A network physical layer signal detection and data model analysis system

Abstract

The application discloses a network physical layer signal detection and data model analysis system, and belongs to the technical field of communication. The system comprises a data acquisition module, a data processing module and a data analysis module. The data acquisition module is used for collecting physical layer signals of copper cable networks and optical cable networks. The data processing module is used for receiving the physical layer signals sent by the data acquisition module, obtaining an original data set after preprocessing the physical layer signals, and uploading the original data set after encoding and compression. The data analysis module is used for storing the decoded original data set in a database for analysis and processing. The analysis and processing comprises edge-cloud collaborative analysis and fault judgment on the original data set. Real-time feature extraction, preliminary discrimination of abnormal points, data cleaning and compression processing are performed on the data through the edge computing layer. Multi-time scale fault prediction, automatic root cause positioning and false alarm suppression processing are performed through the cloud analysis layer. Finally, a prediction result is output. The application has low cost, accurate fault analysis and positioning, and can realize prediction and warning.

Description

Technical Field

[0001] This invention belongs to the field of network communication technology, specifically relating to a low-cost network detection system for quickly locating network physical link faults, detecting network connectivity status, and troubleshooting physical signal anomalies, as well as a network quality assessment and fault prediction system based on a physical layer signal data acquisition and analysis model. Background Technology

[0002] Digital communication networks have been widely used in local area networks, artificial intelligence computing nodes, data centers, transportation, and national defense. Wired communication, as the network foundation, mainly includes copper cable networks (such as the ISO / IEC 11801-12017 standard) and optical fiber networks (such as the GB 51158-2015 standard).

[0003] The security and intelligent management of physical networks are of paramount importance. However, existing management tools are mostly based on high-level protocols (such as SNMP and NetFlow) and lack direct monitoring methods for physical layer signals themselves.

[0004] The signal quality of the physical link—including indicators such as transmission rate, signal attenuation, and electromagnetic interference—directly determines the stability and service quality of a communication network. Currently, physical layer faults are usually only detected when network connectivity is interrupted or the protocol layer becomes severely unstable, requiring manual repairs, which are costly and slow to respond. Network operators have been requesting the procurement of network physical layer fault prediction systems for over a decade, but mature products are still lacking in the market.

[0005] While mainstream communication equipment manufacturers provide online monitoring systems such as OPM (Optical Performance Monitor) and OTDR (Optical Time Domain Reflectometer) for optical communication networks, which detect and locate faults by scattering and reflecting modulated signals in single-mode optical fibers, these systems have two significant drawbacks: first, they are costly and unsuitable for large-scale deployment; second, they are primarily used for post-fault alarms and are difficult to predict. Furthermore, in the copper cable network field, there is currently a lack of effective physical layer fault detection technologies and tools. Therefore, developing a low-cost, large-scale deployable network physical layer signal detection system with fault prediction capabilities is a pressing technical challenge in this field. Summary of the Invention

[0006] This invention aims to overcome many shortcomings of existing technologies and provide a network physical layer signal detection and data model analysis system, comprising:

[0007] The data acquisition module is used to acquire physical layer signals from copper and optical fiber networks and feed them back to the data processing module.

[0008] The data processing module is used to receive physical layer signals sent by the data acquisition module, preprocess the physical layer signals to obtain the raw dataset, and encode and compress the raw dataset before uploading it to the data analysis module.

[0009] The data analysis module decodes the received raw dataset and stores it in the database for analysis and processing. The analysis and processing includes edge-cloud collaborative analysis and fault judgment of the raw dataset: real-time feature extraction, preliminary anomaly identification, and data cleaning and compression are performed on the data through the edge computing layer; multi-timescale fault prediction, automatic root cause localization, and false alarm suppression are performed through the cloud analysis layer; and the final prediction result is output.

[0010] In the aforementioned network physical layer signal detection and data model analysis system, the physical layer signals include carrier signals from copper cable networks and optical communication signals from optical networks. The data acquisition module includes a carrier signal acquisition circuit and an optical communication signal acquisition circuit. The carrier signal acquisition circuit includes an impedance matching unit, a first isolation unit, a filtering unit, and an amplification unit connected in sequence. The first isolation unit is an isolation transformer or an isolation capacitor. The optical communication signal acquisition circuit includes a splitter, a second isolation unit, a filtering unit, and an amplification unit. The second isolation unit is an optocoupler. Both the carrier signal acquisition circuit and the optical communication signal acquisition circuit acquire corresponding signal data using a non-intrusive sampling method, with a sampling amplitude of approximately 0.5% of the original signal, without affecting the original network communication.

[0011] In the aforementioned network physical layer signal detection and data model analysis system, the physical layer signal further includes: a reference voltage, used to provide a precise reference voltage for the sampling process;

[0012] Ambient temperature, used for data calibration and compensation;

[0013] Clock sequences are used to accurately timestamp sampled data to construct time-series data;

[0014] Operating voltage, used to determine whether the operating voltage is in a normal state;

[0015] Port identifiers are used to identify the port on which the link corresponding to each data sampling module is located, so as to locate the fault point in a large network.

[0016] In the aforementioned network physical layer signal detection and data model analysis system, the data preprocessing includes normalizing the raw data and then constructing time-series vector data to form the original dataset.

[0017] In the aforementioned network physical layer signal detection and data model analysis system, the data processing module further includes a display unit, which is used to classify and display the normalized results according to different thresholds: when the result is less than or equal to the first threshold, it is displayed as a fault; when it is greater than the first threshold and less than or equal to the second threshold, it is displayed as a warning; and when it is greater than the second threshold, it is displayed as normal.

[0018] In the aforementioned network physical layer signal detection and data model analysis system, the real-time feature extraction includes calculating the following statistical features of the normalized data within a sliding time window W: mean μ, rate of change R, slope k, variance σ², jitter J, and peak-to-peak value P_pk.

[0019] The anomaly point is initially identified using an adaptive threshold method for first-level alarm filtering.

[0020] Flag_anomaly = 1, if |S(t) - μ_W| > k · σ_W or |R(t)| > R_th

[0021] Flag_anomaly = 0, otherwise

[0022] Where μ_W and σ_W are the mean and standard deviation within the sliding window; k is the sensitivity coefficient; R_th is the rate of change threshold. When Flag=1, a local audible and visual alarm is triggered immediately, and the high-frequency raw data of that period is cached for later upload to the cloud for secondary analysis.

[0023] The data cleaning and compression includes: cleaning, removing outliers that are significantly beyond the sensor's range; and compression, using DPCM differential coding + run-length coding, with a compression ratio of 10:1 to 20:1. Under normal conditions, compressed summary data is reported every 30 seconds, and under abnormal conditions, high-frequency raw data is reported immediately.

[0024] In the aforementioned network physical layer signal detection and data model analysis system, the multi-time-scale fault prediction is based on LSTM or Transformer time series models. For each link, a prediction model with three time scales—short-term, medium-term, and long-term—is established. The prediction module outputs the probability of various specific fault types, including optical fiber networks and copper cable networks.

[0025] The automatic root cause localization is obtained by the system through multi-far feature fusion when it detects abnormal power fluctuations, and the localization results are presented in a probability ranking manner.

[0026] The false alarm suppression process employs a two-stage filtering approach: the first stage involves uploading data through dual channels from the edge layer and continuously verifying it; the second stage involves training a dedicated false alarm discriminator in the cloud layer. The input features of this discriminator include all feature vectors uploaded from the edge layer, the status of other related links during the same period, and the ring context, with the output being the "probability of a true alarm".

[0027] In the aforementioned network physical layer signal detection and data model analysis system, the cloud analysis layer adopts an alarm decision architecture that integrates a rule engine and an AI model:

[0028] The hard rule engine uses a set of zero-tolerance deterministic conditions preset by the system as the basis for hard rule judgment. When the feature vector uploaded by the edge node meets any deterministic condition, the hard rule engine immediately outputs an alarm command and stops subsequent model inference. The threshold of the deterministic condition is preset by domain experts based on the physical meaning of the physical layer signal.

[0029] Soft rule scoring module: The system presets a set of empirical conditions as the basis for soft rule judgment. Each empirical condition corresponds to a weight coefficient. When the feature vector partially matches an empirical condition, the soft rule score is obtained by accumulating the weights. Soft rules are used to capture typical fault precursor patterns. Their weight coefficients can be preset by domain experts and dynamically adjusted according to model training results and operation and maintenance review feedback.

[0030] AI model output: The LSTM / Transformer model outputs the failure probability based on the input feature vector;

[0031] Fusion Decision Layer: A serial fusion strategy is adopted. First, hard rule checks are performed. If a match is found, an alarm is output directly. Otherwise, a weighted fusion value of the soft rule score and the fault probability output by the AI ​​model is calculated. When the weighted fusion value is greater than or equal to the first warning value, an alarm is output. When the weighted fusion value is less than the first warning value but greater than or equal to the second warning value, a warning is output. When the weighted fusion value is less than the second warning value, it is judged as normal.

[0032] In the aforementioned network physical layer signal detection and data model analysis system, the modeling and training process of the AI ​​model is as follows:

[0033] The edge computing layer uses lightweight isolated forests or one-class SVMs for unsupervised anomaly detection, while the cloud analytics layer uses Transformers, long short-term memory networks, or temporal convolutional networks.

[0034] Data preprocessing: Historical data is divided into samples according to a fixed window and then standardized.

[0035] Model training: Train the model using historical data from when the network was running normally;

[0036] Prediction and evaluation: The model receives the latest real-time data window, outputs the predicted value for the next time step, compares it with the actual observed value, calculates the residual, and determines an abnormal event when the residual continuously exceeds the preset threshold.

[0037] In the aforementioned network physical layer signal detection and data model analysis system, the data analysis module also includes a handheld terminal. The handheld terminal is used to display the results of edge-cloud collaborative analysis and fault judgment performed by the data analysis module through the raw dataset, and to guide maintenance personnel to quickly locate, retest on-site, and provide diagnostic guidance to complete maintenance operations.

[0038] The present invention has the following beneficial effects:

[0039] Extremely low cost: The detection circuit is built using discrete components and general-purpose chips, eliminating the need for expensive dedicated testing instruments and making large-scale deployment possible.

[0040] Real-time online monitoring: The system can continuously monitor physical layer signals, detect link degradation in the first instance, and transform passive repair into proactive prevention.

[0041] Fault prediction capability: By analyzing historical data trends through AI models, early warnings can be issued before a complete network outage, greatly reducing the risk of business interruption. Supports fault prediction at multiple time scales.

[0042] Precise root cause identification: Through multi-source feature fusion, it automatically distinguishes different root causes such as temperature drift, equipment aging, external construction, and electromagnetic interference, freeing maintenance personnel from tedious troubleshooting work. It also covers the unique faults of both fiber optic and copper cable networks.

[0043] False alarm suppression: The unique edge-cloud two-level false alarm suppression mechanism greatly improves the system's alarm accuracy and avoids the "crying wolf" effect.

[0044] Full network visualization: By using handheld terminals, abstract physical layer signals are quantified into intuitive health scores and charts, enabling network administrators to grasp the status of the entire network at a glance.

[0045] Continuous evolution: The closed-loop model iteration based on operation and maintenance feedback makes the system more and more accurate with use, forming a positive cycle of "detection-alarm-review-training".

[0046] High maintenance efficiency: On-site audible and visual alarms and handheld terminal guidance functions greatly shorten the time for fault location and repair. Attached Figure Description

[0047] Figure 1 This is a diagram of the overall architecture of the present invention.

[0048] Figure 2This is a schematic diagram of a network signal detection circuit (magnetically isolated) according to the present invention;

[0049] Figure 3 This is a schematic diagram of a network signal detection circuit (capacitive isolation) according to the present invention;

[0050] Figure 4 This is a schematic diagram of a network signal detection circuit (optical isolation) according to the present invention;

[0051] Figure 5 This is a schematic diagram of the copper cable signal detection module of the present invention on a patch panel. Detailed Implementation

[0052] The present invention will now be described in further detail and in complete form with reference to the accompanying drawings and specific embodiments.

[0053] The accompanying drawings are for illustrative purposes only and are schematic diagrams, not actual images. They should not be construed as limiting the scope of this patent. To better illustrate the embodiments of the present invention, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual dimensions of the product. It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0054] In the accompanying drawings of the embodiments of the present invention, the same or similar reference numerals correspond to the same or similar components. In the description of the present invention, it should be understood that if terms such as "upper," "lower," "left," "right," "inner," and "outer" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, they are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the terms used to describe positional relationships in the drawings are only for illustrative purposes and should not be construed as limiting the present patent. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances.

[0055] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0056] Example 1:

[0057] like Figure 1 As shown, the network physical layer signal detection and data model analysis system of the present invention includes a data acquisition module, a data processing module, and a data analysis module; the data acquisition module, the data processing module, and the data analysis module establish communication connections in sequence.

[0058] The data acquisition module connects to both the copper and fiber optic network links to acquire physical layer signals from these networks and feed them back to the data processing module. The physical layer signals include carrier signals from the copper network and optical communication signals from the optical network. The data acquisition module includes a carrier signal acquisition circuit and an optical communication signal acquisition circuit. The carrier signal acquisition circuit comprises an impedance matching unit, a first isolation unit, a filtering unit, and an amplification unit connected in sequence. The first isolation unit is an isolation transformer or an isolation capacitor. The optical communication signal acquisition circuit includes a splitter, a second isolation unit, a filtering unit, and an amplification unit. The second isolation unit is an optocoupler. Both the carrier signal acquisition circuit and the optical communication signal acquisition circuit acquire their respective signal data using a non-intrusive sampling method, with a sampling amplitude of approximately 0.5% of the original signal, without affecting the original network communication.

[0059] like Figure 2 As shown, the carrier signal acquisition circuit mainly includes resistor R1, inductor L1, resistor R3, capacitor C11, capacitor C2, inductor L2, capacitor C12, transformer T1, diode D1, resistor R2, capacitor C1, and operational amplifier U1A. Resistor R1 and inductor L1 are connected in parallel, resistor R3 and capacitor C11 are connected in parallel, one end of capacitor C12 is connected to resistor R1, and the other end is connected to one end of the primary winding of transformer T1 and one end of inductor L2. The other end of inductor L2 is connected to the other end of the primary winding of transformer T1 and resistor R3 through capacitor C12, thus forming an impedance matching unit. The copper cable network carrier signal is connected to the input sides of resistors R1 and R3 through rd2+ and rd2+ respectively. After impedance matching by the impedance matching unit, it is input to transformer T1 for electrical isolation and signal coupling. The stable AC signal output from the secondary winding of transformer T1 is detected by diode D1 and converted into a weak DC level reflecting the signal amplitude. The DC level is then filtered by an RC low-pass filter composed of R2 and C1 to remove high-frequency noise, and finally fed into a non-inverting proportional amplifier circuit composed of operational amplifier U1A for gain adjustment, outputting an analog voltage V_out_cu that is proportional to the carrier signal strength. It should be noted that in practical applications, the specific matching circuit needs to be adjusted according to the type of network, and better results can be obtained during actual debugging by appropriately modifying other auxiliary components in the circuit.

[0060] like Figure 3As shown, the optical communication signal acquisition circuit mainly includes an optical splitter OBD1, an optocoupler, a diode D3, a resistor R16, a capacitor C9, and an operational amplifier U3A. The optical network signal is split by the optical splitter OBD1, with a small amount of optical power sent to the photodetector LED2 at a ratio (e.g., 1:99). LED2 converts the received optical signal into a photocurrent, achieving opto-isolation. This current is detected by diode D3 and filtered by R16 and C9. It is then converted into an analog voltage V_out_op by a transimpedance amplifier or voltage amplifier composed of operational amplifier U3A, the magnitude of which is proportional to the optical signal intensity of the main optical path. Some auxiliary components in the scheme were added during actual debugging for better results.

[0061] Furthermore, to ensure the accuracy and environmental adaptability of the data model, the following other physical parameters need to be collected simultaneously for auxiliary monitoring: Reference voltage (V_ref): Provides an accurate reference for ADC conversion and eliminates the influence of power supply fluctuations; Ambient temperature (Temp): Temperature affects cable impedance and optical device characteristics; temperature is collected for data calibration and compensation; Clock sequence (Time_Stamp): Accurately timestamps each sampled data for constructing timing data; Operating voltage (V_cc): Monitors the system's own power supply voltage to determine whether the equipment is in normal working condition; Port identifier (Port_ID): Uniquely identifies the port where the link corresponding to each detection module is located, facilitating fault location in large networks.

[0062] The data processing module's functions are implemented through three functional units: data acquisition, analysis, encoding, and compression; data uploading; and intuitive display of analysis results. The data processing module receives physical layer signals from the data acquisition module, preprocesses these signals to obtain the raw dataset, and then encodes, compresses, and uploads the raw dataset to the data analysis module.

[0063] Data preprocessing includes normalizing the raw data and then constructing time-series vector data to form the original dataset. Specifically:

[0064] Normalization: The acquired analog voltage V_x is converted into dimensionless scalar data S, with the reference voltage V_ref as the baseline, and the range is mapped to [0, 100]. The mathematical formula is:

[0065] S = (V_x / V_ref) × 100

[0066] Where V_x can be V_out_cu (copper cable signal) or V_out_op (optical signal). If S > 100, then clamp to 100.

[0067] Time-series vector data construction: Multiple scalar data points collected at the same time (such as copper cable signal strength, optical signal strength, and temperature) and their timestamps are combined into a multi-dimensional time-series vector V_t. The formula is expressed as:

[0068] V_t = [S_cu, S_op, Temp, Time_Stamp, Port_ID]

[0069] A continuous sequence of V_t constitutes the original dataset used for model analysis.

[0070] Data encoding: Defines a unified data frame format to improve transmission efficiency and security. A typical data frame contains the following:

[0071] Frame header: Fixed bytes (e.g., 0xAA55), used for synchronization;

[0072] Port ID: 2 bytes, identifies the detection module;

[0073] Timestamp: 4 bytes, Unix timestamp format;

[0074] Data payload: N bytes, containing normalized S value and temperature value;

[0075] Check bit: 2 bytes, using CRC16 algorithm, used to detect data transmission errors;

[0076] Encryption information: Optional, performs AES-128 lightweight encryption on the data payload to prevent data tampering.

[0077] Data compression: Differential Pulse Code Modulation (DPCM) algorithm is used. This algorithm only transmits the difference between adjacent sampling points. Since the physical signal changes slowly, the difference is usually very small and can be represented with fewer bits, thus achieving efficient lossless compression. Under normal conditions, the compression ratio can reach 10:1 to 20:1. More efficient algorithms such as LZ4 or Deflate can also be selected, depending on the actual computing power of the MCU.

[0078] Data Upload: Utilizing widely used industrial protocols such as RS-485 or CAN bus, compressed data is packaged and uploaded to the local gateway or edge server. RS-485 is suitable for long-distance, multi-point communication; CAN bus offers higher real-time performance and reliability. The upload strategy is as follows: under normal conditions, compressed summary data is reported every 30 seconds; under abnormal conditions, high-frequency raw data is reported immediately.

[0079] The analysis results are displayed intuitively: the display unit categorizes the normalized results according to different thresholds: a result less than or equal to the first threshold is displayed as a fault; a result greater than the first threshold but less than or equal to the second threshold is displayed as a warning; and a result greater than the second threshold is displayed as normal. Specifically: Red light (fault): S ≤ 10; Yellow light (warning): 10 < S ≤ 30; Green light (normal): S > 30. These thresholds are system defaults and can be adaptively adjusted based on the baseline signal strength of the actual deployment environment.

[0080] The data analysis module decodes the received raw dataset and stores it in the database for analysis and processing. This analysis includes edge-cloud collaborative analysis and fault diagnosis: real-time feature extraction, preliminary anomaly identification, and data cleaning and compression are performed through the edge computing layer; multi-timescale fault prediction, automatic root cause localization, and false alarm suppression are performed through the cloud analysis layer; and the final prediction results are output. Specifically, this involves data decoding, storage, data modeling, data training, and data evaluation. It also provides intuitive display of analysis results, predicts network faults, displays real-time network health status, and guides maintenance personnel through faulty network maintenance tasks via handheld terminals.

[0081] After receiving the data stream, the server first synchronizes the data frames based on the frame header. Then, it extracts the device ID and uses a pre-shared key to decrypt the encrypted data payload using AES. Next, it performs a CRC check on the decrypted data; packets that fail the check are discarded and an error is logged. Finally, the valid data is stored in a time-series database (such as InfluxDB) ordered by device ID and timestamp for subsequent modeling and analysis.

[0082] The specific architecture for edge-cloud collaborative analysis and fault diagnosis is as follows:

[0083] I. Edge computing layer (local processing, millisecond-level response).

[0084] Deploy a lightweight computing engine on each detection module or the nearest smart gateway to perform the following tasks:

[0085] ① Real-time feature extraction:

[0086] The following statistical characteristics were calculated for the collected normalized signal intensity S(t) within a sliding time window W (e.g., 10 minutes), as shown in Table 1 below:

[0087] Table 1. Real-time Features

[0088]

[0089] The symbols for each feature in the table above have the following meanings:

[0090] S(t) represents the normalized signal strength at time t, which is the value of the original voltage collected by the ADC after normalization by V_ref, and its range is [0, 100].

[0091] μ represents the signal mean, which is the arithmetic mean of all S(t) within the sliding window W, reflecting the signal baseline level;

[0092] σ² represents the signal variance, which is the square mean of the deviation of S(t) from the mean within the sliding window W, reflecting the degree of signal dispersion.

[0093] σ_J_normal represents the normal jitter standard deviation, which is the sample standard deviation of the jitter J value during the historical normal operation period of this link, and serves as the benchmark value for the adaptive baseline.

[0094] 2σ_J_normal represents the jitter abnormality threshold, which is twice the value of σ_J_normal. When J > 2σ_J_normal, the current jitter is considered to be outside the normal range.

[0095] S_adj represents the normalized signal strength of adjacent ports, which is the normalized signal strength value of other ports that are physically adjacent to the monitored link (same patch panel, same harness, or same slot).

[0096] r or r_k represents the Pearson correlation coefficient, which measures the linear correlation between the signal sequence of this link and the signal sequences of adjacent ports, and its value ranges from [-1, 1].

[0097] R represents the rate of change, the speed at which the signal strength changes between adjacent sampling times, reflecting the degree of drastic instantaneous change in the signal;

[0098] k represents the slope. The slope obtained by linearly fitting S(t) to S = kt + b reflects the long-term trend of the signal.

[0099] J represents jitter, the average absolute difference between the signal strengths of adjacent sampling points, reflecting the degree of short-term signal fluctuation.

[0100] P_pk represents the peak-to-peak value, which is the difference between the maximum and minimum values ​​of S(t) within the sliding window W, reflecting the maximum swing of the signal.

[0101] W represents the sliding time window, which is the time window used for feature extraction. The default value is 10 minutes, but it can be adjusted according to the actual sampling frequency.

[0102] ② Preliminary identification of anomalies:

[0103] First-level alarm filtering is performed using an adaptive threshold method:

[0104] Flag_anomaly = 1, if |S(t) - μ_W| > k · σ_W or |R(t)| > R_th

[0105] Flag_anomaly = 0, otherwise

[0106] Where μ_W and σ_W are the mean and standard deviation within the sliding window; k is the sensitivity coefficient; and R_th is the rate of change threshold. When Flag=1, a local audible and visual alarm is triggered immediately, and the high-frequency raw data for that period is cached for later upload to the cloud for secondary analysis.

[0107] ③ Data cleaning and compression:

[0108] Cleaning: Remove outliers that significantly exceed the sensor's range (e.g., ADC saturation values ​​of 1023 or 0). Compression: Under normal conditions, DPCM differential encoding + run-length encoding is used, achieving a compression ratio of 10:1 to 20:1. Upload strategy: Under normal conditions, compressed summary data is reported every 30 seconds; under abnormal conditions, high-frequency raw data is reported immediately.

[0109] II. Cloud-based analytics layer (global modeling, minute-level prediction).

[0110] ① Fault prediction at multiple time scales

[0111] Based on LSTM or Transformer time series models, a prediction model with three time scales is established for each link segment:

[0112] Prediction Model 1: Short-term (1 hour), the input window is the data of the past 1 hour, and the output is the signal strength curve of the next 1 hour. The main application scenario is an impending sudden failure.

[0113] Prediction Model 2: Medium-term (1 day), with the input window being the data from the past 7 days, and the output being the decay trend for the next 24 hours. Its main application scenario is the scheduling of maintenance plans for the next day.

[0114] Predictive Model 3: Long-term (1 week), with the input window being data from the past 30 days, and the output being a health score for the next 7 days. Its main application scenarios are spare parts procurement and inspection route planning.

[0115] The prediction module outputs the probability of various specific fault types, including those for fiber optic and copper cable networks.

[0116] ② Automatic root cause localization

[0117] When abnormal power fluctuations are detected, the system automatically distinguishes the root cause through multi-source feature fusion, including the root cause location of optical cable network faults and the root cause location of copper cable network faults, as shown in Tables 2 and 3 below.

[0118] Table 2: Root Cause Analysis of Fiber Optic Network Faults

[0119]

[0120] Table 3: Root Cause Analysis of Copper Cable Network Faults

[0121]

[0122] The location results are presented to operations and maintenance personnel in a probability ranking manner, for example:

[0123] "Link #A03-B07: 88% probability of significant optical attenuation due to temperature drift; it is recommended to check the data center air conditioning; 12% probability of loose connectors."

[0124] ③ False alarm suppression mechanism:

[0125] Two-stage filtering significantly reduces the false alarm rate:

[0126] Level 1 (Edge Layer): Dual-channel upload + continuous confirmation stabilization

[0127] Edge nodes employ a dual-channel data and alarm upload mechanism:

[0128] (1) Normal data channel: Under normal conditions, the edge nodes extract 6 major feature vectors (mean μ, rate of change R, slope k, variance σ², jitter J, peak value P_pk) every Δt (default 30 seconds) and then report them to the cloud periodically via RS-485 / CAN bus after DPCM compression, to ensure that the cloud AI model has sufficient normal period training samples to establish a baseline and predict future trends.

[0129] (2) Anomaly Alarm Channel: Edge nodes adopt a "continuous confirmation" debouncing strategy for the anomaly flag Flag_anomaly. When Flag_anomaly is continuously maintained for M sampling points (default M=5, corresponding to about 5 seconds), it is considered a valid anomaly, and a high-priority alarm upload is immediately triggered. The high-frequency raw data of the anomaly cached in the local circular buffer before the anomaly is also uploaded to the cloud as the input context of the false alarm discriminator.

[0130] This design ensures the continuity of cloud-based model training data and avoids invalid alarm uploads caused by single electromagnetic interference spikes through a continuous confirmation mechanism, thereby reducing communication overhead.

[0131] Level 2 (Cloud Layer):

[0132] Train a dedicated false alarm discriminator. The input features include all feature vectors from the edge, the status of other related links at the same time, and environmental context (weather, construction notices, etc.). The output is the "probability of a true alarm". A work order is only pushed when the probability exceeds a threshold (e.g., 70%).

[0133] The training data for the false positive discriminator comes from the verification feedback of operations and maintenance personnel (see the closed-loop mechanism in Section 5.3.3), enabling it to continuously learn to distinguish between "normal fluctuations" and "precursors of failure". Model performance is evaluated using recall and false positive rate (FPR):

[0134] Recall = TP / (TP + FN) (the proportion of real faults that the model successfully identifies).

[0135] FPR = FP / (FP + TN) (the proportion of all normal links that are misjudged as faulty).

[0136] In this embodiment, the cloud-based analysis layer adopts an alarm decision architecture that integrates a rule engine and an AI model:

[0137] The hard rule engine is implemented in software code by pre-setting a set of zero-tolerance deterministic judgment conditions. When the feature vector uploaded by the edge node meets any hard rule condition (such as normalized signal strength S < 5, rate of change R < -40% / second, etc.), the rule engine immediately outputs an alarm command and stops further model inference. The threshold of the hard rules is pre-set by domain experts based on the physical meaning of the physical layer signals to ensure millisecond-level response to obvious faults.

[0138] The soft rule scoring module consists of a pre-set set of empirical judgment rules, each with a corresponding weight coefficient. When a feature vector partially matches a soft rule, the soft rule score (soft_score ∈ [0,1]) is obtained by accumulating the weights. Soft rules are used to capture typical early warning patterns of faults (such as a persistently negative slope or jitter exceeding twice the baseline). Their weight coefficients can be pre-set by domain experts and dynamically adjusted based on model training results and operational review feedback.

[0139] AI model output: The LSTM / Transformer model outputs the fault probability model_prob ∈ [0,1] based on the input feature vector.

[0140] Fusion Decision Layer: A serial fusion strategy is adopted. First, hard rule checks are performed. If a match is found, an alarm is output directly. Otherwise, a weighted fusion value of the soft rule score (soft_score) and the AI ​​model probability (model_prob) is calculated: fused = α · model_prob + β · soft_score, where α = 0.7 and β = 0.3. An alarm is output when fused ≥ 0.8, a warning is output when 0.5 ≤ fused < 0.8, and otherwise it is considered normal. This hybrid architecture combines the determinism and auditability of a rule engine with the pattern recognition capabilities of an AI model. The entire decision-making process is automatically executed by software without manual intervention, meeting the real-time requirements of communication network operation and maintenance.

[0141] In this embodiment, the modeling and training process of the AI ​​model is as follows:

[0142] The edge computing layer uses lightweight isolated forests or one-class SVMs for unsupervised anomaly detection, while the cloud analytics layer uses Transformers, long short-term memory networks, or temporal convolutional networks.

[0143] Data preprocessing: Historical data is divided into samples according to a fixed window and then standardized.

[0144] Model training: Train the model using historical data from when the network was running normally;

[0145] Prediction and evaluation: The model receives the latest real-time data window, outputs the predicted value for the next time step, compares it with the actual observed value, calculates the residual, and determines an abnormal event when the residual continuously exceeds the preset threshold.

[0146] Model performance is evaluated using recall and false positive rate to ensure that the system maintains a high detection rate while controlling the false positive rate.

[0147] The analysis results are displayed intuitively via a handheld terminal, and a dedicated handheld terminal app is developed and installed on the handheld terminal. The handheld terminal communicates with the on-site detection module via Bluetooth or Wi-Fi. When the system issues an alarm, maintenance personnel can: quickly locate the device (the app automatically displays the ID and geographical location of the alarm device), perform on-site retesting (the app can force the detection module to perform an immediate measurement to eliminate false alarms), and receive diagnostic guidance (the app provides standardized troubleshooting process guidance based on the fault type and records the maintenance process).

[0148] Furthermore, the data analysis module performs the following intuitive display process for network monitoring: Based on the AI ​​model's real-time assessment of each physical link, a health score of 0-100 (Health_Score) is calculated. The scoring rules can be set as follows: an initial maximum score of 100; deduct 5 points whenever the model's predicted residual exceeds the warning threshold; deduct 20 points when it exceeds the fault threshold; if there are no abnormalities for a continuous period (e.g., 1 hour), points are gradually added until the maximum score is restored. Finally, the health of all links in the network is intuitively displayed through a web frontend or mobile app in the form of a topology map and heatmap. Green indicates healthy (>80 points), yellow indicates sub-healthy (60-80 points), and red indicates dangerous (<60 points).

[0149] Furthermore, to enable continuous system evolution, a closed-loop model iteration mechanism is implemented: after on-site maintenance personnel verify alarms using handheld devices (confirming genuine faults / false alarms / wait-to-be-observed), the verification results, along with the corresponding raw data for that time period, are sent back to the cloud and added to the training set as labeled samples. The cloud periodically (e.g., monthly) retrains the AI ​​model based on incremental data and distributes the updated model to edge nodes, thus enabling continuous system evolution.

[0150] The specific process is as follows: Model alarm → Work order pops up in handheld app → On-site verification by maintenance personnel → Click "Confirm Real Fault" / "False Alarm" / "Pending Observation" on the app → Tag is sent back to the cloud → Model is retrained regularly → Model update is distributed.

[0151] See Figure 4 This invention presents a specific productized structure in copper cable networks—an intelligent patch panel. This patch panel integrates multiple detection modules. To balance cost and detection granularity, ports of 1, 2, 6, or even more can be grouped together, sharing a single detection module. Signals from each group of ports are collected in turn via a multiplexer. The design of the detection module balances flexibility and maintainability.

[0152] Integrated design: The detection circuit is directly soldered onto the main board of the patch panel, resulting in the lowest cost;

[0153] Plug-in modular design: The detection circuit is made into an independent plug-in module (such as an RJ45 interface daughter card). Users can selectively install it as needed without replacing the entire patch panel; it is also easy to replace when a single module fails, reducing maintenance costs.

[0154] Example 2:

[0155] This embodiment has the same main architecture as embodiment 1, the difference being that, as Figure 5As shown, the carrier signal acquisition circuit mainly includes resistor R7, capacitor C13, resistor R11, capacitor C14, capacitors C5, C4, and C8, diode D2, resistor R10, capacitor C6, and operational amplifier U2A. Resistor R7 and capacitor C13 are connected in parallel, as are resistor R11 and capacitor C14. One end of capacitor C5 is connected to resistor R1, and the other end is connected to resistor R11, thus forming an impedance matching unit. Capacitor C4 is connected in series on the output side of resistor R7, and capacitor C8 is connected in series on the output side of resistor R11 for capacitive isolation. The copper cable network carrier signal is connected to the input sides of resistors R7 and R11 via rd2+ and rd2+ respectively. Impedance matching is achieved through the impedance matching unit. AC coupling and DC isolation are achieved through series capacitors C4 and C8. The coupled signal is detected by diode D2, filtered by resistor R10 and capacitor C6, and finally amplified by operational amplifier U2A to output an analog voltage V_out_cu. Similarly, in practical applications, the specific matching circuit needs to be adjusted according to the type of network, and other auxiliary components in the circuit can be appropriately modified to achieve better results in actual debugging.

[0156] The capacitive isolation acquisition scheme used in this embodiment is less expensive than the magnetic isolation scheme and does not have the problem of transformer magnetic saturation, making it suitable for high-density deployment scenarios.

[0157] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features, and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network physical layer signal detection and data model analysis system, comprising: The data acquisition module is used to acquire physical layer signals from copper and optical fiber networks and feed them back to the data processing module. The data processing module is used to receive physical layer signals sent by the data acquisition module, preprocess the physical layer signals to obtain the raw dataset, and encode and compress the raw dataset before uploading it to the data analysis module. The data analysis module decodes the received raw dataset and stores it in the database for analysis and processing. The analysis and processing includes edge-cloud collaborative analysis and fault judgment of the raw dataset: real-time feature extraction, preliminary anomaly identification, and data cleaning and compression are performed on the data through the edge computing layer; and multi-timescale fault prediction, automatic root cause location, and false alarm suppression are performed through the cloud analysis layer. Output the final prediction result.

2. The network physical layer signal detection and data model analysis system according to claim 1, characterized in that, The physical layer signals include carrier signals from the copper cable network and optical communication signals from the optical network. The data acquisition module includes a carrier signal acquisition circuit and an optical communication signal acquisition circuit. The carrier signal acquisition circuit includes an impedance matching unit, a first isolation unit, a filtering unit, and an amplification unit connected in sequence. The first isolation unit is an isolation transformer or an isolation capacitor. The optical communication signal acquisition circuit includes a splitter, a second isolation unit, a filtering unit, and an amplification unit. The second isolation unit is an optocoupler.

3. The network physical layer signal detection and data model analysis system according to claim 2, characterized in that, The physical layer signals also include: Reference voltage, used to provide a precise reference voltage for the sampling process; Ambient temperature, used for data calibration and compensation; Clock sequences are used to accurately timestamp sampled data to construct time-series data; Operating voltage, used to determine whether the operating voltage is in a normal state; Port identifiers are used to identify the port on which the link corresponding to each data sampling module is located, so as to locate the fault point in a large network.

4. The network physical layer signal detection and data model analysis system according to claim 1, 2, or 3, characterized in that, The data preprocessing includes normalizing the raw data and then constructing time-series vector data to form the original dataset.

5. The network physical layer signal detection and data model analysis system according to claim 4, characterized in that, The data processing module also includes a display unit, which is used to classify and display the normalized results according to different thresholds: when the result is less than or equal to the first threshold, it is displayed as a fault; when it is greater than the first threshold and less than or equal to the second threshold, it is displayed as a warning; and when it is greater than the second threshold, it is displayed as normal.

6. The network physical layer signal detection and data model analysis system according to claim 4, characterized in that, The real-time feature extraction includes calculating the following statistical features on the normalized data within a sliding time window W: mean μ, rate of change R, slope k, variance σ², jitter J, and peak-to-peak value P_pk; The anomaly point is initially identified using an adaptive threshold method for first-level alarm filtering. Flag_anomaly = 1, if |S(t) - μ_W| > k · σ_W or |R(t)| > R_th Flag_anomaly = 0, otherwise Where μ_W and σ_W are the mean and standard deviation within the sliding window; k is the sensitivity coefficient; R_th is the rate of change threshold. When Flag=1, a local audible and visual alarm is triggered immediately, and the high-frequency raw data of that period is cached for later upload to the cloud for secondary analysis. The data cleaning and compression includes: cleaning, removing outliers that are significantly beyond the sensor's range; and compression, using DPCM differential coding + run-length coding, with a compression ratio of 10:1 to 20:

1. Under normal conditions, compressed summary data is reported every 30 seconds, and under abnormal conditions, high-frequency raw data is reported immediately.

7. The network physical layer signal detection and data model analysis system according to claim 4, characterized in that, The multi-timescale fault prediction is based on LSTM or Transformer time series models. It establishes prediction models for each link at three time scales: short-term, medium-term, and long-term. The prediction module outputs the probability of various specific fault types, including optical fiber networks and copper cable networks. The automatic root cause localization is obtained by the system through multi-far feature fusion when it detects abnormal power fluctuations, and the localization results are presented in a probability ranking manner. The false alarm suppression process employs a two-stage filtering approach: the first stage involves uploading data through dual channels from the edge layer and continuously verifying it; the second stage involves training a dedicated false alarm discriminator in the cloud layer. The input features of this discriminator include all feature vectors uploaded from the edge layer, the status of other related links during the same period, and the ring context, with the output being the "probability of a true alarm".

8. The network physical layer signal detection and data model analysis system according to claim 4, characterized in that, The cloud-based analytics layer employs an alerting decision-making architecture that integrates a rule engine and an AI model. The hard rule engine uses a set of zero-tolerance deterministic conditions preset by the system as the basis for hard rule judgment. When the feature vector uploaded by the edge node meets any deterministic condition, the hard rule engine immediately outputs an alarm command and stops subsequent model inference. The threshold of the deterministic condition is preset by domain experts based on the physical meaning of the physical layer signal. Soft rule scoring module: The system presets a set of empirical conditions as the basis for soft rule judgment. Each empirical condition corresponds to a weight coefficient. When the feature vector partially matches an empirical condition, the soft rule score is obtained by accumulating the weights. Soft rules are used to capture typical fault precursor patterns. Their weight coefficients can be preset by domain experts and dynamically adjusted according to model training results and operation and maintenance review feedback. AI model output: The LSTM / Transformer model outputs the failure probability based on the input feature vector; Fusion Decision Layer: A serial fusion strategy is adopted. First, hard rule checks are performed. If a match is found, an alarm is output directly. Otherwise, a weighted fusion value of the soft rule score and the fault probability output by the AI ​​model is calculated. When the weighted fusion value is greater than or equal to the first warning value, an alarm is output. When the weighted fusion value is less than the first warning value but greater than or equal to the second warning value, a warning is output. When the weighted fusion value is less than the second warning value, it is judged as normal.

9. The network physical layer signal detection and data model analysis system according to claim 8, characterized in that, The modeling and training process of the AI ​​model is as follows: The edge computing layer uses lightweight isolated forests or one-class SVMs for unsupervised anomaly detection, while the cloud analytics layer uses Transformers, long short-term memory networks, or temporal convolutional networks. Data preprocessing: Historical data is divided into samples according to a fixed window and then standardized. Model training: Train the model using historical data from when the network was running normally; Prediction and evaluation: The model receives the latest real-time data window, outputs the predicted value for the next time step, compares it with the actual observed value, calculates the residual, and determines an abnormal event when the residual continuously exceeds the preset threshold.

10. The network physical layer signal detection and data model analysis system according to claim 1, 2, or 3, characterized in that, The data analysis module also includes a handheld terminal, which is used to display the results of edge-cloud collaborative analysis and fault diagnosis performed by the data analysis module through the raw dataset, and to guide maintenance personnel to quickly locate, retest on-site, and provide diagnostic guidance to complete maintenance operations.

Images