A method and system for tracing and troubleshooting network node data anomalies of heterogeneous communications

Abstract

The application discloses a kind of network node data abnormality tracing and checking method and system of heterogeneous communication, its method includes the following steps: S1: multi-source heterogeneous data global acquisition and standardization pretreatment;S2: four-layer heterogeneous network dynamic topology atlas real-time construction and update.The application breaks through the limitation of traditional single-layer checking by constructing four-layer heterogeneous network dynamic topology correlation atlas, realizes cross-level fault correlation reasoning, truly restores abnormal propagation path, adapts various heterogeneous node data characteristics through adaptive dynamic threshold screening mechanism, effectively improves the false detection and missed detection problems existing in traditional fixed threshold, improves the abnormal identification accuracy, at the same time, relying on hierarchical causal reasoning and weight scoring mechanism discriminates false trace path, accurately distinguishes primary fault and secondary conduction anomaly, avoids alarm storm, can quickly lock fault root cause and identify fault type, effectively improves the accuracy and checking efficiency of heterogeneous communication network abnormality tracing.

Description

Technical Field

[0001] This invention relates to the field of network node data anomaly tracing and troubleshooting technology, and in particular to a method and system for tracing and troubleshooting network node data anomalies in heterogeneous communication. Background Technology

[0002] In mainstream application scenarios such as industrial IoT, smart cities, and vehicle-to-everything (V2X) networks, communication networks generally possess typical heterogeneous integration characteristics, compatible with multiple communication protocols such as Ethernet, 5G, NB-IoT, LoRa, Modbus, and ZigBee. Massive heterogeneous nodes complete data sampling, protocol forwarding, transmission interaction, and service parsing across layers and links. The network coupling relationship is complex, and the transmission links are dynamically changing, which can easily lead to problems such as data packet loss, data tampering, abnormal terminal sampling, gateway protocol conversion errors, and link transmission failures, which seriously affect the reliability of network data transmission and the stability of service operation. Existing heterogeneous network data anomaly tracing and troubleshooting technologies have the following shortcomings: 1. Traditional solutions only support surface-level anomaly marking and simple alarms for single layers and single links. Root cause localization is superficial, and cross-layer fault correlation reasoning is weak. They cannot distinguish the causal relationship and transmission level of anomalies, making it difficult to differentiate between primary faults and secondary transmission anomalies. This easily triggers alarm storms, preventing maintenance personnel from quickly locating the core fault source. 2. Existing technologies have not built a four-layer cross-layer topology correlation model adapted to heterogeneous networks, ignoring the coupling dependencies between terminals, gateways, transmission, and the cloud, making it impossible to achieve cross-layer correlation tracing of multi-node chain anomalies. 3. Traditional fixed threshold discrimination methods cannot adapt to the differentiated data characteristics of heterogeneous nodes, easily leading to false positives and false negatives. Furthermore, they cannot accurately distinguish between different root causes such as hardware failures, protocol failures, link failures, and data attacks, resulting in low tracing accuracy and troubleshooting efficiency. In summary, this application proposes a method and system for tracing and troubleshooting abnormal data in network nodes of heterogeneous communication. Summary of the Invention

[0003] Based on the technical problems existing in the background technology, this invention proposes a method and system for tracing and investigating abnormal network node data in heterogeneous communication.

[0004] This invention proposes a method for tracing and troubleshooting anomalies in network node data in heterogeneous communication, comprising the following steps: S1: Multi-source heterogeneous data full-domain collection and standardized preprocessing: Full-dimensional data collection is carried out on the terminal sampling layer, gateway forwarding layer, network transmission layer and cloud service layer of heterogeneous communication networks, and the multi-source heterogeneous data is standardized and preprocessed to unify timestamps, unique node identifiers, link numbers and abnormal feature fields to form a standardized heterogeneous traceability dataset. S2: Real-time construction and updating of dynamic topology map of four-layer heterogeneous network: Based on the standardized heterogeneous source tracing dataset of S1, a dynamic topology map of four-layer heterogeneous network is constructed, consisting of terminal sampling layer, gateway forwarding layer, network transmission layer and cloud service layer. The map is also used to detect node online / offline status, route switching, gateway load change status in real time, and dynamically update the topology node and link dependency relationships. S3: Heterogeneous Node Adaptive Dynamic Threshold Anomaly Screening: Based on the data characteristics of different types of heterogeneous nodes, a differentiated data baseline model is constructed. The dynamic anomaly judgment threshold is iteratively updated through a sliding window. Based on the dynamic anomaly judgment threshold, the initial screening of network-wide data anomalies is completed, anomaly nodes, anomaly links and anomaly time periods are marked, and a preliminary anomaly set is output. S4: Cross-level fault causal association and anomaly primary and secondary distinction: Based on the dynamic topological association map and the preliminary anomaly set output by S3, the temporal propagation characteristics and topological dependencies of the abnormal events are extracted. Cross-level fault association analysis is completed through a hierarchical fault causal reasoning model. According to the order of anomaly occurrence and hierarchical propagation logic, the primary fault node and the secondary affected node are distinguished. S5: Identification of false tracing paths and precise location of root causes of faults: Combining physical topology constraints and data propagation logic, false tracing paths generated by mathematical fitting are identified and eliminated. Through a fault weight scoring mechanism, combined with abnormal timing, scope of impact and hierarchical priority, the core fault root cause nodes and fault types are selected. S6: Visualization of source tracing results and closed-loop output of fault handling: Generate a visualized cross-layer source tracing link map based on the root cause localization results, and push the corresponding fault handling solution according to the fault knowledge base to complete the abnormal source tracing closed loop.

[0005] Preferably, the specific logical steps of S2 are as follows: S201: Extraction of Heterogeneous Network Nodes and Links at Four Layers: From the standardized heterogeneous source dataset, extract the terminal sampling layer node set, gateway forwarding layer node set, network transmission layer link set, and cloud service layer service node set respectively, and define the total set of heterogeneous nodes in the entire network. With the entire network transmission link edge set ; in Represents a node To the node The valid communication links are retained only when the handshake is successful and the link connectivity status is normal. Disconnected, unregistered, and invalid nodes and links are filtered out to complete the original entity modeling of the four-layer topology. S202: Hierarchical Adjacency Weight Assignment: Constructing a hierarchical adjacency weight matrix to address the hierarchical coupling characteristics of a four-layer heterogeneous network. The link weight is calculated based on link connectivity and data forwarding binding relationships, using the following formula: ; in For nodes and Topological association weights, The frequency of data interaction between two nodes per unit time. This is the weighting adjustment coefficient, with a value range of (0,1); S203: Constructing a four-layer heterogeneous static topology graph: Based on the node set V, the link edge set E, and the hierarchical weight matrix W, construct an initial four-layer heterogeneous network topology graph: ; in A collection of hierarchical tags. For terminal sampling layer, For gateway forwarding layer, For network transport layer, For the cloud-based business layer, cross-layer association logic is constrained through hierarchical tags, establishing a fixed hierarchical topology mapping relationship of "terminal-gateway-transmission link-cloud" to prevent cross-layer mismatch issues; S204: Quantitative Calculation of Network Dynamic State Characteristics: Real-time collection of node online / offline status, routing switch records, gateway load parameters, and definition of topology dynamic change coefficients. The calculation formula is as follows: ; in Let be the change in the online / offline status of the node at time t. The number of route hops changed. This refers to the gateway load fluctuation. , , The normalized weight coefficients are used to quantify the real-time fluctuations of the network through dynamic coefficients, serving as the trigger for topology updates. S205: Dynamic Iterative Update of Topology Graph: Setting Update Threshold ,when When this occurs, the dynamic update mechanism of the topology map is triggered, and the update formula is as follows: ; in The topological weight matrix is ​​from the previous time step. Calculate the new weight matrix for the current time step.

[0006] Preferably, the specific logical steps of S3 are as follows: S301: Heterogeneous Node Data Feature Classification and Baseline Sample Construction: Based on the business attributes, data dimensions, and numerical distribution characteristics of different nodes in the four-layer heterogeneous network, the heterogeneous nodes in the entire network are classified into sensor sampling nodes, gateway forwarding nodes, network transmission nodes, and cloud service parsing nodes. For each type of node, historical normal steady-state data within a preset sliding window period is selected, extreme noise data and known abnormal data are removed, and an initial baseline sample dataset exclusive to each type of node is constructed to provide compliant sample support for subsequent baseline fitting and threshold calculation. S302: Baseline Distribution Fitting for Heterogeneous Node Data: For the baseline sample datasets of various types of nodes, a Gaussian distribution fitting method is used to fit the steady-state distribution law of data for each type of heterogeneous node. The mean and standard deviation of the data distribution are calculated to construct a node-differentiated initial data baseline model. The calculation formula is as follows: ; in Let be the baseline mean of the i-th type of heterogeneous nodes. Let be the baseline standard deviation of the i-th type of heterogeneous nodes, and N be the total amount of baseline sample data within the sliding window. This represents the k-th steady-state sample data of the i-th node; S303: Adaptive Dynamic Anomaly Threshold Iterative Update: Combining the data drift characteristics and real-time operating status of heterogeneous nodes, an adaptive dynamic threshold is constructed based on the initial baseline model. Simultaneously, sample data is updated as the sliding window scrolls, iteratively optimizing the threshold parameters in real time. This avoids the problem of fixed thresholds failing to adapt to slow data drift caused by equipment aging and environmental changes. The core calculation formulas for the dynamic upper and lower thresholds are as follows: ; in , Let be the upper and lower threshold values ​​for dynamic anomalies of the i-th type of heterogeneous node, respectively. The adaptive fluctuation adjustment coefficient can be dynamically configured according to the node's service accuracy requirements. It will be automatically recalculated every time the sliding window updates with a new set of steady-state data. and This completes the dynamic iterative update of the threshold. S304: Detection of Differentiated Anomalies in Heterogeneous Data Across the Entire Network: Traverse the real-time collected data of all heterogeneous nodes across the entire network, match the dynamic threshold range corresponding to the node type for anomaly detection, and execute differential screening rules: If the node's real-time data... If the real-time data falls within the threshold range, it is considered abnormal data; if the real-time data falls within the threshold range, it is considered normal data. S305: Anomaly Information Marking and Initial Screening Set Output: All data judged as abnormal are marked with full-dimensional information, accurately binding the node ID, network level, communication link number, anomaly occurrence timestamp, and abnormal data offset corresponding to the anomaly, completing the archiving of basic information for anomaly tracing, summarizing the association information of all abnormal nodes, abnormal links, and corresponding abnormal time periods, and integrating them after deduplication and noise reduction to generate a standardized preliminary anomaly set, providing an accurate anomaly data source for subsequent cross-layer fault causal association reasoning.

[0007] Preferably, the specific logical steps of S4 are as follows: S401: Standardized extraction of time sequence features of abnormal events: Traverse all abnormal records in the preliminary abnormal set, uniformly extract the node-level labels, abnormal start timestamps, abnormal durations and related link information of each abnormal event, construct a set of abnormal time sequence events in the whole network, and sort all abnormal events in time sequence by timestamp to establish the time sequence benchmark of abnormal occurrence, and provide a time sequence dimension basis for subsequent fault propagation causal determination. S402: Constructing a cross-layer fault propagation temporal correlation model: Combining the hierarchical dependencies of the four-layer topology with the time difference of anomaly occurrence, the causal correlation degree of anomaly events at different nodes is quantified, and the anomaly temporal correlation degree is defined. The formula used is as follows: ; in Let represent the temporal causal correlation degree between the anomaly of node i and the anomaly of node j. Let be the time difference between the occurrence of the anomaly at node i and node j. This is the time-series decay coefficient. This is the topological correlation coefficient. If there is a cross-layer upstream and downstream topological dependency between two nodes, the value is 1; otherwise, the value is 0. S403: Hierarchical Fault Priority Weight Quantization Calculation: For the four-layer structure of terminal sampling layer, gateway forwarding layer, network transmission layer, and cloud service layer, and in combination with fault propagation characteristics, hierarchical fault priority weights are set. The priority of primary faults at the bottom layer is higher than that of faults propagated at the upper layer. The priority quantification formula is as follows: ; in The fault priority weight is the weight of the k-th level. These correspond to the terminal sampling layer, gateway forwarding layer, network transmission layer, and cloud service layer, respectively. The closer the layer is to the data source, the higher its priority and weight, which conforms to the propagation law of heterogeneous networks where "bottom-level faults are propagated upwards layer by layer". S404: Hierarchical Fault Causal Reasoning and Primary / Secondary Anomaly Discrimination: By integrating temporal correlation and hierarchical priority weights, a node fault confidence scoring formula is constructed to determine whether a node is a native fault node. The node fault confidence scoring formula is as follows: ; in The original fault confidence score of node i is given. The higher the score, the greater the probability that the node is the initial fault source. If a node has the earliest abnormal time sequence, the highest fault confidence, and the chain of abnormalities of subsequent multi-level nodes can be deduced through topological correlation, then the node is determined to be the original fault node. If the node abnormality lags behind the abnormality of other nodes and there is a high correlation fault propagation relationship with upstream nodes, then it is determined to be a secondary affected node. S405: Accurate Classification and Correlation Output of Cross-Layer Fault Types: Based on the four-layer cross-validation logic, the root cause of faults is classified. If the terminal sampling layer is abnormal first and the upstream and downstream synchronization is abnormal, it is determined to be a terminal hardware sampling fault. If the terminal is normal and the gateway layer is abnormal first, it is determined to be a gateway protocol conversion fault. If the terminal and gateway are normal and the transport layer is abnormal first, it is determined to be a network transmission fault. If the bottom three layers are normal and the cloud layer is abnormal first, it is determined to be a cloud service parsing fault. Finally, a complete set of cross-layer fault correlation links, including native faults and secondary transmission anomalies, is formed.

[0008] Preferably, the specific logical steps of S5 are as follows: S501: Candidate Source Tracing Path Set Extraction and Feature Analysis: Summarize all abnormal propagation links output by S4 causal inference, extract all candidate source tracing paths, and construct a candidate path set. For each candidate path It unifies the analysis of the node hierarchy sequence, anomaly propagation time sequence, cross-layer topological connection relationship, and data forwarding dependency features within the path, and records the algorithm fitting correlation parameters for each path, providing original verification samples for subsequent false path identification; S502: False Path Detection Based on Physical Topology Constraints: Based on the real four-layer heterogeneous network topology map constructed by S2, a topology path matching verification mechanism is established. The authenticity of paths is determined by the metric of path topology matching, and a formula for path topology matching degree is defined. ; in Let be the topological matching degree of the m-th candidate source path. This represents the number of connection edges in the path that match the actual network topology. A preset matching threshold is set for the total number of connected edges contained in the candidate path. ,like If the path is determined to be a spurious mathematical fit that deviates from the physical network logic, it will be directly eliminated. Retain it as a valid traceability path; S503: Quantitative Extraction of Multi-Dimensional Fault Evaluation Indicators: For abnormal nodes in the selected effective tracing paths, quantitative indicators are extracted from three core dimensions: anomaly timing priority, fault impact range, and hierarchical fault priority. The timing indicator represents the order in which the anomaly occurs, with higher weights for earlier occurrences. The impact range indicator represents the number of secondary abnormal nodes triggered by the anomaly propagation of the node. The hierarchical priority indicator adopts the inherent hierarchical weights of the four-layer network, with the weight of the bottom data collection layer being higher than that of the upper forwarding and parsing layers, ensuring that the root cause determination is consistent with the fault propagation mechanism of heterogeneous networks. S504: Construct a multi-dimensional fault root cause scoring model: Integrate time-series factors, impact range factors, and hierarchical priority factors to construct a node comprehensive fault weight scoring formula, quantifying the probability that each abnormal node is the core root cause. The node comprehensive fault weight scoring formula is as follows: ; in The comprehensive root cause score for node i is given. The node time-series normalized score is calculated; the earlier the anomaly occurs, the higher the score. The score is a normalized score for the scope of the fault's impact; the more secondary anomaly nodes associated, the higher the score. The node hierarchy priority weights defined for S4 , , These are the corresponding dimension weight coefficients, and each coefficient can be adaptively fine-tuned according to the heterogeneous network scenario; S505: Root Cause Node Screening and Precise Fault Type Location: Comprehensive root cause score for all valid abnormal nodes. The nodes are sorted in descending order, and the nodes with the highest scores are identified as the core root cause nodes. Combining the four-layer hierarchical classification and cross-layer fault verification logic, the corresponding fault types are matched. If the root cause node is located at the terminal sampling layer, it is identified as a hardware sampling fault; if it is located at the gateway forwarding layer, it is identified as a protocol conversion fault; if it is located at the network transmission layer, it is identified as a link transmission fault; and if it is located at the cloud service layer, it is identified as a service parsing fault. Finally, a unique core root cause node, accurate fault type, and clean and effective source propagation link are output.

[0009] Preferably, the specific logical steps of S6 are as follows: S601: Structured Data Reconstruction and Feature Encoding of Source Tracing Links: The effective cross-layer source tracing links, root cause nodes, secondary abnormal nodes, abnormal time series sequences, and hierarchical relationships finally determined in S5 are restructured to construct a standardized source tracing result dataset. The fault nodes and propagation links of the entire network are uniformly feature-encoded to generate a unique fault feature vector, which is used to characterize the hierarchical distribution, propagation path, and multi-dimensional features of the fault degree of this anomaly, providing standardized data input for subsequent visualization rendering and knowledge base matching; S602: Quantitative Assessment of Fault Impact: Combining fault duration, abnormal offset degree, and number of affected nodes, a comprehensive fault impact calculation formula is constructed to quantify the severity level of this anomaly, providing numerical basis for visual weight rendering and fault priority labeling. The formula is as follows: ; in To assess the overall impact of the fault, , These are the current time and the fault start time, respectively. To preset the standard fault assessment time, This represents the number of abnormal nodes. To monitor the total number of nodes in the domain, This represents the average offset of the outlier data relative to the baseline. , , The weighting coefficients are used to classify faults into four levels: minor, moderate, severe, and urgent based on the calculation results. S603: Dynamic rendering of cross-layer source tracing link visualization map: Based on a four-layer network topology, combined with the root cause location and anomaly propagation sequence, a visual source tracing link map is dynamically rendered and generated. The map displays the node distribution of the terminal sampling layer, gateway forwarding layer, network transmission layer, and cloud service layer in layers. Root cause nodes, secondary abnormal nodes, and normal nodes are marked with different colors. The thickness and highlighting of the link lines are adjusted according to the fault impact Q, intuitively presenting the complete path of the anomaly propagating upwards from the original fault node, the time period of the fault, and the scope of impact. S604: Intelligent Recommendation of Fault Handling Solutions Based on Similarity Matching: A fault knowledge base containing various fault types, corresponding troubleshooting procedures, and repair strategies is pre-built. The cosine similarity algorithm is used to calculate the matching degree between the current fault feature vector and historical fault samples in the knowledge base, thereby achieving intelligent solution matching. The formula used is as follows: ; in This is the feature vector of the current fault; This is the feature vector of historical fault samples in the knowledge base. The similarity of the faults is the highest. The higher the similarity, the stronger the consistency between the historical fault scenario and the current fault. The historical fault case with the highest similarity is selected, and the corresponding fault investigation steps, equipment verification methods and fault repair strategies are retrieved to accurately push the handling plan. S605: Standardized Source Tracing Report Generation and Fault Operation and Maintenance Closed Loop: Integrating root cause location results, fault level, visualized source tracing link, fault matching degree, and intelligent handling plan, it automatically generates a standardized anomaly source tracing and investigation report. The report fully records the fault occurrence time, anomaly propagation path, core root cause, fault impact scope, hierarchical alarm information, and on-the-ground repair suggestions, supporting operation and maintenance personnel to quickly complete fault rectification. After rectification, the fault data, source tracing process, and handling results are synchronously updated to the fault knowledge base, realizing a full-process source tracing closed loop of fault identification, source location, intelligent handling, and knowledge iteration.

[0010] Preferably, in step S605, the iterative update of the fault knowledge base and the closed-loop implementation of operation and maintenance include: structuring and archiving the fault feature vector, fault level type, source propagation link, comprehensive fault impact, manual rectification results, and fault matching similarity data of the current fault, and synchronously recording them into the fault knowledge base using an incremental update method to continuously enrich the capacity of the fault sample library and the dimensions of fault strategies; simultaneously, based on the continuously iterating fault knowledge base, dynamically optimizing the accuracy of subsequent fault similarity matching and the adaptability of handling solutions, realizing continuous self-optimization closed-loop iteration of heterogeneous network anomaly source tracing and investigation, intelligent repair guidance, and operation and maintenance knowledge accumulation.

[0011] This invention also proposes a network node data anomaly tracing and troubleshooting system for heterogeneous communication, including a data acquisition and preprocessing module, a dynamic topology construction module, an adaptive anomaly screening module, a cross-layer causal reasoning module, a false path identification module, and a visual tracing and output module; The data acquisition and preprocessing module is used to collect full-dimensional operational data and log data from the terminal sampling layer, gateway forwarding layer, network transmission layer, and cloud service layer, and to complete the format unification, time alignment, noise reduction and fusion of multi-source heterogeneous data, and output a standardized heterogeneous source tracing dataset. The dynamic topology construction module is used to build a four-layer heterogeneous network topology association graph, monitor network node status and routing link changes in real time, and dynamically update topology connection relationships and link weights. The adaptive anomaly screening module is used to construct differentiated data baselines for different types of heterogeneous nodes, iteratively update dynamic anomaly thresholds, complete the initial screening of anomalies in the entire network node data, and output a preliminary anomaly set. The cross-layer causal reasoning module is used to perform cross-layer fault correlation analysis based on dynamic topological correlation graphs and anomaly screening results, combined with anomaly time-series propagation characteristics and hierarchical coupling relationships, to distinguish between primary root cause faults and secondary transmission faults. The false path identification module is used to verify the validity of the source path by combining physical topology constraints and data propagation logic, eliminate false fitting paths, and complete accurate root cause location through fault weight scoring. The visualization traceability output module is used to visualize the entire level of anomaly traceability chain, root cause of the fault, and scope of impact of the anomaly, match the fault knowledge base to push the repair solution, and generate a standardized traceability investigation report.

[0012] Compared with existing technologies, the beneficial effects of this invention are: By constructing a hierarchical fault causal reasoning mechanism, it is possible to accurately identify the timing and topological transmission relationship of anomaly propagation, effectively distinguish between primary fault nodes and secondary affected nodes, fundamentally solve the problem of cause confusion and indistinguishable primary and secondary causes in heterogeneous network multi-node chain anomaly scenarios, avoid alarm storms formed by a large number of invalid alarms, help operation and maintenance personnel directly lock the initial root cause of the fault, and greatly improve the pertinence and accuracy of fault tracing. By constructing a four-layer dynamic topology association graph consisting of terminal sampling layer, gateway forwarding layer, network transmission layer, and cloud service layer, the coupling and dependency relationships between different layers of heterogeneous network are fully depicted. This breaks through the limitations of traditional single-layer independent investigation and enables cross-layer association reasoning for chain anomaly scenarios involving multiple links and cross-layers. It restores the real data anomaly propagation path and solves the problems of lack of cross-layer tracing, incomplete tracing links, and low network realism in traditional solutions. 3. Adopting a heterogeneous node adaptive dynamic threshold mechanism, a differentiated baseline model is constructed for the data characteristics of different types of devices, and the anomaly judgment criteria are dynamically updated iteratively. This effectively adapts to the differences in data distribution across multiple standards and dimensions in heterogeneous networks, significantly reducing the probability of false positives and missed detections due to hidden data drift. At the same time, it can accurately distinguish multiple types of faults, such as terminal hardware failures, gateway protocol conversion failures, link transmission failures, and cloud parsing anomalies. This completely solves the pain points of unclear root cause differentiation and low investigation efficiency in traditional technologies, and comprehensively improves the intelligence and accuracy of anomaly tracing in large-scale heterogeneous networks. This invention overcomes the limitations of traditional single-layer troubleshooting by constructing a four-layer dynamic topology association graph of heterogeneous networks. It enables cross-level fault association reasoning, accurately reconstructs anomaly propagation paths, and effectively improves the false detection and missed detection problems of traditional fixed thresholds by adapting to the data characteristics of various heterogeneous nodes through an adaptive dynamic threshold screening mechanism. This enhances the accuracy of anomaly identification. At the same time, it identifies false tracing paths by relying on hierarchical causal reasoning and weighted scoring mechanisms, accurately distinguishes between primary faults and secondary propagation anomalies, avoids alarm storms, and can quickly locate the root cause of the fault and identify the fault type, effectively improving the accuracy and efficiency of anomaly tracing in heterogeneous communication networks. Attached Figure Description

[0013] Figure 1 This is a flowchart of a method for tracing and investigating abnormal network node data in heterogeneous communication proposed in this invention; Figure 2 This is a block diagram of a network node data anomaly tracing and troubleshooting system for heterogeneous communication proposed in this invention. Detailed Implementation

[0014] The present invention will be further explained below with reference to specific embodiments. Example

[0015] Reference Figure 1 This embodiment proposes a method for tracing and troubleshooting anomalies in network node data in heterogeneous communication, including the following steps: S1: Multi-source heterogeneous data full-domain collection and standardized preprocessing: Full-dimensional data collection is carried out on the terminal sampling layer, gateway forwarding layer, network transmission layer and cloud service layer of heterogeneous communication networks, and the multi-source heterogeneous data is standardized and preprocessed to unify timestamps, unique node identifiers, link numbers and abnormal feature fields to form a standardized heterogeneous traceability dataset. S2: Real-time construction and updating of dynamic topology map of four-layer heterogeneous network: Based on the standardized heterogeneous source tracing dataset of S1, a dynamic topology map of four-layer heterogeneous network is constructed, consisting of terminal sampling layer, gateway forwarding layer, network transmission layer and cloud service layer. The map is also used to detect node online / offline status, route switching, gateway load change status in real time, and dynamically update the topology node and link dependency relationships. S3: Heterogeneous Node Adaptive Dynamic Threshold Anomaly Screening: Based on the data characteristics of different types of heterogeneous nodes, a differentiated data baseline model is constructed. The dynamic anomaly judgment threshold is iteratively updated through a sliding window. Based on the dynamic anomaly judgment threshold, the initial screening of network-wide data anomalies is completed, anomaly nodes, anomaly links and anomaly time periods are marked, and a preliminary anomaly set is output. S4: Cross-level fault causal association and anomaly primary and secondary distinction: Based on the dynamic topological association map and the preliminary anomaly set output by S3, the temporal propagation characteristics and topological dependencies of the abnormal events are extracted. Cross-level fault association analysis is completed through a hierarchical fault causal reasoning model. According to the order of anomaly occurrence and hierarchical propagation logic, the primary fault node and the secondary affected node are distinguished. S5: Identification of false tracing paths and precise location of root causes of faults: Combining physical topology constraints and data propagation logic, false tracing paths generated by mathematical fitting are identified and eliminated. Through a fault weight scoring mechanism, combined with abnormal timing, scope of impact and hierarchical priority, the core fault root cause nodes and fault types are selected. S6: Visualization of source tracing results and closed-loop output of fault handling: Generate a visualized cross-layer source tracing link map based on the root cause localization results, and push the corresponding fault handling solution according to the fault knowledge base to complete the abnormal source tracing closed loop.

[0016] In this embodiment, the specific logical steps of S2 are as follows: S201: Extraction of Heterogeneous Network Nodes and Links at Four Layers: From the standardized heterogeneous source dataset, extract the terminal sampling layer node set, gateway forwarding layer node set, network transmission layer link set, and cloud service layer service node set respectively, and define the total set of heterogeneous nodes in the entire network. With the entire network transmission link edge set ; in Represents a node To the node The valid communication links are retained only when the handshake is successful and the link connectivity status is normal. Disconnected, unregistered, and invalid nodes and links are filtered out to complete the original entity modeling of the four-layer topology. S202: Hierarchical Adjacency Weight Assignment: Constructing a hierarchical adjacency weight matrix to address the hierarchical coupling characteristics of a four-layer heterogeneous network. The link weight is calculated based on link connectivity and data forwarding binding relationships, using the following formula: ; in For nodes and Topological association weights, The frequency of data interaction between two nodes per unit time. This is the weighting adjustment coefficient, with a value range of (0,1); S203: Constructing a four-layer heterogeneous static topology graph: Based on the node set V, the link edge set E, and the hierarchical weight matrix W, construct an initial four-layer heterogeneous network topology graph: ; in A collection of hierarchical tags. For terminal sampling layer, For gateway forwarding layer, For network transport layer, For the cloud-based business layer, cross-layer association logic is constrained through hierarchical tags, establishing a fixed hierarchical topology mapping relationship of "terminal-gateway-transmission link-cloud" to prevent cross-layer mismatch issues; S204: Quantitative Calculation of Network Dynamic State Characteristics: Real-time collection of node online / offline status, routing switch records, gateway load parameters, and definition of topology dynamic change coefficients. The calculation formula is as follows: ; in Let be the change in the online / offline status of the node at time t. The number of route hops changed. This refers to the gateway load fluctuation. , , The normalized weight coefficients are used to quantify the real-time fluctuations of the network through dynamic coefficients, serving as the trigger for topology updates. S205: Dynamic Iterative Update of Topology Graph: Setting Update Threshold ,when When this occurs, the dynamic update mechanism of the topology map is triggered, and the update formula is as follows: ; in The topological weight matrix is ​​from the previous time step. Calculate the new weight matrix for the current time step.

[0017] In this embodiment, the specific logical steps of S3 are as follows: S301: Heterogeneous Node Data Feature Classification and Baseline Sample Construction: Based on the business attributes, data dimensions, and numerical distribution characteristics of different nodes in the four-layer heterogeneous network, the heterogeneous nodes in the entire network are classified into sensor sampling nodes, gateway forwarding nodes, network transmission nodes, and cloud service parsing nodes. For each type of node, historical normal steady-state data within a preset sliding window period is selected, extreme noise data and known abnormal data are removed, and an initial baseline sample dataset exclusive to each type of node is constructed to provide compliant sample support for subsequent baseline fitting and threshold calculation. S302: Baseline Distribution Fitting for Heterogeneous Node Data: For the baseline sample datasets of various types of nodes, a Gaussian distribution fitting method is used to fit the steady-state distribution law of data for each type of heterogeneous node. The mean and standard deviation of the data distribution are calculated to construct a node-differentiated initial data baseline model. The calculation formula is as follows: ; in Let be the baseline mean of the i-th type of heterogeneous nodes. Let be the baseline standard deviation of the i-th type of heterogeneous nodes, and N be the total amount of baseline sample data within the sliding window. This represents the k-th steady-state sample data of the i-th node; S303: Adaptive Dynamic Anomaly Threshold Iterative Update: Combining the data drift characteristics and real-time operating status of heterogeneous nodes, an adaptive dynamic threshold is constructed based on the initial baseline model. Simultaneously, sample data is updated as the sliding window scrolls, iteratively optimizing the threshold parameters in real time. This avoids the problem of fixed thresholds failing to adapt to slow data drift caused by equipment aging and environmental changes. The core calculation formulas for the dynamic upper and lower thresholds are as follows: ; in , Let be the upper and lower threshold values ​​for dynamic anomalies of the i-th type of heterogeneous node, respectively. The adaptive fluctuation adjustment coefficient can be dynamically configured according to the node's service accuracy requirements. It will be automatically recalculated every time the sliding window updates with a new set of steady-state data. and This completes the dynamic iterative update of the threshold. S304: Detection of Differentiated Anomalies in Heterogeneous Data Across the Entire Network: Traverse the real-time collected data of all heterogeneous nodes across the entire network, match the dynamic threshold range corresponding to the node type for anomaly detection, and execute differential screening rules: If the node's real-time data... If the real-time data falls within the threshold range, it is considered abnormal data; if the real-time data falls within the threshold range, it is considered normal data. S305: Anomaly Information Marking and Initial Screening Set Output: All data judged as abnormal are marked with full-dimensional information, accurately binding the node ID, network level, communication link number, anomaly occurrence timestamp, and abnormal data offset corresponding to the anomaly, completing the archiving of basic information for anomaly tracing, summarizing the association information of all abnormal nodes, abnormal links, and corresponding abnormal time periods, and integrating them after deduplication and noise reduction to generate a standardized preliminary anomaly set, providing an accurate anomaly data source for subsequent cross-layer fault causal association reasoning.

[0018] In this implementation, the specific logical steps of S4 are as follows: S401: Standardized extraction of time sequence features of abnormal events: Traverse all abnormal records in the preliminary abnormal set, uniformly extract the node-level labels, abnormal start timestamps, abnormal durations and related link information of each abnormal event, construct a set of abnormal time sequence events in the whole network, and sort all abnormal events in time sequence by timestamp to establish the time sequence benchmark of abnormal occurrence, and provide a time sequence dimension basis for subsequent fault propagation causal determination. S402: Constructing a cross-layer fault propagation temporal correlation model: Combining the hierarchical dependencies of the four-layer topology with the time difference of anomaly occurrence, the causal correlation degree of anomaly events at different nodes is quantified, and the anomaly temporal correlation degree is defined. The formula used is as follows: ; in Let represent the temporal causal correlation degree between the anomaly of node i and the anomaly of node j. Let be the time difference between the occurrence of the anomaly at node i and node j. This is the time-series decay coefficient. This is the topological correlation coefficient. If there is a cross-layer upstream and downstream topological dependency between two nodes, the value is 1; otherwise, the value is 0. S403: Hierarchical Fault Priority Weight Quantization Calculation: For the four-layer structure of terminal sampling layer, gateway forwarding layer, network transmission layer, and cloud service layer, and in combination with fault propagation characteristics, hierarchical fault priority weights are set. The priority of primary faults at the bottom layer is higher than that of faults propagated at the upper layer. The priority quantification formula is as follows: ; in The fault priority weight is the weight of the k-th level. These correspond to the terminal sampling layer, gateway forwarding layer, network transmission layer, and cloud service layer, respectively. The closer the layer is to the data source, the higher its priority and weight, which conforms to the propagation law of heterogeneous networks where "bottom-level faults are propagated upwards layer by layer". S404: Hierarchical Fault Causal Reasoning and Primary / Secondary Anomaly Discrimination: By integrating temporal correlation and hierarchical priority weights, a node fault confidence scoring formula is constructed to determine whether a node is a native fault node. The node fault confidence scoring formula is as follows: ; in The original fault confidence score of node i is given. The higher the score, the greater the probability that the node is the initial fault source. If a node has the earliest abnormal time sequence, the highest fault confidence, and the chain of abnormalities of subsequent multi-level nodes can be deduced through topological correlation, then the node is determined to be the original fault node. If the node abnormality lags behind the abnormality of other nodes and there is a high correlation fault propagation relationship with upstream nodes, then it is determined to be a secondary affected node. S405: Accurate Classification and Correlation Output of Cross-Layer Fault Types: Based on the four-layer cross-validation logic, the root cause of faults is classified. If the terminal sampling layer is abnormal first and the upstream and downstream synchronization is abnormal, it is determined to be a terminal hardware sampling fault. If the terminal is normal and the gateway layer is abnormal first, it is determined to be a gateway protocol conversion fault. If the terminal and gateway are normal and the transport layer is abnormal first, it is determined to be a network transmission fault. If the bottom three layers are normal and the cloud layer is abnormal first, it is determined to be a cloud service parsing fault. Finally, a complete set of cross-layer fault correlation links, including native faults and secondary transmission anomalies, is formed.

[0019] In this embodiment, the specific logical steps of S5 are as follows: S501: Candidate Source Tracing Path Set Extraction and Feature Analysis: Summarize all abnormal propagation links output by S4 causal inference, extract all candidate source tracing paths, and construct a candidate path set. For each candidate path It unifies the analysis of the node hierarchy sequence, anomaly propagation time sequence, cross-layer topological connection relationship, and data forwarding dependency features within the path, and records the algorithm fitting correlation parameters for each path, providing original verification samples for subsequent false path identification; S502: False Path Detection Based on Physical Topology Constraints: Based on the real four-layer heterogeneous network topology map constructed by S2, a topology path matching verification mechanism is established. The authenticity of paths is determined by the metric of path topology matching, and a formula for path topology matching degree is defined. ; in Let be the topological matching degree of the m-th candidate source tracing path. This represents the number of connection edges in the path that match the actual network topology. A preset matching threshold is set for the total number of connected edges contained in the candidate path. ,like If the path is determined to be a spurious mathematical fit that deviates from the physical network logic, it will be directly eliminated. Retain it as a valid traceability path; S503: Quantitative Extraction of Multi-Dimensional Fault Evaluation Indicators: For abnormal nodes in the selected effective tracing paths, quantitative indicators are extracted from three core dimensions: anomaly timing priority, fault impact range, and hierarchical fault priority. The timing indicator represents the order in which the anomaly occurs, with higher weights for earlier occurrences. The impact range indicator represents the number of secondary abnormal nodes triggered by the anomaly propagation of the node. The hierarchical priority indicator adopts the inherent hierarchical weights of the four-layer network, with the weight of the bottom data collection layer being higher than that of the upper forwarding and parsing layers, ensuring that the root cause determination is consistent with the fault propagation mechanism of heterogeneous networks. S504: Construct a multi-dimensional fault root cause scoring model: Integrate time-series factors, impact range factors, and hierarchical priority factors to construct a node comprehensive fault weight scoring formula, quantifying the probability that each abnormal node is the core root cause. The node comprehensive fault weight scoring formula is as follows: ; in The comprehensive root cause score for node i is given. The node time-series normalized score is calculated; the earlier the anomaly occurs, the higher the score. The score is a normalized score for the scope of the fault's impact; the more secondary anomaly nodes associated, the higher the score. The node hierarchy priority weights defined for S4 , , These are the corresponding dimension weight coefficients, and each coefficient can be adaptively fine-tuned according to the heterogeneous network scenario; S505: Root Cause Node Screening and Precise Fault Type Location: Comprehensive root cause score for all valid abnormal nodes. The nodes are sorted in descending order, and the nodes with the highest scores are identified as the core root cause nodes. Combining the four-layer hierarchical classification and cross-layer fault verification logic, the corresponding fault types are matched. If the root cause node is located at the terminal sampling layer, it is identified as a hardware sampling fault; if it is located at the gateway forwarding layer, it is identified as a protocol conversion fault; if it is located at the network transmission layer, it is identified as a link transmission fault; and if it is located at the cloud service layer, it is identified as a service parsing fault. Finally, a unique core root cause node, accurate fault type, and clean and effective source propagation link are output.

[0020] In this embodiment, the specific logical steps of S6 are as follows: S601: Structured Data Reconstruction and Feature Encoding of Source Tracing Links: The effective cross-layer source tracing links, root cause nodes, secondary abnormal nodes, abnormal time series sequences, and hierarchical relationships finally determined in S5 are restructured to construct a standardized source tracing result dataset. The fault nodes and propagation links of the entire network are uniformly feature-encoded to generate a unique fault feature vector, which is used to characterize the hierarchical distribution, propagation path, and multi-dimensional features of the fault degree of this anomaly, providing standardized data input for subsequent visualization rendering and knowledge base matching; S602: Quantitative Assessment of Fault Impact: Combining fault duration, abnormal offset degree, and number of affected nodes, a comprehensive fault impact calculation formula is constructed to quantify the severity level of this anomaly, providing numerical basis for visual weight rendering and fault priority labeling. The formula is as follows: ; in To assess the overall impact of the fault, , These are the current time and the fault start time, respectively. To preset the standard fault assessment time, This represents the number of abnormal nodes. To monitor the total number of nodes in the domain, This represents the average offset of the outlier data relative to the baseline. , , The weighting coefficients are used to classify faults into four levels: minor, moderate, severe, and urgent based on the calculation results. S603: Dynamic rendering of cross-layer source tracing link visualization map: Based on a four-layer network topology, combined with the root cause location and anomaly propagation sequence, a visual source tracing link map is dynamically rendered. The map displays the node distribution of the terminal sampling layer, gateway forwarding layer, network transmission layer, and cloud service layer in layers. Root cause nodes, secondary abnormal nodes, and normal nodes are marked with different colors. The thickness and highlighting of the link lines are adjusted according to the fault impact Q, intuitively presenting the complete path of the anomaly propagating upwards from the original fault node, the time period of the fault, and the scope of impact. S604: Intelligent Recommendation of Fault Handling Solutions Based on Similarity Matching: A fault knowledge base containing various fault types, corresponding troubleshooting procedures, and repair strategies is pre-built. The cosine similarity algorithm is used to calculate the matching degree between the current fault feature vector and historical fault samples in the knowledge base, thereby achieving intelligent solution matching. The formula used is as follows: ; in This is the feature vector of the current fault; This is the feature vector of historical fault samples in the knowledge base. The similarity of the faults is the highest. The higher the similarity, the stronger the consistency between the historical fault scenario and the current fault. The historical fault case with the highest similarity is selected, and the corresponding fault investigation steps, equipment verification methods and fault repair strategies are retrieved to accurately push the handling plan. S605: Standardized Source Tracing Report Generation and Fault Operation and Maintenance Closed Loop: Integrating root cause location results, fault level, visualized source tracing link, fault matching degree, and intelligent handling plan, it automatically generates a standardized anomaly source tracing and investigation report. The report fully records the fault occurrence time, anomaly propagation path, core root cause, fault impact scope, hierarchical alarm information, and on-the-ground repair suggestions, supporting operation and maintenance personnel to quickly complete fault rectification. After rectification, the fault data, source tracing process, and handling results are synchronously updated to the fault knowledge base, realizing a full-process source tracing closed loop of fault identification, source location, intelligent handling, and knowledge iteration; The iterative update and operation and maintenance closed-loop implementation of the fault knowledge base includes: structuring and archiving the fault feature vector, fault level type, source propagation link, comprehensive fault impact, manual rectification results, and fault matching similarity data of this fault, and synchronously entering them into the fault knowledge base using an incremental update method to continuously enrich the capacity of the fault sample database and the dimensions of fault strategies; at the same time, based on the continuously iterating fault knowledge base, dynamically optimizing the accuracy of subsequent fault similarity matching and the adaptability of handling solutions, realizing continuous self-optimization closed-loop iteration of heterogeneous network anomaly source tracing and investigation, intelligent repair guidance, and operation and maintenance knowledge accumulation.

[0021] Reference Figure 2 This embodiment proposes a network node data anomaly tracing and troubleshooting system for heterogeneous communication, including a data acquisition and preprocessing module, a dynamic topology construction module, an adaptive anomaly screening module, a cross-layer causal reasoning module, a false path identification module, and a visual tracing and output module; The data acquisition and preprocessing module is used to collect full-dimensional operational data and log data from the terminal sampling layer, gateway forwarding layer, network transmission layer, and cloud business layer, and to complete the format unification, time alignment, noise reduction and fusion of multi-source heterogeneous data, and output a standardized heterogeneous traceability dataset. The dynamic topology building module is used to build a four-layer heterogeneous network topology graph, monitor network node status and routing link changes in real time, and dynamically update topology connection relationships and link weights. The adaptive anomaly screening module is used to build differentiated data baselines for different types of heterogeneous nodes, iteratively update dynamic anomaly thresholds, complete the initial screening of anomalies in the entire network node data, and output a preliminary anomaly set. The cross-layer causal reasoning module is used to perform cross-layer fault correlation analysis based on dynamic topological correlation graphs and anomaly screening results, combined with anomaly time-series propagation characteristics and hierarchical coupling relationships, to distinguish between primary root cause faults and secondary transmission faults. The false path identification module is used to verify the validity of the source path by combining physical topology constraints and data propagation logic, eliminate false fitting paths, and complete accurate root cause location through fault weight scoring; The visual source tracing output module is used to visually display the entire level of anomaly source tracing chain, root cause of failure, and scope of anomaly impact, match the fault knowledge base to push repair solutions, and generate standardized source tracing and investigation reports. This embodiment constructs a four-layer dynamic topology association graph of heterogeneous networks, breaking through the limitations of traditional single-layer investigation, realizing cross-level fault association reasoning, and realistically restoring the anomaly propagation path. Through an adaptive dynamic threshold screening mechanism, it adapts to the data characteristics of various heterogeneous nodes, effectively improving the false detection and missed detection problems of traditional fixed thresholds, and improving the accuracy of anomaly identification. At the same time, relying on hierarchical causal reasoning and weighted scoring mechanisms, it identifies false tracing paths, accurately distinguishes between primary faults and secondary propagation anomalies, avoids alarm storms, and can quickly lock the root cause of the fault and identify the fault type, effectively improving the accuracy and efficiency of anomaly tracing in heterogeneous communication networks.

[0022] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for tracing and troubleshooting anomalies in network node data in heterogeneous communication, characterized in that, Includes the following steps: S1: Multi-source heterogeneous data full-domain collection and standardized preprocessing: Full-dimensional data collection is carried out on the terminal sampling layer, gateway forwarding layer, network transmission layer and cloud service layer of heterogeneous communication networks, and the multi-source heterogeneous data is standardized and preprocessed to unify timestamps, unique node identifiers, link numbers and abnormal feature fields to form a standardized heterogeneous traceability dataset. S2: Real-time construction and updating of dynamic topology map of four-layer heterogeneous network: Based on the standardized heterogeneous source tracing dataset of S1, a dynamic topology map of four-layer heterogeneous network is constructed, consisting of terminal sampling layer, gateway forwarding layer, network transmission layer and cloud service layer. The map is also used to detect node online / offline status, route switching, gateway load change status in real time, and dynamically update the topology node and link dependency relationships. S3: Heterogeneous Node Adaptive Dynamic Threshold Anomaly Screening: Based on the data characteristics of different types of heterogeneous nodes, a differentiated data baseline model is constructed. The dynamic anomaly judgment threshold is iteratively updated through a sliding window. Based on the dynamic anomaly judgment threshold, the initial screening of network-wide data anomalies is completed, anomaly nodes, anomaly links and anomaly time periods are marked, and a preliminary anomaly set is output. S4: Cross-level fault causal association and anomaly primary and secondary distinction: Based on the dynamic topological association map and the preliminary anomaly set output by S3, the temporal propagation characteristics and topological dependencies of the abnormal events are extracted. Cross-level fault association analysis is completed through a hierarchical fault causal reasoning model. According to the order of anomaly occurrence and hierarchical propagation logic, the primary fault node and the secondary affected node are distinguished. S5: Identification of false tracing paths and precise location of root causes of faults: Combining physical topology constraints and data propagation logic, false tracing paths generated by mathematical fitting are identified and eliminated. Through a fault weight scoring mechanism, combined with abnormal timing, scope of impact and hierarchical priority, the core fault root cause nodes and fault types are selected. S6: Visualization of source tracing results and closed-loop output of fault handling: Generate a visualized cross-layer source tracing link map based on the root cause localization results, and push the corresponding fault handling solution according to the fault knowledge base to complete the abnormal source tracing closed loop.

2. The method for tracing and investigating network node data anomalies in heterogeneous communication according to claim 1, characterized in that, The specific logical steps of S2 are as follows: S201: Extraction of Heterogeneous Network Nodes and Links at Four Layers: From the standardized heterogeneous source dataset, extract the terminal sampling layer node set, gateway forwarding layer node set, network transmission layer link set, and cloud service layer service node set respectively, and define the total set of heterogeneous nodes in the entire network. With the entire network transmission link edge set ; in Represents a node To the node The valid communication links are retained only when the handshake is successful and the link connectivity status is normal. Disconnected, unregistered, and invalid nodes and links are filtered out to complete the original entity modeling of the four-layer topology. S202: Hierarchical Adjacency Weight Assignment: Constructing a hierarchical adjacency weight matrix to address the hierarchical coupling characteristics of a four-layer heterogeneous network. The link weight is calculated based on link connectivity and data forwarding binding relationships, using the following formula: ； in For nodes and Topological association weights, The frequency of data interaction between two nodes per unit time. This is the weighting adjustment coefficient, with a value range of (0,1); S203: Constructing a four-layer heterogeneous static topology graph: Based on the node set V, the link edge set E, and the hierarchical weight matrix W, construct an initial four-layer heterogeneous network topology graph: ； in A collection of hierarchical tags. For terminal sampling layer, For gateway forwarding layer, For network transport layer, For the cloud-based business layer, cross-layer association logic is constrained through hierarchical tags, establishing a fixed hierarchical topology mapping relationship of "terminal-gateway-transmission link-cloud" to prevent cross-layer mismatch issues; S204: Quantitative Calculation of Network Dynamic State Characteristics: Real-time collection of node online / offline status, routing switch records, gateway load parameters, and definition of topology dynamic change coefficients. The calculation formula is as follows: ； in Let be the change in the online / offline status of the node at time t. The number of route hops changed. This refers to the gateway load fluctuation. , , The normalized weight coefficients are used to quantify the real-time fluctuations of the network through dynamic coefficients, serving as the trigger for topology updates. S205: Dynamic Iterative Update of Topology Graph: Setting Update Threshold ,when When this occurs, the dynamic update mechanism of the topology map is triggered, and the update formula is as follows: ； in The topological weight matrix is ​​from the previous time step. Calculate the new weight matrix for the current time step.

3. The method for tracing and investigating abnormal data in heterogeneous communication network nodes according to claim 2, characterized in that, The specific logical steps of S3 are as follows: S301: Heterogeneous Node Data Feature Classification and Baseline Sample Construction: Based on the business attributes, data dimensions, and numerical distribution characteristics of different nodes in the four-layer heterogeneous network, the heterogeneous nodes in the entire network are classified into sensor sampling nodes, gateway forwarding nodes, network transmission nodes, and cloud service parsing nodes. For each type of node, historical normal steady-state data within a preset sliding window period is selected, extreme noise data and known abnormal data are removed, and an initial baseline sample dataset exclusive to each type of node is constructed to provide compliant sample support for subsequent baseline fitting and threshold calculation. S302: Baseline Distribution Fitting for Heterogeneous Node Data: For the baseline sample datasets of various types of nodes, a Gaussian distribution fitting method is used to fit the steady-state distribution law of data for each type of heterogeneous node. The mean and standard deviation of the data distribution are calculated to construct a node-differentiated initial data baseline model. The calculation formula is as follows: ； in Let be the baseline mean of the i-th type of heterogeneous nodes. Let be the baseline standard deviation of the i-th type of heterogeneous nodes, and N be the total amount of baseline sample data within the sliding window. This represents the k-th steady-state sample data of the i-th node; S303: Adaptive Dynamic Anomaly Threshold Iterative Update: Combining the data drift characteristics and real-time operating status of heterogeneous nodes, an adaptive dynamic threshold is constructed based on the initial baseline model. Simultaneously, sample data is updated as the sliding window scrolls, iteratively optimizing the threshold parameters in real time. This avoids the problem of fixed thresholds failing to adapt to slow data drift caused by equipment aging and environmental changes. The core calculation formulas for the dynamic upper and lower thresholds are as follows: ； in , Let be the upper and lower threshold values ​​for dynamic anomalies of the i-th type of heterogeneous node, respectively. The adaptive fluctuation adjustment coefficient can be dynamically configured according to the node's service accuracy requirements. It will be automatically recalculated every time the sliding window updates with a new set of steady-state data. and This completes the dynamic iterative update of the threshold. S304: Detection of Differentiated Anomalies in Heterogeneous Data Across the Entire Network: Traverse the real-time collected data of all heterogeneous nodes across the entire network, match the dynamic threshold range corresponding to the node type for anomaly detection, and execute differential screening rules: If the node's real-time data... If the real-time data falls within the threshold range, it is considered abnormal data; if the real-time data falls within the threshold range, it is considered normal data. S305: Anomaly Information Marking and Initial Screening Set Output: All data judged as abnormal are marked with full-dimensional information, accurately binding the node ID, network level, communication link number, anomaly occurrence timestamp, and abnormal data offset corresponding to the anomaly, completing the archiving of basic information for anomaly tracing, summarizing the association information of all abnormal nodes, abnormal links, and corresponding abnormal time periods, and integrating them after deduplication and noise reduction to generate a standardized preliminary anomaly set, providing an accurate anomaly data source for subsequent cross-layer fault causal association reasoning.

4. The method for tracing and investigating abnormal data in heterogeneous communication network nodes according to claim 3, characterized in that, The specific logical steps of S4 are as follows: S401: Standardized extraction of time sequence features of abnormal events: Traverse all abnormal records in the preliminary abnormal set, uniformly extract the node-level labels, abnormal start timestamps, abnormal durations and related link information of each abnormal event, construct a set of abnormal time sequence events in the whole network, and sort all abnormal events in time sequence by timestamp to establish the time sequence benchmark of abnormal occurrence, and provide a time sequence dimension basis for subsequent fault propagation causal determination. S402: Constructing a cross-layer fault propagation temporal correlation model: Combining the hierarchical dependencies of the four-layer topology with the time difference of anomaly occurrence, the causal correlation degree of anomaly events at different nodes is quantified, and the anomaly temporal correlation degree is defined. The formula used is as follows: ; in Let represent the temporal causal correlation degree between the anomaly of node i and the anomaly of node j. Let be the time difference between the occurrence of the anomaly at node i and node j. This is the time-series decay coefficient. This is the topological correlation coefficient. If there is a cross-layer upstream and downstream topological dependency between two nodes, the value is 1; otherwise, the value is 0. S403: Hierarchical Fault Priority Weight Quantization Calculation: For the four-layer structure of terminal sampling layer, gateway forwarding layer, network transmission layer, and cloud service layer, and in combination with fault propagation characteristics, hierarchical fault priority weights are set. The priority of primary faults at the bottom layer is higher than that of faults propagated at the upper layer. The priority quantification formula is as follows: ； in The fault priority weight is the weight of the k-th level. These correspond to the terminal sampling layer, gateway forwarding layer, network transmission layer, and cloud service layer, respectively. The closer the layer is to the data source, the higher its priority and weight, which conforms to the propagation law of heterogeneous networks where "bottom-level faults are propagated upwards layer by layer". S404: Hierarchical Fault Causal Reasoning and Primary / Secondary Anomaly Discrimination: By integrating temporal correlation and hierarchical priority weights, a node fault confidence scoring formula is constructed to determine whether a node is a native fault node. The node fault confidence scoring formula is as follows: ； in The original fault confidence score of node i is given. The higher the score, the greater the probability that the node is the initial fault source. If a node has the earliest abnormal time sequence, the highest fault confidence, and the chain of abnormalities of subsequent multi-level nodes can be deduced through topological correlation, then the node is determined to be the original fault node. If the node abnormality lags behind the abnormality of other nodes and there is a high correlation fault propagation relationship with upstream nodes, then it is determined to be a secondary affected node. S405: Accurate Classification and Correlation Output of Cross-Layer Fault Types: Based on the four-layer cross-validation logic, the root cause of faults is classified. If the terminal sampling layer is abnormal first and the upstream and downstream synchronization is abnormal, it is determined to be a terminal hardware sampling fault. If the terminal is normal and the gateway layer is abnormal first, it is determined to be a gateway protocol conversion fault. If the terminal and gateway are normal and the transport layer is abnormal first, it is determined to be a network transmission fault. If the bottom three layers are normal and the cloud layer is abnormal first, it is determined to be a cloud service parsing fault. Finally, a complete set of cross-layer fault correlation links, including native faults and secondary transmission anomalies, is formed.

5. The method for tracing and investigating abnormal data in heterogeneous communication network nodes according to claim 4, characterized in that, The specific logical steps of S5 are as follows: S501: Candidate Source Tracing Path Set Extraction and Feature Analysis: Summarize all abnormal propagation links output by S4 causal inference, extract all candidate source tracing paths, and construct a candidate path set. For each candidate path It unifies the analysis of the node hierarchy sequence, anomaly propagation time sequence, cross-layer topological connection relationship, and data forwarding dependency features within the path, and records the algorithm fitting correlation parameters for each path, providing original verification samples for subsequent false path identification; S502: False Path Detection Based on Physical Topology Constraints: Based on the real four-layer heterogeneous network topology map constructed by S2, a topology path matching verification mechanism is established. The authenticity of paths is determined by the metric of path topology matching, and a formula for path topology matching degree is defined. ; in Let be the topological matching degree of the m-th candidate source path. This represents the number of connection edges in the path that match the actual network topology. A preset matching threshold is set for the total number of connected edges contained in the candidate path. ,like If the path is determined to be a spurious mathematical fit that deviates from the physical network logic, it will be directly eliminated. Retain it as a valid traceability path; S503: Quantitative extraction of multi-dimensional fault evaluation indicators: For abnormal nodes in the effective tracing path after screening, quantitative indicators are extracted from three core dimensions: abnormal time sequence priority, fault impact range, and hierarchical fault priority. The time sequence indicator represents the order in which the abnormality occurs, and the earlier it occurs, the higher the weight. The impact range index represents the number of secondary abnormal nodes triggered by the abnormal propagation of this node; The hierarchical priority index adopts the inherent hierarchical weight of the four-layer network, with the weight of the bottom data collection layer being higher than that of the upper forwarding and parsing layers, ensuring that the root cause determination is consistent with the fault propagation mechanism of heterogeneous networks. S504: Construct a multi-dimensional fault root cause scoring model: Integrate time-series factors, impact range factors, and hierarchical priority factors to construct a node comprehensive fault weight scoring formula, quantifying the probability that each abnormal node is the core root cause. The node comprehensive fault weight scoring formula is as follows: ； in The comprehensive root cause score for node i is given. The node time-series normalized score is calculated; the earlier the anomaly occurs, the higher the score. The score is a normalized score for the scope of the fault's impact; the more secondary anomaly nodes associated, the higher the score. The node hierarchy priority weights defined for S4 , , These are the corresponding dimension weight coefficients, and each coefficient can be adaptively fine-tuned according to the heterogeneous network scenario; S505: Root Cause Node Screening and Precise Fault Type Location: Comprehensive root cause score for all valid abnormal nodes. The nodes are sorted in descending order, and the nodes with the highest scores are identified as the core root cause nodes. Combining the four-layer hierarchical classification and cross-layer fault verification logic, the corresponding fault types are matched. If the root cause node is located at the terminal sampling layer, it is identified as a hardware sampling fault; if it is located at the gateway forwarding layer, it is identified as a protocol conversion fault; if it is located at the network transmission layer, it is identified as a link transmission fault; and if it is located at the cloud service layer, it is identified as a service parsing fault. Finally, a unique core root cause node, accurate fault type, and clean and effective source propagation link are output.

6. The method for tracing and investigating abnormal data in heterogeneous communication network nodes according to claim 5, characterized in that, The specific logical steps of S6 are as follows: S601: Structured Data Reconstruction and Feature Encoding of Source Tracing Links: The effective cross-layer source tracing links, root cause nodes, secondary abnormal nodes, abnormal time series sequences, and hierarchical relationships finally determined in S5 are restructured to construct a standardized source tracing result dataset. The fault nodes and propagation links of the entire network are uniformly feature-encoded to generate a unique fault feature vector, which is used to characterize the hierarchical distribution, propagation path, and multi-dimensional features of the fault degree of this anomaly, providing standardized data input for subsequent visualization rendering and knowledge base matching; S602: Quantitative Assessment of Fault Impact: Combining fault duration, abnormal offset degree, and number of affected nodes, a comprehensive fault impact calculation formula is constructed to quantify the severity level of this anomaly, providing numerical basis for visual weight rendering and fault priority labeling. The formula is as follows: ； in To determine the overall impact of the fault, , These are the current time and the fault start time, respectively. To preset the standard fault assessment time, This represents the number of abnormal nodes. To monitor the total number of nodes in the domain, This represents the average offset of the outlier data relative to the baseline. , , The weighting coefficients are used to classify faults into four levels: minor, moderate, severe, and urgent based on the calculation results. S603: Dynamic rendering of cross-layer source tracing link visualization map: Based on a four-layer network topology, combined with the root cause location and anomaly propagation sequence, a visual source tracing link map is dynamically rendered. The map displays the node distribution of the terminal sampling layer, gateway forwarding layer, network transmission layer, and cloud service layer in layers. Root cause nodes, secondary abnormal nodes, and normal nodes are marked with different colors. The thickness and highlighting of the link lines are adjusted according to the fault impact Q, intuitively presenting the complete path of the anomaly propagating upwards from the original fault node, the time period of the fault, and the scope of impact. S604: Intelligent Recommendation of Fault Handling Solutions Based on Similarity Matching: A fault knowledge base containing various fault types, corresponding troubleshooting procedures, and repair strategies is pre-built. The cosine similarity algorithm is used to calculate the matching degree between the current fault feature vector and historical fault samples in the knowledge base, thereby achieving intelligent solution matching. The formula used is as follows: ； in This is the feature vector of the current fault; This is the feature vector of historical fault samples in the knowledge base. The similarity of the faults is the highest. The higher the similarity, the stronger the consistency between the historical fault scenario and the current fault. The historical fault case with the highest similarity is selected, and the corresponding fault investigation steps, equipment verification methods and fault repair strategies are retrieved to accurately push the handling plan. S605: Standardized Source Tracing Report Generation and Fault Operation and Maintenance Closed Loop: Integrating root cause location results, fault level, visualized source tracing link, fault matching degree, and intelligent handling plan, it automatically generates a standardized anomaly source tracing and investigation report. The report fully records the fault occurrence time, anomaly propagation path, core root cause, fault impact scope, hierarchical alarm information, and on-the-ground repair suggestions, supporting operation and maintenance personnel to quickly complete fault rectification. After rectification, the fault data, source tracing process, and handling results are synchronously updated to the fault knowledge base, realizing a full-process source tracing closed loop of fault identification, source location, intelligent handling, and knowledge iteration.

7. The method for tracing and investigating abnormal data in heterogeneous communication network nodes according to claim 6, characterized in that, In S605, the iterative update of the fault knowledge base and the closed-loop implementation of operation and maintenance include: structuring and archiving the fault feature vector, fault level type, source propagation link, comprehensive fault impact, manual rectification results, and fault matching similarity data of this fault, and synchronously entering them into the fault knowledge base using an incremental update method to continuously enrich the capacity of the fault sample library and the dimensions of fault strategies; at the same time, based on the continuously iterating fault knowledge base, dynamically optimizing the accuracy of subsequent fault similarity matching and the adaptability of handling solutions, realizing continuous self-optimization closed-loop iteration of heterogeneous network anomaly source tracing and investigation, intelligent repair guidance, and operation and maintenance knowledge accumulation.

8. A system for tracing and investigating abnormal data in heterogeneous communication network nodes, used to implement the method described in any one of claims 1-7, characterized in that, It includes a data acquisition and preprocessing module, a dynamic topology construction module, an adaptive anomaly screening module, a cross-layer causal reasoning module, a false path identification module, and a visual tracing output module; The data acquisition and preprocessing module is used to collect full-dimensional operational data and log data from the terminal sampling layer, gateway forwarding layer, network transmission layer, and cloud service layer, and to complete the format unification, time alignment, noise reduction and fusion of multi-source heterogeneous data, and output a standardized heterogeneous source tracing dataset. The dynamic topology construction module is used to build a four-layer heterogeneous network topology association graph, monitor network node status and routing link changes in real time, and dynamically update topology connection relationships and link weights. The adaptive anomaly screening module is used to construct differentiated data baselines for different types of heterogeneous nodes, iteratively update dynamic anomaly thresholds, complete the initial screening of anomalies in the entire network node data, and output a preliminary anomaly set. The cross-layer causal reasoning module is used to perform cross-layer fault correlation analysis based on dynamic topological correlation graphs and anomaly screening results, combined with anomaly time-series propagation characteristics and hierarchical coupling relationships, to distinguish between primary root cause faults and secondary transmission faults. The false path identification module is used to verify the validity of the source path by combining physical topology constraints and data propagation logic, eliminate false fitting paths, and complete accurate root cause location through fault weight scoring. The visualization traceability output module is used to visualize the entire level of anomaly traceability chain, root cause of the fault, and scope of impact of the anomaly, match the fault knowledge base to push the repair solution, and generate a standardized traceability investigation report.

Images