precedence over the downlink direction, and the downlink direction taking precedence over the outward connection direction; then, based on the path acceptance sequence number in the forwarding adjacency relationship group, the port location identifiers with message acceptance relationships are concatenated; the hierarchical port index includes the index sequence number, network layer identifier, device identifier, port identifier, port direction, upstream port identifier, downstream port identifier, port connection relationship, and path acceptance sequence number.

[0026] For example, index number P001 corresponds to L1, ASW01, GE1 / 0 / 48, uplink direction, none, DSW01-GE1 / 0 / 1, direct port relationship, 001; index number P002 corresponds to L2, DSW01, GE1 / 0 / 1, downlink direction, ASW01-GE1 / 0 / 48, DSW01-GE1 / 0 / 24, three-layer next-hop relationship, 002; through this hierarchical port index, the physical location, network layer, and forwarding relationship of the port are correspondingly linked under the same index system.

[0027] In a preferred embodiment, when merging communication session characteristics based on the hierarchical port index, the same index number in the hierarchical port index is used as the merging benchmark. Communication sessions entering or leaving the same port location are merged according to session identifier, protocol type, and session persistence state. The session identifier is formed by combining the source address, destination address, source port, destination port, and transport layer protocol type. The protocol type includes TCP, UDP, ICMP, HTTP, HTTPS, DNS, SSH, and custom service protocols. The message length distribution includes the number of messages below 64B, the number of messages between 64B and 512B, and the number of messages between 512B and... The number of 1500B packets, the number of packets above 1500B, and the average packet length; session persistence status includes new session, persistent session, terminated session, retransmission session, and half-open session; port session characteristic group includes index sequence number, port location identifier, session identifier set, protocol type set, packet length distribution item, and session persistence status item; for example, if port P001 has 360 TCP sessions, 48 ​​UDP sessions, 31 half-open sessions, and 7600 packets from 512B to 1500B within 5 seconds, then the port session characteristic group corresponding to this port records the above session statistics and the corresponding port location identifier item.

[0028] Furthermore, when merging forwarding adjacency features based on hierarchical port indexes, the same upstream port identifier and the same downstream port identifier in the forwarding adjacency relationship group are used as the merging benchmark. The forwarding direction, adjacent port relationship, and path acceptance relationship between adjacent ports are combined into a port forwarding feature group. The forwarding direction includes the forwarding direction from the upstream port to the downstream port and the back-forwarding direction from the downstream port to the upstream port. The adjacent port relationship includes direct connection relationship, aggregation relationship, routing next-hop relationship, VLAN bridging relationship, and tunnel encapsulation relationship. The path acceptance relationship includes the previous accepting port, the current accepting port, the next accepting port, and the path acceptance sequence number. The port forwarding feature group includes the upstream index sequence number, the downstream index sequence number, the forwarding direction, the adjacent port relationship, the path acceptance relationship, and the forwarding status identifier. For example, if there is a direct connection between P001 and P002, and a three-layer next-hop relationship between P002 and P003, then P001 to P002 and P002 to P003 will form different port forwarding feature groups.

[0029] Preferably, when merging communication connection status characteristics based on hierarchical port index, the same port location identifier is used as the merging benchmark, and the port's connection hold status, forwarding congestion status, and port abnormal status are combined into a port connection status feature group. The connection hold status includes interface Up status, interface Down status, interface frequent jitter status, neighbor relationship existence status, and neighbor relationship interruption status. The forwarding congestion status includes port queue backlog status, outbound packet loss status, inbound packet loss status, buffer occupancy increase status, and flow control pause frame occurrence status. The port abnormal status includes CRC error, alignment error, optical power abnormality, link negotiation abnormality, interface bandwidth sudden drop, and port security policy triggering. The port connection status feature group includes index sequence number, port location identifier, connection hold status item, forwarding congestion status item, port abnormal status item, and status change location item. For example, if port P002 experiences outbound packet loss of 18, 95, and 210 in three consecutive sampling batches, and the cumulative number of CRC errors increases by 35, then the port connection status feature group records the outbound packet loss change and CRC error change corresponding to port P002.

[0030] It should also be noted that communication session characteristics can be obtained from NetFlow records, IPFIX records, switch flow tables, router session statistics, border firewall session tables, and server access logs; forwarding adjacency characteristics can be obtained from LLDP neighbor information, CDP neighbor information, ARP entries, MAC address entries, routing forwarding tables, VLAN forwarding tables, and tunnel session tables; communication connection status characteristics can be obtained from SNMP interface counters, switch port status, router interface status, Syslog logs, port error counts, optical module digital diagnostic information, and device operation status monitoring information. After obtaining the above information, the device port affiliation is first verified according to the device management address and port identifier, and then arranged according to the collection batch, so that the communication session characteristics, forwarding adjacency characteristics, and communication connection status characteristics all have corresponding port location identifiers.

[0031] Specifically, when generating the port session matrix, the port arrangement order in the hierarchical port index is used as the matrix row arrangement order. The port arrangement order is first arranged according to the network layer identifier from L1 to L3, then arranged according to the path inheritance number from small to large, and then arranged according to the port identifier within the same communication network device from small to large. The rows of the port session matrix are each port position identifier item in the hierarchical port index, and the columns are feature items in the port session feature group, port forwarding feature group, and port connection status feature group. The port session matrix specifically includes index number, device identifier, port identifier, network layer identifier, port direction, session identifier set, protocol type set, packet length distribution item, session persistence status item, forwarding direction, adjacent port relationship, path inheritance relationship, connection maintenance status item, forwarding congestion status item, and port abnormal status item.

[0032] Since each row of the matrix corresponds to a unique port location identifier, and each column corresponds to a specific communication session characteristic, forwarding adjacency characteristic, or communication connection status characteristic, the port session matrix can provide a unified data arrangement basis for subsequent port mutation location comparison.

[0033] Preferably, step S1 can unify and merge network information scattered in session statistics, neighbor relationships, routing and forwarding, port status and device operation status according to network level, port location and forwarding adjacency relationship, so as to solve the problems of unclear port ownership, broken forwarding path and difficulty in matching session features with port status during abnormal traffic detection; the formed port session matrix places the port's session behavior, forwarding relationship and communication connection status under the same hierarchical port index, which can reduce port mismatch and path misjudgment in subsequent abnormal propagation analysis and improve the accuracy of abnormal propagation phase extraction.

[0034] S2. Compare the port mutation positions in the port session matrix along the upstream and downstream order of the hierarchical port index to generate an anomaly propagation phase matrix. Note that the following points should be noted in this step: S2.1. According to the forwarding order in the hierarchical port index, form port acceptance pairs by connecting adjacent upstream and downstream ports; S2.2 Select the communication session characteristics, forwarding adjacency characteristics, and communication connection state characteristics of the port acceptance pair in the port session matrix to generate the port acceptance feature group; S2.3. Based on the sequential relationship of characteristic changes between upstream and downstream ports in the port acceptance characteristic group, determine the port abrupt change position of the port acceptance pair; S2.4. According to the order of port mutation locations in the hierarchical port index, continuously merge the port mutation locations to generate abnormal propagation phase segments. S2.5 Arrange the abnormal propagation phase segments in the upstream and downstream order of the hierarchical port index to generate the abnormal propagation phase matrix.

[0035] Specifically, the abnormal propagation phase matrix is ​​arranged with abnormal propagation phase segments as rows and phase attribute items as columns. The phase attribute items include phase segment identifier, start port identifier, end port identifier, upstream port identifier, downstream port identifier, port mutation position, forwarding order, communication session characteristic change identifier, forwarding adjacency characteristic change identifier, communication connection state characteristic change identifier, and phase continuity identifier.

[0036] In a preferred embodiment, when forming port acceptance pairs according to the forwarding order in the hierarchical port index, firstly, port location identifiers with consecutive path acceptance numbers are determined in the hierarchical port index; then, the port location identifier with the smaller path acceptance number is determined as the upstream port, and the port location identifier with the adjacent and larger path acceptance number is determined as the downstream port; then, the upstream port and the downstream port are combined into a port acceptance pair; for scenarios with aggregated ports or equal-cost routes, multiple downstream ports corresponding to the same upstream port are respectively formed into multiple port acceptance pairs, and the branch acceptance identifier is retained in the port acceptance pair.

[0037] Taking P001, P002, and P003 as consecutive path acceptance numbers as an example, P001 and P002 form the first port acceptance pair, and P002 and P003 form the second port acceptance pair; if P002 accepts both P003 and P004, then P002 and P003, and P002 and P004 respectively form port acceptance pairs.

[0038] When selecting the communication session characteristics, forwarding adjacency characteristics, and communication connection status characteristics corresponding to the port acceptance pair in the port session matrix, the corresponding matrix rows are first located in the port session matrix using the upstream port identifier and downstream port identifier in the port acceptance pair. Then, the session identifier set, protocol type set, message length distribution item, session persistence item, connection hold-up item, forwarding congestion item, and port abnormal status item are extracted from the matrix row corresponding to the upstream port. At the same time, the same column items are extracted from the matrix row corresponding to the downstream port. Then, the forwarding direction, adjacent port relationship, and path acceptance relationship between the two ports are added as the acceptance relationship part to generate the port acceptance feature group. The port acceptance feature group includes the port acceptance pair identifier, upstream port identifier, downstream port identifier, upstream port communication session characteristics, downstream port communication session characteristics, port forwarding characteristics, upstream port communication connection status characteristics, downstream port communication connection status characteristics, and acceptance batch sequence number.

[0039] Furthermore, when determining the location of port mutations, the changes in upstream port characteristics and downstream port characteristics within the same collection batch are compared. The order of characteristic changes includes changes in the number of upstream sessions before changes in the number of downstream sessions, changes in the proportion of upstream protocol types before changes in the proportion of downstream protocol types, changes in the distribution of upstream packet lengths before changes in the distribution of downstream packet lengths, an increase in upstream half-open sessions before an increase in downstream half-open sessions, changes in upstream forwarding congestion status before changes in downstream forwarding congestion status, and changes in the abnormal status of upstream ports before changes in the abnormal status of downstream ports.

[0040] Specifically, if the upstream port shows a significant increase in the number of half-open sessions, a significant increase in the number of 512B to 1500B packets, or a significant increase in outbound packet loss in the fourth collection batch, and the downstream port shows the same type of change in the fifth or sixth collection batch, then the position between the upstream and downstream ports corresponding to that port is identified as the port mutation position. If the downstream port first shows an abnormal communication connection status, but the upstream port does not show a corresponding change, then the downstream port is identified as the port mutation position. If session changes and connection status changes occur simultaneously in the same port pair, then the port that first shows a connection status change is taken as the port mutation position, and the corresponding communication session characteristic change identifier, forwarding adjacency characteristic change identifier, and communication connection status characteristic change identifier are retained.

[0041] When performing continuous merging of port mutation locations, all port mutation locations are first arranged according to the path connection sequence number in the hierarchical port index; then it is determined whether adjacent port mutation locations are in the same path connection sequence and whether there are no non-mutation ports between adjacent port mutation locations; if adjacent port mutation locations are in the same path connection sequence and there are no non-mutation ports between them, then the adjacent port mutation locations are merged into the same abnormal propagation phase segment; if there is more than one non-mutation port between adjacent port mutation locations, or if adjacent port mutation locations are in different path connection sequences, then different abnormal propagation phase segments are formed respectively; for scenarios with branch paths, if multiple port mutation locations have the same upstream port and propagate along different downstream ports, then multiple abnormal propagation phase segments are generated with the same upstream port as the starting point of the phase segment, and the corresponding branch connection identifier is recorded in each abnormal propagation phase segment.

[0042] Furthermore, when generating the abnormal propagation phase matrix, the abnormal propagation phase segments are arranged in the upstream and downstream order of the hierarchical port index; the behavior of the abnormal propagation phase matrix is ​​the abnormal propagation phase segments, listed as phase attribute items; the phase attribute items include phase segment identifier, starting port identifier, ending port identifier, upstream port identifier, downstream port identifier, port mutation position, forwarding order, communication session characteristic change identifier, forwarding adjacency characteristic change identifier, communication connection state characteristic change identifier, and phase continuity identifier; among them, the phase continuity identifier is determined based on whether the mutation positions of adjacent ports are in the same path inheritance sequence and whether they are arranged continuously; if they are arranged continuously, they are recorded as continuous phase; if there is a non-mutation port in the middle, they are recorded as discontinuous phase.

[0043] It should be noted that step S2 can analyze the location of port mutations along the upstream and downstream order of the hierarchical port index, solving the problem that it is difficult to distinguish between local congestion, path propagation and local port failure when judging anomalies based on a single port traffic surge. This step extracts the sequential relationship of feature changes between upstream and downstream ports through port pairing, so that the anomaly propagation process forms a comparable anomaly propagation phase matrix, which is beneficial for subsequent exclusion of normal changes caused by routing scheduling and provides a propagation direction basis for root cause port location.

[0044] S3. Generate a scheduling phase matrix based on the port acceptance relationship before and after the routing path switch, and remove phase segments that overlap with the scheduling phase matrix from the abnormal propagation phase matrix to generate a candidate propagation matrix. Note that the following points should be noted in this step: S3.1. Generate the port acceptance sequence before the route path switch based on the port acceptance relationship before the switch; generate the port acceptance sequence after the switch based on the port acceptance relationship after the route path switch. S3.2 Compare the port acceptance sequence before and after the switchover to determine the scheduling change port and the scheduling acceptance port; S3.3 Generate scheduling phase segments according to the upstream and downstream order of the scheduling change port and the scheduling takeover port in the hierarchical port index; S3.4 Arrange the scheduling phase segments according to the order of routing path switching to generate a scheduling phase matrix; S3.5. Compare the port positions and upstream / downstream order of the abnormal propagation phase segments in the abnormal propagation phase matrix with the scheduling phase segments in the scheduling phase matrix to determine the overlapping phase segments. S3.6. Eliminate overlapping phase segments from the abnormal propagation phase matrix and retain abnormal propagation phase segments that do not overlap with the scheduling phase matrix to generate a candidate propagation matrix.

[0045] In a preferred embodiment, the port acceptance relationship before the route path switch includes the previous route next hop, previous outgoing port, previous incoming port, previous upstream device, previous downstream device, and previous path acceptance sequence number; the port acceptance relationship after the route path switch includes the next route next hop, next outgoing port, next incoming port, next upstream device, next downstream device, and next path acceptance sequence number; when generating the port acceptance sequence before the switch, the port acceptance relationship before the route path switch is first extracted from the routing table, equivalent routing table, policy routing information, dynamic routing neighbor status, and routing change log; then, according to the upstream and downstream order in the hierarchical port index, the switch... The upstream and downstream ports before the switch are arranged sequentially to form the port acceptance sequence before the switch. When generating the port acceptance sequence after the switch, the same port arrangement method is used to arrange the port acceptance relationship after the route path switch in the upstream and downstream order to form the port acceptance sequence after the switch. For example, if the path before the switch is ASW01-GE1 / 0 / 48 to DSW01-GE1 / 0 / 1 to CSW01-GE1 / 0 / 1, and the path after the switch is ASW01-GE1 / 0 / 48 to DSW02-GE1 / 0 / 1 to CSW02-GE1 / 0 / 1, then the port acceptance sequence before the switch and the port acceptance sequence after the switch record the different accepting ports mentioned above.

[0046] When comparing port acceptance sequences before and after the handover, the same service partition identifier, the same source port, and the same destination port are used as the comparison benchmarks. Then, the upstream ports, downstream ports, path acceptance sequence numbers, and adjacent port relationships in both sequences are compared one by one. If a port exists in the pre-handover port acceptance sequence but not in the post-handover port acceptance sequence, it is identified as a scheduling change port. If a port does not exist in the pre-handover port acceptance sequence but exists in the post-handover port acceptance sequence, it is identified as a scheduling acceptance port. If a port exists both before and after the handover, but its upstream and downstream adjacent ports have changed, it is simultaneously identified as a scheduling change port and a scheduling acceptance port. Scheduling change ports include ports that exit the current packet forwarding path due to route convergence, policy switching, changes in port aggregation members, or equivalent path reselection. Scheduling acceptance ports include ports that enter the current packet forwarding path due to route convergence, policy switching, changes in port aggregation members, or equivalent path reselection.

[0047] When generating a scheduling phase segment, first determine the index number corresponding to the scheduling change port and the scheduling acceptance port in the hierarchical port index; then, according to the upstream and downstream order of the scheduling change port and the scheduling acceptance port in the hierarchical port index, merge the scheduling change port and the scheduling acceptance port located in the same service partition, the same route switching event, and the same path acceptance range into the same scheduling phase segment; if the scheduling change port and the scheduling acceptance port are located in different network layers, then the port closer to the source side in the layer is used as the starting port of the scheduling phase segment, and the port closer to the destination side in the layer is used as the ending port of the scheduling phase segment; if the same route switching event involves multiple equivalent paths, then generate a scheduling phase segment for each equivalent path, and record the equivalent path identifier in the scheduling phase segment.

[0048] In a preferred embodiment, when generating the scheduling phase matrix, the scheduling phase segments are arranged according to the order of routing path switching; the columns of the scheduling phase matrix are scheduling phase segments, listed as scheduling attribute items; the scheduling attribute items include scheduling phase segment identifier, routing switching event identifier, starting port identifier before switching, ending port identifier before switching, starting port identifier after switching, ending port identifier after switching, scheduling change port identifier, scheduling takeover port identifier, path takeover sequence number before switching, path takeover sequence number after switching, service partition identifier, and routing switching order identifier; for example, in a certain service partition, before switching, port DSW01-GE1 / 0 / 24 exits the path, and after switching, port DSW02-GE1 / 0 / 24 enters the path, then the same row in the scheduling phase matrix records DSW01-GE1 / 0 / 24 as the scheduling change port and DSW02-GE1 / 0 / 24 as the scheduling takeover port.

[0049] In a preferred embodiment, when determining overlapping phase segments, each abnormal propagation phase segment in the abnormal propagation phase matrix is ​​compared with each scheduling phase segment in the scheduling phase matrix in terms of port position and upstream / downstream order. The port position comparison rule is as follows: if the starting port, ending port, upstream port, or downstream port in the abnormal propagation phase segment is the same as the scheduling change port or scheduling takeover port in the scheduling phase segment, then it is determined that the two have overlapping port positions. The upstream / downstream order comparison rule is as follows: if the forwarding order in the abnormal propagation phase segment is within the same upstream / downstream range as the pre-switching path takeover number or post-switching path takeover number in the scheduling phase segment, then it is determined that the two have overlapping upstream / downstream orders. Only when both port position overlap and upstream / downstream order overlap are simultaneously established, the corresponding segment is determined to be an overlapping phase segment. If only the ports are the same but the forwarding order is inconsistent, or only the upstream / downstream ranges are similar but the port positions are inconsistent, then the corresponding segment is not determined to be an overlapping phase segment.

[0050] Furthermore, when excluding overlapping phase segments from the abnormal propagation phase matrix, abnormal propagation phase segments that do not overlap with the scheduling phase matrix are retained, and the retained abnormal propagation phase segments are arranged in their original upstream and downstream order to generate a candidate propagation matrix. The candidate propagation matrix consists of candidate propagation phase segments, listed as candidate propagation attribute items. The candidate propagation attribute items retain the phase segment identifier, start port identifier, end port identifier, upstream port identifier, downstream port identifier, port mutation position, forwarding order, communication session characteristic change identifier, forwarding adjacency characteristic change identifier, communication connection state characteristic change identifier, and phase continuity identifier from the abnormal propagation phase matrix, while adding a scheduling exclusion identifier. The scheduling exclusion identifier indicates that the candidate propagation phase segment does not form an overlapping phase segment with the scheduling phase matrix.

[0051] Preferably, step S3 can distinguish normal scheduling behaviors such as route path switching, equivalent path reselection, and aggregation port member changes from abnormal propagation behaviors, thus solving the problem of misjudging normal path switching as abnormal propagation in abnormal traffic detection. By forming a scheduling phase matrix through the port acceptance sequence before and after the switch, and then excluding overlapping phase segments from the abnormal propagation phase matrix, the remaining candidate propagation matrix is ​​closer to the real abnormal propagation process, thereby reducing the false alarm rate and improving the reliability of root cause localization.

[0052] S4. Generate a physical pre-propagation matrix based on the physical parameters of the communication connection. Combine the candidate propagation matrix and the physical pre-propagation matrix into a model input matrix. Input the model input matrix into an anomaly propagation root cause localization model constructed based on a graph neural network. The anomaly propagation root cause localization model outputs the anomaly detection result, root cause location, and root cause type. Note the following in this step: S4.1. Based on the candidate propagation phase segments in the candidate propagation matrix, determine the candidate port group in the hierarchical port index; S4.2. Based on the candidate port group, merge the communication connection physical parameters to generate a port physical parameter group; S4.3 Compare the port physical parameter group with the candidate propagation phase segment to determine the physical first port and the physical follow-up port. S4.4 Generate the physical first-mover matrix according to the physical first-mover port, the physical follow-up port and their order of arrangement in the candidate propagation matrix; S4.5 Combine the candidate propagation matrix and the physical pre-launch matrix according to the same port position to generate the model input matrix; S4.6 Input the model input matrix into the anomaly propagation root cause localization model constructed based on graph neural network, and the anomaly propagation root cause localization model outputs the anomaly detection result, root cause location and root cause type; The root cause types include physical root causes of communication connections and root causes of traffic behavior.

[0053] Specifically, the physical parameters of the communication connection include port signal quality, port error rate, port connection hold status, and the operating status of the device to which the port belongs.

[0054] In a preferred embodiment, when determining the candidate port group based on the candidate propagation matrix, the starting port identifier, ending port identifier, upstream port identifier, downstream port identifier, and port mutation position are first extracted from each candidate propagation phase segment of the candidate propagation matrix; then, the above port identifiers are matched with the port position identifier entries in the hierarchical port index; then, the matched port position identifier entries are arranged according to the path succession sequence number to generate the candidate port group; the candidate port group includes candidate starting ports, candidate intermediate ports, candidate ending ports, and candidate mutation ports; if the same port appears in multiple candidate propagation phase segments at the same time, only one port position identifier entry is retained in the candidate port group, and an occurrence count identifier is added; if a certain candidate propagation phase segment corresponds to a branch path, then the candidate ports on that branch path are formed into a separate candidate port subgroup.

[0055] Furthermore, the physical parameters of the communication connection can be obtained from switch port counters, router interface counters, optical module digital diagnostic information, equipment operation monitoring information, interface negotiation information, physical layer alarm information, and network management system alarm information; port signal quality includes optical received power, optical transmitted power, signal-to-noise ratio, link negotiation rate, duplex status, and interface rate change status; port error status includes the number of CRC errors, the number of FCS errors, the number of alignment errors, the number of input errors, the number of output errors, and the number of packet losses; port connection hold status includes interface Up status, interface Down status, interface jitter count, and neighbor presence status. The port's associated device operating status includes CPU usage, memory usage, board temperature, power module status, fan status, and device alarm status. When generating port physical parameter groups, the port location identifier in the candidate port group is used as the merging benchmark. The port signal quality, port error rate, port connection hold status, and associated device operating status corresponding to the same port are arranged according to the collection batch to form a port physical parameter group. The port physical parameter group includes candidate port identifier, port signal quality item, port error rate item, port connection hold status item, associated device operating status item, and physical parameter change location item.

[0056] When determining the physical first-transmit port and the physical subsequent-transmit port, the port physical parameter set is compared with the candidate propagation phase segment according to the port position and the order of change. The port position comparison rule is: if the candidate port identifier in the port physical parameter set is the same as the start port identifier, end port identifier, upstream port identifier, downstream port identifier, or port change position in the candidate propagation phase segment, then the port physical parameter set and the candidate propagation phase segment are determined to have a port position correspondence. The order of change comparison rule is: if a candidate port first experiences a decrease in optical received power, an increase in CRC error, interface jitter, or abnormal temperature of the device board, then... If a change in communication session characteristics, forwarding congestion status, or port abnormal status occurs in the same or adjacent candidate propagation phase segment, the candidate port is identified as the physical first port. If a change in the physical parameters of a candidate port occurs after an abnormal propagation phase change, or if the change in its physical parameters occurs after the abnormal propagation of an upstream port, the candidate port is identified as the physical follow-up port. If a candidate port only experiences a surge in the number of sessions, a sudden change in protocol type, or an increase in half-open sessions, but the port signal quality and port error status do not change accordingly, the candidate port is not identified as the physical first port.

[0057] In a preferred embodiment, when generating the physical precedence matrix, the physical precedence ports, physical follow-up ports, and their order in the candidate propagation matrix are combined; the physical precedence matrix consists of candidate ports or candidate port pairs, listed as physical precedence attribute items; the physical precedence attribute items include candidate port identifier, port location identifier, physical precedence identifier, physical follow-up identifier, port signal quality change identifier, port bit error state change identifier, port connection hold state change identifier, port device operating state change identifier, corresponding candidate propagation phase segment identifier, and candidate propagation order; if a candidate port is determined to be a physical precedence port, the corresponding row of the candidate port records the physical precedence identifier; if a candidate port is determined to be a physical follow-up port, the corresponding row of the candidate port records the physical follow-up identifier; through the physical precedence matrix, the sequential relationship between physical layer anomalies and anomaly propagation phase changes can be presented as model input content.

[0058] When generating the model input matrix, the candidate propagation matrix and the physical precedence matrix are combined according to the same port position. Specifically, the candidate port identifier and port position identifier are first used as the combination basis. Then, the candidate propagation attribute items in the candidate propagation matrix and the physical precedence attribute items in the physical precedence matrix are merged into the same matrix row. If the same candidate port appears in multiple candidate propagation phase segments, multiple rows of records are formed according to the candidate propagation order, and the same candidate port identifier is retained. The rows of the model input matrix are the port succession relationships of candidate ports or candidate propagation phase segments, listed as model input attribute items. The model input attribute items include candidate port identifier, upstream port identifier, downstream port identifier, forwarding order, communication session characteristic change identifier, forwarding adjacency characteristic change identifier, communication connection state characteristic change identifier, phase continuity identifier, physical precedence identifier, physical follow-up identifier, port signal quality change identifier, port error state change identifier, port connection maintenance state change identifier, and port equipment operation state change identifier. Thus, the model input matrix simultaneously contains abnormal propagation phase information and communication connection physical parameter sequence information.

[0059] Furthermore, the anomaly propagation root cause localization model is a joint model of node classification and edge relationship classification constructed based on a graph neural network. The anomaly propagation root cause localization model includes an input encoding layer, a port node embedding layer, a port receiving edge embedding layer, a graph convolutional layer, a graph attention layer, a propagation aggregation layer, an anomaly detection output layer, a root cause location output layer, and a root cause type output layer. The input encoding layer receives the model input matrix and converts the candidate port identifier, upstream port identifier, downstream port identifier, forwarding order, communication session feature change identifier, communication connection state feature change identifier, and physical preemption identifier into numerical input items that the model can process. The port node embedding layer generates port node representations based on the model input attribute items corresponding to the candidate ports. The port receiving edge embedding layer generates port receiving edge representations based on the upstream port identifier, downstream port identifier, and forwarding order. The graph convolutional layer transmits port node representations between candidate ports according to the port receiving edge representations. The graph attention layer adjusts the information weights between adjacent ports based on the physical preemption identifier, communication session feature change identifier, and communication connection state feature change identifier. The propagation aggregation layer aggregates the port node representations in the same candidate propagation phase segment to form a candidate propagation phase segment representation.

[0060] In a preferred embodiment, the anomaly detection output layer outputs anomaly detection results based on candidate propagation phase segments. The anomaly detection results include normal propagation results, suspected abnormal propagation results, and abnormal propagation results. When no continuous communication session feature change identifier, communication connection state feature change identifier, or physical preemption identifier appears in the candidate propagation phase segment, a normal propagation result is output. When continuous communication session feature change identifiers appear in the candidate propagation phase segment, but no corresponding communication connection state feature change identifier or physical preemption identifier appears, a suspected abnormal propagation result is output. When continuous communication session feature change identifiers appear in the candidate propagation phase segment, accompanied by communication connection state feature change identifiers or physical preemption identifiers, an abnormal propagation result is output.

[0061] In a preferred embodiment, the root cause location output layer outputs the root cause location based on the port node representation of the candidate ports and the candidate propagation order. The root cause location includes the root cause port, the communication network device to which the root cause port belongs, the network layer where the root cause port is located, and the candidate propagation phase segment corresponding to the root cause port. The candidate port that first shows an abnormal change in the candidate propagation order and has a physical first-mover indicator or a communication connection status characteristic change indicator is preferentially selected as the root cause port. If there is no physical first-mover indicator, the candidate port that first shows a change in communication session characteristics and is located at the beginning of the abnormal propagation phase segment is selected as the root cause port. If multiple candidate ports simultaneously meet the above conditions, the candidate port that is first in the upstream order and has a successor relationship with multiple downstream abnormal ports is selected as the root cause port.

[0062] In a preferred embodiment, the root cause type output layer outputs either the physical root cause of the communication connection or the root cause of the traffic behavior. When the root cause port has a port signal quality change identifier, a port error state change identifier, a port connection hold state change identifier, or a port device operation state change identifier, and the above changes occur earlier than the communication session characteristic change or the communication connection state characteristic change, the root cause type is determined to be the physical root cause of the communication connection. When the root cause port does not have a port signal quality change identifier, a port error state change identifier, a port connection hold state change identifier, or a port device operation state change identifier, but there is a sudden increase in the number of sessions, an increase in half-open sessions, a concentrated change in protocol type, an abnormally concentrated distribution of message length, or an abnormal access to multiple destinations from the same source, the root cause type is determined to be the traffic behavior root cause.

[0063] For example, physical causes of communication connection problems may correspond to optical module attenuation, port bit errors, interface jitter, device board malfunction, or port negotiation anomalies; traffic behavior problems may correspond to scan traffic, burst access, abnormal session retransmission, service traffic offset, or abnormal protocol traffic concentration.

[0064] Furthermore, the training samples for the anomaly propagation root cause localization model can consist of historical network fault work orders, port alarm logs, NetFlow records, route switching logs, port error counts, and manually labeled root cause results. Each training sample includes a model input matrix, anomaly detection labels, root cause location labels, and root cause type labels. Anomaly detection labels include normal propagation labels, suspected anomaly propagation labels, and anomaly propagation labels. Root cause location labels include root cause port identifiers, root cause device identifiers, and root cause network layer identifiers. Root cause type labels include communication connection physical root cause labels and traffic behavior root cause labels. After training, the anomaly propagation root cause localization model can output the corresponding anomaly detection results, root cause location, and root cause type when a new model input matrix is ​​entered.

[0065] It should be noted that step S4 combines the abnormal propagation phase information in the candidate propagation matrix with the communication connection physical parameter sequence information in the physical precedence matrix and inputs them into the abnormal propagation root cause localization model. This solves the problem of difficulty in distinguishing between physical connection failures and abnormal traffic behavior in abnormal traffic detection. By distinguishing between physical precedence ports and physical follow-up ports, the model no longer relies solely on the magnitude of traffic changes when determining the root cause location. Instead, it considers the port physical status, abnormal propagation sequence, and upstream and downstream connection relationships simultaneously, thereby improving the accuracy of root cause port localization and reducing the possibility of misidentifying downstream affected ports as root cause ports.

[0066] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for abnormal traffic detection and root cause localization in communication networks based on graph neural networks, characterized in that, include: A hierarchical port index is generated based on the network level, port location, and forwarding adjacency of the communication network equipment. Then, communication session characteristics, forwarding adjacency characteristics, and communication connection status characteristics are merged according to the hierarchical port index to generate a port session matrix. By comparing the port mutation positions of the port session matrix along the upstream and downstream order of the hierarchical port index, an anomaly propagation phase matrix is ​​generated. A scheduling phase matrix is ​​generated based on the port acceptance relationship before and after the routing path switch, and phase segments that overlap with the scheduling phase matrix are removed from the abnormal propagation phase matrix to generate a candidate propagation matrix. A physical precedence matrix is ​​generated based on the physical parameters of the communication connection. The candidate propagation matrix and the physical precedence matrix are combined into a model input matrix. The model input matrix is ​​then input into an anomaly propagation root cause localization model constructed based on a graph neural network. The anomaly propagation root cause localization model outputs the anomaly detection result, root cause location, and root cause type.

2. The method for abnormal traffic detection and root cause localization in communication networks based on graph neural networks according to claim 1, characterized in that, Generating the hierarchical port index includes: According to the position of the communication network equipment in the access layer, aggregation layer and core layer, the communication network equipment is hierarchically labeled to generate a network hierarchical identifier group; According to the device affiliation, port direction, and port connection object of the port in the communication network device, the port location is marked and a port location identifier group is generated. Based on the message forwarding direction and port connection relationship between adjacent communication network devices, the network layer identifier group and the port location identifier group are sequentially combined to generate a forwarding adjacency relationship group; The network hierarchy identifier group, the port location identifier group, and the forwarding adjacency relationship group are arranged in order of hierarchy and forwarding order to generate the hierarchical port index.

3. The method for abnormal traffic detection and root cause localization in communication networks based on graph neural networks according to claim 2, characterized in that, Generating the port session matrix includes: Based on the hierarchical port index, communication session features at the same port location are merged to generate port session feature groups; Based on the hierarchical port index, the forwarding adjacency features under the same forwarding adjacency relationship are merged to generate port forwarding feature groups; Based on the hierarchical port index, the communication connection status features under the same port location are merged to generate a port connection status feature group; The port session feature group, the port forwarding feature group, and the port connection status feature group are combined according to the port arrangement order in the hierarchical port index to generate the port session matrix.

4. The method for abnormal traffic detection and root cause localization in communication networks based on graph neural networks according to claim 3, characterized in that, The communication session characteristics include session identifier, protocol type, message length distribution, and session persistence state; the forwarding adjacency characteristics include forwarding direction, adjacent port relationship, and path connection relationship; the communication connection state characteristics include connection hold state, forwarding congestion state, and port abnormal state.

5. The method for abnormal traffic detection and root cause localization in communication networks based on graph neural networks according to claim 1, characterized in that, Generating the anomaly propagation phase matrix includes: According to the forwarding order in the hierarchical port index, adjacent upstream and downstream ports are formed into port acceptance pairs; The communication session characteristics, forwarding adjacency characteristics, and communication connection state characteristics of the port acceptance pair are selected from the port session matrix to generate a port acceptance feature group; Based on the sequential relationship of feature changes between the upstream and downstream ports in the port acceptance feature group, determine the port abrupt change position of the port acceptance pair; According to the order in which the port mutation locations are arranged in the hierarchical port index, the port mutation locations are continuously merged to generate anomaly propagation phase segments; The abnormal propagation phase segments are arranged in the upstream and downstream order of the hierarchical port index to generate the abnormal propagation phase matrix.

6. The method for abnormal traffic detection and root cause localization in communication networks based on graph neural networks according to claim 5, characterized in that, The abnormal propagation phase matrix is ​​composed of abnormal propagation phase segments as rows and phase attribute items as columns. The phase attribute items include phase segment identifier, start port identifier, end port identifier, upstream port identifier, downstream port identifier, port change position, forwarding order, communication session characteristic change identifier, forwarding adjacency characteristic change identifier, communication connection state characteristic change identifier, and phase continuity identifier.

7. The method for abnormal traffic detection and root cause localization in communication networks based on graph neural networks according to claim 1, characterized in that, Generating the scheduling phase matrix includes: Based on the port assignment relationships before the route path switch, generate the port assignment sequence before the switch; based on the port assignment relationships after the route path switch, generate the port assignment sequence after the switch. The port acceptance sequence before the switchover is compared with the port acceptance sequence after the switchover to determine the scheduling change port and the scheduling acceptance port. A scheduling phase segment is generated according to the upstream and downstream order of the scheduling change port and the scheduling acceptance port in the hierarchical port index. The scheduling phase segments are arranged according to the order of routing path switching to generate the scheduling phase matrix.

8. The method for abnormal traffic detection and root cause localization in communication networks based on graph neural networks according to claim 7, characterized in that, Generating the candidate propagation matrix includes: The port positions and upstream / downstream order of the abnormal propagation phase segments in the abnormal propagation phase matrix are compared with the scheduling phase segments in the scheduling phase matrix to determine the overlapping phase segments. The overlapping phase segments are excluded from the abnormal propagation phase matrix, and the abnormal propagation phase segments that do not overlap with the scheduling phase matrix are retained to generate the candidate propagation matrix.

9. The method for abnormal traffic detection and root cause localization in communication networks based on graph neural networks according to claim 1, characterized in that, The output includes the anomaly detection result, the root cause location, and the root cause type, including: Based on the candidate propagation phase segments in the candidate propagation matrix, determine the candidate port group in the hierarchical port index; Based on the candidate port group, merge the communication connection physical parameters to generate a port physical parameter group; The port physical parameter set is compared with the candidate propagation phase segment to determine the physical first port and the physical follow-up port by comparing the port position and the order of change of the port. A physical first-mover matrix is ​​generated according to the physical first-mover port, the physical follow-up port and their arrangement order in the candidate propagation matrix; The candidate propagation matrix and the physical pre-progress matrix are combined according to the same port position to generate the model input matrix; The model input matrix is ​​input into the anomaly propagation root cause localization model constructed based on graph neural network, and the anomaly propagation root cause localization model outputs the anomaly detection result, root cause location and root cause type; The root cause types include physical root causes of communication connections and root causes of traffic behavior.

10. The method for abnormal traffic detection and root cause localization in communication networks based on graph neural networks according to claim 9, characterized in that, The physical parameters of the communication connection include port signal quality, port error status, port connection hold status, and the operating status of the device to which the port belongs.

Images