A high-performance network fault monitoring method and system based on active probing and Bayesian inference

Abstract

The application discloses a kind of high-performance network fault monitoring method and system based on active detection and bayesian inference, it is related to network fault monitoring technical field, comprising: topology management module: for unified maintenance whole network equipment, link, port and the mapping relationship of detection path, provide bottom topology data support for detection routing and bayesian inference;Active detection module: adaptive sending lightweight detection message is arranged in each service node, for collecting path delay and packet loss original time series data.This kind of high-performance network fault monitoring method and system based on active detection and bayesian inference, without switch, network card hardware telemetry protocol supporting modification, not dependent on equipment manufacturer private interface, only rely on distributed service node deployment lightweight detection agent can complete whole network monitoring, without modifying upper AI training and distributed storage etc. Service application, zero service invasion, substantially reduce the deployment cost and implementation threshold of cross-vendor heterogeneous spine-leaf high-performance network.

Description

Technical Field

[0001] This invention relates to the field of network fault monitoring technology, specifically to a high-performance network fault monitoring method and system based on active detection and Bayesian inference. Background Technology

[0002] With the continuous expansion of data center scale, high-performance networks such as RDMA and InfiniBand are widely used in scenarios such as artificial intelligence training, cloud storage, and distributed computing. These networks typically employ a spine-leaf flat topology to achieve high bandwidth, low latency, and multi-path forwarding capabilities. Because services are highly sensitive to latency changes at the microsecond or millisecond level, intermittent link anomalies, congestion, and network card failures can cause service jitter, decreased throughput, or task failures within a short period.

[0003] Existing network fault monitoring technologies mainly include passive monitoring based on network devices, active detection based on thresholds, and anomaly detection based on machine learning. Passive monitoring relies on the support of switches, network interface cards (NICs), or telemetry protocols, resulting in high deployment costs and difficulty in unified implementation across cross-vendor devices or constrained production networks. Traditional active detection methods such as ping and traceroute are simple to deploy, but they typically use single-path latency or fixed thresholds as the basis for judgment, easily misjudging short-term jitter as faults, and struggling to distinguish between link failures, congestion, and end-side NIC anomalies. While machine learning methods can learn complex patterns, they often require large amounts of labeled data, and the interpretability of the reasoning process is insufficient, hindering operations personnel from quickly locating faults and identifying their causes. Summary of the Invention

[0004] The purpose of this invention is to provide a high-performance network fault monitoring method and system based on active detection and Bayesian inference to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a high-performance network fault monitoring system based on active detection and Bayesian inference, comprising: Topology Management Module: Used to uniformly maintain the mapping relationship between devices, links, ports and probe paths across the entire network, providing underlying topology data support for probe routing and Bayesian inference; Active Probe Module: Deployed on each business node, it adaptively sends lightweight probe messages to collect raw time-series data on path latency and packet loss, serving as the data source for monitoring; Feature extraction module: used to perform sliding window statistics on raw detection data, converting latency or jitter indicators into evidence of normal or abnormal path observations, and completing data standardization preprocessing; Bayesian inference module: used to build fault and path probability models, combine observational evidence to calculate the posterior confidence of each fault location and fault type, and realize intelligent fault reasoning; Fault Judgment Module: Based on preset probability thresholds, it screens out the actual fault location and fault type, integrates a complete set of diagnostic criteria, and filters out invalid jitter false alarms; Alarm and Display Module: Used to visualize the diagnostic results topology and generate standardized operation and maintenance alarms, and then archive historical data for iterative optimization of the probability model; Hardware module: Composed of electronic devices and computer-readable storage media. The electronic devices include a monitoring server equipped with a processor, memory and storage media, as well as a distributed probe node host. The computer-readable storage media includes storage of monitoring programs, Bayesian probability matrices, topology databases and historical probe time-series data. When the program runs, it implements the entire monitoring process.

[0006] Furthermore, the active detection module includes a detection task scheduling unit, an adaptive frequency control unit, a message sending and receiving unit, and a raw data reporting unit. The detection task scheduling unit is used to receive the detection path list issued by the topology module and uniformly manage the start and stop of detection tasks and periodic scheduling. The adaptive frequency control unit is used to dynamically adjust the detection frequency according to network latency fluctuations and to balance monitoring real-time performance with bandwidth overhead.

[0007] Furthermore, the message sending and receiving unit is used to send lightweight probe messages and collect raw network timing indicators such as RTT, packet loss, and timestamps, while the raw data reporting unit is used to standardize and encapsulate the probe raw data and push it to the feature extraction module in real time for preprocessing.

[0008] Furthermore, the feature extraction module includes a sliding window calculation unit, a threshold comparison unit, an observation variable generation unit, and a data denoising unit. The sliding window calculation unit is used to perform window statistics on the streaming detection data and score the mean, standard deviation, sudden increase magnitude, and path consistency in the output. The threshold comparison unit is used to compare the statistical features with the preset warning threshold to determine whether there are abnormal fluctuations in a single path. The observation variable generation unit is used to mark each path as a normal or abnormal observation variable and integrate them to form a global observation evidence set for the inference module. The data denoising unit is used to filter noise such as single detection errors and instantaneous short-term jitter to reduce invalid abnormal inputs and reduce subsequent misjudgments.

[0009] Furthermore, the Bayesian inference module includes a model building unit, a probability parameter management unit, a likelihood calculation unit, and a posterior probability solution unit. The model building unit is used to build a Bayesian network and maintain the correlation between three types of variables: fault location, fault type, and path observation. The probability parameter management unit is used to store, load, and iteratively update the prior probability and conditional probability matrices to support probability calculation.

[0010] Furthermore, the likelihood calculation unit is used to calculate the likelihood value of each fault location generating current observational anomaly evidence by combining topological mapping relationships, while the posterior probability calculation unit calculates the fault confidence of all links, network cards, and congested areas in batches based on Bayes' theorem, as well as the probability of various fault types. The calculation formula is as follows: ,in Fault location variable; Prior probability of candidate fault location; Likelihood; : Set of observational evidence ; Total probability; : Posterior probability.

[0011] Furthermore, the fault determination module includes a fault location determination unit, a fault type determination unit, an alarm filtering unit, and a diagnostic information assembly unit. The fault location determination unit is used to filter fault locations with posterior probabilities that meet the criteria based on the location alarm threshold, thereby quickly locating the fault location. The fault type determination unit is used to distinguish between intermittent link faults, congestion, and network card faults based on the determined fault location and the type threshold. The alarm filtering unit is used to remove short-term jitter-related suspected faults with probabilities below the threshold, thereby reducing invalid alarms and lowering the false alarm rate. The diagnostic information assembly unit is used to integrate fault location, fault type, confidence level, affected paths, and abnormal evidence to generate complete diagnostic data.

[0012] A high-performance network fault monitoring method based on active detection and Bayesian inference, wherein the high-performance network fault monitoring method is applied to the aforementioned high-performance network fault monitoring system, includes the following steps: S1. Network topology initialization: Based on the topology management module, collect the entire network's spine-leaf hardware topology, then establish path and underlying link mapping, and filter three types of representative probe paths: baseline, cross-switch, and high-load, and send them to the probe nodes; S2. Adaptive multi-path active detection: The active detection module of each detection node sends detection messages at a dynamic frequency. When the network is stable, the sampling overhead is reduced. When an abnormal delay is detected, the detection frequency of the associated path is increased. The raw data of RTT and packet loss timing are collected and reported. S3, Temporal Feature Extraction: The feature extraction module performs window statistics on the reported raw data, then calculates features such as the mean time delay, standard deviation, and sudden increase magnitude, and then compares the threshold labels to mark each path as normal or abnormal, and integrates them to generate a global observation evidence set; S4. Bayesian network modeling: The Bayesian inference module loads the topology mapping, conditional probability matrix and observation evidence to construct a model of three types of variables: fault location, fault type and path observation. Then, the posterior confidence of all candidate fault locations and fault types is calculated in batches using the Bayesian formula. S5. Fault Diagnosis: The fault judgment module uses two levels of probability thresholds to determine the fault location and fault type in sequence, then filters the confidence level items, binds the affected path, abnormal characteristics and probability basis, and then outputs a complete structured diagnostic conclusion. S6. Visualization and Rendering: The alarm and display module combines the network topology rendering heatmap and probability time series curves to generate alarm information with handling suggestions and push it to the outside world. At the same time, it archives the full amount of detection, inference and diagnosis data for continuous optimization of Bayesian probability parameters.

[0013] Furthermore, the three types of paths in step S1 are the baseline path within the same leaf switch, the cross-node path across leaves and through the spine switch, and the dedicated path for high-load service areas and core services. The output is a standardized list of detection paths, which is distributed to all detection nodes in the entire network.

[0014] Furthermore, step S4 includes the following sub-steps: S41. Initialize the Bayesian network model: Read the topology mapping data, define three types of variables: fault location, fault type, and path observation, and establish the correlation between the fault impact of the variables. S42. Loading probability parameters and observational evidence: Importing the prior probability and path anomaly conditional probability matrix for each fault location ( This indicates that the path passes through a faulty link. This indicates that the path does not pass through the faulty link. (Indicating no network fault), then receive the complete set of observation evidence of normal or abnormal paths output by S3. ; S43. Calculate the likelihood of evidence corresponding to the fault location: Traverse each candidate fault location, match the detection path passing through that location, and calculate the joint likelihood of the current observation occurring when the fault occurs at that location by multiplying the conditional probabilities. The calculation formula is as follows: ,in: : For all Multiplication of probabilities of detection paths :Location In case of failure, the path The conditional probability of presenting the current observation state :Location Under fault conditions, the current complete set of observational evidence is available. The joint likelihood value; S44. Calculate the fault location: Substitute the values ​​into Bayes' theorem to calculate the posterior confidence of the fault at all points. Then, after identifying the fault location, calculate the conditional posterior probability formula for each type of fault: ,in: Determine the location Fault and combined with observational evidence The fault is Type confidence, Iterate through all fault types, sum them to achieve normalization, and output a probability list for fault judgment.

[0015] This invention provides a high-performance network fault monitoring method and system based on active detection and Bayesian inference, which has the following beneficial effects: 1. This invention requires no modification to the hardware telemetry protocol of switches or network cards, does not rely on proprietary interfaces of equipment manufacturers, and can complete full network monitoring by deploying lightweight probe agents on distributed service nodes. It does not require modification to upper-layer AI training and distributed storage business applications, resulting in zero business intrusion. It significantly reduces the deployment cost and implementation threshold of cross-vendor heterogeneous spine-leaf high-performance networks. Furthermore, by distinguishing between baseline, cross-switch, and high-load probe paths, it fully covers the entire network link. It also collects RTT and packet loss time sequence data from multiple paths, ensuring that short-term jitter on a single path will not affect the overall monitoring and judgment. At the same time, it automatically reduces the probe sampling frequency to reduce packet overhead when the network is running smoothly. Once path latency or jitter exceeds the standard, it automatically increases the probe frequency of associated and adjacent paths, thereby quickly capturing the fault evolution process and achieving the goal of saving bandwidth during idle time and responding quickly to anomalies.

[0016] 2. This invention is based on the multi-dimensional features of the mean, standard deviation, sudden increase magnitude, and path consistency of the batch statistical delay using a sliding window, abandoning the single-index judgment logic. Furthermore, it filters out single-probe errors and millisecond-level instantaneous jitter noise through a built-in data denoising unit, thereby uniformly transforming the original time-series data into standardized 0 / 1 observation variables. This eliminates the interference of original data noise on subsequent fault inference, reducing the false alarm rate caused by network instantaneous jitter from 12.5% ​​to 3.2%. Moreover, it completes the fault confidence calculation based on a Bayesian network, making the inference logic transparent and traceable, without requiring massive amounts of labeled training data.

[0017] 3. This invention uses a two-level probability threshold hierarchical diagnosis to accurately pinpoint links, network cards, or congested areas, thereby distinguishing between intermittent faults, congestion, or network card faults. This significantly improves the accuracy of fault location in large-scale experimental environments. Furthermore, the setting of topology heatmap visualization alarms enables the automatic archiving and iterative updating of the probability model with all historical data, effectively forming a closed loop from monitoring to diagnosis to optimization. Moreover, it is optimized for scenarios sensitive to microsecond-level latency such as RDMA and InfiniBand, accurately identifying faults unique to high-performance networks and filling the gaps in industry monitoring solutions. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall architecture of a high-performance network fault monitoring system based on active detection and Bayesian inference according to the present invention. Figure 2 This is a schematic diagram of the experimental network topology of a high-performance network fault monitoring system based on active detection and Bayesian inference according to the present invention. Figure 3 This is a schematic diagram of the overall operation process of a high-performance network fault monitoring method based on active detection and Bayesian inference according to the present invention. Detailed Implementation

[0019] The embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and should not be construed as limiting the scope of the invention.

[0020] like Figure 1 As shown, a high-performance network fault monitoring system based on active detection and Bayesian inference includes: Topology Management Module: Used to uniformly maintain the mapping relationship between devices, links, ports and probe paths across the entire network, providing underlying topology data support for probe routing and Bayesian inference; Active Probe Module: Deployed at each service node, it adaptively sends lightweight probe messages to collect raw time-series data on path latency and packet loss. It is the data source for monitoring. The active probe module includes a probe task scheduling unit, an adaptive frequency control unit, a message sending and receiving unit, and a raw data reporting unit. The probe task scheduling unit receives the probe path list issued by the topology module and manages the start and stop of probe tasks and periodic scheduling. The adaptive frequency control unit dynamically adjusts the probe frequency according to network latency fluctuations, balancing real-time monitoring and bandwidth overhead. The message sending and receiving unit sends lightweight probe messages to collect raw network time-series indicators such as RTT, packet loss, and timestamps. The raw data reporting unit standardizes and encapsulates the raw probe data and pushes it to the feature extraction module in real time for preprocessing. Feature extraction module: This module performs sliding window statistics on the raw detection data, transforming latency or jitter indicators into evidence of normal or abnormal path observations, and completing data standardization preprocessing. The feature extraction module includes a sliding window calculation unit, a threshold comparison unit, an observation variable generation unit, and a data denoising unit. The sliding window calculation unit performs window statistics on the streaming detection data and scores the mean latency, standard deviation, sudden increase magnitude, and path consistency in the output. The threshold comparison unit compares the statistical features with preset warning thresholds to determine whether there are abnormal fluctuations in a single path. The observation variable generation unit marks each path as a normal or abnormal observation variable and integrates them into a global set of observation evidence for the inference module. The data denoising unit filters out noise such as single detection errors and instantaneous short-term jitter to reduce invalid abnormal inputs and lower subsequent misjudgments. The Bayesian inference module is used to build fault and path probability models, calculate the posterior confidence of each fault location and fault type based on observational evidence, and achieve intelligent fault inference. The Bayesian inference module includes a model building unit, a probability parameter management unit, a likelihood calculation unit, and a posterior probability solution unit. The model building unit is used to build a Bayesian network and maintain the association between three types of variables: fault location, fault type, and path observation. The probability parameter management unit is used to store, load, and iteratively update the prior probability and conditional probability matrices to support probability calculations. The likelihood calculation unit is used to calculate the likelihood value of each fault location generating current observational anomaly evidence based on topological mapping relationships. The posterior probability solution unit calculates the fault confidence of all links, network cards, and congested areas in batches, as well as the probability of various fault types, based on the Bayesian formula. The calculation formula is as follows: ,in Fault location variable ( A fault has occurred at this location; (This location is normal and has no faults). Prior probability of candidate fault location (obtained solely from historical fault records and operational experience when no detection and observation data is available). (Base probability of self-failure); Likelihood (assuming the first The location is indeed faulty; evidence of either an anomaly or normality has been observed in the current path. (probability of occurrence) : Set of observational evidence ; : Full probability (the generation of current observation evidence at all fault locations (including normal states) across the entire network) The total probability is a fixed denominator used to normalize the result to the 0-1 interval. Posterior probability (in the current detection of anomalous evidence) Given the given information, the first (Confidence probability that a network location is faulty). Fault Judgment Module: Based on preset probability thresholds, the module filters out the true fault location and fault type, integrates a complete set of diagnostic criteria, and filters out invalid jitter false alarms. The fault judgment module includes a fault location determination unit, a fault type determination unit, an alarm filtering unit, and a diagnostic information assembly unit. The fault location determination unit is used to filter fault locations with posterior probability that meet the criteria based on the location alarm threshold, quickly locating the fault location. The fault type determination unit is used to distinguish between intermittent link faults, congestion, and network card faults based on the determined fault location and type threshold. The alarm filtering unit is used to remove short-term jitter suspected faults with insufficient probability thresholds, reducing invalid alarms and lowering the false alarm rate. The diagnostic information assembly unit is used to integrate fault location, fault type, confidence level, affected paths, and abnormal evidence to generate complete diagnostic data. Alarm and Display Module: Used to visualize the diagnostic results topology and generate standardized operation and maintenance alarms, and then archive historical data for iterative optimization of the probability model; Hardware module: Composed of electronic devices and computer-readable storage media. The electronic devices include a monitoring server equipped with a processor, memory and storage media, as well as a distributed probe node host. The computer-readable storage media includes storage of monitoring programs, Bayesian probability matrices, topology databases and historical probe time-series data. When the program runs, it implements the entire monitoring process. like Figure 1 As shown, the data acquisition layer consists of a topology management module, an active detection module, and a hardware module (distributed detection node host, storage medium) (used to collect raw network time-series data from each server, network card, and link in the RDMASpine-Leaf network, complete the raw data reporting, and deliver it to the intermediate inference layer for preprocessing). The inference engine layer consists of a feature extraction module and a Bayesian inference module (used to clean and reduce noise from the raw collected data and extract abnormal features to construct observation evidence, and complete intelligent fault inference through the Bayesian network probability model, output the fault confidence of each link, network card, and congested area, and send it to the top-level decision layer). The decision output layer consists of a fault judgment module, an alarm and display module, and a hardware module (monitoring server, storage medium) (used to complete the final fault judgment, false alarm filtering, and diagnostic information integration, output visualized topology, operation and maintenance alarms, and fault root cause conclusions, and at the same time accumulate historical data to optimize the inference model).

[0021] like Figure 2 and Figure 3 As shown, a high-performance network fault monitoring method based on active detection and Bayesian inference is proposed. This high-performance network fault monitoring method is applied to the aforementioned high-performance network fault monitoring system and includes the following steps: S1. Network Topology Initialization: Based on the topology management module, the entire network's spine-leaf hardware topology is collected. Then, the path and underlying link mapping is established. Three representative probe paths are selected: baseline, cross-switch, and high-load, and distributed to the probe nodes. The three types of paths are the same leaf switch baseline path (used for network baseline comparison), cross-leaf path through the spine switch, and dedicated path for high-load service areas and core services. The output is a standardized probe path list, which is distributed to all probe nodes in the entire network. S2. Adaptive multi-path active detection: The active detection module of each detection node sends detection messages at a dynamic frequency. When the network is stable, the sampling overhead is reduced. When an abnormal delay is detected, the detection frequency of the associated path is increased. The raw data of RTT and packet loss timing are collected and reported. S3, Temporal Feature Extraction: The feature extraction module performs window statistics on the reported raw data, then calculates features such as the mean time delay, standard deviation, and sudden increase magnitude, and then compares the threshold labels to mark each path as normal or abnormal, and integrates them to generate a global observation evidence set; S4. Bayesian Network Modeling: The Bayesian inference module loads the topological mapping, conditional probability matrix, and observational evidence to construct a model of three types of variables: fault location, fault type, and path observation. Then, it uses Bayes' formula to batch calculate the posterior confidence of all candidate fault locations and fault types, including the following sub-steps: S41. Initialize the Bayesian network model: Read the topology mapping data and define the fault location ( : , (Numbering links, ports, network interface cards, or congested areas), fault type ( : Representing normal, intermittent link failures, network congestion, or NIC failures) and path observation ( : , This indicates a path error. Three types of variables (indicating normal path) are used to establish the correlation between variables regarding the impact of failures; S42. Loading probability parameters and observational evidence: Importing the prior probability and path anomaly conditional probability matrix for each fault location ( This indicates that the path passes through a faulty link. This indicates that the path does not pass through the faulty link. (Indicating no network fault), then receive the complete set of observation evidence of normal or abnormal paths output by S3. ; S43. Calculate the likelihood of evidence corresponding to the fault location: Traverse each candidate fault location, match the detection path passing through that location, and calculate the joint likelihood of the current observation occurring when the fault occurs at that location by multiplying the conditional probabilities. The calculation formula is as follows: ,in: : For all Multiplication of probabilities of detection paths :Location In case of failure, the path The conditional probability of presenting the current observation state :Location Under fault conditions, the current complete set of observational evidence is available. The joint likelihood value; S44. Calculate the fault location: Substitute the values ​​into Bayes' theorem to calculate the posterior confidence of the fault at all points. Then, after identifying the fault location, calculate the conditional posterior probability formula for each type of fault: ,in: Determine the location Fault and combined with observational evidence The fault is Type confidence, : Iterate through all fault types, sum them to achieve normalization, and output a probability list for fault judgment; S5. Fault Diagnosis: The fault judgment module uses two levels of probability thresholds to determine the fault location and fault type in sequence, then filters the confidence level items, binds the affected path, abnormal characteristics and probability basis, and then outputs a complete structured diagnostic conclusion. S6. Visualization and Rendering: The alarm and display module combines the network topology rendering heatmap and probability time series curves to generate alarm information with handling suggestions and push it to the outside world. At the same time, it archives the full amount of detection, inference and diagnosis data for continuous optimization of Bayesian probability parameters.

[0022] The embodiments of the present invention are given for illustrative and descriptive purposes only, and are not intended to be exhaustive or to limit the invention to the forms disclosed. Many modifications and variations will be apparent to those skilled in the art. The embodiments were chosen and described in order to better illustrate the principles and practical application of the invention, and to enable those skilled in the art to understand the invention and to design various embodiments with various modifications suitable for a particular purpose.

Claims

1. A high-performance network fault monitoring system based on active detection and Bayesian inference, characterized in that, The system includes: Topology Management Module: Used to uniformly maintain the mapping relationship between devices, links, ports and probe paths across the entire network, providing underlying topology data support for probe routing and Bayesian inference; Active Probe Module: Deployed on each business node, it adaptively sends lightweight probe messages to collect raw time-series data on path latency and packet loss, serving as the data source for monitoring; Feature extraction module: used to perform sliding window statistics on raw detection data, converting latency or jitter indicators into evidence of normal or abnormal path observations, and completing data standardization preprocessing; Bayesian inference module: used to build fault and path probability models, combine observational evidence to calculate the posterior confidence of each fault location and fault type, and realize intelligent fault reasoning; Fault Judgment Module: Based on preset probability thresholds, it screens out the actual fault location and fault type, integrates a complete set of diagnostic criteria, and filters out invalid jitter false alarms; Alarm and Display Module: Used to visualize the diagnostic results topology and generate standardized operation and maintenance alarms, and then archive historical data for iterative optimization of the probability model; Hardware module: Composed of electronic devices and computer-readable storage media. The electronic devices include a monitoring server equipped with a processor, memory and storage media, as well as a distributed probe node host. The computer-readable storage media includes storage of monitoring programs, Bayesian probability matrices, topology databases and historical probe time-series data. When the program runs, it implements the entire monitoring process.

2. The high-performance network fault monitoring system based on active detection and Bayesian inference according to claim 1, characterized in that, The active detection module includes a detection task scheduling unit, an adaptive frequency control unit, a message sending and receiving unit, and a raw data reporting unit. The detection task scheduling unit is used to receive the detection path list issued by the topology module and uniformly manage the start and stop of detection tasks and periodic scheduling. The adaptive frequency control unit is used to dynamically adjust the detection frequency according to network latency fluctuations and take into account both monitoring real-time performance and bandwidth overhead.

3. The high-performance network fault monitoring system based on active detection and Bayesian inference according to claim 2, characterized in that, The message sending and receiving unit is used to send lightweight probe messages and collect raw network timing indicators such as RTT, packet loss, and timestamps, while the raw data reporting unit is used to standardize and encapsulate the probe raw data and push it to the feature extraction module in real time for preprocessing.

4. The high-performance network fault monitoring system based on active detection and Bayesian inference according to claim 1, characterized in that, The feature extraction module includes a sliding window calculation unit, a threshold comparison unit, an observation variable generation unit, and a data denoising unit. The sliding window calculation unit performs window statistics on the streaming detection data and scores the mean, standard deviation, abrupt increase magnitude, and path consistency in the output. The threshold comparison unit compares the statistical features with preset warning thresholds to determine whether there are abnormal fluctuations in a single path. The observation variable generation unit marks each path as a normal or abnormal observation variable and integrates them into a global observation evidence set for the inference module. The data denoising unit filters out single detection errors and instantaneous short-term jitter noise to reduce invalid abnormal inputs and lower subsequent misjudgments.

5. The high-performance network fault monitoring system based on active detection and Bayesian inference according to claim 1, characterized in that, The Bayesian inference module includes a model building unit, a probability parameter management unit, a likelihood calculation unit, and a posterior probability solution unit. The model building unit is used to build a Bayesian network and maintain the correlation between three types of variables: fault location, fault type, and path observation. The probability parameter management unit is used to store, load, and iteratively update the prior probability and conditional probability matrices to support probability calculation.

6. The high-performance network fault monitoring system based on active detection and Bayesian inference according to claim 5, characterized in that, The likelihood calculation unit is used to calculate the likelihood value of each fault location generating current observational anomaly evidence by combining topological mapping relationships. The posterior probability calculation unit calculates the fault confidence of all links, network interface cards (NICs), and congested regions in batches based on Bayes' theorem, as well as the probabilities of various fault types. The calculation formula is as follows: ,in Fault location variable; Prior probability of candidate fault location; Likelihood; : Set of observational evidence ; Total probability; : Posterior probability.

7. The high-performance network fault monitoring system based on active detection and Bayesian inference according to claim 1, characterized in that, The fault determination module includes a fault location determination unit, a fault type determination unit, an alarm filtering unit, and a diagnostic information assembly unit. The fault location determination unit is used to filter fault locations with posterior probabilities that meet the criteria based on the location alarm threshold, thereby quickly locating the fault location. The fault type determination unit is used to distinguish between intermittent link faults, congestion, and network card faults based on the determined fault location and type threshold. The alarm filtering unit is used to remove short-term jitter-related suspected faults with probabilities below the threshold, thereby reducing invalid alarms and lowering the false alarm rate. The diagnostic information assembly unit is used to integrate fault location, fault type, confidence level, affected paths, and abnormal evidence to generate complete diagnostic data.

8. A high-performance network fault monitoring method based on active detection and Bayesian inference, characterized in that, The high-performance network fault monitoring method is applied to the high-performance network fault monitoring system according to any one of claims 1-7, and includes the following steps: S1. Network topology initialization: Based on the topology management module, collect the entire network's spine-leaf hardware topology, then establish path and underlying link mapping, and filter three types of representative probe paths: baseline, cross-switch, and high-load, and send them to the probe nodes; S2. Adaptive multi-path active detection: The active detection module of each detection node sends detection messages at a dynamic frequency. When the network is stable, the sampling overhead is reduced. When an abnormal delay is detected, the detection frequency of the associated path is increased. The raw data of RTT and packet loss timing are collected and reported. S3, Temporal Feature Extraction: The feature extraction module performs window statistics on the reported raw data, then calculates the mean, standard deviation and sudden increase characteristics of the time delay, and then compares the threshold labels to mark each path as normal or abnormal, and integrates them to generate a global observation evidence set. S4. Bayesian network modeling: The Bayesian inference module loads the topology mapping, conditional probability matrix and observation evidence to construct a model of three types of variables: fault location, fault type and path observation. Then, the posterior confidence of all candidate fault locations and fault types is calculated in batches using the Bayesian formula. S5. Fault Diagnosis: The fault judgment module uses two levels of probability thresholds to determine the fault location and fault type in sequence, then filters the confidence level items, binds the affected path, abnormal characteristics and probability basis, and then outputs a complete structured diagnostic conclusion. S6. Visualization and Rendering: The alarm and display module combines the network topology rendering heatmap and probability time series curves to generate alarm information with handling suggestions and push it to the outside world. At the same time, it archives the full amount of detection, inference and diagnosis data for continuous optimization of Bayesian probability parameters.

9. The high-performance network fault monitoring method based on active detection and Bayesian inference according to claim 8, characterized in that, The three types of paths in step S1 are the baseline path within the same leaf switch, the cross-node path across leaves and through the spine switch, and the dedicated path for high-load service areas and core services. The output is a standardized list of detection paths, which is distributed to all detection nodes in the entire network.

10. A high-performance network fault monitoring method based on active detection and Bayesian inference according to claim 8, characterized in that, Step S4 includes the following sub-steps: S41. Initialize the Bayesian network model: Read the topology mapping data, define three types of variables: fault location, fault type, and path observation, and establish the correlation between the fault impact of the variables. S42. Loading probability parameters and observational evidence: Importing the prior probability and path anomaly conditional probability matrix for each fault location ( This indicates that the path passes through a faulty link. This indicates that the path does not pass through the faulty link. (Indicating no network fault), then receive the complete set of observation evidence of normal or abnormal paths output by S3. ; S43. Calculate the likelihood of evidence corresponding to the fault location: Traverse each candidate fault location, match the detection path passing through that location, and calculate the joint likelihood of the current observation occurring when the fault occurs at that location by multiplying the conditional probabilities. The calculation formula is as follows: ,in: : For all Multiplication of probabilities of detection paths :Location In case of failure, the path The conditional probability of presenting the current observation state :Location Under fault conditions, the current complete set of observational evidence is available. The joint likelihood value; S44. Calculate the fault location: Substitute the values ​​into Bayes' theorem to calculate the posterior confidence of the fault at all points. Then, after identifying the fault location, calculate the conditional posterior probability formula for each type of fault: ,in: Determine the location Fault and combined with observational evidence The fault is Type confidence, Iterate through all fault types, sum them to achieve normalization, and output a probability list for fault judgment.

Images