An interface fault early warning method based on state sequence statistical characteristics and a server

Abstract

The application discloses an interface fault early warning method based on state sequence statistical characteristics and a server, and relates to the field of operation and maintenance.The method comprises the following steps: collecting the physical layer, IPv4 layer and IPv6 layer states of each interface of a network device, and aligning the states in time sequence to form a multilayer state sequence. Intermittent jitter interfaces with frequent state changes and high availability are identified. Each state change is analyzed one by one, and it is judged whether each layer changes synchronously according to a preset time window, and marked as multilayer linkage or single layer independent change. The linkage change frequency and linkage synchronization rate are calculated according to a statistical unit, and two types of time sequence are generated. When the linkage synchronization rate in the observation window continuously exceeds the threshold value, the linkage change frequency sequence is linearly fitted to obtain a deterioration rate. If the deterioration rate is positive and exceeds the threshold value, the remaining available time window is calculated according to the rate, the current frequency and the unavailable frequency threshold value, and time prediction and fault early warning are output. By implementing the application, the ability to judge the continuous deterioration of the interface health condition can be improved.

Description

Technical Field

[0001] This application relates to the field of operation and maintenance, and in particular to an interface fault early warning method and server based on state sequence statistical characteristics. Background Technology

[0002] As data centers continue to expand and network architectures become increasingly complex, the stable operation of network device interfaces has become a critical factor in ensuring business continuity. Network devices typically contain numerous physical interfaces, each carrying communication functions across multiple layers, including the physical layer, IPv4 protocol layer, and IPv6 protocol layer. Failure at any of these layers can lead to service interruption. In real-world operation and maintenance scenarios, interface failures often do not occur instantaneously but rather undergo a period of instability before complete failure. Therefore, timely detection of early warning signs and allowing sufficient time for intervention are crucial for improving network operation and maintenance efficiency and minimizing business losses.

[0003] In related technologies, network operation and maintenance systems typically employ alarm mechanisms based on fixed thresholds to monitor interface status. Specifically, the system collects status information for each interface according to a preset sampling period. When an interface's status changes from available to unavailable, an alarm is immediately triggered to notify the operation and maintenance personnel. Once the interface becomes available again, the corresponding alarm is cleared. This mechanism uses the current state of the interface as the basis for judgment; the generation and clearing of alarms directly correspond to changes in the interface's status.

[0004] However, the evolution of interface failures is a gradual process, with its state repeatedly switching between available and unavailable, and the time intervals and density of state changes do not exhibit a clear regularity. Existing technologies typically perform trend analysis based on historical records of interface state changes to predict the speed of failure evolution, but in actual operation and maintenance, the accuracy of such predictions is insufficient, and operation and maintenance personnel still find it difficult to reliably predict the remaining availability time of the interface. Summary of the Invention

[0005] This application provides an interface fault early warning method and server based on state sequence statistical characteristics, which can improve the ability to judge the continuous deterioration of interface health status.

[0006] Firstly, this application provides an interface fault early warning method based on state sequence statistical characteristics, applied to a server. The method includes: collecting the physical layer state, IPv4 protocol layer state, and IPv6 protocol layer state of each interface of a target network device in parallel according to a preset sampling period, and generating a multi-layer state time sequence aligned with the sampling time; identifying interfaces whose state change frequency reaches a preset active threshold and whose availability is higher than a preset health threshold as intermittent jitter interfaces based on the multi-layer state time sequence; traversing each state change of the intermittent jitter interface, and marking it as a multi-layer linked change or a single-layer independent change according to whether other layers change synchronously within a preset linkage determination time window; and dividing the data into preset statistical units. The system counts the number of multi-level linkage changes within each statistical unit to obtain a linkage change frequency time series. It then calculates the linkage synchronization rate based on the ratio of the number of multi-level linkage changes within each statistical unit to the total number of changes, obtaining a linkage synchronization rate time series. Within a preset observation window, when the linkage synchronization rate consistently exceeds a preset linkage threshold, the linkage change frequency time series is identified as the degradation trend fitting object. A linear fit is performed on the degradation trend fitting object over time to obtain the degradation rate. When the degradation rate is positive and exceeds a preset rate threshold, the remaining available time window is calculated based on the degradation rate, the current linkage change frequency, and a preset continuous unavailability frequency threshold, and the remaining available time window and fault warning are output.

[0007] In the above embodiments, the states of the physical layer, IPv4 protocol layer, and IPv6 protocol layer are collected in parallel and aligned by time to form a multi-layer state time sequence, providing a unified data foundation for subsequent analysis; intermittent jitter interfaces are screened by dual conditions of change frequency and availability to ensure that the analyzed object is in a gradual degradation stage; multi-layer linkage changes and single-layer independent changes are distinguished by linkage judgment time window, and change events with inter-layer transmission characteristics are separated from noise; after the linkage synchronization rate is continuously higher than the threshold, the linkage change frequency is linearly fitted to obtain the degradation rate, and the remaining available time window is calculated by combining the difference between the current frequency and the continuous unavailable frequency threshold, so as to realize quantitative time warning before the interface completely fails.

[0008] In conjunction with some embodiments of the first aspect, in some embodiments, the step of identifying interfaces whose state change count reaches a preset active threshold and whose availability rate is higher than a preset health threshold as intermittent jitter interfaces based on a multi-layer state time sequence specifically includes: within a preset detection period, counting the number of state changes from available to unavailable states for each interface in the multi-layer state time sequence, for the physical layer state, IPv4 protocol layer state, and IPv6 protocol layer state, and calculating the ratio of the number of sampling points in available states for the physical layer state, IPv4 protocol layer state, and IPv6 protocol layer state to the total number of sampling points as the availability rate of each layer; for interfaces whose state change count reaches the preset active threshold and whose availability rate of each layer is higher than the preset health threshold, extracting the time interval between two consecutive state changes of the interface in each layer to form a change interval sequence; calculating the mean and standard deviation of the change interval sequence, and determining the ratio of the standard deviation to the mean as the change interval variation coefficient; identifying interfaces whose change interval variation coefficient is greater than a preset discrete threshold as intermittent jitter interfaces.

[0009] In the above embodiments, the number of changes from available to unavailable and the availability rate of each interface and each layer are counted within a preset detection period. Frequent state switching is confirmed by the number of changes reaching an active threshold, and interfaces with persistent faults are excluded by the availability rate being higher than a health threshold. Furthermore, the time interval between two consecutive changes is extracted to form a change interval sequence, and the ratio of the standard deviation to the mean is calculated to obtain the change interval variation coefficient, which measures the degree of dispersion of the change distribution on the time axis. Interfaces with a variation coefficient greater than the dispersion threshold are identified as intermittent jitter interfaces, thereby distinguishing interfaces with random degradation characteristics from periodic operations or instantaneous disturbances, ensuring that the trend analysis object has real progressive fault evolution characteristics.

[0010] In conjunction with some embodiments of the first aspect, in some embodiments, the step of traversing each state change of the intermittent jitter interface and marking it as a multi-layer linkage change or a single-layer independent change according to whether other layers change synchronously within a preset linkage judgment time window specifically includes: traversing each state change of the intermittent jitter interface in the multi-layer state time sequence, extracting the change time and the layer to which the change belongs for each state change; determining the linkage detection time range by extending half the duration of the preset linkage judgment time window forward and backward, centered on the change time; within the linkage detection time range, searching whether there are state changes in other layers besides the layer to which the change belongs; when the number of layers with state changes in other layers within the linkage detection time range is not less than one, marking the state change corresponding to the change time as a multi-layer linkage change; when there are no state changes in other layers within the linkage detection time range, marking the state change corresponding to the change time as a single-layer independent change, and recording the layer to which the change belongs for the single-layer independent change.

[0011] In the above embodiments, the linkage detection range is determined by extending half a linkage judgment time window forward and backward, with each state change time as the center. The system searches for synchronous changes in other layers besides the layer to which the change belongs. When at least one of the other layers has a change, it is marked as a multi-layer linkage change; otherwise, it is marked as a single-layer independent change and the layer to which it belongs is recorded. The symmetrical time window design ensures that even if there is a slight propagation delay between layers, it can still be identified as a linkage event. Through the above classification mechanism, the system divides all change events into two categories: linkage changes that reflect the overall health degradation of the interface and independent changes caused by a brief anomaly in a single layer. This allows subsequent statistics to focus on fault events with inter-layer correlation characteristics.

[0012] In conjunction with some embodiments of the first aspect, in some embodiments, the degradation trend fitting object is linearly fitted over time to obtain the degradation rate. When the degradation rate is positive and exceeds a preset rate threshold, the remaining available time window is calculated based on the degradation rate, the current linkage change frequency, and a preset continuous unavailability frequency threshold, and the remaining available time window and fault warning are output. Specifically, this includes: extracting the number of multi-level linkage changes corresponding to each statistical unit in the degradation trend fitting object, arranging them according to the time sequence of each statistical unit to generate a linkage change frequency sequence; and using the number of statistical units in the linkage change frequency sequence to generate a linkage change frequency sequence. The unit's time sequence number is used as the independent variable, and the corresponding number of multi-level linkage changes is used as the dependent variable. Least square linear fitting is performed to obtain the slope and intercept of the fitted line. The slope of the fitted line is determined as the degradation rate. When the degradation rate is positive and exceeds the preset rate threshold, the number of multi-level linkage changes of the current statistical unit is obtained as the current linkage change frequency. The difference between the preset continuous unavailability frequency threshold and the current linkage change frequency is calculated. The difference is divided by the degradation rate to obtain the number of remaining statistical units. The remaining available time window is calculated based on the number of remaining statistical units and the duration of a single statistical unit.

[0013] In the above embodiment, least squares linear fitting is performed with the statistical unit time sequence number as the independent variable and the number of multi-level linkage changes as the dependent variable to obtain the slope, i.e., the degradation rate. When the degradation rate is positive and exceeds the rate threshold, the current linkage change frequency is obtained, and the difference between the continuous unusable frequency threshold and the current frequency is calculated to represent the required frequency increment. The difference is divided by the degradation rate to obtain the remaining number of statistical units, and then multiplied by the unit duration to convert it into the remaining available time window. This method maps the frequency growth trend to the fault arrival prediction in the time dimension based on linear extrapolation, so that the output result has a clear physical meaning and an operable time scale.

[0014] In conjunction with some embodiments of the first aspect, in some embodiments, after outputting the remaining available time window and fault warning, the method further includes: extracting all state changes marked as multi-layer linkage changes within a preset observation window, and obtaining the change time corresponding to each layer participating in the change in each multi-layer linkage change; for each multi-layer linkage change, determining the layer with the earliest change time among the participating layers as the first change layer; counting the number of times the first change layer is a physical layer in all multi-layer linkage changes, and determining the ratio of the number to the total number of multi-layer linkage changes as the physical layer first change rate; when the physical layer first change rate is higher than a preset causal direction threshold, determining the fault root cause layer as a physical layer, and adding the identifier of the physical layer as the fault root cause layer to the fault warning.

[0015] In the above embodiment, the change time of each participating layer in all multi-layer linkage changes within the observation window is extracted, and the layer with the earliest time in each linkage change is determined as the first change layer; the ratio of the number of times the first change layer is the physical layer to the total number of linkage changes is calculated to obtain the physical layer first change rate; when this ratio is higher than the causal direction threshold, it indicates that the physical layer anomaly occurs before the upper layer in the vast majority of linkage events, which is consistent with the causal logic of the upward propagation of the lower layer fault. Based on this, the root cause layer of the fault is determined to be the physical layer; this mechanism enables the early warning to simultaneously include the remaining available window in the time dimension and the fault root cause location in the spatial dimension, helping operation and maintenance personnel to determine the priority direction of investigation.

[0016] In conjunction with some embodiments of the first aspect, in some embodiments, after determining that the root cause layer of the fault is the physical layer, the method further includes: determining the target network device where the intermittent jitter interface that outputs the fault warning is located, and extracting the state change records of each remaining interface on the target network device other than the intermittent jitter interface that outputs the fault warning from the multi-layer state time sequence; within a preset observation window, counting the number of state changes of each remaining interface in the root cause layer, and determining the remaining interfaces whose number of state changes reaches a preset active threshold as associated abnormal interfaces; determining the ratio of the number of associated abnormal interfaces to the total number of remaining interfaces as the device-level fault propagation rate; when the device-level fault propagation rate is higher than the preset propagation threshold, upgrading the warning level of the fault warning from the interface-level warning to the device-level warning, and re-outputting the device-level warning and the remaining available time window.

[0017] In the above embodiments, the target network device where the warned interface is located is determined, the state change records of the remaining interfaces on the device at the root cause layer of the fault are extracted, the number of changes of each remaining interface within the observation window is counted, and the interface that reaches the active threshold is identified as the associated abnormal interface; the ratio of the number of associated abnormal interfaces to the total number of remaining interfaces is determined as the device-level fault propagation rate; when the propagation rate is higher than the propagation threshold, it indicates that the fault is no longer an isolated interface problem but a systemic degradation at the device level, and the system raises the warning level from the interface level to the device level and re-outputs it, so that the warning granularity matches the actual fault impact range and avoids maintenance personnel underestimating the harm of the fault.

[0018] In conjunction with some embodiments of the first aspect, in some embodiments, the step of upgrading the warning level of the fault warning from the interface-level warning to the device-level warning when the device-level fault propagation rate is higher than a preset propagation threshold, and re-outputting the device-level warning and the remaining available time window, specifically includes: when the device-level fault propagation rate is higher than the preset propagation threshold, extracting the moment when each associated abnormal interface first undergoes a state change at the fault root cause layer, and arranging them in chronological order to generate a fault propagation time sequence; calculating the time interval between the first state change moments of two adjacent associated abnormal interfaces in the fault propagation time sequence to form a propagation interval sequence; calculating the mean of the propagation interval sequence as the average propagation interval; determining the difference between the total number of remaining interfaces and the number of associated abnormal interfaces as the number of remaining normal interfaces, and determining the product of the number of remaining normal interfaces and the average propagation interval as the device-level fault propagation time; upgrading the warning level of the fault warning from the interface-level warning to the device-level warning, and re-outputting the updated remaining available time window using the smaller value between the device-level fault propagation time and the remaining available time window.

[0019] In the above embodiments, each associated abnormal interface is extracted and arranged in chronological order at the first change time of the fault root cause layer. The average of the intervals between the first changes of adjacent interfaces is calculated as the average propagation interval, which reflects the speed at which the fault propagates between interfaces within the device. The number of remaining normal interfaces is multiplied by the average propagation interval to obtain the device-level fault propagation time. The smaller value between the device-level fault propagation time and the original interface-level remaining available time window is taken as the updated remaining available time window output. Taking the smaller value ensures that the final warning reflects the most pressing time boundary among all constraints, thus guaranteeing the conservatism and reliability of the warning.

[0020] In a second aspect, embodiments of this application provide a server comprising: one or more processors and a memory; the memory is coupled to the one or more processors and is used to store computer program code, the computer program code including computer instructions, wherein the one or more processors invoke the computer instructions to cause the server to perform the method described in the first aspect and any possible implementation thereof.

[0021] Thirdly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a server, cause the server to perform the method described in the first aspect and any possible implementation thereof.

[0022] Fourthly, embodiments of this application provide a computer program product containing instructions that, when the computer program product is run on a server, cause the server to execute the method described in the first aspect and any possible implementation thereof.

[0023] Understandably, the server provided in the second aspect, the computer storage medium provided in the third aspect, and the computer program product provided in the fourth aspect are all used to execute the methods provided in the embodiments of this application. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0024] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0025] 1. Because the linkage judgment time window is used to classify multi-level changes, and the linkage synchronization rate is continuously higher than the threshold to calculate the remaining available time window by linear fitting of the linkage change frequency, it can output a quantitative warning with time scale before the interface fails. This solves the problem that the existing trend analysis is affected by single-layer noise interference in the judgment of deterioration trend and the accuracy of remaining available time prediction is insufficient due to the mixed statistics of various types of status change events.

[0026] 2. Because a triple screening mechanism of change count, availability, and coefficient of variation is used to identify intermittent jitter interfaces, it can accurately distinguish between progressively degraded interfaces and interfaces with periodic operations or continuous failures, thus solving the problem of inaccurate trend analysis objects.

[0027] 3. By using symmetrical time windows for multi-layer correlation detection and classifying and marking linked changes and independent changes, fault events with inter-layer transmission characteristics can be independently extracted from single-layer noise, thus solving the problem of trend judgment being interfered with by mixed statistics. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating an interface fault early warning method based on state sequence statistical features in an embodiment of this application.

[0029] Figure 2 This is another flowchart illustrating the interface fault early warning method based on state sequence statistical features in this application embodiment;

[0030] Figure 3This is a schematic diagram of the physical device structure of a server in an embodiment of this application. Detailed Implementation

[0031] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification of this application, the singular expressions “a,” “an,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations including one or more of the listed items.

[0032] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0033] To facilitate understanding, the application scenarios of the embodiments of this application are described below.

[0034] In the actual operation and maintenance of large-scale IPv4 / IPv6 dual-stack network deployments, the physical interfaces of router devices not only need to maintain physical layer connectivity, but also need to ensure the normal operation of the IPv4 and IPv6 protocol layers simultaneously. When potential fault factors such as cable aging, optical module attenuation, or abnormal peer equipment occur, the problem often does not manifest as a sudden and complete disconnection, but rather as an intermittent and jittery degradation process—that is, the interface repeatedly experiences linked changes in physical state and link protocol state within a short period of time. For example, a momentary physical layer disconnection may cause the IPv4 and IPv6 protocol layers to synchronously fail and then automatically recover. These multi-layered linked change events have a low frequency in the early stages of a fault, but their frequency gradually increases as hardware degradation intensifies, eventually leading to a continuous unavailability of the interface.

[0035] However, in existing technologies, network administrators can only manually log into devices to check the physical interface status, IPv4 protocol status, and IPv6 protocol status one by one, comparing each to determine whether the current interface is normal. There is a lack of automated means to link and analyze the physical status with the status of multiple protocol layers. More importantly, existing solutions can only observe the static state of the interface at a certain moment, and cannot perform time-series statistics and trend analysis on interface status change events. They cannot identify the degradation trend of intermittently fluctuating interfaces, nor can they predict the time required for the interface to deteriorate from its current deteriorated state to complete unavailability. This often results in maintenance personnel only being able to respond passively after the interface has completely failed, missing the optimal repair window.

[0036] In a typical application scenario, for example, in an operator's metropolitan area network, there are hundreds of router devices from different manufacturers and with different models. Each device carries dozens of dual-stack interfaces, and the total number of interfaces in the whole network reaches thousands. Due to reasons such as long-term operation, environmental factors, or equipment aging, some interfaces begin to show intermittent multi-layer linkage change phenomena. Taking the GigabitEthernet0 / 0 / 1 interface of a certain router as an example, the synchronization state between the physical layer and the IPv4 / IPv6 protocol layer of this interface has repeatedly flipped within the past 24 hours, and the flipping frequency shows an increasing trend hour by hour. If the operation and maintenance personnel fail to detect this degradation trend in time, this interface will enter a continuously unavailable state in a few hours, affecting the service traffic carried on it.

[0037] When the technical solution provided by the embodiment of the present application is applied to the above scenario, first, through a pre-configured timed acquisition task, corresponding acquisition commands are automatically selected according to different manufacturers and different device models, and multi-dimensional information such as the physical state of the interface, the link state, and the IPv4 address, IPv6 address, and local link address are periodically acquired from each router device. The collected raw data is written into the message queue after being unified in format, de-duplicated, and filtered for invalid values by a cleaning script. The calculation script performs status filtering and logical verification to identify the linkage change events between the physical state and the protocol state of each interface. On this basis, the system divides the preset detection period into multiple statistical units according to a fixed duration, counts the number of multi-layer linkage changes occurring in each intermittent jitter interface within each statistical unit, and generates a linkage change frequency sequence arranged in time series. The system uses the time series number of each statistical unit as the independent variable and the corresponding number of multi-layer linkage changes as the dependent variable, and uses the least squares linear fitting method to fit the trend of the linkage change frequency sequence, calculates the slope of the fitted straight line as the degradation rate, and quantifies the speed of the interface state deterioration. When the degradation rate is positive and exceeds the preset rate threshold, the system determines that this interface is in a significant degradation trend, and then obtains the number of multi-layer linkage changes in the current statistical unit as the current linkage change frequency, divides the difference between the preset continuously unavailable frequency threshold and the current linkage change frequency by the degradation rate, calculates the remaining number of statistical units, and converts it into the remaining available time window according to the duration of a single statistical unit, and outputs a fault warning message to the operation and maintenance personnel, clearly informing how long the interface is expected to enter a continuously unavailable state.

[0038] For ease of understanding, the method provided in this embodiment will be described in terms of its process in combination with the above scenario. Please refer to Figure 1 , which is a schematic flowchart of a method for early warning of interface faults based on statistical characteristics of state sequences in an embodiment of the present application.

[0039] S101. Collect the physical layer status, IPv4 protocol layer status and IPv6 protocol layer status of each interface of the target network device in parallel according to the preset sampling period, and generate a multi-layer status time sequence by aligning the sampling time.

[0040] The preset sampling period refers to the length of the period during which the server performs a status collection operation at fixed time intervals. The target network device refers to the monitored network devices such as switches and routers. The physical layer status refers to the connection status of the interface at the physical link level, manifested as link up or link down. The IPv4 protocol layer status refers to the operational status of the IPv4 protocol on the interface. The IPv6 protocol layer status refers to the operational status of the IPv6 protocol on the interface. The multi-layer state time sequence refers to a time-series data structure containing state values ​​from the physical layer, IPv4 protocol layer, and IPv6 protocol layer, arranged in chronological order.

[0041] Specifically, the server, according to a preset sampling period, simultaneously collects the physical layer status, IPv4 protocol layer status, and IPv6 protocol layer status of each interface of the target network device at each sampling moment. The status values ​​are represented in binary form, with available status recorded as 1 and unavailable status recorded as 0. For the same interface, the three-layer status values ​​acquired at the same sampling moment are grouped into a triplet as the multi-layer status sampling point at that moment, and arranged sequentially in chronological order to form the multi-layer status time sequence of that interface. The above process is performed on all interfaces on the target network device to obtain a set of multi-layer status time sequences for all interfaces.

[0042] In some embodiments, the parallel collection of multi-layer states of each interface and the generation of multi-layer state time-series sequences can be achieved in several ways according to a preset sampling period: Optionally, the server periodically sends SNMP operation and maintenance domain GET requests to the target network device according to the preset sampling period, reads the physical layer state object, IPv4 protocol layer state object, and IPv6 protocol layer state object corresponding to each interface, and writes the three-layer state values ​​returned at the same time into a time-series database to form a multi-layer state time-series sequence. Optionally, the server pre-configures a state reporting policy on the target network device, and the device actively reports the three-layer state information of each interface to the server at the end of each sampling period. The server groups and aligns the data according to the interface identifier and sampling timestamp, and splices the state values ​​of each layer of the same interface in time sequence to form a multi-layer state time-series sequence. It is understood that other methods can also be used to achieve parallel collection of multi-layer states and generation of time-series sequences, which are not limited here.

[0043] S102. Based on the multi-level state time sequence, interfaces whose state change count reaches a preset active threshold and whose availability is higher than a preset health threshold are identified as intermittent jitter interfaces.

[0044] Here, "state change count" refers to the cumulative number of times a certain layer of the interface changes from available to unavailable. "Preset activity threshold" is a pre-set lower limit for the number of state changes, used to determine if the interface experiences frequent state switching. "Availability" refers to the ratio of the number of sampling points in an available state at a certain layer of the interface to the total number of sampling points. "Preset health threshold" is a pre-set lower limit for availability, used to determine whether the interface is still in an overall available state. "Intermittent jitter interface" refers to an interface whose state frequently switches between available and unavailable but still maintains a high overall availability, indicating that the interface is in a gradual degradation phase.

[0045] Specifically, within a preset detection period, the server counts the number of times each interface transitions from an available state to an unavailable state at the physical layer, IPv4 protocol layer, and IPv6 protocol layer. The availability rate is calculated as the ratio of available sampling points at each layer to the total number of sampling points. When the number of state changes at any layer of an interface reaches a preset active threshold, and the availability rate at each layer is higher than a preset health threshold, the interface is marked as a candidate intermittent jitter interface. This dual condition ensures that the analyzed object exhibits both frequent state switching and is not completely unusable.

[0046] In some embodiments, interfaces meeting certain conditions can be identified as intermittent jitter interfaces in several ways: Optionally, for candidate interfaces that meet both conditions, the time intervals between two consecutive state changes at each layer are extracted to form a change interval sequence. The ratio of the standard deviation to the mean of this sequence is calculated to obtain the change interval variation coefficient. Interfaces with a variation coefficient greater than a preset discrete threshold are ultimately identified as intermittent jitter interfaces. Optionally, for candidate interfaces that meet both conditions, all change times are extracted, and their distribution entropy values ​​on the time axis are calculated. Interfaces with entropy values ​​higher than a preset entropy threshold are identified as intermittent jitter interfaces to ensure that their change times exhibit irregular distribution characteristics. It is understood that other methods can also be used to identify and filter intermittent jitter interfaces, which are not limited here.

[0047] In some embodiments, this step specifically includes:

[0048] S1021. Within the preset detection period, count the number of times the physical layer state, IPv4 protocol layer state, and IPv6 protocol layer state change from available to unavailable for each interface in the multi-layer state time sequence, and calculate the ratio of the number of sampling points in the physical layer state, IPv4 protocol layer state, and IPv6 protocol layer state that are in the available state to the total number of sampling points as the availability rate of each layer.

[0049] The preset detection period refers to a fixed time period pre-set for interface status monitoring and analysis. The multi-layer status time sequence refers to an ordered data sequence containing timestamps and status values ​​for each layer, formed after collecting data on the physical layer status, IPv4 protocol layer status, and IPv6 protocol layer status of each interface at fixed sampling intervals. The number of status changes refers to the cumulative number of times a layer's status value changes from an available state to an unavailable state; only switches from available to unavailable are counted. The availability rate of each layer is the ratio of the number of sampling points in an available state at a certain layer to the total number of sampling points in that layer, ranging from 0 to 1. For example, if an interface has 100 sampling points within the detection period, and 95 of these sampling points in the physical layer are in an available state, then the physical layer availability rate is 95 divided by 100, which equals 0.95.

[0050] Specifically, the server reads the start and end times of a preset detection period and extracts all sampled data for each interface within that time range from the multi-layer state time sequence. For each interface, the server performs a point-by-point scan of the physical layer state sequence, the IPv4 protocol layer state sequence, and the IPv6 protocol layer state sequence: starting from the second sampling point, it sequentially compares the state value of the current sampling point with the previous sampling point. When the previous sampling point is in an available state and the current sampling point is in an unavailable state, the state change count counter for the corresponding layer is incremented by one. After the scan is completed, the number of state changes for each layer is obtained. At the same time, the server counts the number of sampling points with an available state value in each layer state sequence as N_up, obtains the total number of sampling points as N_total, and calculates the availability rate for each layer as N_up / N_total. The server performs the above statistics independently for the physical layer, IPv4 protocol layer, and IPv6 protocol layer, and finally obtains six indicators for each interface: the number of state changes and availability rate at the three layers.

[0051] S1022. For interfaces whose number of state changes reaches the preset active threshold and whose availability rate at each layer is higher than the preset health threshold, extract the time interval between two consecutive state changes in each layer of the interface to form a change interval sequence.

[0052] The preset active threshold refers to a pre-set lower limit for the number of state changes. Reaching this threshold indicates frequent state switching behavior on the interface. The preset health threshold refers to a pre-set lower limit for availability. Availability at all layers exceeding this threshold indicates that the interface is generally still in a predominantly available operating state. The change interval sequence is an ordered numerical sequence formed by arranging the time difference between two consecutive state change events from available to unavailable at a certain layer of the interface in chronological order. For example, if the preset active threshold is 5 times, the preset health threshold is 0.8, and an interface has 8 physical layer state changes with availability rates of 0.92, 0.95, and 0.94 at the three layers, all higher than 0.8, then the interface meets the filtering criteria. If the physical layer of the interface has three consecutive state changes at 10:00, 10:15, and 10:22, then the change interval sequence is [15 minutes, 7 minutes in the operations and maintenance field].

[0053] Specifically, the server iterates through all interfaces, checking for any one of its three layer state change counts to be greater than or equal to a preset active threshold. Simultaneously, it checks if the physical layer availability, IPv4 protocol layer availability, and IPv6 protocol layer availability are all greater than preset health thresholds. Only when both conditions are met does the server perform a change interval extraction operation for that interface. The server locates all state change events that changed from available to unavailable from the state sequence of each layer where the interface's state change count reached the preset active threshold, records the timestamps of each change in chronological order, calculates the difference between two adjacent change timestamps, and arranges all differences in order to form the change interval sequence for that interface at the corresponding layer. For interfaces that meet the conditions, the server generates an independent change interval sequence for each layer where the state change count reaches the preset active threshold.

[0054] S1023. Calculate the mean and standard deviation of the change interval series, and determine the ratio of the standard deviation to the mean as the change interval variation coefficient.

[0055] The mean of the change interval series is the arithmetic mean obtained by summing all the time interval values ​​in the series and dividing by the number of intervals. The standard deviation is a statistic obtained by summing the squares of the differences between each time interval value and the mean, dividing by the number of intervals, and then taking the square root; it measures the dispersion of the time interval values ​​relative to the mean. The coefficient of variation of the change interval is a dimensionless ratio obtained by dividing the standard deviation by the mean; it eliminates the influence of the mean on the measure of dispersion and reflects the relative fluctuation range of the change intervals. For example, the change interval sequence is [15 minutes, 7 minutes in the operation and maintenance field, 10 minutes in the operation and maintenance field, 20 minutes in the operation and maintenance field], with a mean of (15+7+10+20) / 4=13 minutes, a standard deviation of sqrt(((15-13)²+(7-13)²+(10-13)²+(20-13)²) / 4)=sqrt((4+36+9+49) / 4)=sqrt(24.5)≈4.95 minutes, and a change interval coefficient of variation of 4.95 / 13≈0.38.

[0056] Specifically, the server reads the change interval sequence [Δt_1, Δt_2, ..., Δt_m], where m is the number of time intervals in the sequence. The server sums all the time intervals to get the total S_Operations_domain = Operations_domain_Δt_1 + Operations_domain_Δt_2 + ... + Operations_domain_Δt_m, and divides this by the number m to get the mean μ_Operations_domain = S_Operations_domain / Operations_domain_m. The server sequentially calculates the difference between each time interval and the mean, and squares it to obtain (Δt_1 - μ)², (Δt_2 - μ)², up to (Δt_m - μ)². All squared values ​​are summed to obtain the sum of squares: SS = Σ(Δt_i - μ)². Dividing this by the number m gives the variance σ² = SS / m. Taking the square root of the variance gives the standard deviation σ = sqrt(σ²). The server divides the standard deviation σ by the mean μ to obtain the coefficient of variation (CV) = σ / μ. A larger CV indicates more drastic fluctuations in the time intervals of state changes, and a less periodic change behavior; a smaller CV indicates more stable change intervals, and a change behavior closer to an evenly spaced periodic pattern.

[0057] S1024. Interfaces with a change interval variation coefficient greater than a preset discrete threshold are identified as intermittent jitter interfaces.

[0058] The preset discrete threshold refers to a pre-defined lower limit for judging the coefficient of variation of the change interval. A coefficient of variation exceeding this value indicates that the interface's state change interval exhibits a highly irregular discrete distribution. An intermittent jitter interface refers to an interface that experiences frequent state changes, maintains overall availability within a healthy range, but exhibits irregular fluctuations in the change interval. This type of interface displays unpredictable, intermittent state interruption behavior. For example, if the preset discrete threshold is 0.3, and the change interval coefficient of variation of an interface is 0.38, which is greater than 0.3, then this interface is identified as an intermittent jitter interface.

[0059] Specifically, the server compares the coefficient of variation (CV) of the change interval for each interface that meets the S1022 filtering criteria with a preset discrete threshold. When the CV of a certain interface is greater than the preset discrete threshold, the server marks the interface as an intermittent jitter interface and adds it to the list of intermittent jitter interfaces. The judgment basis of this identification logic is: the number of state changes reaches a preset active threshold to ensure that the interface has sufficiently frequent state switching behavior; the availability of each layer is higher than a preset health threshold to exclude permanently faulty interfaces that have been continuously unavailable; and the CV of the change interval is greater than the preset discrete threshold to exclude planned operation interfaces that perform state switching at fixed periods. The interfaces remaining after the three conditions are combined for filtering are intermittent jitter interfaces with frequent state switching, are still generally available, but have no fixed pattern in the timing of changes. These types of interfaces have intermittent degradation faults at the physical layer or protocol layer and require fault warning.

[0060] S103. Traverse each state change of the intermittent jitter interface, and mark whether the other layers change synchronously within the preset linkage determination time window as multi-layer linkage change or single-layer independent change respectively.

[0061] The preset linkage judgment time window refers to a time interval extending forward and backward from the moment a state change occurs, used to determine whether multiple layers have changed synchronously. A multi-layer linkage change occurs when at least one of the layers other than the layer to which the change occurred also undergoes a state change within the linkage judgment time window. A single-layer independent change occurs when no other layers undergo a state change within the linkage judgment time window. The layer to which the change occurred refers to the specific layer where the state change took place.

[0062] Specifically, the server extracts all state change events occurring across all layers within the detection period for the intermittent jitter interface. Each event includes the change time and the layer to which the change belongs. For each state change event, the linkage detection time range is determined by extending half the duration of the linkage judgment time window forward and backward from its change time. Within this range, the system searches for state change events in other layers. If at least one of the remaining layers also changes within this range, it is marked as a multi-layer linkage change; if none of the remaining layers change, it is marked as a single-layer independent change, and the layer to which the change belongs is recorded.

[0063] In some embodiments, the linkage or independent determination marking of state changes can be implemented in several ways: Optionally, all layer state change events are uniformly sorted by time, a symmetrical time window is constructed for each event, and change events of other layers are searched within the window. If the search result is not empty, it is marked as a multi-layer linkage change; otherwise, it is marked as a single-layer independent change, and the layer to which it belongs is recorded. Optionally, the state change events of each layer are stored in separate lists. For each change event of a certain layer, a binary search is used in the lists of other layers to determine whether there is a change event within the linkage determination time window. If a match is found, it is marked as a multi-layer linkage change; otherwise, it is marked as a single-layer independent change, and the layer to which it belongs is recorded. It is understood that other methods can also be used to implement the linkage and independent classification marking of state changes, which are not limited here.

[0064] In some embodiments, this step specifically includes:

[0065] S1031. Traverse each state change of the intermittent jitter interface in the multi-layer state time sequence, and extract the change time and the layer to which the change belongs for each state change.

[0066] Intermittent jitter interfaces refer to interfaces identified in step S1024 as having frequent state changes with irregularly fluctuating change intervals. Each state change refers to a single state transition event occurring at any layer in the multi-layer state timing sequence of the intermittent jitter interface, where it changes from an available state to an unavailable state or vice versa. The change time refers to the timestamp of the sampling point corresponding to the state change. The layer to which the change belongs refers to the specific protocol layer identifier where the state change occurred, which can be one of the physical layer, IPv4 protocol layer, or IPv6 protocol layer. For example, if an intermittent jitter interface changes from available to unavailable at 10:05, then the change time for this state change is 10:05, and the layer to which the change belongs is the physical layer.

[0067] Specifically, the server reads each intermittent jitter interface one by one from the list of intermittent jitter interfaces, obtaining the complete state sequence data of the physical layer, IPv4 protocol layer, and IPv6 protocol layer in the multi-layer state time sequence. The server performs a point-by-point scan of the state sequence of each layer, comparing the state value of the current sampling point with the previous sampling point starting from the second sampling point. When the state values ​​of two adjacent sampling points are different, it is determined as a state change event. The server records the timestamp of the current sampling point corresponding to the state change as the change time, and records the protocol layer identifier to which the state sequence belongs as the change layer, combining the change time and the change layer to form a change record. After the server completes the scan of all three layers of state sequences, it obtains a complete set of change records for all state change events of the intermittent jitter interface within a preset detection period. Each record in the set contains two fields: change time and change layer.

[0068] It should be noted that when filtering intermittent jitter interfaces, only the number of unidirectional changes from available to unavailable is counted. The purpose is to measure the frequency of interface failures and eliminate the interference of state recovery events on the failure frequency statistics. However, when traversing state change events in this step, both bidirectional changes from available to unavailable and from unavailable to available are included. The purpose is to fully capture the state propagation process of the interface between multiple layers. This is because when a physical layer failure propagates to the upper layers, it not only causes each layer to enter the unavailable state successively, but also causes each layer to return to the available state successively when the failure is recovered. The multi-layer linkage during the recovery process also reflects the existence of inter-layer coupling. Including the linkage changes in the recovery direction in the statistics can more comprehensively characterize the linkage features of the interface state.

[0069] S1032. Taking the change time as the center, extend it forward and backward by half the duration of the preset linkage judgment time window to determine the linkage detection time range.

[0070] The preset linkage judgment time window refers to a fixed time length pre-set for detecting whether multi-level state changes have temporal correlation. Forward expansion refers to extending from the time of change towards the past on the timeline. Backward expansion refers to extending from the time of change towards the future on the timeline. The linkage detection time range refers to a continuous time interval centered on the time of change, covering half the preset linkage judgment time window length before and after it, used to define the temporal neighborhood for judging multi-level linkage behavior. For example, if the preset linkage judgment time window is 60 seconds, and the time of a state change is 10:05:00, then extending forward by 30 seconds to 10:04:30 and backward by 30 seconds to 10:05:30, the linkage detection time range is [10:04:30, 10:05:30 in the operations and maintenance domain].

[0071] Specifically, the server reads the preset linkage judgment time window duration, denoted as W, and calculates half the window duration as W / 2. The server iterates through each change record extracted in step S1031, reading the change time of that record, denoted as T_change. The server performs a subtraction operation to obtain the start time T_start of the linkage detection time range (Operation Domain = Operation Domain T_change Operation Domain - Operation Domain W / 2), and performs an addition operation to obtain the end time T_end of the linkage detection time range (Operation Domain = Operation Domain T_change Operation Domain + Operation Domain W / 2). The server determines [T_start, Operation Domain T_end] as the linkage detection time range corresponding to this change record and stores this time range in association with the change record. This linkage detection time range is symmetrically centered on the change time, ensuring that it can capture near-synchronous state switching events that may occur in other layers within a short period before and after this state change, thereby determining whether multi-layer state changes are triggered by the same root cause of the fault.

[0072] S1033. Within the linkage detection time range, search for whether there are state changes in other layers besides the layer to which the change belongs.

[0073] The remaining layers, excluding the layer to which the change belongs, refer to the two remaining protocol layers after excluding the layer to which the current change record belongs. A state change is defined as at least one state value change event occurring in the state sequence of the remaining layers within the time interval covered by the linkage detection time range. For example, if the layer to which a change record belongs is the physical layer, then the remaining layers are the IPv4 and IPv6 protocol layers; the linkage detection time range is [10:04:30, 10:05:30 in the operations and maintenance field]. Within this time range, the server searches the state sequences of the IPv4 and IPv6 protocol layers. If the IPv4 protocol layer undergoes a state change at 10:05:02, then a state change is determined to exist in the remaining layers.

[0074] Specifically, the server reads the layer identifier of the current change record, excludes the layer to which the change belongs from the three layer identifiers of the physical layer, IPv4 protocol layer, and IPv6 protocol layer, and determines the list of remaining layers to be searched. The server reads the linkage detection time range [T_start, T_end in the operation and maintenance domain] corresponding to the current change record, and for each layer in the list of remaining layers, filters all sampling points whose timestamps fall between T_start and T_end from the state time sequence of the intermittent jitter interface in that layer. The server performs state change detection on the selected sampling point sequence, comparing the state values ​​of adjacent sampling points sequentially starting from the second sampling point. When any two adjacent sampling points have different state values, it is determined that there is a state change in that layer within the linkage detection time range, and the layer identifier is recorded. After the server has completed the search of all layers in the list of remaining layers, it obtains the set of remaining layers with state changes within the linkage detection time range and their corresponding layer numbers.

[0075] S1034. When the number of layers with state changes in the remaining layers within the linkage detection time range is not less than one, the state change corresponding to the change time is marked as a multi-layer linkage change.

[0076] The requirement that "at least one layer has a state change" means that the number of other layers that have undergone a state change within the linkage detection time frame, as retrieved in step S1033, is greater than or equal to one. This means that at least one of the remaining two layers also experienced a state switch within the linkage detection time frame. A multi-layer linkage change refers to a change event type marker indicating that two or three protocol layers experience synchronous or near-synchronous state switches within a short period, indicating a temporal correlation between this change and changes in other layers. For example, if the IPv4 protocol layer also experiences a state change within the linkage detection time frame of a physical layer state change, and the number of other layers with state changes is at least one, then this physical layer state change is marked as a multi-layer linkage change.

[0077] Specifically, the server reads the number of other layers with state changes within the linkage detection time range obtained in step S1033 and records it as N_co. The server compares N_co with the value 1. When N_co is greater than or equal to 1, it determines that the state change event corresponding to the current change record is accompanied by synchronous state switching behavior of other protocol layers in the time neighborhood. The server marks the change type field of the current change record as a multi-layer linkage change, indicating that this state change is not an independent event occurring in isolation in a single protocol layer, but has a close temporal coupling relationship with the state changes of other layers. The marking result of multi-layer linkage changes is used for subsequent fault root cause layer determination analysis. Multi-layer linkage changes usually correspond to the cascading effect of physical layer faults propagating to upper layer protocols, that is, the interruption of lower layer connectivity causes the upper layer protocol state to become unavailable.

[0078] S1035. When there is no state change in other layers within the linkage detection time range, mark the state change corresponding to the change time as a single-layer independent change, and record the layer to which the single-layer independent change belongs.

[0079] In this context, "no state change in other layers" means that the number of other layers that experienced state changes within the linkage detection time range, as retrieved in step S1033, is zero. This means the state values ​​of the other two layers remain unchanged within the linkage detection time range. A single-layer independent change refers to a change event type that occurs only at a single protocol layer and is not accompanied by synchronous state switching in other protocol layers. Recording the layer to which a single-layer independent change belongs means saving the specific protocol layer identifier where the independent change occurred, for subsequent determination of the root cause layer of the fault. For example, if no state changes occurred at the physical layer or the IPv6 protocol layer within the linkage detection time range for a certain IPv4 protocol layer state change, then this change is marked as a single-layer independent change, and the layer to which the change belongs is recorded as the IPv4 protocol layer.

[0080] Specifically, the server reads the number N_co of other layers with state changes within the linkage detection time range obtained in step S1033. When N_co equals 0, it is determined that the state change event corresponding to the current change record is not accompanied by state switching behavior of other protocol layers in the time neighborhood, and this change only occurs within a single protocol layer. The server marks the change type field of the current change record as a single-layer independent change and writes the value of the change to the layer field in the current change record into the single-layer independent change layer identifier field for storage. The marking of the single-layer independent change and the record of the change to the layer indicate that this state switch only affects a specific protocol layer and does not cause a cross-layer cascading reaction. The corresponding fault cause is limited to the protocol operation or configuration problem of the layer itself, rather than the failure of the entire layer linkage caused by the interruption of the underlying physical connectivity. The server executes the processing flow from S1032 to S1035 for all change records extracted in step S1031 one by one. Finally, each change record is marked as either a multi-layer linkage change or a single-layer independent change.

[0081] S104. Divide the data into segments according to preset statistical units, and count the number of times multi-level linkage changes occur within each statistical unit to obtain a linkage change frequency time sequence.

[0082] Among them, the preset statistical unit refers to the equal-length segments obtained by dividing the detection cycle into fixed durations, which are used to represent the basic time granularity of frequency statistics. The linkage change frequency time sequence refers to the numerical sequence formed by arranging the number of multi-level linkage changes within each statistical unit in chronological order. The linkage synchronization rate is the ratio of the number of multi-level linkage changes within each statistical unit to the total number of all state changes within that unit.

[0083] Specifically, the server divides the detection period into several statistical units according to a preset statistical unit duration. For each statistical unit, the number of events marked as multi-level linkage changes falling within that time period is counted as the linkage change frequency, and these are arranged chronologically to generate a linkage change frequency time series. Simultaneously, the total number of all state change events within each statistical unit is counted, and the linkage change frequency is divided by the total number to obtain the linkage synchronization rate, which is then arranged chronologically to generate a linkage synchronization rate time series.

[0084] In some embodiments, the frequency of linked changes can be statistically analyzed segmented by statistical unit in several ways: Optionally, the detection period is divided into segments based on the start time of the detection period and the duration of the statistical unit. For each segment, the list of marked change events is traversed, and it is determined whether the event falls into the current segment based on the event time. The number of multi-level linked changes is accumulated, and after the traversal is completed, the count values ​​of each segment are output in order to form a time sequence of linked change frequency. Optionally, after sorting all multi-level linked change events by time, the statistical unit number to which each event belongs is calculated (event time minus start time divided by unit duration and rounded down). The count is accumulated in the count array using the number as an index, and finally the count array is output in the order of the numbers. It is understood that other methods can also be used to realize the segmented statistics and time sequence generation of linked change frequency, which are not limited here.

[0085] S105. Within the preset observation window, when the linkage synchronization rate is continuously higher than the preset linkage threshold, the linkage change frequency time series is determined as the object of deterioration trend fitting.

[0086] The preset observation window refers to a continuous time range selected from the linkage synchronization rate time series for trend determination. The preset linkage threshold is a pre-set lower limit value for the linkage synchronization rate. The degradation trend fitting object refers to the linkage change frequency time series data selected for linear fitting after meeting the linkage synchronization rate persistence condition. "Continuously higher than" means that the linkage synchronization rate of all statistical units within the observation window is not lower than the preset linkage threshold.

[0087] Specifically, the server extracts all synchronization rate values ​​within a preset observation window from the synchronization rate time series and checks whether the synchronization rate of each statistical unit is higher than a preset synchronization threshold. When the synchronization rate of all statistical units within the observation window is higher than the preset synchronization threshold, it indicates that the interface state change is always dominated by multi-layered synchronization changes, and the server determines the synchronization change frequency time series within the corresponding time range as the degradation trend fitting object. If the synchronization rate of any statistical unit is lower than or equal to the preset synchronization threshold, subsequent fitting is not performed.

[0088] In some embodiments, the persistence determination of the linkage synchronization rate and the identification of the fitting object can be achieved in multiple ways: Optionally, a data segment of a preset observation window length is truncated from the end of the linkage synchronization rate time series using a sliding window method, and the linkage synchronization rate of each statistical unit is compared with a preset linkage threshold one by one. If all values ​​meet the condition, the corresponding linkage change frequency time series is marked as the deterioration trend fitting object; Optionally, starting from the end of the sequence, the linkage synchronization rate is checked one by one to see if it is higher than the threshold. If the number of units that continuously meet the condition reaches the observation window requirement, the linkage change frequency time series corresponding to these units is determined as the deterioration trend fitting object. It is understood that other methods can also be used to determine the persistence of the linkage synchronization rate and the fitting object, which are not limited here.

[0089] S106. Perform linear fitting on the degradation trend fitting object according to the time series to obtain the degradation rate.

[0090] Linear fitting refers to performing a univariate linear regression on the data point sequence using the least squares method to obtain the slope and intercept of the fitted line. The degradation rate refers to the slope of the fitted line, representing the average increment in the frequency of linked changes after each statistical unit. The independent variable is the time series number of each statistical unit. The dependent variable is the number of multi-level linked changes corresponding to each statistical unit.

[0091] Specifically, the server extracts the number of multi-level linkage changes for each statistical unit from the degradation trend fitting object and arranges them chronologically to generate a linkage change frequency sequence. Assume the observation window contains n statistical units, and assign numbers x1=1, x2=2, ..., xn=n to each unit according to time sequence as independent variables, with corresponding linkage change counts y1, y2, ..., yn as dependent variables. Linear fitting is performed using the least squares method, and the slope k is calculated as: koperational domain = (noperational domain * operational domain sum(xi * yi) * operational domain - operational domain sum(xi) * operational domain sum(yi)) / (noperational domain * operational domain sum(xi^2) * operational domain (sum(xi))^2), where the summation range is i from 1 to n. The calculated slope k is determined as the degradation rate.

[0092] In some embodiments, linear fitting of the degradation trend fitting object can be achieved in various ways to obtain the degradation rate: Optionally, the time series number of each statistical unit and the corresponding number of linkage changes constitute a data point pair set, and the intermediate quantities sum(xi), sum(yi), sum(xi*yi), and sum(xi^2) are calculated respectively using the least squares formula. These intermediate quantities are then substituted into the slope formula to obtain the degradation rate. Simultaneously, the intercept bmaintenance domain = (maintenance domain(sum(yi) / maintenance domain - maintenance domain k / maintenance domain * maintenance domain sum(xi)) / maintenance domain n) is calculated. Optionally, the linkage change frequency sequence is first centered, and the mean is subtracted from each independent variable and the mean is subtracted from each dependent variable to obtain the deviation sequence. The sum of the products of the independent variable deviation and the dependent variable deviation is divided by the sum of the squares of the independent variable deviations to obtain the slope as the degradation rate. It is understood that other methods can also be used to achieve linear trend fitting, which are not limited here.

[0093] S107. When the degradation rate is positive and exceeds the preset rate threshold, calculate the remaining available time window based on the degradation rate, the current linkage change frequency and the preset continuous unavailability frequency threshold, and output the remaining available time window and fault warning.

[0094] Among them, the preset rate threshold refers to the pre-set lower limit of the degradation rate; an early warning calculation is only triggered when this value is reached. The current linkage change frequency refers to the number of multi-level linkage changes occurring within the latest statistical unit. The preset continuous unavailability frequency threshold refers to the value at which the interface is considered to enter a continuous unavailability state. The remaining available time window refers to the remaining time length from the current moment until the linkage change frequency reaches the continuous unavailability frequency threshold. The fault warning refers to a pre-warning notification issued to operations and maintenance personnel that includes information about the remaining available time window.

[0095] Specifically, the server determines whether the degradation rate is positive and exceeds a preset rate threshold. If so, it obtains the number of multi-level linkage changes in the latest statistical unit as the current linkage change frequency f_current, and obtains the preset continuous unavailability frequency threshold f_threshold. The difference df = f_threshold - f_current represents the required frequency increment. Dividing df by the degradation rate k yields the remaining number of statistical units N_remain = df / k, which is then multiplied by the duration of a single statistical unit T_unit to obtain the remaining available time window T_remain = N_remain * T_unit. The server outputs the remaining available time window along with fault warning information to the operations and maintenance system.

[0096] In some embodiments, the calculation of the remaining available time window and the output of fault warnings can be implemented in several ways: Optionally, the frequency value of the last statistical unit in the linkage change frequency sequence is read as the current linkage change frequency. The frequency difference is obtained by subtracting the current frequency from the continuous unavailability frequency threshold, divided by the degradation rate to obtain the number of remaining statistical units, and multiplied by the statistical unit duration to obtain the remaining available time window. A fault warning message containing the interface identifier, the remaining available time window, and the warning timestamp is generated and pushed to the operation and maintenance platform. Optionally, the independent variable value x_target = (f_threshold - b) / k corresponding to the dependent variable reaching the continuous unavailability frequency threshold is calculated using the fitted linear equation y = k*x + b. The number of remaining statistical units is obtained by subtracting the current statistical unit number from x_target, and multiplied by the unit duration to obtain the remaining available time window and output the fault warning. It is understood that other methods can also be used to calculate the remaining available time window and output the fault warning, which are not limited here.

[0097] When the degradation rate is positive and exceeds the preset rate threshold, the system determines that the interface is in a significant degradation trend. It then obtains the number of multi-level linkage changes for the current statistical unit as the current linkage change frequency. The difference between the preset continuous unavailability frequency threshold and the current linkage change frequency is divided by the degradation rate to calculate the remaining number of statistical units. Based on the duration of a single statistical unit, the remaining available time window is calculated, and a fault warning is output to the maintenance personnel, clearly informing them of how long the interface is expected to remain unavailable. When the degradation rate is non-positive or positive but does not exceed the preset rate threshold, the system determines that the interface does not currently show a significant degradation trend. The interface is marked as stable or slightly fluctuating, and no fault warning is triggered. The current monitoring period's status data is simply recorded into the database and marked as normal monitoring status on the display interface. Subsequent periodic data collection and trend analysis continue with the arrival of the next monitoring period to continuously track the evolution of the interface's status.

[0098] For example, in the aforementioned metropolitan area network scenario, the system detected a significant increasing trend in the frequency of linked changes on the GigabitEthernet0 / 0 / 1 interface over the past 24 hours, calculated in hourly increments. The degradation rate, calculated using least-squares fitting, was 0.886 times per hour, exceeding the preset rate threshold of 0.5 times per hour. With 7 multi-level linked changes in the current statistical unit and a continuous unavailability frequency threshold set at 15 times, the remaining usable time window is approximately 9 hours. Based on this, the system generates an early warning and pushes it to maintenance personnel. These personnel can then schedule maintenance operations such as optical module replacement or cable repair within this time window, completing fault repair before the interface becomes completely unusable and avoiding service interruption. For another interface on the same device, GigabitEthernet0 / 0 / 2, although occasional linked change events also occurred during the detection period, the degradation rate calculated using least-squares fitting was 0.2 times per hour, not exceeding the preset rate threshold of 0.5 times per hour. The system determines that this interface is currently stable, does not trigger an early warning, and only records data normally for continued monitoring in subsequent periods. The entire process, from data collection, cleaning and calculation, trend fitting to early warning output, is fully automated. There is no need for manual login to each device for troubleshooting, which effectively solves the maintenance problems of difficulty in perceiving interface degradation trends and grasping the timing of fault repair in large-scale dual-stack network environments.

[0099] In some embodiments, this step specifically includes:

[0100] S1071. Extract the number of multi-level linkage changes corresponding to each statistical unit in the deterioration trend fitting object, and generate a linkage change frequency sequence according to the time sequence of each statistical unit.

[0101] The degradation trend fitting object refers to the target data set used to perform degradation trend analysis, which includes multiple statistical units divided into fixed durations within a preset detection period for intermittent jitter interfaces, and the status change statistics within each unit. A statistical unit refers to each time interval obtained by dividing the preset detection period into equal intervals of fixed duration, serving as the basic time granularity for counting status changes. The number of multi-level linkage changes refers to the total number of status change events marked as multi-level linkage changes within the time interval of a certain statistical unit. The linkage change frequency sequence is an ordered numerical sequence formed by arranging the number of multi-level linkage changes corresponding to each statistical unit according to the chronological order of the statistical units. For example, if the preset detection period is 24 hours, the duration of a single statistical unit is 1 hour, and the total number of statistical units is 24, the number of multi-level linkage changes in each statistical unit is [2, Operations Domain 3, Operations Domain 2, Operations Domain 4, Operations Domain 5, Operations Domain 4, Operations Domain 6, Operations Domain 5, Operations Domain 7, Operations Domain 6, Operations Domain 8, Operations Domain 7, Operations Domain...], and this ordered numerical sequence is the linkage change frequency sequence.

[0102] Specifically, the server reads the list of all statistical units contained in the degradation trend fitting object and sorts them from earliest to latest according to the start time of each statistical unit. The server iterates through each sorted statistical unit, filters all change records of intermittent jitter interfaces within the time segment corresponding to that statistical unit, and counts the number of records marked as multi-level linkage changes in the statistical change type field as the number of multi-level linkage changes for that statistical unit. The server stores the number of multi-level linkage changes for all statistical units in an array according to the chronological order of the statistical units, generating a linkage change frequency sequence. This sequence presents the frequency change trend of multi-level linkage change events in the direction of time progression. If the sequence values ​​show an overall increasing trend, it indicates that the frequency of multi-level linkage failures of the interface is continuously increasing over time, and the interface status is continuously deteriorating.

[0103] S1072. Using the time series number of each statistical unit in the linkage change frequency sequence as the independent variable and the corresponding number of multi-level linkage changes as the dependent variable, perform least squares linear fitting to obtain the slope and intercept of the fitted line, and determine the slope of the fitted line as the degradation rate.

[0104] In this context, the time series number refers to the integer sequence number assigned to each statistical unit according to its chronological order; the first statistical unit is numbered 1, the second 2, and so on. The independent variable is the input variable in the least squares linear fitting, namely the time series number. The dependent variable is the output variable in the least squares linear fitting, namely the number of multi-level linkage changes corresponding to each statistical unit. Least squares linear fitting is a regression method that aims to minimize the sum of squared residuals between the fitted line and all data points by solving for the parameters of a linear function. The degradation rate is the slope of the fitted line, representing the average increase in the number of multi-level linkage changes over each statistical unit's time period. For example, if the linkage change frequency sequence has 6 data points with time series numbers [1, 2, 3, 4, 5, 6] and corresponding frequencies [2, 3, 4, 5, 5, 7], and the slope obtained after least squares fitting is 0.886, then the degradation rate is 0.886 times per statistical unit.

[0105] Specifically, the server assigns time sequence numbers x_1=1, x_2=2, ..., x_n=n to the n statistical units in the linkage change frequency sequence, respectively. The corresponding number of multi-level linkage changes is denoted as y_1, y_2, ..., y_n. The server calculates the slope k and intercept b of the fitted line using the least squares formula: First, calculate the mean of the independent variable x̄ = (1+2+...+n) / n, and the mean of the dependent variable ȳ = (y_1+y_2+...+y_n) / n; then calculate the slope k = Σ((x_i-x̄)(y_i-ȳ)) / Σ((x_i-x̄)²), where the numerator is the sum of the products of the independent and dependent variable deviations for each data point, and the denominator is the sum of the squares of the independent variable deviations for each data point; finally, calculate the intercept b = ȳ-k×x̄. The server determines the calculated slope k as the degradation rate. A positive value indicates that the frequency of multi-layer linkage changes increases over time, meaning the interface status continues to deteriorate. A negative value indicates that the frequency decreases, meaning the interface status tends to improve. The absolute value reflects the speed of degradation or improvement.

[0106] S1073. When the degradation rate is positive and exceeds the preset rate threshold, obtain the number of multi-level linkage changes of the current statistical unit as the current linkage change frequency, calculate the difference between the preset continuous unusable frequency threshold and the current linkage change frequency, and divide the difference by the degradation rate to obtain the number of remaining statistical units.

[0107] The preset rate threshold refers to the lower limit for determining the degradation rate. When the degradation rate exceeds this value, the interface is considered to have a significant degradation trend. The current statistical unit refers to the statistical unit with the largest time sequence number in the linked change frequency sequence, i.e., the most recent time. The current linked change frequency refers to the number of multi-level linked changes within the current statistical unit. The preset continuous unavailability frequency threshold refers to the upper limit for the number of multi-level linked changes within a statistical unit. When the number of multi-level linked changes within a statistical unit reaches this value, the interface is considered to have entered a continuous unavailability state. The remaining number of statistical units refers to the number of statistical units required to increase from the current linked change frequency to the continuous unavailability frequency threshold according to the current degradation rate. For example, if the degradation rate is 0.886 times per statistical unit, the preset rate threshold is 0.5, the current linked change frequency is 7 times, and the continuous unavailability frequency threshold is 15 times, the difference is 15-7=8 times, and the remaining number of statistical units is 8 / 0.886≈9.03.

[0108] Specifically, the server compares the calculated degradation rate k with the value 0 to confirm it is positive, and then compares the degradation rate k with a preset rate threshold to confirm it exceeds the preset rate threshold. If both conditions are met, subsequent calculations are performed. The server reads the last element from the linkage change frequency sequence, i.e., the number of multi-level linkage changes corresponding to the current statistical unit, and assigns it as the current linkage change frequency F_current. The server reads the preset continuous unavailability frequency threshold F_threshold, performs a subtraction operation to obtain the difference ΔF_maintenance_domain = maintenance_domain F_threshold_maintenance_domain - maintenance_domain F_current. This difference represents the remaining frequency growth space before the current linkage change frequency reaches the continuous unavailability judgment threshold. The server divides the difference ΔF by the degradation rate k to obtain the remaining number of statistical units N_remain_maintenance_domain = maintenance_domain ΔF_maintenance_domain / maintenance_domain k. This value represents how many statistical units from the current moment, based on a linear trend of constant degradation rate, will cause the multi-level linkage change frequency of the interface to reach the continuous unavailability frequency threshold.

[0109] S1074. Calculate the remaining available time window based on the number of remaining statistical units and the duration of a single statistical unit.

[0110] The duration of a single statistical unit refers to the fixed time length set for each statistical unit when dividing the preset detection cycle. The remaining available time window refers to the total remaining time from the current moment until the interface is expected to reach a state of continuous unavailability, serving as a reference for available repair time provided to maintenance personnel in fault warnings. For example, if the number of remaining statistical units is 9.03 and the duration of a single statistical unit is 1 hour, then the remaining available time window is 9.03 multiplied by 1 hour, which equals 9.03 hours, or approximately 541.8 minutes.

[0111] Specifically, the server reads the duration of a single statistical unit, denoted as T_unit, and reads the remaining number of statistical units N_remain calculated in step S1073. The server performs a multiplication operation, multiplying the remaining number of statistical units by the duration of a single statistical unit to obtain the remaining available time window T_available (Operational Domain = Operational Domain N_remain Operational Domain × Operational Domain T_unit). This calculation converts the remaining degradation space, represented by the number of statistical units, into the remaining available time, represented by the actual time length, allowing operations personnel to intuitively grasp the time span required for the interface to deteriorate from its current degradation state to a continuously unavailable state. The server writes the remaining available time window T_available into the fault warning information as a time dimension parameter output for interface-level warnings, providing operations personnel with a clear time deadline for formulating maintenance plans and resource allocation, ensuring that maintenance responses are completed before the interface becomes completely unavailable.

[0112] The following provides a more detailed description of the process of the method provided in this implementation. Please refer to [link / reference]. Figure 2 This is another flowchart illustrating the interface fault early warning method based on state sequence statistical features in this application embodiment.

[0113] S201. Extract all status changes marked as multi-layer linkage changes within the preset observation window, and obtain the change time corresponding to each layer involved in the change in each multi-layer linkage change.

[0114] The preset observation window refers to the continuous time range selected from the detection period for trend analysis. Multi-layer linkage change refers to an event where, within the linkage determination time window, at least one of the layers other than the layer to which the change originates also undergoes a state change. The participating layers refer to all protocol layers that undergo state switching in the same multi-layer linkage change event, including two or three layers from the physical layer, IPv4 protocol layer, and IPv6 protocol layer. The change time refers to the precise timestamp of a layer's state value changing from available to unavailable or from unavailable to available. For example, if the physical layer undergoes a state switch at 10:00:01 and the IPv4 protocol layer undergoes a state switch at 10:00:03 in a multi-layer linkage change, then the participating layers are the physical layer and the IPv4 protocol layer, with corresponding change times of 10:00:01 and 10:00:03, respectively.

[0115] Specifically, the server filters out all state change events marked as multi-layered linked changes from all state change events within a preset observation window from the intermittent jitter interface. For each multi-layered linked change event, the server reads the initial change layer that triggered the event and its change time, while simultaneously retrieving the state changes and corresponding times of other layers within the linked determination time window. The server stores an ordered record of the layer identifiers and their respective change times in each multi-layered linked change event, forming a set of change participation records containing layer identifiers and corresponding times. Each record in this set represents all participating layer information in a multi-layered linked change event, for use in subsequent initial change layer analysis.

[0116] S202. For each multi-layer linkage change, the layer with the earliest change time among the participating layers is determined as the first change layer.

[0117] In this context, the first layer to change refers to the protocol layer that undergoes the first state transition in a multi-layered coordinated change event. This layer's change occurs earlier than the changes of other participating layers in the same event. For example, in a multi-layered coordinated change event, the physical layer changes at 10:00:01, the IPv4 protocol layer at 10:00:03, and the IPv6 protocol layer at 10:00:04. Since the physical layer's change occurs earliest, it is determined as the first layer to change in this multi-layered coordinated change event.

[0118] Specifically, the server iterates through all the change participation records of multi-layered linkage change events within the preset observation window. For each record, it compares the values ​​of each participating layer based on the change time, selecting the layer with the smallest change time value as the initial change layer for that multi-layered linkage change and recording its layer identifier. When two or more layers have the same change time, the server selects the initial change layer according to a fixed priority order: physical layer first, then IPv4 protocol layer, then IPv4 protocol layer first, then IPv6 protocol layer. The server performs the above comparison and determination operation for each multi-layered linkage change event, ultimately generating a sequence of initial change layer identifiers corresponding one-to-one with each multi-layered linkage change event. This sequence records the layer information that initiates the state switch first in each linkage change.

[0119] S203. Count the number of times the first change layer in all multi-layer linkage changes is the physical layer, and determine the physical layer first change rate by the ratio of the number of times to the total number of multi-layer linkage changes.

[0120] The number of times the initial change layer is the physical layer refers to the cumulative number of events in all multi-layer linkage change events where the initial change layer is the physical layer. The total number of multi-layer linkage changes refers to the total number of all multi-layer linkage change events within the preset observation window. The physical layer initial change rate is the ratio of the number of times the physical layer is the initial change layer to the total number of multi-layer linkage changes, ranging from 0 to 1. For example, if there are 20 multi-layer linkage changes within the preset observation window, and 15 of them have the physical layer as the initial change layer, then the physical layer initial change rate is 15 divided by 20, which equals 0.75.

[0121] Specifically, the server iterates through the initial change layer identifier sequence, setting an initial count of zero. Each time a record in the sequence has an initial change layer identifier that is the physical layer, the count is incremented. After the iteration, the number of times the initial change layer is the physical layer is denoted as C_phy. The server also obtains the total number of records in the initial change layer identifier sequence as the total number of multi-layered linked changes, denoted as C_total. The server divides C_phy by C_total to obtain the physical layer initial change rate R_phy (Operations Domain) = Operations Domain C_phy (Operations Domain) / Operations Domain C_total. This ratio reflects the frequency of the physical layer initiating changes first in multi-layered linked change events; the closer the ratio is to 1, the stronger the tendency for the physical layer to be the starting point for changes.

[0122] S204. When the initial occurrence rate of the physical layer is higher than the preset causal direction threshold, the root cause layer of the fault is determined to be the physical layer, and the physical layer is marked as the root cause layer of the fault in the fault warning.

[0123] The preset causal direction threshold refers to a pre-defined lower limit for the physical layer initialization rate. When the physical layer initialization rate exceeds this value, the physical layer is identified as the initiating layer of fault propagation. The root cause layer refers to the layer where the fundamental cause of multi-layer linkage changes is located, as determined by statistical analysis. The root cause layer identifier refers to the field information attached to the fault warning information to indicate the layer where the root cause is located. For example, if the preset causal direction threshold is 0.7, and the calculated physical layer initialization rate is 0.75, since 0.75 is higher than 0.7, the root cause layer is determined to be the physical layer.

[0124] Specifically, the server compares the calculated physical layer initialization rate R_phy with a preset causal direction threshold. When R_phy is greater than the preset causal direction threshold, the server determines that the physical layer is the root cause of the intermittent jitter interface's multi-layer linkage change, indicating that the intermittent physical layer failure propagates to the upper-layer IPv4 and IPv6 protocol layers, triggering a multi-layer synchronization state switch. The server adds a root cause field to the generated fault warning information and sets its value to the physical layer identifier, enabling maintenance personnel to directly identify the root cause of the fault as being at the physical layer when receiving a fault warning. This allows them to focus troubleshooting operations on physical layer maintenance measures such as physical link checks, optical module replacement, or cable connector reconnection.

[0125] S205. Determine the target network device where the intermittent jitter interface that outputs fault warning is located, and extract the state change records of each remaining interface on the target network device other than the intermittent jitter interface that outputs fault warning at the fault root cause layer from the multi-layer state time sequence.

[0126] The intermittent jitter interface that outputs fault warnings refers to the specific interface that has triggered a fault warning through the aforementioned steps. The remaining interfaces refer to all other interfaces on the target network device besides the intermittent jitter interface that has triggered a fault warning. The state change record at the root cause layer refers to all the times when the state value of the remaining interfaces changes from available to unavailable or from unavailable to available at the root cause layer. For example, if the target network device has 48 interfaces, and interface GE0 / 0 / 1 is the intermittent jitter interface that outputs fault warnings, then the remaining interfaces are GE0 / 0 / 2 to GE0 / 0 / 48, a total of 47 interfaces.

[0127] Specifically, the server queries the target network device identifier based on the interface identifier of the intermittent jitter interface that outputs fault warnings, obtains a complete list of all interfaces on that target network device, and excludes the intermittent jitter interfaces that have output fault warnings from the list to obtain the remaining interface set. The server locates the time-series data of each remaining interface from the multi-layer state time-series sequence set according to the device identifier and interface identifier, extracts the state sequence corresponding to the fault root cause layer, scans the state value changes of adjacent sampling points one by one, records the sampling time when the state value changes as a state change, and saves the change time and change direction, forming a set of state change records for each remaining interface at the fault root cause layer.

[0128] S206. Within the preset observation window, count the number of state changes of each remaining interface at the root cause layer of the fault, and identify the remaining interfaces whose number of state changes reaches the preset active threshold as associated abnormal interfaces.

[0129] The number of state changes for each remaining interface at the root cause layer refers to the cumulative number of state transitions that each remaining interface undergoes at the root cause layer within a preset observation window. Associated abnormal interfaces refer to remaining interfaces whose number of state changes reaches a preset active threshold. This indicates that the interface also exhibits abnormally active state transition behavior at the root cause layer, displaying similar physical layer degradation characteristics to the intermittent jitter interface that has triggered a fault warning on the same device. For example, if the preset active threshold is 5 times, and the remaining interface GE0 / 0 / 3 undergoes 7 physical layer state changes within the preset observation window (7 times is greater than 5), then GE0 / 0 / 3 is identified as an associated abnormal interface.

[0130] Specifically, the server extracts the state change records of each remaining interface at the root cause layer according to the start and end times of a preset observation window, retaining records whose change times fall within the observation window range. The number of state change records extracted for each remaining interface is counted as the state change count for that interface at the root cause layer. The server compares the state change count of each remaining interface with a preset active threshold. Remaining interfaces with a state change count greater than or equal to the preset active threshold are marked as associated abnormal interfaces and added to the associated abnormal interface list. Interfaces in this list that are located on the same target network device as the intermittent jitter interface that has triggered a fault warning and exhibit frequent state switching at the root cause layer indicate that the physical layer of these interfaces is also in a degraded state. Maintenance personnel must include associated abnormal interfaces in the maintenance scope when performing physical layer troubleshooting.

[0131] S207. The ratio of the number of associated abnormal interfaces to the total number of remaining interfaces is determined as the device-level fault propagation rate.

[0132] The number of associated abnormal interfaces refers to the total number of interfaces identified as associated abnormal interfaces after screening in step S206. The total number of remaining interfaces refers to the total number of interfaces on the target network device, excluding the intermittent jitter interface that has triggered a fault warning. The device-level fault propagation rate is the ratio of the number of associated abnormal interfaces to the total number of remaining interfaces. It measures the extent to which a fault spreads from a single interface to other interfaces within the same network device, and its value ranges from 0 to 1. For example, if the target network device has 48 interfaces, one of which is an intermittent jitter interface that has triggered a fault warning, the total number of remaining interfaces is 47, and the number of associated abnormal interfaces is 12, then the device-level fault propagation rate is approximately 0.255 (12 divided by 47).

[0133] Specifically, the server reads the number of interface entries from the associated abnormal interface list as the number of associated abnormal interfaces, denoted as N_abnormal. It reads the number of interface entries from the remaining interface set as the total number of remaining interfaces, denoted as N_remain. The server performs a division operation, dividing N_abnormal by N_remain to obtain the device-level fault spread rate R_spread (Operational Domain) = Operational Domain N_abnormal (Operational Domain) / Operational Domain N_remain. This ratio quantifies the coverage proportion of abnormal state switching behavior at the fault root cause layer spreading from the interface that triggered the warning to other interfaces on the same device. A larger ratio indicates a wider range of interfaces affected by the fault within the device, and a higher probability that the fault has evolved from a single interface-level problem into a device-level systemic problem.

[0134] S208. When the device-level fault propagation rate is higher than the preset propagation threshold, extract the moment when each associated abnormal interface first changes state at the root cause layer of the fault, and arrange them in chronological order to generate a fault propagation time sequence.

[0135] The preset diffusion threshold refers to a pre-set lower limit for judging the device-level fault diffusion rate. When the device-level fault diffusion rate exceeds this value, the fault is considered to have spread within the device. The first state change time refers to the timestamp corresponding to the first state switch of each associated abnormal interface at the fault root cause layer within the preset observation window. The fault diffusion time sequence refers to an ordered timestamp sequence formed by arranging the first state change times of each associated abnormal interface in chronological order. For example, if the preset diffusion threshold is 0.2, the device-level fault diffusion rate is 0.255 which is higher than 0.2, and the first change times of associated abnormal interfaces GE0 / 0 / 3 are 10:05, GE0 / 0 / 7 is 10:12, and GE0 / 0 / 15 is 10:18, then the fault diffusion time sequence is [10:05, 10:12, 10:18].

[0136] Specifically, the server compares the calculated device-level fault spread rate R_spread with a preset spread threshold. When R_spread is greater than the preset spread threshold, the server iterates through each interface in the list of associated abnormal interfaces and extracts the earliest record of the state change time from the root cause layer's state change records for each interface as the time when the interface first experienced a state change. After collecting the first state change times of all associated abnormal interfaces, the server sorts them in ascending order of timestamp values ​​to form a fault spread time sequence. This sequence reflects the time order in which the fault gradually spreads among the interfaces within the device, with earlier times in the sequence corresponding to interfaces affected by the fault earlier.

[0137] S209. Calculate the time interval between the first state change times of two adjacent associated abnormal interfaces in the fault propagation time sequence, and form a propagation interval sequence.

[0138] In this context, two adjacent associated abnormal interfaces refer to the timestamp entries corresponding to two consecutive interfaces in the fault propagation time sequence after being arranged chronologically. The time interval is the time difference obtained by subtracting the preceding timestamp from the subsequent timestamp in the fault propagation time sequence. The propagation interval sequence is an ordered numerical sequence composed of the time intervals between all adjacent timestamp pairs in the fault propagation time sequence, with a length equal to the length of the fault propagation time sequence minus one. For example, if the fault propagation time sequence is [10:05, 10:12, 10:18], then the first time interval is 10:12 minus 10:05, which equals 7 minutes; the second time interval is 10:18 minus 10:12, which equals 6 minutes; and the propagation interval sequence is [7 minutes, 6 minutes].

[0139] Specifically, the server reads the fault propagation time sequence, which contains n timestamps denoted as T_1, T_2, T_3 up to T_n, where T_1 is the earliest time and T_n is the latest time. Starting from the first position of the sequence, the server performs a difference operation on adjacent timestamps sequentially, calculating the first interval Δt_1 = (Operational Domain T_2 - Operational Domain T_1) for the first interval, T_3 = (Operational Domain T_3 - Operational Domain T_2) for the second interval, and so on until the (n-1)th interval Δt_(n-1) = (Operational Domain T_n - Operational Domain T_(n-1)). The server arranges all calculated time intervals sequentially to form a propagation interval sequence [Δt_1, Operational Domain Δt_2, Operational Domain ..., Operational Domain Δt_(n-1)], which contains a total of n-1 time interval values. The values ​​in the diffusion interval sequence reflect the time it takes for a fault to spread from one interface to the next; the smaller the value, the faster the fault spreads.

[0140] S210. Calculate the mean of the diffusion interval sequence as the average diffusion interval.

[0141] The mean of the diffusion interval sequence is the arithmetic mean obtained by summing all the time interval values ​​in the diffusion interval sequence and dividing by the number of time intervals. The average diffusion interval refers to the average time required for a fault to propagate from one interface to the next adjacent interface within the device; it is used to estimate the rate at which a fault continues to propagate to the remaining healthy interfaces. For example, if the diffusion interval sequence is [7 minutes, 6 minutes in the operations and maintenance field, 5 minutes in the operations and maintenance field], and the mean is (7+6+5) divided by 3 equals 6 minutes, then the average diffusion interval is 6 minutes.

[0142] Specifically, the server reads the diffusion interval sequence [Δt_1, Δt_2, ..., Δt_(n-1)], sums all the time interval values ​​in the sequence, and obtains the sum S_(Operational Domain) = Operational Domain Δt_1 Operational Domain + Operational Domain Δt_2 Operational Domain + ... Operational Domain + Operational Domain Δt_(n-1). The server obtains n-1 elements from the diffusion interval sequence, and divides the sum S by the number of elements n-1 to obtain the average diffusion interval T_avg_Operational Domain = Operational Domain S_Operational Domain / Operational Domain (n-1). This average diffusion interval represents the average time consumed for the fault to propagate to each new interface during the observed fault propagation process, serving as the basis for calculating the total time required for the subsequent prediction of the fault to continue propagating to the remaining normal interfaces.

[0143] S211. The difference between the total number of remaining interfaces and the number of associated abnormal interfaces is determined as the number of remaining normal interfaces, and the product of the number of remaining normal interfaces and the average propagation interval is determined as the device-level fault propagation time.

[0144] The remaining normal interfaces refer to the number of interfaces on the target network device that have not yet been identified as associated abnormal interfaces; that is, the difference between the total number of remaining interfaces and the number of associated abnormal interfaces. Device-level fault propagation time refers to the estimated total time required for a fault to propagate from its current state to cover all remaining normal interfaces, based on the current fault propagation rate. For example, if the total number of remaining interfaces is 47 and the number of associated abnormal interfaces is 12, then the number of remaining normal interfaces is 47 - 12 = 35; with an average propagation interval of 6 minutes, the device-level fault propagation time is 35 multiplied by 6, which equals 210 minutes.

[0145] Specifically, the server performs a subtraction operation, subtracting the number of associated abnormal interfaces N_abnormal from the total number of remaining interfaces N_remain to obtain the number of remaining normal interfaces N_normal. The operation domain is calculated as: operation domain N_remain - operation domain N_abnormal. The server then performs a multiplication operation, multiplying the number of remaining normal interfaces N_normal by the average propagation interval T_avg to obtain the device-level fault spread time T_spread. The operation domain is calculated as: operation domain N_normal × operation domain T_avg. This calculation logic is based on a linear extrapolation model where the fault propagates to each remaining normal interface at a fixed rate with an average propagation interval. This yields the total time required for the fault to completely cover all remaining normal interfaces on the device, providing maintenance personnel with an estimate of the available maintenance time window before overall device failure.

[0146] S212. Upgrade the fault warning level from interface-level warning to device-level warning, and re-output the updated remaining available time window using the smaller value between the device-level fault propagation time and the remaining available time window.

[0147] Interface-level warnings refer to warnings where the impact of a fault is limited to a single interface. Device-level warnings are higher-level warnings where the impact of a fault has expanded to multiple interfaces within the device, indicating that the fault has spread to a device level. The remaining available time window refers to the amount of time remaining from the current moment until the interface is expected to become completely unavailable, as previously output in the fault warning. The updated remaining available time window is the smaller of the device-level fault propagation time and the original remaining available time window. For example, if the original remaining available time window is 300 minutes and the device-level fault propagation time is 210 minutes, the smaller value of 210 minutes is used as the updated remaining available time window.

[0148] Specifically, the server modifies the warning level field value in the fault warning information from an interface-level warning to a device-level warning, indicating that the fault has escalated from intermittent jitter on a single interface to a systemic fault propagation event across the entire device. The server reads the remaining available time window T_remain output in the previous fault warning and compares it with the calculated device-level fault propagation time T_spread. The smaller value, min(T_remain, T_spread in the operational domain), is taken as the updated remaining available time window. The server writes the updated remaining available time window into the corresponding field of the fault warning information, replacing the original value, and re-outputs the fault warning information containing the device-level warning level and the updated remaining available time window. Taking the smaller value aims to employ a more stringent time constraint; whether a single interface degrades and exhausts its remaining available time or a device-level fault propagates and covers all interfaces, the earlier time point is used as the deadline for the operational response.

[0149] The server in the embodiments of this invention is described below from the perspective of hardware processing. Please refer to [link / reference]. Figure 3 This is a schematic diagram of the physical device structure of a server in an embodiment of this application.

[0150] It should be noted that, Figure 3 The server structure shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0151] like Figure 3 As shown, the server includes a CPU 301, which can perform various appropriate actions and processes according to a program stored in ROM 302 or a program loaded into RAM 303 from storage section 308, such as performing the methods described in the above embodiments. RAM 303 also stores various programs and data required for system operation. CPU 301, ROM 302, and RAM 303 are interconnected via bus 304. I / O interface 305 is also connected to bus 304.

[0152] The following components are connected to I / O interface 305: input section 306 including audio input devices, push-button switches, etc.; output section 307 including liquid crystal display (LCD) and audio output devices, indicator lights, etc.; storage section 308 including hard disks, etc.; and communication section 309 including network interface cards such as LAN (Local Area Network) cards, modems, etc. Communication section 309 performs communication processing via a network such as the Internet. Drive 310 is also connected to I / O interface 305 as needed. Removable media 311, such as disks, optical disks, magneto-optical disks, semiconductor memories, etc., are installed on drive 310 as needed so that computer programs read from them can be installed into storage section 308 as needed.

[0153] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing computer programs for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 309, and / or installed from removable medium 311. When the computer program is executed by CPU 301, it performs the various functions defined in the present invention.

[0154] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, program segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those shown in the drawings.

[0155] Specifically, the server in this embodiment includes a processor and a memory. The memory stores a computer program. When the computer program is executed by the processor, it implements the interface fault early warning method based on state sequence statistical features provided in the above embodiment.

[0156] In another aspect, the present invention also provides a computer-readable storage medium, which may be included in the server described in the above embodiments; or it may exist independently and not assembled into the server. The storage medium carries one or more computer programs that, when executed by a processor of the server, cause the server to implement the interface fault early warning method based on state sequence statistical characteristics provided in the above embodiments.

[0157] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0158] As used in the above embodiments, depending on the context, the term "when..." can be interpreted as meaning "if...", "after...", "in response to determining...", or "in response to detecting...". Similarly, depending on the context, the phrase "when determining..." or "if (the stated condition or event) is interpreted as meaning "if determining...", "in response to determining...", "when (the stated condition or event) is detected", or "in response to detecting (the stated condition or event)".

Claims

1. A method for early warning of interface faults based on statistical features of state sequences, characterized in that, Applied to a server, the method includes: The physical layer status, IPv4 protocol layer status, and IPv6 protocol layer status of each interface of the target network device are collected in parallel according to the preset sampling period, and a multi-layer status time sequence is generated by aligning the sampling time. Based on the multi-layer state time sequence, interfaces whose state change count reaches a preset active threshold and whose availability is higher than a preset health threshold are identified as intermittent jitter interfaces. Iterate through each state change of the intermittent jitter interface, and mark it as a multi-layer linkage change or a single-layer independent change according to whether the other layers change synchronously within the preset linkage determination time window. The system is divided into segments according to preset statistical units. The number of occurrences of multi-level linkage changes within each statistical unit is counted to obtain a linkage change frequency time series. The linkage synchronization rate is calculated based on the ratio of the number of multi-level linkage changes within each statistical unit to the total number of changes, and the linkage synchronization rate time series is obtained. Within the preset observation window, when the linkage synchronization rate is continuously higher than the preset linkage threshold, the linkage change frequency time series is determined as the deterioration trend fitting object. The degradation rate is obtained by performing a linear fit on the degradation trend fitting object according to the time series. When the degradation rate is positive and exceeds the preset rate threshold, the remaining available time window is calculated based on the degradation rate, the current linkage change frequency and the preset continuous unavailability frequency threshold, and the remaining available time window and fault warning are output.

2. The method according to claim 1, characterized in that, The step of identifying interfaces whose state change count reaches a preset active threshold and whose availability is higher than a preset health threshold as intermittent jitter interfaces based on the multi-layer state time sequence specifically includes: Within a preset detection period, the number of times the physical layer state, IPv4 protocol layer state, and IPv6 protocol layer state change from available to unavailable for each interface in the multi-layer state time sequence is counted, and the ratio of the number of sampling points in the physical layer state, IPv4 protocol layer state, and IPv6 protocol layer state in the available state to the total number of sampling points is calculated as the availability rate of each layer. For interfaces whose state change count reaches the preset active threshold and whose availability at each layer is higher than the preset health threshold, the time interval between two consecutive state changes at each layer is extracted to form a change interval sequence. Calculate the mean and standard deviation of the change interval sequence, and determine the ratio of the standard deviation to the mean as the change interval variation coefficient; Interfaces with a change interval variation coefficient greater than a preset discrete threshold are identified as intermittent jitter interfaces.

3. The method according to claim 1, characterized in that, The step of traversing each state change of the intermittent jitter interface and marking it as a multi-layer linkage change or a single-layer independent change according to whether other layers change synchronously within a preset linkage determination time window specifically includes: Iterate through each state change of the intermittent jitter interface in the multi-layer state time sequence, and extract the change time and the layer to which the change belongs for each state change; Taking the change time as the center, extend it forward and backward by half the duration of the preset linkage judgment time window to determine the linkage detection time range; Within the aforementioned linkage detection time range, search for any state changes in layers other than the layer to which the change belongs; When the number of layers with state changes in the remaining layers within the linkage detection time range is not less than one, the state change corresponding to the change time is marked as the multi-layer linkage change; When there is no state change in the other layers within the linkage detection time range, the state change corresponding to the change time is marked as the single-layer independent change, and the layer to which the change belongs is recorded.

4. The method according to claim 1, characterized in that, The steps of performing linear fitting on the degradation trend fitting object according to time sequence to obtain the degradation rate, and calculating the remaining available time window based on the degradation rate, the current linkage change frequency, and the preset continuous unavailability frequency threshold when the degradation rate is positive and exceeds a preset rate threshold, and outputting the remaining available time window and fault warning, specifically include: Extract the number of multi-level linkage changes corresponding to each statistical unit in the degradation trend fitting object, and generate a linkage change frequency sequence according to the time sequence of each statistical unit. Using the time series number of each statistical unit in the frequency sequence of the linkage change as the independent variable and the corresponding number of multi-level linkage changes as the dependent variable, least squares linear fitting is performed to obtain the slope and intercept of the fitted line, and the slope of the fitted line is determined as the degradation rate. When the degradation rate is positive and exceeds the preset rate threshold, the number of multi-level linkage changes of the current statistical unit is obtained as the current linkage change frequency. The difference between the preset continuous unavailability frequency threshold and the current linkage change frequency is calculated. The difference is divided by the degradation rate to obtain the number of remaining statistical units. The remaining available time window is calculated based on the number of remaining statistical units and the duration of a single statistical unit.

5. The method according to claim 1, characterized in that, After the step of outputting the remaining available time window and fault warning, the method further includes: Extract all state changes marked as multi-layer linkage changes within the preset observation window, and obtain the change time corresponding to each layer involved in the change in each multi-layer linkage change; For each multi-layer linkage change, the layer with the earliest change time among all participating layers is determined as the first change layer; The number of times the first change layer in all the multi-layer linkage changes is the physical layer is counted, and the ratio of the number of times is the physical layer to the total number of multi-layer linkage changes is determined as the physical layer first change rate. When the initial occurrence rate of the physical layer is higher than the preset causal direction threshold, the root cause layer of the fault is determined to be the physical layer, and an identifier indicating that the physical layer is the root cause layer of the fault is added to the fault warning.

6. The method according to claim 5, characterized in that, After the step of determining that the root cause layer of the fault is the physical layer, the method further includes: The target network device where the intermittent jitter interface that outputs the fault warning is located is determined, and the state change records of each remaining interface on the target network device other than the intermittent jitter interface that outputs the fault warning are extracted from the multi-layer state time sequence at the fault root cause layer. Within the preset observation window, the number of state changes of each of the remaining interfaces at the root cause layer of the fault is counted, and the remaining interfaces whose number of state changes reaches the preset active threshold are identified as associated abnormal interfaces. The ratio of the number of associated abnormal interfaces to the total number of remaining interfaces is determined as the device-level fault propagation rate; When the device-level fault propagation rate is higher than the preset propagation threshold, the warning level of the fault warning is upgraded from the interface-level warning to the device-level warning, and the device-level warning and the remaining available time window are re-output.

7. The method according to claim 6, characterized in that, The step of raising the warning level of the fault warning from the interface level warning to the device level warning when the device-level fault propagation rate is higher than the preset propagation threshold, and re-outputting the device-level warning along with the remaining available time window, specifically includes: When the device-level fault propagation rate is higher than the preset propagation threshold, the moment when each of the associated abnormal interfaces first changes its state at the fault root cause layer is extracted and arranged in chronological order to generate a fault propagation time sequence. Calculate the time interval between the first state change times of two adjacent associated abnormal interfaces in the fault propagation time sequence, and form a propagation interval sequence; The mean of the diffusion interval sequence is calculated as the average diffusion interval; The difference between the total number of remaining interfaces and the number of associated abnormal interfaces is determined as the number of remaining normal interfaces, and the product of the number of remaining normal interfaces and the average diffusion interval is determined as the device-level fault propagation time. The warning level of the fault warning is upgraded from the interface-level warning to the device-level warning, and the smaller value between the device-level fault propagation time and the remaining available time window is used as the updated remaining available time window and re-output.

8. A server, characterized in that, The server includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code including computer instructions, and the one or more processors call the computer instructions to cause the server to perform the method as described in any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that, When the instructions are executed on the server, the server causes the server to perform the method as described in any one of claims 1-7.

10. A computer program product, characterized in that, When the computer program product is run on the server, the server performs the method as described in any one of claims 1-7.

Images