Multi-source data fusion network state reconstruction method and electronic device

Abstract

Embodiments of the present application relate to a multi-source data fusion network state reconstruction method and electronic equipment. The method comprises: collecting multi-source heterogeneous network data in real time, marking by exception level, aligning time sequence and unifying entities to generate network event data stream; constructing a dynamic time sequence heterogeneous graph containing physical nodes, performance indicators, alarm events and service instances; using a spatio-temporal graph attention network with causal delay learning capability to infer a causal strength and delay matrix, and constructing a fault propagation event chain; combining network digital twin to reconstruct historical state, and predicting future state graph sequence through a multi-step prediction spatio-temporal graph neural network; finally, simulating and evaluating operation and maintenance strategy to realize network reconstruction. Embodiments of the present application accurately mine network fault causal chain, improve root cause positioning accuracy and interpretability; realize network state active prediction and strategy simulation, change passive response to preventive operation and maintenance, greatly reduce network maintenance burden and risk.

Description

Technical Field

[0001] This application relates to the field of intelligent operation and maintenance technology for communication networks, and in particular to a method for reconstructing network status through multi-source data fusion, an electronic device, a storage medium, and a computer program product. Background Technology

[0002] Current communication network operation and maintenance management relies on a series of independently built and operated monitoring and analysis systems. These systems form the basis of network observability, but they lack effective intelligent collaboration among themselves. Existing technical solutions mainly involve passive monitoring systems based on multiple parallel systems, correlation analysis based on predefined rules and static thresholds, offline aggregation and post-hoc analysis based on data warehouses, and the preliminary application of single-point artificial intelligence technology.

[0003] However, existing technical solutions are characterized by system fragmentation, shallow analysis, delayed response, and isolated intelligence. Specifically, they suffer from unresolved challenges of heterogeneity at the data level, low integration quality, lack of causal inference and unclear root cause localization at the analysis level, lack of forward-looking prediction and proactive simulation at the capability level, passive operation and maintenance mode, and heavy maintenance burden. Summary of the Invention

[0004] To address the aforementioned issues, embodiments of this application provide a method for reconstructing the state of a multi-source data fusion network, an electronic device, a storage medium, and a computer program product.

[0005] According to a first aspect of the embodiments of this application, a method for reconstructing the state of a multi-source data fusion network is provided, the method comprising: Real-time acquisition of multi-source heterogeneous network data of the target network, and anomaly level marking, time sequence alignment and entity unification are performed to obtain network event data stream. The multi-source heterogeneous network data includes at least two of the following: network resource management data, performance index data, real-time alarm data and active dialing test data. The network event data stream includes timestamp, device identifier, index name or alarm code, and corresponding content of index name or alarm code. A dynamic temporal heterogeneous graph sequence is constructed based on the network event data stream. The nodes in the graph of the dynamic temporal heterogeneous graph sequence include physical nodes, performance indicators, alarm events, and service instances. The edges in the graph of the dynamic temporal heterogeneous graph sequence include edges based on physical connection relationships, edges based on membership relationships, and edges based on temporal association relationships. The attributes of the nodes are used to indicate the anomaly level of the nodes. The spatiotemporal graph attention network model with causal delay learning capability is used to reason about the dynamic temporal heterogeneous graph sequence to output a causal strength matrix and a causal delay matrix, and an event chain representing the fault propagation path is constructed based on the causal strength matrix and the causal delay matrix. Based on the network event data stream and the event chain, the historical state sequence of the target network is reconstructed using the network digital twin of the target network, and the future state graph sequence with a preset step size is predicted by a spatiotemporal graph neural network state prediction model based on multi-step prediction. Based on the state diagram sequence with the preset future step size, simulation evaluation is performed on each operation and maintenance strategy, and network reconstruction is carried out based on the simulation evaluation results.

[0006] In one implementation, the abnormality level marking includes: Multiple sliding windows of different scales are maintained in parallel, and the isolated forest algorithm is run independently in each sliding window to calculate the anomaly coefficient of the data points of the multi-source heterogeneous network data, and the composite anomaly score of the real-time data stream is obtained based on the anomaly coefficient. If the composite anomaly score exceeds a preset absolute threshold, the multi-source heterogeneous network data is marked as anomaly data. If the composite anomaly score exceeds the adaptive relative threshold, the multi-source heterogeneous network data is marked as suspected anomaly data. The adaptive relative threshold is obtained based on the mean and standard deviation of the composite anomaly score sequence over a preset time period.

[0007] In one implementation, the step of performing time alignment and entity unification includes: By utilizing periodically occurring anchor events, the offset distribution of anchor event timestamps in different network event data streams is calculated, and a dynamic time warping algorithm is applied to estimate and compensate for systematic time delays. The anchor events include periodically reported heartbeat messages or periodically dialed test tasks. A network entity knowledge graph with resource management data as its backbone is constructed. The contextual information of the incoming data is used as a feature. The semantic similarity between the incoming data and the entities in the knowledge graph is calculated through an entity linking model based on graph neural network. Based on the semantic similarity, intelligent mapping and unification of entities are achieved to obtain cleaned and aligned data. The cleaned and aligned data is aggregated using a sliding window or scrolling window in the streaming computing engine to generate the network event data stream.

[0008] In one embodiment, the spatiotemporal graph attention network model includes a temporal convolutional layer or recurrent neural network in the temporal dimension, and a graph attention layer in the spatial dimension. The step of using the spatiotemporal graph attention network model with causal delay learning capability to infer the dynamic temporal heterogeneous graph sequence to output a causal strength matrix and a causal delay matrix includes: Through the graph attention layer, node influence association features are extracted from the attribute features of nodes in the dynamic temporal heterogeneous graph sequence based on the multi-head attention mechanism. The graph attention layer sets a learnable causal delay parameter for any connected nodes. The causal delay parameter represents the time step required from the state change of the target node to the state of its neighboring nodes. The node influence association features are used to indicate the strength of the influence of each target node on its neighboring nodes. Based on the temporal convolutional layer or recurrent neural network, the sequence of the node influence correlation features is processed to obtain the causal strength matrix and the causal delay matrix, which are used to represent the evolution mode of the state of each node over time.

[0009] In one implementation, constructing an event chain representing a fault propagation path based on the causal strength matrix and the causal delay matrix includes: The causal intensity matrix is ​​pruned based on the contribution threshold, and unreachable edges are removed by temporal reachability verification to generate a candidate causal directed graph. The temporal reachability verification is used to detect whether the time difference between the occurrence of two adjacent events is less than a preset error window. A specified path search algorithm is executed on the candidate causal directed graph to obtain candidate paths, and the path causal contribution and temporal fit of each candidate path are calculated. The path confidence of each candidate path is obtained based on the path causal contribution and the temporal fit. The specified path search algorithm is used to determine potential root cause nodes and business impact nodes in the candidate causal directed graph, and to perform path search from root cause nodes to impact nodes. Candidate paths with confidence levels exceeding a preset threshold are used as candidate event chains. Overlapping candidate event chains are fused and conflict-resolved to generate the event chain representing the fault propagation path. The event chain representing the fault propagation path is then transformed into interpretable root cause analysis results described in natural language.

[0010] In one implementation, predicting a future state graph sequence with a preset step size using a spatiotemporal graph neural network state prediction model based on multi-step prediction includes: The historical state sequence is input into the state prediction model to output a future state diagram sequence with a preset step size and corresponding key indicators. For each key indicator, a predicted mean and a confidence interval representing uncertainty are output.

[0011] In one implementation, the simulation evaluation of each operation and maintenance strategy includes: A Markov chain is constructed, wherein the state space of the Markov chain includes all network states of the network digital twin, the action space of the Markov chain includes a predefined set of operation and maintenance operations, and the state transition of the Markov chain is implemented by a simulation engine. The simulation engine predicts the next state of the current state based on the current state and current action of the network digital twin through the spatiotemporal graph neural network state prediction model. The target reinforcement learning model is invoked to automatically explore and evaluate various operation and maintenance strategies in the network digital twin through the Markov chain; The target reinforcement learning model is trained using a near-end policy optimization algorithm to recommend the operation and maintenance strategy with the highest long-term cumulative reward for a given state. The target reinforcement learning model integrates a security action mask to shield actions that may degrade the network state based on domain expert knowledge before execution. The reward function of the target reinforcement learning model during reinforcement learning is a hierarchical reward function that includes a basic reward and a sparse reward. The basic reward is used to balance service quality, resource cost, and configuration change penalties, while the sparse reward is only given when key milestones for preventing service level agreement breaches are achieved.

[0012] In one embodiment, the method further includes: The system uniformly manages designated AI models and monitors the performance degradation and concept drift of the designated AI models through a two-layer concept drift detection mechanism. It also uses feedback data samples from different sources to drive the designated AI models to perform incremental learning and iterative updates. The designated AI models include at least one of the spatiotemporal graph attention network model, the state prediction model, or the target reinforcement learning large model.

[0013] In one implementation, monitoring the performance degradation and concept drift of the specified AI model through a two-layer concept drift detection mechanism includes: Online statistical testing based on business metrics is used to screen for performance degradation of the specified AI model by comparing key business metrics of a sliding window and a baseline window over a preset time period. Based on the Bayesian online change point detection algorithm, the posterior probability of concept drift at the current moment is calculated by using the prior change point probability on the original prediction error sequence of the specified AI model, and concept drift is determined to have occurred when the posterior probability exceeds a preset threshold.

[0014] In one implementation, the step of using feedback data samples from different sources to drive the specified AI model for incremental learning and iterative updates includes: Each feedback data sample is assigned a different credibility weight according to different feedback sources, and the feedback data samples are weighted in the loss function of the incremental learning of the specified AI model based on the credibility weight. The feedback data samples from different sources include at least two of the following: manually confirmed feedback data samples, automatically verified feedback data samples, or isolated feedback data samples. The weighted feedback data samples and new production data samples are used to form an incremental training dataset. The specified AI model is then incrementally trained or fine-tuned. After verifying that the effect meets the standards in the network digital twin environment, the online model is smoothly replaced.

[0015] According to a second aspect of the embodiments of this application, an electronic device is provided, comprising: A memory on which computer programs are stored; A processor for executing the computer program in the memory to implement the steps of the method of any one of the first aspects.

[0016] According to a third aspect of the embodiments of this application, a non-transitory computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the method described in any one of the first aspects.

[0017] According to a fourth aspect of the embodiments of this application, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the method described in any one of the first aspects.

[0018] The embodiments of this application achieve the following beneficial effects: Real-time acquisition of multi-source heterogeneous network data, followed by anomaly level labeling, temporal alignment, and entity unification, generates a network event data stream; based on this, a dynamic temporal heterogeneous graph containing physical nodes, performance indicators, alarm events, and service instances is constructed; causal strength and delay matrices are obtained using a spatiotemporal graph attention network with causal delay learning capabilities, constructing a fault propagation event chain; historical states are reconstructed using a network digital twin, and future state graph sequences are predicted through a multi-step predictive spatiotemporal graph neural network; finally, the operation and maintenance strategy is simulated and evaluated to achieve network reconstruction. The embodiments of this application accurately mine network fault causal chains, improving the accuracy and interpretability of root cause localization; they achieve proactive network state prediction and strategy simulation, transforming passive response into preventative operation and maintenance, significantly reducing network maintenance burden and risk.

[0019] Other features and advantages of this application will be described in detail in the following detailed description section. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a flowchart of a multi-source data fusion network state reconstruction method provided in an embodiment of this application.

[0021] Figure 2 This is a flowchart of a multi-source data fusion network state reconstruction method provided in an embodiment of this application.

[0022] Figure 3 This is a flowchart of a multi-source data fusion network state reconstruction method provided in an embodiment of this application.

[0023] Figure 4 This is a flowchart of a multi-source data fusion network state reconstruction method provided in an embodiment of this application.

[0024] Figure 5 This is a flowchart of a multi-source data fusion network state reconstruction method provided in an embodiment of this application.

[0025] Figure 6 This is a flowchart of a multi-source data fusion network state reconstruction method provided in an embodiment of this application.

[0026] Figure 7 This is a flowchart of a multi-source data fusion network state reconstruction method provided in an embodiment of this application.

[0027] Figure 8 This is a flowchart of a multi-source data fusion network state reconstruction method provided in an embodiment of this application.

[0028] Figure 9 This is a flowchart of a multi-source data fusion network state reconstruction method provided in an embodiment of this application.

[0029] Figure 10 This is a flowchart of a multi-source data fusion network state reconstruction method provided in an embodiment of this application.

[0030] Figure 11 This is a block diagram of an electronic device provided in one embodiment of this application. Detailed Implementation

[0031] The specific embodiments of this application will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit this application.

[0032] It should be understood that the term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the following description.

[0033] It should be noted that the concepts of "first" and "second" mentioned in this application are only used to distinguish different devices, modules, or units, and are not used to limit the order of functions performed by these devices, modules, or units or their interdependencies. The modifications of "one" and "multiple" mentioned in this application are illustrative rather than restrictive, and those skilled in the art should understand that, unless explicitly stated in the context, they should be understood as "one or more". In the description of this application, unless otherwise stated, "multiple" means two or more, and other quantifiers are similar; "at least one item", "one item or multiple items", or similar expressions refer to any combination of these items, including any combination of single or multiple items.

[0034] Although operations or steps are described in a specific order in the accompanying drawings in the embodiments of this application, this should not be construed as requiring these operations or steps to be performed in the specific order or serial order shown, or requiring all of the shown operations or steps to be performed to obtain the desired result. In the embodiments of this application, these operations or steps may be performed serially; they may be performed in parallel; or a portion of these operations or steps may be performed.

[0035] The names of the messages or information exchanged between multiple devices in the embodiments of this application are for illustrative purposes only and are not intended to limit the scope of these messages or information. It is understood that before using the technical solutions disclosed in the embodiments of this application, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this application in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained. The application will now be described in conjunction with specific embodiments.

[0036] Figure 1 This is a flowchart illustrating a multi-source data fusion network state reconstruction method provided in an embodiment of this application. Figure 1 As shown in the figure, this application provides a method for reconstructing the state of a multi-source data fusion network, which may include the following steps: In step S10, multi-source heterogeneous network data of the target network is collected in real time, and anomaly level marking, time sequence alignment and entity unification are performed to obtain network event data stream. The multi-source heterogeneous network data includes at least two of network resource management data, performance index data, real-time alarm data and active dialing test data. The network event data stream includes timestamp, device identifier, index name or alarm code, and corresponding content of index name or alarm code.

[0037] In step S20, a dynamic temporal heterogeneous graph sequence is constructed based on the network event data stream. The nodes in the graph of the dynamic temporal heterogeneous graph sequence include physical nodes, performance indicators, alarm events, and service instances. The edges in the graph of the dynamic temporal heterogeneous graph sequence include edges based on physical connection relationships, edges based on membership relationships, and edges based on temporal association relationships. The attributes of the nodes are used to indicate the anomaly level of the nodes.

[0038] In step S30, a spatiotemporal graph attention network model with causal delay learning capability is used to reason about the dynamic temporal heterogeneous graph sequence to output a causal strength matrix and a causal delay matrix, and an event chain representing the fault propagation path is constructed based on the causal strength matrix and the causal delay matrix.

[0039] In step S40, based on the network event data stream and the event chain, the historical state sequence of the target network is reconstructed using the network digital twin of the target network, and the future state graph sequence with a preset step size is predicted by a spatiotemporal graph neural network state prediction model based on multi-step prediction.

[0040] In step S50, based on the state diagram sequence of the future preset step size, each operation and maintenance strategy is simulated and evaluated, and network reconstruction is performed based on the simulation and evaluation results.

[0041] For example, one can start by collecting multi-source heterogeneous network data in real time, first performing anomaly level labeling, time sequence alignment, and entity unification to obtain a network event data stream. The multi-source heterogeneous network data specifically includes at least two of the following: network resource management data, performance indicator data, real-time alarm data, and proactive testing data. The network event data stream contains timestamps, device identifiers, indicator names or alarm codes, and the corresponding content of these indicator names or alarm codes.

[0042] After data preprocessing, a dynamic temporal heterogeneous graph sequence can be constructed based on the network event data stream. The graph sequence contains a variety of node types, including physical nodes, performance metrics, alarm events, and business instances. The edges cover edges based on physical connections, membership relationships, and temporal associations. The attributes of each node are used to indicate the anomaly level of that node.

[0043] Example: Dynamic temporal heterogeneous graph It can be represented as: Formula 1 node : Represents different categories of entities, including physical nodes (such as routers and switches), performance metrics (such as port inbound traffic and CPU utilization), alarm events (such as "BGP neighbor loss"), and service instances (such as "User A's VoLTE call"). Nodes have attributes that vary. .

[0044] side : Represents the relationship between entities, divided into static topological edges (such as physical connections between devices), logical membership edges (such as a port belonging to a certain device), and temporal association edges (such as within a time window). Within the event, the mutations in event A and indicator B occur sequentially.

[0045] Node attributes Each node has its own feature vector or attribute, which is a specific description of its state. For example, alarm node: attribute = {severity level: 5, occurrence time: 10:05, description: "..."}, indicator node: attribute = {current value: 95.7, unit: "%", trend: rising}, device node: attribute = {manufacturer: "XX", model: "XXX"}.

[0046] Relationship type Define the semantics of an edge, such as "connect", "carry", "occurs in", and "associate".

[0047] The system instantiates information from the standardized data stream into graphs in real time. The nodes and edges in the graph form a sequence of graphs that evolve over time, serving as the basic input for AI models.

[0048] This sequence of graphs is a dynamic temporal heterogeneous graph sequence within a time window. … M represents the time window length, which is determined based on the actual duration of the causal events. For example: "Device A memory leak (t-5 minutes) → Link B throughput decrease (t-2 minutes) → Service C access timeout (t)", where M is 5 minutes.

[0049] Subsequently, a spatiotemporal graph attention network model with causal delayed learning capabilities can be used to infer dynamic temporal heterogeneous graph sequences, outputting a causal strength matrix and a causal delay matrix. Based on these two matrices, an event chain representing the fault propagation path is constructed. Building upon this, based on the network event data stream and event chain, the historical state sequence of the target network is reconstructed using a network digital twin of the target network. Furthermore, a future state graph sequence with a preset step size is predicted using a spatiotemporal graph neural network state prediction model based on multi-step prediction. Finally, based on the future state graph sequence with the preset step size, various operational strategies are simulated and evaluated, and network reconstruction is performed based on the simulation evaluation results.

[0050] In actual operation, various data sources can be accessed first through a multi-protocol adapter to parse the raw data and encapsulate it into event objects of a unified format. For numerical data streams, multiple sliding windows of different scales can be maintained in parallel. Within each window, the Isolation Forest algorithm is run independently to calculate the anomaly coefficient, and a composite anomaly score is obtained through a weighted geometric mean. When the composite anomaly score exceeds an absolute threshold, it is marked as anomalous data; when it exceeds an adaptive relative threshold, it is marked as suspected anomalous data.

[0051] In terms of temporal alignment, periodically occurring anchor events can be utilized, and dynamic time warping algorithms can be used to estimate and compensate for systematic time delays. Regarding entity unification, a network entity knowledge graph with resource management data as its backbone can be constructed. A graph neural network-based entity linking model can be used to calculate the semantic similarity between the incoming data and entities in the knowledge graph, achieving intelligent entity mapping. The cleaned and aligned data undergoes sliding window or rolling window aggregation operations in a streaming computing engine to generate a standard network event data stream.

[0052] Once the causal strength matrix and causal delay matrix are obtained, a candidate causal directed graph can be generated through contribution threshold pruning and temporal reachability verification. A path search algorithm is then executed on the graph to obtain candidate paths. The causal contribution and temporal fit of each path are calculated. Candidate paths with confidence exceeding a preset threshold are used as event chains, and finally, the results are transformed into interpretable root cause analysis results described in natural language.

[0053] In the state prediction phase, historical state sequences can be input into the state prediction model, which outputs a future state graph sequence with a preset step size and corresponding key indicators. Simultaneously, the predicted mean and confidence interval representing uncertainty are output for each key indicator. In the strategy simulation phase, the operation and maintenance strategy simulation process can be modeled as a Markov decision process. A hierarchical reward function is designed to balance service quality, resource costs, and configuration change penalties. Furthermore, a security action mask is integrated to shield actions that may degrade the network state before execution, based on domain expert knowledge.

[0054] The embodiments of this application realize a complete closed loop from data acquisition to strategy simulation, which significantly improves the accuracy of network state reconstruction, the efficiency of fault location, and the scientific nature of operation and maintenance decisions, and greatly reduces the network maintenance burden and risks.

[0055] Figure 2 This is a flowchart illustrating a multi-source data fusion network state reconstruction method provided in an embodiment of this application. Figure 2 As shown, the abnormality level marking process may include the following steps: In step S101, multiple sliding windows of different scales are maintained in parallel, and the isolated forest algorithm is run independently in each sliding window to calculate the anomaly coefficient of the data points of the multi-source heterogeneous network data, and the composite anomaly score of the real-time data stream is obtained based on the anomaly coefficient.

[0056] In step S102, if the composite anomaly score exceeds a preset absolute threshold, the multi-source heterogeneous network data is marked as anomaly data.

[0057] In step S103, if the composite anomaly score exceeds the adaptive relative threshold, the multi-source heterogeneous network data is marked as suspected anomaly data. The adaptive relative threshold is obtained based on the mean and standard deviation of the composite anomaly score sequence over a preset time period.

[0058] For example, in the anomaly level labeling process, this application employs a parallel maintenance of multiple sliding windows of different scales. Within each sliding window, the Isolation Forest algorithm is run independently to calculate the anomaly coefficient of data points in multi-source heterogeneous network data, and a composite anomaly score for the real-time data stream is obtained based on this anomaly coefficient. Specifically, three sliding windows of different scales—fast, medium, and slow—can be maintained simultaneously, with each window length set to 10, 60, and 600 time units, respectively. The Isolation Forest algorithm runs independently in each window to calculate the anomaly coefficient of the data points. The anomaly coefficients obtained from the three windows are then fused using a weighted geometric mean to generate a composite anomaly score. The weight for the fast window can be 0.45, the weight for the medium window can be 0.35, and the weight for the slow window can be 0.20. This weight allocation imparts higher sensitivity to rapid fluctuations, enabling accurate capture of fault initiation points.

[0059] For example, three sliding windows can be maintained simultaneously: the width of the fast window f. Width of the medium-speed window (m) in seconds The width of the slow window (s) in seconds Seconds. Each window runs the Isolation Forest algorithm independently, calculating data points. anomaly coefficient Final composite abnormal score Obtained by weighted geometric mean: Formula 2 Among them, weight The default value is 0.45, and the weight is... The default value is 0.35, and the weight is... The default value is 0.2, which provides higher sensitivity to rapid fluctuations to accurately capture the initiation point of a fault. Let f be the anomaly coefficient of the fast window. Let m be the anomaly coefficient for the medium-speed window. is the anomaly coefficient for the slow window s.

[0060] After obtaining the composite anomaly score, a dynamic dual-threshold judgment mechanism can be adopted. First, an absolute threshold verification can be performed, which can be set to 0.75. When the composite anomaly score exceeds this absolute threshold, the multi-source heterogeneous network data is marked as anomaly data. If the composite anomaly score does not exceed the absolute threshold, an adaptive relative threshold verification is further performed. The adaptive relative threshold is calculated by adding the mean of the recent composite anomaly score sequence to the product of a sensitivity coefficient and the standard deviation; the sensitivity coefficient is set to 2 by default. When the composite anomaly score exceeds this adaptive relative threshold, the multi-source heterogeneous network data can be marked as suspected anomaly data.

[0061] For example, an absolute threshold and an adaptive relative threshold are set, and a dynamic dual-criteria are used to reduce false alarms. First, the absolute threshold is validated, where the absolute threshold... ,when It is then judged as a serious abnormality.

[0062] Further adaptive relative threshold validation was performed. This can be expressed as the following formula: Formula 3 in, The mean of the recent composite fraction series. The standard deviation of the recent composite fractional series. This is the sensitivity coefficient, which is adjustable. The default value is set to 2.

[0063] when When this happens, the data point is marked as potentially abnormal. These abnormal markers are then accompanied by quality labels for downstream modules to reference or to trigger real-time alarms. This method effectively captures data quality issues such as single-point spikes and spikes.

[0064] During operation, for each newly arrived data point, the contents of three sliding windows can be updated simultaneously. Within each window, one or more isolated trees can be maintained, and the degree of anomaly is assessed by calculating the path length of the data point within the tree. Fast windows, due to their short length, are sensitive to instantaneous fluctuations in the data stream and can quickly capture sudden spikes in anomalies; slow windows, due to their long length, reflect the long-term distribution characteristics of the data and help identify persistent anomaly trends.

[0065] The weighted geometric average fusion method ensures that even if one window's assessment of the current data point is inaccurate, the anomaly coefficients of other windows can still play a balancing role. Dynamic threshold settings allow the system to adapt to normal fluctuations in network conditions, avoiding false alarms or missed alarms caused by fixed thresholds during peak or off-peak periods. By directly marking data with composite anomaly scores exceeding absolute thresholds as anomalies and data exceeding relative thresholds as suspected anomalies, the system achieves hierarchical data quality awareness, providing reliable data quality labels for downstream modules.

[0066] This embodiment of the application effectively solves the problems of traditional anomaly detection methods being insensitive to changes in data distribution and having difficulty distinguishing between instantaneous noise and the actual fault origin, providing a high-quality data foundation for subsequent fault causal analysis and network state reconstruction.

[0067] Figure 3 This is a flowchart illustrating a multi-source data fusion network state reconstruction method provided in an embodiment of this application. Figure 3 As shown, the process of performing time alignment and entity unification may include the following steps: In step S104, using periodically occurring anchor events, the offset distribution of anchor event timestamps in different network event data streams is calculated, and a dynamic time warping algorithm is applied to estimate and compensate for systematic time delays. The anchor events include periodically reported heartbeat messages or periodically dialed test tasks.

[0068] In step S105, a network entity knowledge graph with resource management data as its backbone is constructed. The contextual information of the incoming data is used as a feature. The semantic similarity between the incoming data and the entities in the knowledge graph is calculated through an entity linking model based on a graph neural network. Based on the semantic similarity, intelligent mapping and unification of entities are achieved to obtain cleaned and aligned data.

[0069] In step S106, the cleaned and aligned data is aggregated using a sliding window or scrolling window in the streaming computing engine to generate the network event data stream.

[0070] For example, static topology information of network devices can be extracted from the asset management system first, including device name, management IP, port description, rack location, device model, etc., to construct a lightweight network entity knowledge graph as a benchmark for entity alignment. For newly incoming data, such as a hostname contained in an alarm record or a device identifier contained in performance data, the contextual information in the data record can be extracted as a feature vector, including IP address, device name pattern, data center identifier, associated port description, etc.

[0071] These features are input into an entity linking model based on a graph neural network. This model calculates the semantic similarity between the input features and the features of each candidate entity in the knowledge graph, and selects the entity with the highest similarity as the mapping target. For example, the hostname in the alarm and the IP address in the performance metric are mapped to the same router node in the knowledge graph, thereby achieving a unified identification of the same physical entity from different data sources.

[0072] In terms of time alignment, anchor events that occur periodically in network data streams can be identified, such as heartbeat messages reported by devices every 30 seconds or timed probing tasks executed every 5 minutes. By collecting timestamps of the same anchor event from different data streams over a period of time, the distribution characteristics of the offset are calculated, and a dynamic time warping algorithm is applied to estimate the systematic time delay between data sources. The timestamps are then compensated and corrected in subsequent data processing. After being cleaned and aligned by time and entity, the data is aggregated in a streaming computing engine such as Apache Flink according to predefined time windows. For example, this can be used to calculate the average traffic per minute or the alarm count per 5 minutes, generating a standardized, high-quality, and fusionable real-time network event data stream.

[0073] This application's embodiments achieve accurate and robust alignment by deeply embedding domain knowledge into machine learning models, fundamentally solving the problem of distorted downstream analysis results caused by timestamp deviations and entity identifier ambiguities.

[0074] Figure 4 This is a flowchart of a multi-source data fusion network state reconstruction method provided in one embodiment of this application. The spatiotemporal graph attention network model includes a temporal convolutional layer or recurrent neural network in the temporal dimension, and a spatial graph attention layer, such as... Figure 4 As shown, the step of using a spatiotemporal graph attention network model with causal delay learning capability to infer the dynamic temporal heterogeneous graph sequence to output a causal strength matrix and a causal delay matrix may include the following steps: In step S301, the graph attention layer extracts node influence association features from the attribute features of nodes in the dynamic temporal heterogeneous graph sequence based on the multi-head attention mechanism. The graph attention layer sets a learnable causal delay parameter for any connected nodes. The causal delay parameter represents the time step required from the state change of the target node to the state of its neighboring nodes. The node influence association features are used to indicate the strength of the influence of each target node on its neighboring nodes.

[0075] In step S302, based on the temporal convolutional layer or recurrent neural network, the sequence of the node influence correlation features is processed to obtain the causal strength matrix and the causal delay matrix, which are used to represent the evolution mode of the state of each node over time.

[0076] For example, each node in the input graph sequence can first be converted into an initial feature vector representation through an embedding layer. In the causal delay-aware graph attention layer, for the graph at the current time step, this layer calculates the attention weights between any two connected node pairs. A learnable causal delay parameter is introduced during the calculation of these attention weights. This parameter is an integer representing the time step required for a change in the state of a neighboring node to affect the state of the current node. This parameter can be initialized to 0 at the beginning of model training and optimized within a range from 0 to a maximum delay, such as 10, during training. The formula for calculating the attention weights considers the correlation between the feature vector of the current node and the delayed feature vectors of its neighboring nodes, enabling the model to automatically learn the causal propagation delay between events.

[0077] For example, the input graph sequence can be... The attribute A of each node (such as alarms, KPIs) is converted into an initial feature vector representation through the embedding layer of the spatiotemporal graph attention network model. .

[0078] In the graph attention layer of causal delay perception, for the graph at the current time t This layer calculates any connected node pairs. Attention weights between The aim is to capture "nodes" How far back in time will the state affect the node? The state at time t: Formula 4 in, This coefficient implies that, in a specific context, the node... For nodes The “influence strength” includes information on causal delay correction and importance weighting, with the goal of enabling the model to learn automatically.

[0079] in, It is an exponential function; It is a non-linear activation function, with the following formula: Formula 5 It provides a very small slope for negative inputs. It is a learnable weight matrix, which are parameters automatically learned during model training and used to weight the feature vectors of all nodes. Dimensionality reduction and feature transformation are performed to extract features that are more effective for the task, enabling the model to autonomously discover which node features (such as alarm level, KPI value range) are important for judging causal relationships, rather than relying on manual definition; [||] is vector concatenation, which connects the beginning and end of two vectors into a longer vector; It is a learnable attention vector, which is a parameter automatically learned during model training and is used to map the concatenated high-dimensional vector to a scalar score. It is a learnable causal delay parameter, an integer representing the delay from node [node name missing]. State changes affect nodes The time step (delay) required for a state is a relation to the node pair. The relevant trainable parameters are initialized at the beginning of training (set to 0) and constrained during training. Optimize within the scope, The default value is 10; For nodes The set of neighbors (in the graph) In the middle, through the edge With nodes The set of all directly connected nodes); In order to reach a settlement, Let T be the set of nodes i, T be the transpose, and k be the k-th eigenvector.

[0080] To stabilize the learning process and capture various types of dependencies, the model can employ a multi-head attention mechanism. This involves using multiple independent attention heads to perform attention weight calculations in parallel, and then concatenating or aggregating the outputs of each head to update the features of each node in the heterogeneous graph. Each attention head has an independent, learnable weight matrix and causal delay parameters, allowing different attention heads to focus on different types of causal patterns. For example, one head might learn the fault propagation patterns at the device level, while another head might learn the impact propagation patterns at the business level.

[0081] For example, you can use One (e.g., 4, the default is 4, corresponding to four node types: physical nodes, performance metrics, alarm events, and business instances; can be adjusted for optimization based on results) independent attention heads execute attention weights in parallel. The calculations are then performed, and the outputs of each head are aggregated to update the features of each node in the heterogeneous graph. From its neighboring nodes The formula for updating aggregated information is: Formula 6 in, For nodes The new feature representation after aggregating neighbor information This represents the number of attention heads, and ∥ indicates vector concatenation. It is a non-linear activation function (such as ELU). It is the node of the kth attention head. For nodes Attention coefficient It is the learnable weight matrix of the k-th attention head. For neighboring nodes Input features, It is the learnable causal delay parameter of the k-th attention head.

[0082] After completing attention aggregation in the spatial dimension, the model can apply a one-dimensional temporal convolutional network or recurrent neural network to the feature sequence of each node along the temporal dimension to capture the evolution pattern of the node state over time, such as identifying fault development processes like slow deterioration, mutation, and recovery. The spatiotemporal graph attention network model can be trained end-to-end using a large amount of historical fault scenario data. After training, for any new graph sequence as input, the model can map the learned high-level spatiotemporal features into two core outputs through the output layer: a causal strength matrix, which quantifies the causal contribution between events or entities, with values ​​between 0 and 1; and a causal delay matrix, which quantifies the causal relationship delay between events or entities, i.e., the number of time units typically required for one event to influence another.

[0083] For example, after attention aggregation in the spatial dimension (graph structure), the model performs attention on the feature sequence of each node along the temporal dimension. Apply a one-dimensional temporal convolutional network or a recurrent neural network. This operation aims to capture the evolution pattern of node states over time, such as identifying the "slow deterioration-mutation-recovery" fault development process.

[0084] The spatiotemporal graph attention network model is trained end-to-end using a large amount of historical fault scenario data. After training, for any new input graph sequence, the model can ultimately map the learned high-level spatiotemporal features into two core outputs through an output layer: (1) Causality strength matrix Its elements Quantified events / entities For events / entities The causal contribution results are between 0 and 1.

[0085] (2) Causal delay matrix Its elements Quantified events / entities For events / entities The causal relationship and the time delay of the result, i.e., the event Impact Events Usually required Each time unit.

[0086] The embodiments of this application explicitly model causal delays, enabling the model to accurately capture the temporal characteristics of causal relationships in the network, thus significantly improving the accuracy of root cause localization.

[0087] Figure 5 This is a flowchart illustrating a multi-source data fusion network state reconstruction method provided in an embodiment of this application. Figure 5 As shown, constructing an event chain representing a fault propagation path based on the causal strength matrix and the causal delay matrix may include the following steps: In step S303, the causal intensity matrix is ​​pruned based on the contribution threshold, and unreachable edges are removed by temporal reachability verification to generate a candidate causal directed graph. The temporal reachability verification is used to detect whether the time difference between the occurrence of two adjacent events is less than a preset error window.

[0088] In step S304, a specified path search algorithm is executed on the candidate causal directed graph to obtain candidate paths, and the path causal contribution and temporal fit of each candidate path are calculated. The path confidence of each candidate path is obtained based on the path causal contribution and the temporal fit. The specified path search algorithm is used to determine potential root cause nodes and business impact nodes in the candidate causal directed graph, and to perform path search from root cause nodes to impact nodes.

[0089] In step S305, candidate paths with confidence levels exceeding a preset threshold are used as candidate event chains, and overlapping candidate event chains are fused and conflict-resolved to generate the event chain representing the fault propagation path. The event chain representing the fault propagation path is then converted into interpretable root cause analysis results described in natural language.

[0090] For example, the causal strength matrix can be pruned based on a contribution threshold, and unreachable edges can be removed using a temporal reachability check to generate a candidate causal directed graph. The contribution threshold can be set to 0.3 by default, retaining only edges with a causal strength greater than or equal to this threshold, thereby filtering out insignificant causal associations and focusing on core causal relationships. The temporal reachability check is used to detect whether the time difference between two adjacent events is less than a preset error window, that is, to check whether the occurrence time of event i plus the causal delay is approximately equal to the occurrence time of event j, with the allowed error window not exceeding 10% of the causal delay. If the deviation is too large, the edge is temporarily removed.

[0091] For example, pruning can first be based on a contribution threshold, i.e., on the causal strength matrix. Set a contribution threshold (Default value is 0.3), only reserved The edges are filtered out, meaning insignificant causal relationships are filtered out, focusing on core causal relationships. Then, each active event of key event nodes (such as sudden KPI anomalies or new alarms) identified within the most recent time window that has not yet expired is selected. As a node, retain the data from the previous step. The edge is a directed edge, and the weight of the edge is... The properties of the edge include delay. Generate a candidate causal directed graph For each edge in the graph, i.e., any pair of connected nodes Perform timing reachability checks and examine events. Time of occurrence Does it meet the requirements? (Allow a small error window) No more than (10%). If the deviation is too large, the edge will be temporarily removed because it does not conform to the learned temporal pattern.

[0092] Subsequently, a specified path search algorithm is executed on the candidate causal directed graph to obtain candidate paths. This algorithm is used to identify potential root cause nodes and business-influencing nodes in the candidate causal directed graph and to perform path search from root cause nodes to influencing nodes. For each candidate path, the path causal contribution and temporal fit are calculated. The path causal contribution can be defined as the geometric mean of the causal strength of all edges on the path. The geometric mean is more sensitive to weak edges on the path and can ensure the overall strength of the chain.

[0093] Temporal fit can be defined as an exponentially decaying function of the degree of agreement between the actual time difference and the learned delay. The temporal penalty factor can be set to 2 by default, controlling the penalty applied to path confidence by time deviation. The path confidence of each candidate path can be obtained by multiplying the path causal contribution and temporal fit. Candidate paths with confidence exceeding a preset threshold are used as candidate event chains. Overlapping candidate event chains are fused and conflict resolved to generate an event chain representing the fault propagation path. This event chain is then transformed into interpretable root cause analysis results described in natural language.

[0094] For example, a causal-oriented heuristic search algorithm can be used in... The search proceeds to trace the path from the potential root cause to the final impact. First, the starting and ending points of this path are determined. The ending point (leaf node) typically represents the event that ultimately impacts the business (e.g., test events like "video service buffering" or "user access failure"). The starting point (candidate root node) is selected from those without significant incoming edges (i.e., those with few or no incoming edges). The event node that is either the lowest (or the earliest) or the one that occurred. For each pair of starting points and the end point The algorithm performs pathfinding and scoring, employing a search method similar to a random walk but subject to causal constraints. It defines the path starting from the node... To the node path Path causal contribution This is the geometric mean of the causal strength of all edges on the path (the geometric mean is more sensitive to weak edges on the path and can ensure the overall strength of the chain): Formula 7 in, That is, any side of the path (the two ends of the path are respectively) and The corresponding causal strength is m, where m is the number of nodes traversed by path P.

[0095] At the same time, calculate the temporal fit of the path. Measuring the actual time difference of the path and the learning delay Degree of agreement: Formula 8 in, This is the timing penalty factor, with a default value of 2. It controls the severity of the penalty imposed on path confidence by time deviations. The larger the value, the lower the tolerance for timing misalignments, requiring the path to strictly conform to the learned delay pattern. That is, any side of the path (the nodes at both ends are...) and The corresponding actual time difference, This is a delay in causality.

[0096] The overall path causal contribution Timing fit Calculate the confidence scores of all edges on path P. : Formula 9 Algorithm reserves all rights The path, and according to Sort the events from highest to lowest and generate TOP-N (default N=5) candidate event path chains.

[0097] During operation, edges in the causal strength matrix can first be filtered according to a contribution threshold, retaining those exceeding the threshold, as these represent more significant causal relationships. Simultaneously, active event nodes identified by the dynamic temporal heterogeneous graph construction module within the current time window can be obtained, including sudden performance metric anomalies and newly added alarm events. These nodes are used as vertices of a candidate causal directed graph, and the retained edges are designated as directed edges. The weight of each edge represents its causal strength, and its attributes include the corresponding causal delay. For each edge in the graph, temporal reachability verification can be performed to ensure that the actual time difference between the event occurrence and the causal delay learned by the model are consistent within the allowable error range.

[0098] After pruning and validation, a candidate causal directed graph can be obtained. Then, potential root cause nodes (event nodes without significant incoming edges or those occurring earliest) and business impact nodes (event nodes representing the final business impact) can be identified. For each pair of start and end points, a causal-constrained heuristic path search algorithm can be executed. This algorithm is similar to a random walk but is constrained by causal strength and temporal order. For each path obtained, the path causal contribution is calculated, which can be the geometric mean of the causal strength of all edges on the path. Simultaneously, the temporal fit is calculated to measure the degree of agreement between the actual time difference of the path and the learned delay. The two are then multiplied to obtain the path confidence. Paths with a confidence greater than 0.5 can be retained, and several candidate event path chains are generated by sorting them from high to low confidence.

[0099] For highly overlapping candidate path chains, chains sharing most nodes and edges can be merged to form more generalized hyperlinks and labeled with different branch possibilities. For chains with logical conflicts, such as the rule that the same event cannot be the cause of two mutually exclusive events simultaneously, the branch with the highest confidence level is retained. Finally, each high-confidence structured path can be automatically converted into an easily understandable natural language description using templates, such as a complete chain of root causes, intermediate phenomena, and business impacts, along with confidence and delay information, achieving deep interpretability.

[0100] For example, each high-confidence structured path can be... The template is automatically converted into an easy-to-understand natural language description. For example: "Root cause: Core router R1 experienced a memory leak alarm at 10:05 (confidence level)." =0.95), after approximately 7 time units (learning delay) The propagation of (=7) caused the link L1 it carries to experience a sudden increase in packet loss rate to 5% at 10:12 (confidence level). =0.88), this link degradation further occurred after 3 units of time ( =3), causing a buffering issue in the video-on-demand service that relies on this link at 10:15 (confidence level). =0.82), overall chain confidence level =0.85. The final generated event chain, complete with confidence levels and explicit delay information, serves as the direct input to the state evolution deduction and decision simulation layer. This description directly integrates... , , All quantitative information was used, and the logic of "root cause - intermediate phenomenon - business impact" was clarified, achieving deep interpretability.

[0101] This process in the embodiments of this application upgrades root cause localization from rule-based correlation matching to deep learning-based causal inference, which can significantly improve the accuracy and reliability of fault localization.

[0102] Figure 6 This is a flowchart illustrating a multi-source data fusion network state reconstruction method provided in an embodiment of this application. Figure 6 As shown, the prediction of a future state graph sequence with a preset step size using a spatiotemporal graph neural network state prediction model based on multi-step prediction may include the following steps: In step S401, the historical state sequence is input into the state prediction model to output a future state diagram sequence with a preset step size and corresponding key indicators, and a predicted mean and a confidence interval representing uncertainty are output for each key indicator.

[0103] For example, the historical state sequence reconstructed from the network digital twin can be input into a spatiotemporal graph neural network state prediction model based on multi-step prediction. This model outputs a future state graph sequence at a preset step size and corresponding key indicators, and for each key indicator, outputs a predicted mean and a confidence interval representing uncertainty. This state prediction model takes multiple consecutive historical state graph sequences as input and predicts future state graph sequences at multiple step sizes. The loss function used for model training can be negative log-likelihood loss, which penalizes not only the deviation between the predicted mean and the true value but also the uncertainty of the prediction. When the model is uncertain about a prediction, it tends to increase the prediction variance to reduce the loss, thus honestly reflecting its confidence level. During model inference, the model outputs the predicted mean and standard deviation for each future step size, and an early warning strategy can be triggered based on the predicted mean and standard deviation.

[0104] During operation, a continuous sequence of historical state graphs can be obtained from the network digital twin. These state graphs contain multi-dimensional features such as topology, resource utilization, and workload. These historical state graph sequences are then input into a trained spatiotemporal graph neural network state prediction model. This model uses graph convolution or graph attention mechanisms in the spatial dimension to capture the spatial dependencies between network entities, and uses recurrent neural networks or temporal convolutional networks in the temporal dimension to capture the evolution of states over time.

[0105] During model training, a negative log-likelihood loss function can be used. For each prediction step, the model outputs the predicted mean and predicted variance. The first part of the loss function is the squared error between the predicted mean and the true value, divided by the predicted variance. This amplifies the error when the model is confident in its prediction (i.e., the variance is small), prompting the model to strive for higher prediction accuracy. The second part of the loss function is the logarithm of the predicted variance. This allows the model to appropriately increase the variance to reduce the overall loss when it is uncertain about the prediction, thus honestly reflecting its confidence level rather than forcibly giving an accurate but incorrect prediction. During the inference phase, for each key indicator at each future prediction step, the model can simultaneously output the predicted mean and standard deviation, based on which a 95% confidence interval can be constructed.

[0106] For example, to predict the future of a network, a state prediction model based on a spatiotemporal graph neural network can be trained. This model uses continuous... +1 historical state diagram sequence As input, predict the future A sequence of state diagrams for each step size. .for For each key indicator, it outputs both its predicted value (mean) and confidence interval (95% interval: [mean - 1.96 * standard deviation, mean + 1.96 * standard deviation]).

[0107] Loss function for model training Negative log-likelihood loss can be used: Formula 10 Where NLL represents negative log-likelihood. These are the actual state values. and These are the mean and variance of the model's predictions. This prediction function not only penalizes the deviation between the predicted mean and the true value. It also punishes the uncertainty of prediction. When a model is uncertain about a prediction, it tends to increase the prediction variance. To reduce losses and thus honestly reflect its confidence level; among them, To find the square of the norm, It is a logarithmic function.

[0108] Optionally, an uncertainty-based early warning strategy can be configured. When the lower bound of the confidence interval for the predicted mean exceeds a business threshold, the system will issue a high-risk warning even if the predicted mean itself does not exceed the threshold. For example, when the lower bound of the confidence interval for the predicted mean exceeds the threshold specified in the service level agreement, it indicates that the network status has a high probability of reaching or exceeding the alarm line in the future, and the system can take measures in advance. This confidence interval-based early warning strategy can issue signals when fault signs are weaker, truly achieving preventative maintenance.

[0109] For example, to upgrade AI predictions from "black box point estimations" to "interpretable probability estimations" and enable operations personnel to understand the reliability of the predictions, an uncertainty-based early warning strategy can be set up: during model inference, the model outputs future... The predicted mean of the step and standard deviation ,when Alarms will be triggered at the threshold (the threshold is the optimal threshold determined by combining the service level agreement and actual data patterns, and confirmed by experts).

[0110] in, This is the risk tolerance factor (default setting is 1.5).

[0111] The advantage of this application's embodiment is that even if the predicted mean does not exceed the threshold, if the model uncertainty is large (large root mean square), causing the lower bound of its confidence interval to exceed the threshold, the system will issue a "high risk" warning. This achieves earlier, more conservative, and more reliable preventive warnings.

[0112] A confidence interval-based early warning strategy can issue signals when fault signs are weaker, truly achieving preventative maintenance. It also provides crucial input for subsequent strategy simulations—not only knowing "what might happen in the future," but also "how confident this judgment is."

[0113] This application's embodiments upgrade artificial intelligence prediction from black-box point estimation to interpretable probability estimation by outputting probability predictions with uncertainty. This enables operations and maintenance personnel to know the reliability of the predictions, providing a more scientific basis for subsequent strategy simulation and decision-making.

[0114] Figure 7 This is a flowchart illustrating a multi-source data fusion network state reconstruction method provided in an embodiment of this application. Figure 7 As shown, the simulation evaluation of each operation and maintenance strategy may include the following steps: In step S501, a Markov chain is constructed. The state space of the Markov chain includes all network states of the network digital twin. The action space of the Markov chain includes a predefined set of operation and maintenance operations. The state transition of the Markov chain is implemented by a simulation engine. The simulation engine predicts the next state of the current state based on the current state and current action of the network digital twin using the spatiotemporal graph neural network state prediction model.

[0115] In step S502, the target reinforcement learning model is invoked to automatically explore and evaluate various operation and maintenance strategies in the network digital twin through the Markov chain.

[0116] The target reinforcement learning model is trained using a near-end policy optimization algorithm to recommend the operation and maintenance strategy with the highest long-term cumulative reward for a given state. The target reinforcement learning model integrates a security action mask to shield actions that may degrade the network state based on domain expert knowledge before execution. The reward function of the target reinforcement learning model during reinforcement learning is a hierarchical reward function that includes a basic reward and a sparse reward. The basic reward is used to balance service quality, resource cost, and configuration change penalties, while the sparse reward is only given when key milestones for preventing service level agreement breaches are achieved.

[0117] For example, the operation and maintenance strategy simulation process can be modeled as a Markov decision process. The state space comes from the current state of the network digital twin and can include multi-dimensional features such as topology, resource utilization, and service load. The action space can be a predefined set of operation and maintenance operations, such as migrating virtual machine instances from one host to another, assigning higher priority to service flows, and expanding link bandwidth. State transitions can be implemented by the simulation engine. Given the current state and actions, the simulation engine can use predefined physical rules and state prediction models to calculate the next state after executing the action.

[0118] A hierarchical reward function can be designed in a large-scale objective reinforcement learning model. This function can include a base reward and a sparse reward. The base reward balances service quality, resource cost, and configuration change penalties, and is defined as the positive incentive for improving service quality minus the negative incentive for increasing resource cost minus the configuration change penalty. The sparse reward is only given when key milestones for preventing service level agreement (SLA) breaches are achieved, such as successfully avoiding a predicted SLA breach, which results in a large positive reward, while actions that cause service interruption result in a large negative penalty. The sparse reward can be multiplied by an amplification factor to give it sufficient weight in the total reward, guiding the agent to pursue long-term strategic goals such as preventing major failures and ensuring service stability. Furthermore, a safety action mask can be integrated into the large-scale objective reinforcement learning model. This safety action mask is used to shield actions that may degrade the network state before execution, based on domain expert knowledge.

[0119] For example, when faced with predicted problems or sudden failures, the system can evaluate the effectiveness of different coping strategies in a digital twin based on a strategy simulation model. This process can be modeled as a Markov decision process, and a reinforcement learning agent can be trained using a proximal policy optimization algorithm to automatically explore and evaluate various operational strategies (such as expansion, migration, and routing adjustments), and recommend the optimal solution, thus achieving a closed loop from "diagnosis" to "prescription".

[0120] The state space of a Markov decision process: the current state of the digital twin. It consists of multiple dimensions such as topology, resource utilization, and business load.

[0121] Action Space: The operational actions that an agent can execute are a predefined set of executable operational operations, such as "migrate virtual machine instances from host A to host B", "assign higher priority to business flow X", and "expand the bandwidth of link Y by 10%".

[0122] State transition: Implemented by the simulation engine. Given the current state. and actions The simulation engine uses predefined physical rules and prediction models to calculate the next state after an action is performed. .

[0123] Reward function: Design a reward function to guide the agent to learn the optimal policy.

[0124] reward function It can be defined as: Formula 11 in, The basic reward can be defined as:

[0125] Formula 12 Used to balance business experience quality, resource consumption costs, and penalties for breach of service level agreements. , , The default values ​​are 0.5, 0.3, and 0.2 respectively. It is a sparse reward, given only when key milestones are achieved, such as: successfully avoiding a predicted SLA default: +10; actions that cause business disruption: -20. It is the sparse reward amplification factor, with a default value of 5.0. It significantly amplifies the importance of sparse milestone rewards, guiding the agent to move beyond short-term metric optimization and pursue long-term strategic goals such as preventing major failures and ensuring business stability.

[0126] During operation, the operational strategy to be evaluated can first be input into the simulation environment. This simulation environment can be a sub-module of the network digital twin, capable of simulating network behavior with high fidelity. The agent explores and learns in the simulation environment, employing modern reinforcement learning algorithms such as near-end policy optimization, learning through millions of trial-and-error interactions with the simulation engine. In each interaction, the agent observes the current state and selects an action based on its strategy. A safety action mask comes into play during action selection. The safety action mask is a set of predefined hard constraint rules based on domain expert knowledge, such as prohibiting the migration of load to overloaded hosts or prohibiting configuration changes that may affect stability during peak business periods. The agent can only select actions from the set of actions allowed by the mask, ensuring absolute safety during the exploration process and overcoming the biggest obstacle to applying reinforcement learning in critical systems.

[0127] After executing an action, the simulation engine calculates the next state, and the environment returns a reward. The reward calculation employs a hierarchical design: a base reward is calculated at each time step, reflecting a comprehensive trade-off between service experience quality, resource consumption costs, and service level agreement (SLA) breach penalties. Sparse rewards are only given upon achieving specific milestones; for example, successfully avoiding a predicted SLA breach can earn a large positive reward, encouraging the agent to focus on long-term strategic goals rather than short-term metric optimization. The agent can update its policy network based on the rewards received, progressively learning to recommend the operational strategy that yields the highest long-term cumulative reward for a given state.

[0128] When a real-world network encounters a state requiring a decision, the current state can be input into a pre-trained agent. The agent can then generate a series of high-value action sequences (i.e., policies) based on a security mask and learned strategies. Each policy can be rapidly extrapolated, generating simulation results that include quantitative comparisons and risk assessments. Operations personnel can view the simulated execution process and prediction results of the policies, enabling them to make data-driven decisions.

[0129] This application's embodiments combine reinforcement learning with security constraints to achieve a closed loop from diagnosis to prescription, providing scientific basis and security assurance for operation and maintenance decisions.

[0130] Figure 8 This is a flowchart illustrating a multi-source data fusion network state reconstruction method provided in an embodiment of this application. Figure 8 As shown, the method may further include the following steps: In step S60, a designated AI model is uniformly managed, and the performance degradation and concept drift of the designated AI model are monitored through a two-layer concept drift detection mechanism. Feedback data samples from different sources are used to drive the designated AI model to perform incremental learning and iterative updates. The designated AI model includes at least one of the spatiotemporal graph attention network model, the state prediction model, or the target reinforcement learning large model.

[0131] For example, embodiments of this application also include unified management and continuous monitoring of a specified AI model. The specified AI model is managed uniformly, and its performance degradation and concept drift are monitored through a two-layer concept drift detection mechanism. Feedback data samples from different sources are used to drive incremental learning and iterative updates of the specified AI model. The specified AI model may include at least one of a spatiotemporal graph attention network model, a state prediction model, or a large-scale target reinforcement learning model. Unified management can version-manage the model in a containerized manner, providing standard application interfaces for model training, evaluation, deployment, and online services, achieving full lifecycle management of the model. The two-layer concept drift detection mechanism, combining statistical testing and Bayesian inference methods, can continuously monitor the performance of online artificial intelligence models, proactively and sensitively detect model performance degradation (i.e., concept drift) caused by changes in the network environment, and issue tiered warnings.

[0132] During operation, all AI models can be centrally stored in a unified model repository. Each model is managed as a versioned container image, recording metadata such as the dataset used for model training, training parameters, and performance evaluation metrics. The platform provides standard model training pipelines, evaluation tools, deployment interfaces, and online service interfaces, making the model iteration and deployment process efficient, reliable, and traceable.

[0133] After the model goes live, a two-layer concept drift detection mechanism continuously monitors the model's performance. The first layer of detection is based on online statistical testing of business indicators. It uses a sliding window to monitor the business-level indicators output by the model, comparing the recent key business indicator values ​​with the baseline window from the model's initial stable period. Chi-square tests or proportionality tests can be used. If the p-value is less than the significance level (e.g., 0.05), a primary warning is quickly triggered. This layer is highly sensitive but may produce false alarms due to short-term business fluctuations.

[0134] The second layer of detection is based on the Bayesian online change point detection algorithm, which allows for a more refined analysis of the model's original prediction error sequence. This algorithm assumes that the model's prediction error on each sample follows a Gaussian distribution, and its mean may abruptly change at some unknown time (i.e., a drift point). A prior change point probability that increases over time can be set. Based on the principle that the longer the system runs, the greater the possibility of business and network evolution leading to model mismatch, the prior change point probability increases with running time but does not exceed an upper limit. At each time step, the Bayesian online change point detection algorithm combines the prior probability with the data likelihood calculated based on the prediction error sequence, recursively updating the posterior probability (i.e., the running probability) of a change point occurring at the current time. When the running probability exceeds a preset threshold (e.g., 0.5), concept drift can be determined to have occurred.

[0135] It can combine the results of two layers of detection: if only the first layer is triggered, it may be a short-term fluctuation, log and observe; if both layers are triggered or the second layer is triggered alone, it is determined that a high-confidence concept drift has occurred, an early warning report is generated immediately, and the model update process is automatically triggered.

[0136] This application embodiment achieves rapid screening and accurate location of model performance degradation through a dual-layer detection mechanism, ensuring that the system can promptly detect the risk of model failure.

[0137] Figure 9 This is a flowchart illustrating a multi-source data fusion network state reconstruction method provided in an embodiment of this application. Figure 9 As shown, the monitoring of performance degradation and concept drift of the specified AI model through a two-layer concept drift detection mechanism may include the following steps: In step S601, based on online statistical testing of business indicators, the performance degradation of the specified AI model is screened by comparing the key business indicators of the sliding window and the baseline window over a preset time period.

[0138] In step S602, based on the Bayesian online change point detection algorithm, the posterior probability of concept drift occurring at the current moment is calculated using the prior change point probability on the original prediction error sequence of the specified AI model, and concept drift is determined to have occurred when the posterior probability exceeds a preset threshold.

[0139] For example, in the two-layer concept drift detection mechanism of this application, the first layer is based on online statistical testing of business indicators. This involves comparing key business indicators within a preset time period (sliding window) with a baseline window to screen for performance degradation of a specified AI model. Specifically, a sliding window is used to monitor the business-level indicators output by the model. Within a recent sliding window, such as the most recent 1000 prediction samples, key business indicators are calculated in real time, which may include prediction accuracy, recall, F1 score, and mean absolute error. The key business indicator values ​​in the current window are compared with those in the baseline window, i.e., the indicator values ​​during the model's initial stable period. A chi-square test or proportionality test can be used. If the p-value is less than the significance level (e.g., 0.05), a primary warning is quickly triggered.

[0140] The second layer is based on a Bayesian online change point detection algorithm. It uses the prior change point probability to calculate the posterior probability of concept drift at the current moment from the original prediction error sequence of the specified AI model, and determines that concept drift has occurred when the posterior probability exceeds a preset threshold. This algorithm assumes that the model's prediction error follows a Gaussian distribution, and that its mean may change abruptly at some unknown moment. It detects drift by recursively calculating the posterior probability of change at the current moment.

[0141] For example, suppose the model is in the... Prediction error on each sample It follows a Gaussian distribution, and its mean is Perhaps at some unknown moment A sudden change (drift point) occurs. The probability of execution is calculated online based on a Bayesian detection algorithm. That is, at the current moment The probability of a change point occurring. The core idea of ​​its recursive calculation is to continuously update the belief about the location of the change point based on prior probability and the likelihood of new data.

[0142] The prior probability of the Bayesian detection algorithm is a prior change point probability that increases over time. : Formula 13 in, To obtain the minimum value, This refers to the runtime.

[0143] The longer the system runs, the greater the likelihood of business and network evolution leading to model mismatch. 0.001 represents the prior growth rate of drift. This means that for every 1000 time units the system runs, the prior probability of a drift increasing by 1%, but not exceeding 10%.

[0144] It is the "preconceived notions" (prior probabilities) set by the algorithm and reflecting domain knowledge, while It is the "current belief" (posterior probability) calculated by the algorithm at each moment after combining the prior and actual observation data.

[0145] At every moment The Bayesian online change point detection algorithm incorporates the aforementioned prior probabilities Combined with data likelihood calculated based on the prediction error sequence, the current time step is recursively updated. The posterior probability of a change point, i.e., the running probability. .

[0146] When detected When the threshold value is set to 0.5 (preset threshold), concept drift is considered to have occurred.

[0147] This application combines rapid screening through statistical testing with precise localization through Bayesian inference to achieve comprehensive monitoring of model performance degradation, providing a reliable trigger signal for timely model updates.

[0148] Figure 10 This is a flowchart illustrating a multi-source data fusion network state reconstruction method provided in an embodiment of this application. Figure 10 As shown, the step of using feedback data samples from different sources to drive the specified AI model for incremental learning and iterative updates may include the following steps: In step S603, each feedback data sample is assigned a different credibility weight according to different feedback sources, and the feedback data samples are weighted in the loss function of the incremental learning of the specified AI model based on the credibility weight. The feedback data samples from different sources include at least two of the following: manually confirmed feedback data samples, automatically verified feedback data samples, or isolated feedback data samples.

[0149] In step S604, the weighted feedback data samples and new production data samples are used to form an incremental training dataset. The specified AI model is then incrementally trained or fine-tuned. After verifying that the effect meets the standards in the network digital twin environment, the online model is smoothly replaced.

[0150] For example, in the incremental learning and iterative update process of this application, different credibility weights are assigned to each feedback data sample according to different feedback sources, and the feedback data samples are weighted in the loss function of the specified AI model incremental learning based on the credibility weights. Feedback data samples from different sources may include at least two of the following: manually confirmed feedback samples, automatically verified feedback samples, or isolated feedback samples. Manually confirmed feedback refers to the confirmation, correction, or rejection of the root causes or strategies recommended by the system by maintenance personnel, and has the highest credibility. Automatically verified feedback refers to the difference data between the model's prediction results and the actual subsequent development, that is, feedback that is automatically verified by the system and highly consistent with subsequent facts, and has medium credibility. Isolated feedback refers to isolated automatic feedback that is not corroborated by other data, and has low credibility. The weighted feedback data samples and new production data samples can be used to form an incremental training dataset to incrementally train or fine-tune the specified AI model, and after verifying that the effect meets the standards in the network digital twin environment, the online model can be smoothly replaced.

[0151] During operation, multiple feedback channels can be established to collect feedback data from the production environment. When operations personnel confirm, correct, or reject the root cause analysis results recommended by the model in the system, this interaction can be recorded as manual confirmation feedback. When the model's prediction results are completely consistent with the actual subsequent developments—for example, predicting that a performance indicator will exceed a threshold within the next 5 minutes, and this actually happens—an automatic verification feedback can be automatically generated. When a model's prediction cannot be corroborated by other data sources and there is no manual intervention for confirmation, this feedback can be marked as isolated feedback.

[0152] A confidence weight can be preset for each feedback source; for example, the weight of human confirmation feedback can be 1.0, the weight of automatic verification feedback can be 0.7, and the weight of isolated feedback can be 0.3. During incremental model learning, these feedback data samples can be mixed with new production data samples to form an incremental training dataset. When calculating the loss function, the loss value of each sample is multiplied by its corresponding confidence weight. For human confirmation feedback samples, a higher weight means that the model will pay more attention to learning from these samples during training; for isolated feedback samples, a lower weight means that the model will not deviate from the correct learning direction due to a single unreliable feedback. This weighting mechanism effectively resists the interference of low-quality feedback noise on model updates, achieving robust evolution.

[0153] After weighting the samples, the original model can be incrementally trained or fine-tuned. For spatiotemporal graph attention network models and state prediction models, gradient descent updates can be performed several rounds on the incremental dataset, starting from the current model parameters. For large-scale objective reinforcement learning models, the policy network can be fine-tuned using new feedback samples. After completing incremental training, the new model can first be validated in a digital twin environment, i.e., a shadow environment, comparing the key performance indicators of the new and old models on the validation set to ensure that the performance of the new model is not lower than that of the old model and that no new problems have been introduced. After successful validation, the new model can be deployed online using smooth replacement strategies such as blue-green deployment or canary deployment, completing the learning loop.

[0154] The embodiments of this application utilize a feedback-driven incremental learning mechanism to enable the system to adapt to new network services, new devices, and new fault modes, thereby achieving continuous self-evolution of the artificial intelligence model.

[0155] Figure 11 This is a block diagram of an electronic device provided in one embodiment of this application. For example... Figure 11 As shown, the electronic device 1100 may include: a processor 1101 and a memory 1102. The electronic device 1100 may also include one or more of a multimedia component 1103, an input / output (I / O) interface 1104, and a communication component 1105.

[0156] The processor 1101 controls the overall operation of the electronic device 1100 to complete all or part of the steps in the multi-source data fusion network state reconstruction method described above. The memory 1102 stores various types of data to support the operation of the electronic device 1100. This data may include, for example, instructions for any application or method operating on the electronic device 1100, and application-related data such as contact data, sent and received messages, pictures, audio, video, etc. The memory 1102 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. Multimedia component 1103 may include a screen and an audio component. The screen may be, for example, a touchscreen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signals may be further stored in memory 1102 or transmitted via communication component 1105. The audio component also includes at least one speaker for outputting audio signals. I / O interface 1104 provides an interface between processor 1101 and other interface modules, such as a keyboard, mouse, buttons, etc. These buttons may be virtual or physical buttons. Communication component 1105 is used for wired or wireless communication between the electronic device 1100 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, 4G, NB-IoT, eMTC, or other 5G technologies, or combinations thereof, is not limited here. Therefore, the corresponding communication component 1105 may include: a Wi-Fi module, a Bluetooth module, an NFC module, etc.

[0157] In an exemplary embodiment, the electronic device 1100 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the multi-source data fusion network state reconstruction method described above.

[0158] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, which, when executed by a processor, implement the steps of the multi-source data fusion network state reconstruction method described above. For example, the computer-readable storage medium may be the memory 1102 including program instructions described above, which may be executed by the processor 1101 of the electronic device 1100 to complete the multi-source data fusion network state reconstruction method described above.

[0159] In another exemplary embodiment, a computer program product is also provided, comprising a computer program executable by a programmable device, the computer program having a code portion for performing the above-described multi-source data fusion network state reconstruction method when executed by the programmable device.

[0160] The preferred embodiments of this application have been described in detail above with reference to the accompanying drawings. However, this application is not limited to the specific details of the above embodiments. Within the scope of the technical concept of this application, various simple modifications can be made to the technical solution of this application, and these simple modifications all fall within the protection scope of this application.

[0161] It should also be noted that the various specific technical features described in the above embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, this application will not describe the various possible combinations separately.

[0162] Furthermore, various different implementations of this application can be combined in any way, as long as they do not violate the spirit of this application, they should also be regarded as the content disclosed in this application.

Claims

1. A method for reconstructing the state of a network through multi-source data fusion, characterized in that, The method includes: Real-time acquisition of multi-source heterogeneous network data of the target network, and anomaly level marking, time sequence alignment and entity unification are performed to obtain network event data stream. The multi-source heterogeneous network data includes at least two of the following: network resource management data, performance index data, real-time alarm data and active dialing test data. The network event data stream includes timestamp, device identifier, index name or alarm code, and corresponding content of index name or alarm code. A dynamic temporal heterogeneous graph sequence is constructed based on the network event data stream. The nodes in the graph of the dynamic temporal heterogeneous graph sequence include physical nodes, performance indicators, alarm events, and service instances. The edges in the graph of the dynamic temporal heterogeneous graph sequence include edges based on physical connection relationships, edges based on membership relationships, and edges based on temporal association relationships. The attributes of the nodes are used to indicate the anomaly level of the nodes. The spatiotemporal graph attention network model with causal delay learning capability is used to reason about the dynamic temporal heterogeneous graph sequence to output a causal strength matrix and a causal delay matrix, and an event chain representing the fault propagation path is constructed based on the causal strength matrix and the causal delay matrix. Based on the network event data stream and the event chain, the historical state sequence of the target network is reconstructed using the network digital twin of the target network, and the future state graph sequence with a preset step size is predicted by a spatiotemporal graph neural network state prediction model based on multi-step prediction. Based on the state diagram sequence with the preset future step size, simulation evaluation is performed on each operation and maintenance strategy, and network reconstruction is carried out based on the simulation evaluation results.

2. The method according to claim 1, characterized in that, The process of marking anomaly levels includes: Multiple sliding windows of different scales are maintained in parallel, and the isolated forest algorithm is run independently in each sliding window to calculate the anomaly coefficient of the data points of the multi-source heterogeneous network data, and the composite anomaly score of the real-time data stream is obtained based on the anomaly coefficient. If the composite anomaly score exceeds a preset absolute threshold, the multi-source heterogeneous network data is marked as anomaly data. If the composite anomaly score exceeds the adaptive relative threshold, the multi-source heterogeneous network data is marked as suspected anomaly data. The adaptive relative threshold is obtained based on the mean and standard deviation of the composite anomaly score sequence over a preset time period.

3. The method according to claim 1, characterized in that, The aforementioned temporal alignment and entity unification include: By utilizing periodically occurring anchor events, the offset distribution of anchor event timestamps in different network event data streams is calculated, and a dynamic time warping algorithm is applied to estimate and compensate for systematic time delays. The anchor events include periodically reported heartbeat messages or periodically dialed test tasks. A network entity knowledge graph with resource management data as its backbone is constructed. The contextual information of the incoming data is used as a feature. The semantic similarity between the incoming data and the entities in the knowledge graph is calculated through an entity linking model based on graph neural network. Based on the semantic similarity, intelligent mapping and unification of entities are achieved to obtain cleaned and aligned data. The cleaned and aligned data is aggregated using a sliding window or scrolling window in the streaming computing engine to generate the network event data stream.

4. The method according to claim 1, characterized in that, The spatiotemporal graph attention network model includes a temporal convolutional layer or recurrent neural network in the temporal dimension, and a graph attention layer in the spatial dimension. The process of using the spatiotemporal graph attention network model with causal delay learning capability to infer the dynamic temporal heterogeneous graph sequence to output a causal strength matrix and a causal delay matrix includes: Through the graph attention layer, node influence association features are extracted from the attribute features of nodes in the dynamic temporal heterogeneous graph sequence based on the multi-head attention mechanism. The graph attention layer sets a learnable causal delay parameter for any connected nodes. The causal delay parameter represents the time step required from the state change of the target node to the state of its neighboring nodes. The node influence association features are used to indicate the strength of the influence of each target node on its neighboring nodes. Based on the temporal convolutional layer or recurrent neural network, the sequence of the node influence correlation features is processed to obtain the causal strength matrix and the causal delay matrix, which are used to represent the evolution mode of the state of each node over time.

5. The method according to claim 1, characterized in that, The construction of the event chain representing the fault propagation path based on the causal strength matrix and the causal delay matrix includes: The causal intensity matrix is ​​pruned based on the contribution threshold, and unreachable edges are removed by temporal reachability verification to generate a candidate causal directed graph. The temporal reachability verification is used to detect whether the time difference between the occurrence of two adjacent events is less than a preset error window. A specified path search algorithm is executed on the candidate causal directed graph to obtain candidate paths, and the path causal contribution and temporal fit of each candidate path are calculated. The path confidence of each candidate path is obtained based on the path causal contribution and the temporal fit. The specified path search algorithm is used to determine potential root cause nodes and business impact nodes in the candidate causal directed graph, and to perform path search from root cause nodes to impact nodes. Candidate paths with confidence levels exceeding a preset threshold are used as candidate event chains. Overlapping candidate event chains are fused and conflict-resolved to generate the event chain representing the fault propagation path. The event chain representing the fault propagation path is then transformed into interpretable root cause analysis results described in natural language.

6. The method according to claim 1, characterized in that, The prediction of a future state graph sequence with a preset step size using a spatiotemporal graph neural network state prediction model based on multi-step prediction includes: The historical state sequence is input into the state prediction model to output a future state diagram sequence with a preset step size and corresponding key indicators. For each key indicator, a predicted mean and a confidence interval representing uncertainty are output.

7. The method according to claim 1, characterized in that, The simulation and evaluation of each operation and maintenance strategy includes: A Markov chain is constructed, wherein the state space of the Markov chain includes all network states of the network digital twin, the action space of the Markov chain includes a predefined set of operation and maintenance operations, and the state transition of the Markov chain is implemented by a simulation engine. The simulation engine predicts the next state of the current state based on the current state and current action of the network digital twin through the spatiotemporal graph neural network state prediction model. The target reinforcement learning model is invoked to automatically explore and evaluate various operation and maintenance strategies in the network digital twin through the Markov chain; The target reinforcement learning model is trained using a near-end policy optimization algorithm to recommend the operation and maintenance strategy with the highest long-term cumulative reward for a given state. The target reinforcement learning model integrates a security action mask to shield actions that may degrade the network state based on domain expert knowledge before execution. The reward function of the target reinforcement learning model during reinforcement learning is a hierarchical reward function that includes a basic reward and a sparse reward. The basic reward is used to balance service quality, resource cost, and configuration change penalties, while the sparse reward is only given when key milestones for preventing service level agreement breaches are achieved.

8. The method according to claim 7, characterized in that, The method further includes: The system uniformly manages designated AI models and monitors the performance degradation and concept drift of the designated AI models through a two-layer concept drift detection mechanism. It also uses feedback data samples from different sources to drive the designated AI models to perform incremental learning and iterative updates. The designated AI models include at least one of the spatiotemporal graph attention network model, the state prediction model, or the target reinforcement learning large model.

9. The method according to claim 8, characterized in that, The monitoring of performance degradation and concept drift of the specified AI model through a two-layer concept drift detection mechanism includes: Online statistical testing based on business metrics is used to screen for performance degradation of the specified AI model by comparing key business metrics of a sliding window and a baseline window over a preset time period. Based on the Bayesian online change point detection algorithm, the posterior probability of concept drift at the current moment is calculated by using the prior change point probability on the original prediction error sequence of the specified AI model, and concept drift is determined to have occurred when the posterior probability exceeds a preset threshold.

10. The method according to claim 8, characterized in that, The method of using feedback data samples from different sources to drive the specified AI model for incremental learning and iterative updates includes: Each feedback data sample is assigned a different credibility weight according to different feedback sources, and the feedback data samples are weighted in the loss function of the incremental learning of the specified AI model based on the credibility weight. The feedback data samples from different sources include at least two of the following: manually confirmed feedback data samples, automatically verified feedback data samples, or isolated feedback data samples. The weighted feedback data samples and new production data samples are used to form an incremental training dataset. The specified AI model is then incrementally trained or fine-tuned. After verifying that the effect meets the standards in the network digital twin environment, the online model is smoothly replaced.

Images