A network operation risk assessment and failure collapse early warning method and system
Patent Information
- Application Number
- CN202610981623.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-02
- Publication Date
- 2026-09-15
Smart Images
Figure CN122764784A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of communication network operation and maintenance technology, specifically to a method and system for network operation risk assessment and fault collapse early warning. Background Technology
[0002] Modern communication networks, cloud platforms, and critical digital infrastructure are constantly exposed to various adversarial disturbances, including attack traffic, routing disturbances, node compromises, service overload, and misconfigurations. Resilience, broadly defined as a system's ability to withstand, adapt to, and recover from network attacks and failures, has therefore become a core concern for trusted and secure network systems. In practice, network crashes are rarely triggered by a single, isolated event. Instead, localized degradation can lie dormant for a period, propagating through structural dependencies and ultimately leading to large-scale service outages. This behavior is closely related to the critical transition phenomenon prevalent in complex systems: a system may appear stable just before a tipping point, but can suddenly enter a degraded state. For network operators, the key questions are therefore not only whether the network will fail, but also how far the system is from a crash, how degradation propagates, and which components should be prioritized for protection.
[0003] Existing research on network resilience and security analysis generally follows two lines of thought. The first line is based on theoretical modeling using statistical physics, nonlinear dynamics, and complex network theory. These models have clear analytical structures, but typically rely on highly simplified assumptions, making them difficult to directly apply to noisy, fine-grained measurement data in large-scale, heterogeneous networks. The second line, given recent telemetry data, trains temporal or graph neural network models to directly predict resilience scores or failure probabilities at a target time. However, these discrete-time predictors offer limited insights into operational issues such as how local degradation propagates, when the network enters an unstable state, and which components bear primary responsibility for a collapse.
[0004] Resilience is a latent variable. Operational data records traffic, latency, packet loss, routing changes, and service-level metrics, but these observations do not directly provide node-level resilience status. Therefore, practical models must be able to infer meaningful resilience representations from noisy, heterogeneous telemetry.
[0005] The crashes are coupled. The degradation of a node may not only stem from its own local stress, but also from the failure of neighboring nodes, traffic rerouting, or congestion of shared resources. The model must characterize this time-varying dependency, rather than treating nodes in isolation.
[0006] Instability is nonlinear. A network can absorb fluctuations and maintain its function under mild perturbations; however, once the stress exceeds a certain critical range, the same system may quickly jump into a degenerate state.
[0007] Furthermore, network resilience degradation often exhibits critical transition characteristics—the system may maintain surface stability for a long time before being pushed across a certain degradation boundary. Characterizing this behavior requires modeling trajectories and transition boundaries, rather than just predicting the "next step." However, current technologies are significantly inadequate in these aspects. Summary of the Invention
[0008] To address the aforementioned problems, the present invention aims to provide a method and system for network operation risk assessment and fault collapse early warning. This method infers network resilience from noisy, heterogeneous network telemetry data and learns its continuous-time dynamic evolution, thereby not only predicting whether the network will collapse, but also estimating the network's margin before collapse, identifying the most vulnerable nodes, and providing early warning signals before severe performance degradation manifests. The technical solution is as follows:
[0009] A method for network operation risk assessment and failure / collapse early warning includes the following steps:
[0010] Step 1: Acquire network telemetry data and network dependency snapshots of the target communication network within the observation time window;
[0011] Step 2: Based on the network telemetry data and network dependency snapshots, infer the node resilience index of each network node, which characterizes the ability of a network node to maintain its function under adversarial disturbances.
[0012] Step 3: Using a spatiotemporal graph encoder, based on the network telemetry data, node resilience index, and network dependency snapshot, encode the spatiotemporal evidence vector of each network node, and construct the time-varying dependency matrix and time-varying dynamic parameters based on the spatiotemporal evidence vector;
[0013] Step 4: Construct a continuous-time ordinary differential equation. The right-hand side of the continuous-time ordinary differential equation includes a local degradation term, a network coupling term, and an attack-induced perturbation term. The local degradation term characterizes the resilience decay trend of each network node, the network coupling term describes the resilience interaction between network nodes based on the time-varying dependency matrix, and the attack-induced perturbation term drives the node resilience to decrease based on adversarial perturbation signals.
[0014] Step 5: Based on the resilience evolution trajectory induced by the ordinary differential equation, estimate the resilience margin of the target communication network. The resilience margin represents the minimum additional disturbance required to push the current network state past the preset collapse boundary.
[0015] Step 6: Based on the resilience margin, calculate the contribution of each network node to the decay of the resilience margin, and identify network nodes whose contribution exceeds a preset threshold as vulnerable nodes.
[0016] Step 7: When the resilience margin is lower than the preset warning threshold, an early warning signal for a collapse is generated, and the warning signal contains the identification information of the vulnerable node.
[0017] A network operation risk assessment and failure / collapse early warning system includes:
[0018] The data acquisition module is used to acquire network telemetry data and network dependency snapshots of the target communication network within the observation time window;
[0019] The resilience inference module is used to infer the node resilience index of each network node based on the network telemetry data and the network dependency snapshot. The node resilience index characterizes the ability of a network node to maintain its function under adversarial disturbances.
[0020] The spatiotemporal coding module is used to perform spatiotemporal dependency coding on the node resilience index and the network dependency snapshot using a spatiotemporal graph encoder to obtain spatiotemporal coding features that characterize the dynamic dependency relationship between nodes.
[0021] The dynamic modeling module is used to construct continuous-time ordinary differential equations based on the spatiotemporal coding features. The continuous-time ordinary differential equations characterize local degradation terms, network coupling terms, and attack-induced perturbation terms in a unified dynamic form. The local degradation terms characterize the resilience decay trend of each network node itself, the network coupling terms characterize the resilience interaction between adjacent network nodes, and the attack-induced perturbation terms characterize the driving effect of adversarial perturbations on the resilience of network nodes.
[0022] The margin estimation module is used to estimate the resilience margin of the target communication network based on the resilience evolution trajectory induced by the ordinary differential equation. The resilience margin represents the minimum additional disturbance required to push the current network state over the preset collapse boundary.
[0023] The node identification module is used to calculate the contribution of each network node to the decay of the resilience margin based on the resilience margin, and identify network nodes whose contribution exceeds a preset threshold as vulnerable nodes.
[0024] The early warning output module is used to generate an early collapse warning signal when the resilience margin is lower than a preset early warning threshold. The early warning signal contains the identification information of the vulnerable node.
[0025] Compared with the prior art, the present invention has the following beneficial effects:
[0026] 1) This invention infers the node resilience index by fusing two types of heterogeneous degradation evidence, statistical deviation and reconstruction error, from network telemetry data. This avoids the limitations of manually defining a single resilience metric and can learn meaningful resilience representations from noisy and heterogeneous telemetry.
[0027] 2) This invention captures the structural dependencies between nodes that evolve over time by using a spatiotemporal graph encoder, and constructs a time-varying dependency matrix to characterize the degradation propagation path that changes over time, thus solving the problem that fixed topology models are difficult to cope with dynamic network dependency changes.
[0028] 3) This invention models resilience evolution as a continuous-time ordinary differential equation, which simultaneously represents the three structured components of local degradation, network coupling and attack-induced perturbation in a unified dynamic form. Compared with discrete-time predictors, it can provide in-depth operational insights such as how far the system is from collapse and who is most vulnerable.
[0029] 4) Based on the learned dynamics, this invention estimates the resilience margin, measures the distance between the current network state and the collapse boundary by searching for the minimum disturbance vector, and calculates the contribution of each node to the margin decay to locate vulnerable nodes, providing an operable decision basis for intelligent operation and maintenance and proactive defense of communication networks. Attached Figure Description
[0030] Figure 1 This is a schematic diagram of the overall process of NET-ODE for modeling network collapse under adversarial dynamics. Detailed Implementation
[0031] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.
[0032] This invention studies network collapse from a dynamic perspective, observing that resilience degradation often exhibits structured evolution rather than isolated state changes. Specifically, a network may remain functionally stable under slight perturbations, but once adversarial effects push the system beyond a certain critical range, it rapidly enters a degenerate state. Inspired by this, this invention proposes the NET-ODE (Network Ordinary Differential Equation) framework to understand network collapse under adversarial dynamics. NET-ODE first estimates the potential node-level resilience state from network telemetry data, and then uses a spatiotemporal graph encoder to characterize the time-varying dependencies between nodes. Based on this characterization, NET-ODE learns a continuous-time ordinary differential equation to model local degradation, network coupling, and attack-induced perturbations in a unified dynamic form. The learned dynamics enable NET-ODE not only to predict whether the network will fail, but also to assess how close the current network state is to the collapse boundary, identify vulnerable regions, and provide early warning signals before severe performance degradation manifests by analyzing the evolution process induced by the learned equation. Extensive experiments on network attack datasets demonstrate that NET-ODE possesses strong trajectory modeling capabilities and cross-domain transferability, while also generating interpretable dynamics that reveal resilience degradation and fault propagation patterns under adversarial conditions.
[0033] An embodiment of the present invention: a method for network operation risk assessment and failure / collapse early warning, comprising the following steps:
[0034] Step 1: Acquire network telemetry data and network dependency snapshots of the target communication network within the observation time window;
[0035] Step 2: Based on the network telemetry data and network dependency snapshots, infer the node resilience index of each network node, which characterizes the ability of a network node to maintain its function under adversarial disturbances.
[0036] Step 3: Using a spatiotemporal graph encoder, based on the network telemetry data, node resilience index, and network dependency snapshot, encode the spatiotemporal evidence vector of each network node, and construct the time-varying dependency matrix and time-varying dynamic parameters based on the spatiotemporal evidence vector;
[0037] Step 4: Construct a continuous-time ordinary differential equation. The right-hand side of the ordinary differential equation includes a local degradation term, a network coupling term, and an attack-induced perturbation term. The local degradation term characterizes the resilience decay trend of each network node, the network coupling term describes the resilience interaction between network nodes based on the time-varying dependency matrix, and the attack-induced perturbation term drives the node resilience to decrease based on adversarial perturbation signals.
[0038] Step 5: Based on the resilient evolution trajectory induced by the ordinary differential equation dynamic model, estimate the resilience margin of the target communication network. The resilience margin represents the minimum additional disturbance required to push the current network state past the preset collapse boundary.
[0039] Step 6: Based on the resilience margin, calculate the contribution of each network node to the decay of the resilience margin, and identify network nodes whose contribution exceeds a preset threshold as vulnerable nodes.
[0040] Step 7: When the resilience margin is lower than the preset warning threshold, an early warning signal for a collapse is generated, and the warning signal contains the identification information of the vulnerable node.
[0041] 1. System Modeling and Problem Formalization
[0042] This embodiment provides a method for network operation risk assessment and failure / collapse early warning. Consider a communication network that provides continuous service under benign traffic, operational disturbances, and adversarial disturbances. This network is represented as a time-varying graph. ,in, This refers to network entities such as routers, servers, services, or management domains. Indicates in Momentary communication, routing, or functional dependencies.
[0043] Each network node Associated telemetry observations This includes metrics such as traffic, latency, packet loss, error rate, service response, routing changes, and attack-related metrics when available.
[0044] The system state is not a binary failure label, but rather a potentially resilient state. For each node... Let its toughness state be denoted as A higher value indicates stronger node resilience; a lower value indicates more severe degradation. Network-level resilience is denoted as:
[0045] (1);
[0046] A network crash event is considered to have occurred when a system slides from a functional state into a degraded state, causing service-level functions to be unable to be maintained within an acceptable range.
[0047] Defense refers to the ability of network operators, security analysts, or monitoring systems to receive time-series telemetry from the network. Defenders can observe node-level measurements, aggregated traffic statistics, service-level metrics, and some dependency information, such as routing relationships, traffic correlations, or communication graphs. These observations may be noisy and incomplete, and the true resilience state may vary. It is not directly observable.
[0048] The goal of defenders is not merely to detect current attacks or predict resilience values in the next moment. Instead, defenders seek to answer the following three operational questions:
[0049] How does degradation spread? Defenders need to understand whether local degradation remains localized or has already spread across network dependencies.
[0050] How close is the system to collapse? A network may appear normal on the surface, but it may already have almost no room to withstand additional disturbances. Therefore, defenders need signals of impending collapse, not just future risk scores.
[0051] Where should interventions be prioritized? When resources are limited, defenders need to identify the nodes or regions that contribute the most to the propagation of instability.
[0052] Given a sequence of network observations:
[0053] (2);
[0054] in, Indicates telemetry, Indicates dependence derived from observation or inference. This represents the adversarial perturbation signal when it is available. Our goal is to learn a dynamic model that characterizes the resilience evolution.
[0055] The goal of the defender is to learn a dynamic model that characterizes the evolution of resilience. This includes the following three sub-tasks:
[0056] The first subtask is to infer the potential resilience state. The state estimator maps recent network telemetry and dependency information to node-level resilience states, as shown in the following equation:
[0057] (3);
[0058] in, Map recent telemetry and dependency information to node-level resilience states.
[0059] The second subtask is to learn continuous-time resilience dynamics. This involves learning a continuous-time ordinary differential equation to characterize how local degradation, network coupling, and adversarial perturbations jointly drive resilience evolution. The equation is shown below:
[0060] (4);
[0061] in, To characterize how local degradation, network coupling, and adversarial perturbations jointly drive resilient evolution.
[0062] The third subtask is to estimate the crash proximity. Let the crash indicator function be denoted as... ,in >0 indicates the functional status. ≤0 indicates a degenerate state. NET-ODE estimates a finite time-domain resilience margin. The smaller the margin, the smaller the additional disturbance that can cause the current trajectory to enter a degenerate state.
[0063] (5);
[0064] in, This represents the trajectory induced by the learned dynamics. For the early warning time domain.
[0065] 2. NET-ODE Framework Overview
[0066] Based on the formalization of the above problems, NET-ODE implements the following three functions: (i) inferring potential resilience states from noisy network telemetry; (ii) learning adversarial resilience dynamics from spatiotemporal evidence; and (iii) estimating dynamics-based resilience margins for collapse warning.
[0067] Given recent telemetry With dependency snapshot NET-ODE first infers the node-level resilience state. Then, we learn continuous-time dynamics:
[0068] (6);
[0069] in, Characterizing the time-varying dependency matrix, Indicates a counter-disturbance signal. These are time-varying parameters generated from spatiotemporal evidence. The learned dynamics are used to reconstruct the resilient trajectory and estimate the distance between the current trajectory and the collapse.
[0070] 3. Toughness State Estimator
[0071] The defender observes telemetry, not the actual resilience state. Therefore, the first component of NET-ODE maps recent telemetry and dependency information to potential node-level resilience states:
[0072] (7);
[0073] in, For learnable state estimators, This is the length of the observation window.
[0074] Evidence Fusion: The estimator fuses two types of degradation evidence. The first is statistical bias, which measures the degree of deviation of the current telemetry from historical low-stress behavior. The second is learned anomalous evidence, derived from reconstruction or representation errors, which captures nonlinear degradation patterns. Instead of manually defining a single resilience metric, we allow NET-ODE to learn how to fuse these heterogeneous signals into a bounded latent state:
[0075] (8);
[0076] in, It is a bounded activation function. . The larger the value, the stronger the node's resilience; the smaller the value, the more severe the degradation.
[0077] Role in NET-ODE: This module does not attempt to classify attack types. Its purpose is to provide a continuous state variable for dynamic learning. By transforming noisy telemetry into node-level resilient states, subsequent ODEs can model how degradation evolves, rather than simply predicting discrete failure labels.
[0078] 4. Spatiotemporal graph encoder
[0079] Static structures alone are insufficient to capture the dynamic evolution of resilience. Therefore, NET-ODE constructs a spatiotemporal graph encoder to extract meaningful spatiotemporal evidence from sliding window observations.
[0080] 1) Construction of spatiotemporal evidence. For each node i, the historical telemetry sequence of each time step within the observation time window is constructed. Node status and dynamic dependency graph Encoded as a spatiotemporal evidence vector :
[0081] (9);
[0082] in, It summarizes the spatiotemporal evidence of all nodes. (·) represents a parametric spatio-temporal encoder. All its learnable parameters are used to fuse historical telemetry sequences. Node status and dynamic dependency graph Generate implicit representations of nodes .
[0083] 2) Dynamic dependency construction. Based on NET-ODE constructs a time-varying dependency matrix:
[0084] (10);
[0085] in, (·) is a dynamic graph structure learning network based on multi-head attention. It adaptively calculates edge weights based on the correlation between node representations and dynamically infers the network dependencies at each time step.
[0086] This design enables the model to characterize degradation propagation paths that change over time, rather than relying on a fixed topology.
[0087] 3) Parameter generation. The same representation is also used to generate time-varying ODE parameters:
[0088] (11);
[0089] in, (·) is a parameter A parameterized mapping network is used to map the spatiotemporal evidence vectors of each network node to node-specific degenerate behavior parameters of the ordinary differential equation.
[0090] This design allows nodes to share a common dynamic form while maintaining different degradation thresholds, coupling sensitivities, and attack responses.
[0091] 5. Resistance Toughness Dynamics
[0092] NET-ODE decomposes resilience evolution into three structured components:
[0093] (12);
[0094] in, For the aforementioned local degradation term, For the network coupling term, This refers to the attack-induced perturbation term. Each term will be described in detail below.
[0095] (1) Local degradation. Nodes can maintain their function under mild stress, but once their toughness drops below a certain critical range, they may rapidly slide into a degraded state. This invention models this nonlinear local behavior as follows:
[0096] (13);
[0097] in, This represents the local evolution intensity coefficient of the i-th network node. This represents the node-specific degradation threshold for the i-th network node; Let i be the node resilience index of network node i.
[0098] This provides a compact parameterization of nonlinear degradation and recovery behavior without assuming that all networks follow a fixed, handcrafted physical law.
[0099] (2) Network propagation. A node's resilience can be influenced by its neighbors: healthy neighbors can absorb local stress, while degraded neighbors can accelerate the propagation of instability. This invention models this effect as follows:
[0100] (14);
[0101] The first term captures the diffusion effect of dynamic dependencies; if the neighboring system is more resilient, then ( If positive, this term provides a stabilizing effect on the node; if the neighbor's resilience is lower, it accelerates the node's degradation. The second term captures the degradation pressure from low-resilience neighbors; the lower the neighbor's resilience, the greater the degradation pressure. The larger the value, the stronger the degradation pressure. This form allows NET-ODE to express both stabilizing interactions and cascading degradation.
[0102] (3) Adversarial perturbations. Attacks directly weaken node resilience. Given the perturbation strength... ,definition:
[0103] (15);
[0104] in, This indicates the node's specific attack sensitivity. It is a bounded response function. In the implementation, It limits the impact on already compromised nodes while allowing attacks to be more effective while the nodes are still functional.
[0105] (4) Trajectory generation. After the three components are merged, NET-ODE generates a tough trajectory by solving ODE.
[0106] (16);
[0107] The resulting trajectories were used for state reconstruction and crash-oriented analysis.
[0108] 6. Approximation of toughness margin based on dynamics
[0109] Trajectory modeling can provide estimates of future states, but it does not directly indicate how much additional perturbation the network can withstand before collapse. Therefore, this invention utilizes learned ODEs to perform finite-time domain collapse proximity analysis. For crash indicator functions: >0 indicates the functional status. ≤0 indicates a degenerate state. Given the current state. By searching for a minimum perturbation in the time domain H that can push the ODE-induced trajectory across the collapse boundary. Approximate toughness margin :
[0110] (17);
[0111] in, This is obtained by minimizing the following penalty objective:
[0112] (18);
[0113] Here This represents the trajectory induced by the learned ODE. , Control the intensity of punishment for failing to cross the collapse boundary. The smaller the value, the less tolerance margin the network has before it enters a degraded state.
[0114] Vulnerable node identification. Sensitivity of the margin estimated by NET-ODE calculation to identify which nodes contribute most to instability:
[0115] (19);
[0116] Larger nodes have a greater impact on remaining capacity and are considered vulnerable components. They can be prioritized for defense, resource allocation, or traffic rerouting.
[0117] 7. Model Optimization
[0118] The training objective of NET-ODE is to reconstruct the observed resilient trajectory and keep the learned dynamics bounded and stable.
[0119] 1) Trajectory reconstruction. The primary objective is trajectory consistency.
[0120] (20);
[0121] in, Indicates the resilience state of the reconfiguration. The observation represents the resilience state, and T represents the time step of the trajectory.
[0122] 2) Dynamic regularization. To ensure the legitimacy of state evolution, the generated states are constrained to the [0,1] interval, and rapid parameter fluctuations are regularized:
[0123] (twenty one);
[0124] in, Punishment exceeding the limits of legal resilience The regularization strength controls the smoothness of the parameters.
[0125] 3) Margin-aware supervision. When labeled degenerate or near-collapse fragments exist, near-collapse states are encouraged to have smaller margins than functional states:
[0126] (twenty two);
[0127] in, This indicates a degraded or near-collapsed sample. Indicates functional samples, This is the margin spacing. If this type of supervision is not available, this item is omitted.
[0128] 4) Overall Goal. The final training goal is the weighted sum of the above three items:
[0129] (twenty three);
[0130] in, and These are the preset weighting coefficients.
[0131] After training, NET-ODE uses the learned dynamics to reconstruct the resilience trajectory, estimate the resilience margin, and identify vulnerable nodes under adversarial perturbations. In practical deployments, the parameters of NET-ODE can be jointly optimized through backpropagation and the ODE adjoint sensitivity method.
[0132] 8. Node resilience index
[0133] Based on the network telemetry data, the statistical deviation of the current network node characteristics from the preset normal reference distribution is calculated to obtain statistical deviation evidence. :
[0134] (twenty four);
[0135] in, Let represent the node characteristics of network node i at time t. The mean vector of the preset normal reference distribution. Let be the covariance matrix.
[0136] The current network node features are input into the autoencoder, and deep anomaly evidence is obtained based on the reconstruction error between the autoencoder's output and input. :
[0137] (25);
[0138] in, (·) represents the encoder. (·) represents the decoder.
[0139] The statistical bias evidence and the deep anomaly evidence are weighted and fused, and the fusion result is mapped to a preset bounded interval through a bounded activation function to obtain the node resilience index of each network node i at time t. :
[0140] (26);
[0141] in, (·)and (·) represents a learnable transformation function. To integrate weights, (·) is the sigmoid activation function.
[0142] NET-ODE can be deployed in the network operations center or security operations center of a communication network, integrated into existing network monitoring platforms as a software module. The system periodically collects network telemetry data and network dependency snapshots, inputs them into the NET-ODE framework, and outputs node-level resilience indices, resilience margin estimates, and identification information of vulnerable nodes. When the resilience margin is detected to be lower than a preset warning threshold, the system issues an early warning signal to network operations personnel, suggesting that priority should be given to hardening defenses, reallocating resources, or rerouting traffic to the vulnerable nodes.
[0143] Another embodiment of the present invention: a network operation risk assessment and failure crash early warning system, comprising:
[0144] The data acquisition module is used to acquire network telemetry data and network dependency snapshots of the target communication network within the observation time window. The network telemetry data includes at least one of the following: traffic, latency, packet loss, and service level indicators of each network node. The network dependency snapshots characterize the communication routing or functional dependency relationships between each network node.
[0145] The resilience inference module is used to infer the node resilience index of each network node based on the network telemetry data and the network dependency snapshot. The node resilience index characterizes the ability of a network node to maintain its function under adversarial disturbances.
[0146] The spatiotemporal coding module is used to perform spatiotemporal dependency coding on the node resilience index and the network dependency snapshot using a spatiotemporal graph encoder to obtain spatiotemporal coding features that characterize the dynamic dependency relationship between nodes.
[0147] The dynamic modeling module is used to construct continuous-time ordinary differential equations based on the spatiotemporal coding features. The ordinary differential equations characterize local degradation terms, network coupling terms, and attack-induced perturbation terms in a unified dynamic form. The local degradation terms characterize the resilience decay trend of each network node, the network coupling terms characterize the resilience interaction between adjacent network nodes, and the attack-induced perturbation terms characterize the driving effect of adversarial perturbations on the resilience of network nodes.
[0148] The margin estimation module is used to estimate the resilience margin of the target communication network based on the resilience evolution trajectory induced by the ordinary differential equation. The resilience margin represents the minimum additional disturbance required to push the current network state over the preset collapse boundary.
[0149] The node identification module is used to calculate the contribution of each network node to the decay of the resilience margin based on the resilience margin, and identify network nodes whose contribution exceeds a preset threshold as vulnerable nodes.
[0150] The early warning output module is used to generate an early collapse warning signal when the resilience margin is lower than a preset early warning threshold. The early warning signal contains the identification information of the vulnerable node.
[0151] Each module performs the function of the corresponding step in the above method embodiment, which will not be repeated here.
Claims
1. A method for network operation risk assessment and fault collapse early warning, characterized in that, Includes the following steps: Step 1: Acquire network telemetry data and network dependency snapshots of the target communication network within the observation time window; Step 2: Based on the network telemetry data and network dependency snapshots, infer the node resilience index of each network node, which characterizes the ability of a network node to maintain its function under adversarial disturbances. Step 3: Using a spatiotemporal graph encoder, based on the network telemetry data, node resilience index, and network dependency snapshot, encode the spatiotemporal evidence vector of each network node, and construct the time-varying dependency matrix and time-varying dynamic parameters based on the spatiotemporal evidence vector; Step 4: Construct a continuous-time ordinary differential equation. The right-hand side of the continuous-time ordinary differential equation includes a local degradation term, a network coupling term, and an attack-induced perturbation term. The local degradation term characterizes the resilience decay trend of each network node, the network coupling term describes the resilience interaction between network nodes based on the time-varying dependency matrix, and the attack-induced perturbation term drives the node resilience to decrease based on adversarial perturbation signals. Step 5: Based on the resilience evolution trajectory induced by the ordinary differential equation, estimate the resilience margin of the target communication network. The resilience margin represents the minimum additional disturbance required to push the current network state past the preset collapse boundary. Step 6: Based on the resilience margin, calculate the contribution of each network node to the decay of the resilience margin, and identify network nodes whose contribution exceeds a preset threshold as vulnerable nodes. Step 7: When the resilience margin is lower than the preset warning threshold, an early warning signal for a collapse is generated, and the warning signal contains the identification information of the vulnerable node.
2. The network operation risk assessment and fault collapse early warning method according to claim 1, characterized in that, In step 2, the inference of the node resilience index of each network node specifically includes: Step 2.1: Based on the network telemetry data, calculate the statistical deviation of the current network node characteristics relative to the preset normal reference distribution to obtain statistical deviation evidence. : ； in, Let represent the node characteristics of network node i at time t. The mean vector of the preset normal reference distribution. It is the covariance matrix; Step 2.2: Input the current network node features into the autoencoder, and obtain deep anomaly evidence based on the reconstruction error between the output and input of the autoencoder. : ； in, (·) represents the encoder. (·) represents the decoder; Step 2.3: Perform a weighted fusion of the statistical bias evidence and the deep anomaly evidence, and map the fusion result to a preset bounded interval using a bounded activation function to obtain the node resilience index of each network node i at time t. : ； in, (·)and (·) represents a learnable transformation function. To integrate weights, (·) is the sigmoid activation function.
3. The network operation risk assessment and fault collapse early warning method according to claim 1, characterized in that, In step 3, the spatiotemporal graph encoder is used for: 1) Historical telemetry sequences for each time step within the observation time window. Node status and dynamic dependency graph Encoded as a spatiotemporal evidence vector ; ； in, It summarizes the spatiotemporal evidence of all nodes. ; (·) represents a parametric spatiotemporal encoder. All its learnable parameters are used to fuse historical telemetry sequences. Node status and dynamic dependency graph Generate implicit representations of nodes ; 2) Based on the aforementioned spatiotemporal evidence vector Construct the time-varying dependency matrix The matrix elements in the time-varying dependency matrix represent the intensity of the degradation propagation effect between network nodes at the corresponding time. ； in, (·) is a dynamic graph structure learning network based on multi-head attention, which adaptively calculates edge weights based on the correlation between node representations and dynamically infers network dependencies at each time step; 3) Based on the aforementioned spatiotemporal evidence vector Time-varying parameters of the ordinary differential equation The time-varying parameters This allows each network node to retain its own node-specific degenerate behavior parameters under a unified dynamic form: ； in, (·) is a parameter A parameterized mapping network is used to map the spatiotemporal evidence vectors of each network node to node-specific degenerate behavior parameters of ordinary differential equations.
4. The network operation risk assessment and fault collapse early warning method according to claim 1, characterized in that, In step 4, the right-hand side function of the continuous-time ordinary differential equation is: ； in, For the aforementioned local degradation term, For the network coupling term, The attack-induced perturbation term; The local degradation terms are constructed in the following manner: Configure a node-specific degradation threshold and a local evolution intensity coefficient for each network node; based on the node-specific degradation threshold and the local evolution intensity coefficient, model the local degradation behavior of each network node as follows: ； in, This represents the local evolution intensity coefficient of the i-th network node. This represents the node-specific degradation threshold for the i-th network node; Let i be the node resilience index of network node i; The network coupling term is constructed in the following manner: The resilience interaction between adjacent network nodes is decomposed into two parts: the diffusion coupling effect and the degradation pressure effect. The diffusion coupling effect and the degradation pressure effect are modeled uniformly by the following formula: ； in, Let represent the time-varying dependence strength of network node j on network node i at time t. Let represent the coupling coefficient between network node j and network node i at time t. This represents the difference in resilience between adjacent network nodes j and i, which provides a stabilizing effect when network nodes interact with highly resilient neighbors. This represents the degradation stress sensitivity coefficient of the i-th network node; The attack-induced perturbation term is constructed in the following manner: Configure a node-specific attack sensitivity coefficient for each network node; based on the node-specific attack sensitivity coefficient and the bounded response function, construct the attack-induced perturbation term as follows: ； in, This represents the node-specific attack sensitivity coefficient of the i-th network node. This represents the strength of the adversarial perturbation applied to the i-th network node at time t. Let be the bounded response function. It is a preset small positive number.
5. The network operation risk assessment and fault collapse early warning method according to claim 1, characterized in that, In step 5, estimating the resilience margin of the target communication network specifically includes: Define crash indicator function When the output of the crash indicator function is greater than zero, it indicates that the network is in a functional state; when the output of the crash indicator function is less than or equal to zero, it indicates that the network is in a degenerate state. In the current network state Next, search for a minimum perturbation. The minimum disturbance The network is capable of pushing the resilience evolution trajectory induced by the ordinary differential equation beyond the preset collapse boundary within the preset early warning time domain; current network state. Toughness margin for: ； in, Indicates a toughness margin; The minimum disturbance The following penalty optimization objective is obtained by solving: ； in, (·) represents the trajectory induced by the ordinary differential equation, and h(·) is the collapse indicator function. For the early warning time domain, Penalty coefficient for crossing the collapse boundary; Let L2 be the square of the minimum perturbation. This indicates the positive part operation; The optimized value obtained is the one with small perturbation.
6. The network operation risk assessment and fault collapse early warning method according to claim 5, characterized in that, In step 6, calculating the contribution of each network node to the attenuation of the resilience margin specifically includes: Calculate the partial derivative of the resilience margin with respect to the node resilience index of each network node, and use this derivative as the contribution of each network node: ； in, Let represent the contribution of the i-th network node at time t. Let represent the node resilience index of the i-th network node at time t.
7. The network operation risk assessment and fault collapse early warning method according to claim 6, characterized in that, The method further includes a step of training the model, wherein the training step includes at least one of the following loss terms: 1) Trajectory Reconstruction Loss : This is used to measure the consistency between the resilient evolution trajectory reconstructed from continuous-time ordinary differential equations and the observation trajectory composed of nodal resilience indices: ； in, Indicates the resilience state of the reconfiguration. The observed resilience state is represented by T, which represents the number of time steps of the trajectory. 2) Dynamic regularization loss : It includes bounded constraint penalties and parameter smoothness regularization terms. Bounded constraint penalties are used to penalize reconstructed states that exceed the range of legal resilience, and parameter smoothness regularization terms are used to constrain the variation of time-varying parameters of the continuous-time ordinary differential equation between adjacent time steps. ； in, Indicates bounded constraint penalty. This represents the preset smoothness regularization coefficient; For a moment The time-varying parameter set of the ordinary differential equation is determined by a parameterized mapping network. (·)generate; 3) Loss of margin perception monitoring : To constrain the near-collapse state to have a smaller resilience margin than the functional state in the presence of labeled degraded or near-collapse samples: ； in, This indicates a degraded or near-collapsed sample. Indicates functional samples, This represents the preset margin interval; when there are no labeled degenerate samples or near-collapse samples, the margin-aware supervision loss term is omitted.
8. A network operation risk assessment and fault collapse early warning system, characterized in that, include: The data acquisition module is used to acquire network telemetry data and network dependency snapshots of the target communication network within the observation time window; The resilience inference module is used to infer the node resilience index of each network node based on the network telemetry data and the network dependency snapshot. The node resilience index characterizes the ability of a network node to maintain its function under adversarial disturbances. The spatiotemporal coding module is used to perform spatiotemporal dependency coding on the node resilience index and the network dependency snapshot using a spatiotemporal graph encoder to obtain spatiotemporal coding features that characterize the dynamic dependency relationship between nodes. The dynamic modeling module is used to construct continuous-time ordinary differential equations based on the spatiotemporal coding features. The continuous-time ordinary differential equations characterize local degradation terms, network coupling terms, and attack-induced perturbation terms in a unified dynamic form. The local degradation terms characterize the resilience decay trend of each network node itself, the network coupling terms characterize the resilience interaction between adjacent network nodes, and the attack-induced perturbation terms characterize the driving effect of adversarial perturbations on the resilience of network nodes. The margin estimation module is used to estimate the resilience margin of the target communication network based on the resilience evolution trajectory induced by the ordinary differential equation. The resilience margin represents the minimum additional disturbance required to push the current network state over the preset collapse boundary. The node identification module is used to calculate the contribution of each network node to the decay of the resilience margin based on the resilience margin, and to identify network nodes whose contribution exceeds a preset threshold as vulnerable nodes. The early warning output module is used to generate an early warning signal for a crash when the resilience margin is lower than a preset early warning threshold. The early warning signal contains the identification information of the vulnerable node.