Network anomaly detection method, device, apparatus, medium and product

Abstract

The application provides a network anomaly detection method and device, belonging to the network operation and maintenance technical field, the method comprises the following steps: taking the user and the cell as the node, the connection relationship between the user and the cell as the edge, and the residence time length proportion of the user in the cell as the weight of the edge, a user-cell association graph is established; based on the perception score sequence of the user, the cumulative deviation value of the user is continuously calculated, the cumulative deviation value is the cumulative sum of the previous deviation amount when the perception score continuously falls below the baseline tolerance; the frequency of the short-term quality difference event in the target area is counted, the short-term quality difference event is the event with a duration less than a preset time threshold and a perception score in a preset score interval; if the cumulative deviation value exceeds the deviation threshold or the frequency exceeds the frequency threshold, an abnormal alarm is generated, and the root cause cell leading to the abnormal alarm is located based on the user-cell association graph. The application improves the comprehensiveness and operation efficiency of network anomaly detection.

Description

Technical Field

[0001] This application relates to the field of network operation and maintenance technology, and in particular to a method, device, equipment, medium and product for network anomaly detection. Background Technology

[0002] With the rapid development of mobile communication technology, network scale is growing larger and business models are becoming increasingly complex. Users' expectations for network experience are constantly rising, making network anomaly detection, as a core component of ensuring network service quality, increasingly important. Accurate network anomaly detection not only enables timely discovery and location of network faults, reducing user complaints, but also forms the foundation for network optimization and automated, intelligent operation and maintenance.

[0003] Existing network anomaly detection methods mainly include alarm mechanisms based on static thresholds set by the network management platform, data parsing based on signaling plane deep packet inspection probes, and manual analysis. However, these methods have relatively coarse monitoring granularity, mostly based on the cell or base station level, making it difficult to accurately reflect the real experience of individual SVIP users. When the overall indicators of the cell are normal, the perceived degradation of a single user is easily masked. In addition, existing solutions lack multi-dimensional cross-analysis capabilities, making it difficult to identify long-term chronic degradation, i.e., multiple small deviations from the threshold perceived by users do not trigger alarms individually, and the long-term accumulation is difficult to detect. Furthermore, it is difficult to identify frequent and occasional quality defects in a specific area, i.e., a single short-term quality defect has little impact on the experience, but it occurs repeatedly in a specific area, causing user dissatisfaction.

[0004] Therefore, how to improve the granularity of monitoring and effectively identify implicit sensing problems has become an urgent technical issue to be addressed. Summary of the Invention

[0005] This application provides a network anomaly detection method, apparatus, device, medium, and product to address the shortcomings of existing technologies in network anomaly detection, such as large granularity and inability to effectively identify hidden sensing problems.

[0006] This application provides a method for detecting network anomalies, including the following steps: A user-community relationship graph is constructed, with users and communities as nodes, the connection between users and communities as edges, and the percentage of time a user spends in a community as the weight of the edge. Based on the user's perceived rating sequence, the user's cumulative deviation value is continuously calculated. The cumulative deviation value is the sum of the cumulative deviations when the perceived rating is continuously below the baseline tolerance. The frequency of short-term poor quality events within the target area is counted. A short-term poor quality event is an event whose duration is less than a preset time threshold and whose perception score is within a preset score range. If the cumulative deviation value exceeds the deviation threshold, or the frequency exceeds the frequency threshold, an abnormal alarm is generated, and the root cause cell causing the abnormal alarm is located based on the user-cell association graph.

[0007] According to the network anomaly detection method provided in this application, the step of continuously calculating the user's cumulative deviation value based on the user's perception rating sequence includes: The cumulative deviation value is initialized to zero; The tolerance value is determined based on the difference between the baseline mean and the tolerance offset, where the baseline mean is the mean of the user's historical perception scores, and the tolerance offset reflects the normal fluctuation range of the perception scores. When the user's perception score is lower than the tolerance value, the difference between the perception score and the tolerance value is added to the cumulative deviation value.

[0008] According to the network anomaly detection method provided in this application, the perception score is calculated based on the following steps: Multiple key perception indicators are weighted and fused to obtain the CEI score; Based on a pre-defined AI model, feature mapping scores are extracted from multimodal data; The CEI score and the feature mapping score are weighted and fused to obtain the perception score.

[0009] According to the network anomaly detection method provided in this application, the weights of the key perception indicators are determined based on the following steps: The weight adjustment magnitude is determined based on the product of the gradient of the weights with respect to the loss function and the learning rate. The weights are adjusted based on the weight adjustment range.

[0010] According to the network anomaly detection method provided in this application, the network anomaly detection method further includes: For any of the key perception indicators, the interquartile range threshold and the AI ​​threshold are weighted and fused to obtain the anomaly detection threshold corresponding to the key perception indicator. The interquartile range threshold is a threshold calculated based on the interquartile range method, and the AI ​​threshold is a dynamic threshold calculated based on a neural network model. If the user's key perception indicators exceed the anomaly detection threshold corresponding to the key perception indicators, an anomaly alarm will be generated.

[0011] According to a network anomaly detection method provided in this application, the AI ​​threshold includes an upper bound and a lower bound, and the AI ​​threshold is calculated based on the following steps: The context feature vector is input into the neural network model to obtain the dynamic multiplier factor output by the neural network model; The standard deviation of the key perception index is scaled based on the dynamic multiplier factor to obtain the multiplier standard deviation. The sum of the baseline mean and the multiple standard deviation is used as the upper bound of the AI ​​threshold, and the difference between the baseline mean and the multiple standard deviation is used as the lower bound of the AI ​​threshold.

[0012] This application also provides a network anomaly detection device, including the following modules: The graph construction module is used to: establish a user-cell association graph with users and cells as nodes, the connection between users and cells as edges, and the percentage of time a user spends in a cell as the weight of the edge. The chronic degradation detection module is used to: continuously calculate the user's cumulative deviation value based on the user's perception score sequence, wherein the cumulative deviation value is the cumulative sum of the deviations when the perception score is continuously below the baseline tolerance; The frequent poor quality detection module is used to: count the frequency of short-term poor quality events in the target area, wherein the short-term poor quality event is an event whose duration is less than a preset time threshold and whose perception score is within a preset score range; The root cause localization module is used to: generate an abnormal alarm if the cumulative deviation value exceeds the deviation threshold or the frequency exceeds the frequency threshold, and locate the root cause cell that caused the abnormal alarm based on the user-cell association graph.

[0013] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the network anomaly detection methods described above.

[0014] This application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network anomaly detection method as described above.

[0015] This application also provides a computer program product, including a computer program that, when executed by a processor, implements any of the network anomaly detection methods described above.

[0016] The network anomaly detection method, apparatus, equipment, medium, and product provided in this application, by establishing a user-cell association graph with users and cells as nodes and dwell time percentage as weight, overcomes the limitations of traditional methods that rely solely on cell or base station-level monitoring. It refines the monitoring granularity to the single-user level, thereby accurately reflecting the network experience of individual users and avoiding the problem of single-user perceived degradation being masked by overall cell metrics. Furthermore, for long-term chronic degradation issues, it continuously calculates the cumulative deviation value of user perception scores when they fall below the baseline tolerance, accumulating small deviations over time. When the cumulative deviation value exceeds a threshold, an alarm is triggered, effectively capturing hidden issues where a single instance fails to meet the alarm standard but accumulates over a long period, leading to a severe decline in experience. Anomalies: Addressing the issue of frequent, intermittent quality degradation in specific regions, this application statistically analyzes the frequency of short-duration quality degradation events within a target area that fall within a specific range of perceived scores. Spatiotemporal joint statistics are used to mine recurring patterns of intermittent quality degradation in these areas. When the frequency exceeds a threshold, an alarm is generated. This solves the problem that single, short-duration quality degradation events are difficult to detect, but frequent occurrences severely impact user satisfaction. Furthermore, after generating anomaly alarms, root cause localization is performed based on a user-cell association graph. Since the association graph includes the connection relationships between users and cells and their residency weights, the system can quickly and accurately identify the specific root cause cell leading to cumulative user degradation or frequent regional quality degradation. This provides reference data for network optimization, improving the accuracy of anomaly detection and operational efficiency. In summary, this application, by constructing a user-cell association graph and combining cumulative deviation value calculation with statistics on the frequency of short-duration quality degradation, effectively identifies latent perceived problems such as long-term chronic degradation and frequent, intermittent regional quality degradation. Furthermore, based on the association graph, it accurately locates the root cause cell, thereby improving the comprehensiveness of network anomaly detection and operational efficiency. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the network anomaly detection method provided in this application; Figure 2 This is a schematic diagram of the network anomaly detection device provided in this application; Figure 3 This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] It should be noted that in the description of the embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. The terms "upper," "lower," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application. Unless otherwise expressly specified and limited, the terms "installed," "connected," and "linked" should be interpreted broadly, for example, they can be fixed connections, detachable connections, or integral connections; they can be mechanical connections or electrical connections; they can be direct connections or indirect connections through an intermediate medium; and they can be internal connections between two elements. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0021] The terms "first," "second," etc., used in this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such numbers can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class, without limiting the number of objects; for example, a first object can be one or more. Furthermore, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects have an "or" relationship.

[0022] The following is combined with Figures 1-3 This application describes the network anomaly detection methods, apparatus, devices, media, and products provided in its embodiments.

[0023] Figure 1 This is a flowchart illustrating the network anomaly detection method provided in this application, as follows: Figure 1As shown, the method includes the following: S110: Using users and communities as nodes, the connection between users and communities as edges, and the percentage of time users spend in a community as the edge weight, a user-community association graph is established. S120, based on the user's perceived rating sequence, continuously calculate the user's cumulative deviation value, where the cumulative deviation value is the cumulative sum of the deviation amounts each time the perceived rating is continuously below the baseline tolerance; S130, count the frequency of short-term poor quality events in the target area, wherein the short-term poor quality event is an event whose duration is less than a preset time threshold and whose perception score is within a preset score range. S140, if the cumulative deviation value exceeds the deviation threshold, or the frequency exceeds the frequency threshold, an abnormal alarm is generated, and the root cause cell causing the abnormal alarm is located based on the user-cell association graph.

[0024] It should be noted that the execution subject of the network anomaly detection method provided in this application embodiment can be a server, computer equipment, such as mobile phone, tablet computer, laptop computer, handheld computer, vehicle electronic equipment, wearable device, ultra-mobile personal computer (UMPC), netbook or personal digital assistant (PDA), etc.

[0025] In S110, network signaling data is collected, and user-cell interaction information is extracted. The user-cell association graph is dynamically constructed or updated with users and cells as nodes, connection relationships as edges, and dwell time percentage as weights.

[0026] In the specific implementation process, a three-dimensional association model of AI-enhanced perceptual data is constructed using user identifier, cell identifier, and time dimension (time window) as three-dimensional coordinate axes. Graph neural network technology is introduced to model users and cells as nodes in a heterogeneous graph, constructing a user-cell association graph: nodes represent users and cells, edges represent the connection relationship between users and cells (resident / roaming / handover), and the weight of the edge represents the proportion of time a user spends in that cell. The GraphSAGE / GAT graph attention network model is used to learn node representations on the graph structure, generating low-dimensional embedding vectors for user nodes and cell nodes. By calculating the similarity of the embedding vectors, the perceptual similarity between users (even if users are not in the same cell) and the correlation between cells (even if they are physically far apart) can be automatically discovered. The model supports three analysis paths: finding cells from users, using the GNN message passing mechanism to propagate along the edge from the perceived degradation of a single user to locate the root cause cell affecting that user; finding users from cells, starting from the abnormal cell nodes and finding the set of users most severely affected by attention weight ranking; and finding patterns from time, combining a time-series encoder to incorporate time features into the graph node representation to discover abnormal graph patterns in specific time periods.

[0027] Specifically, when a poor user experience is detected for a particular SVIP, the system traces back along the edges of the association graph and uses a message passing mechanism to pinpoint the exact cell (root cause cell) causing the abnormal user experience. When a cell experiences hardware failure or severe congestion, the GAT model dynamically calculates attention weights by combining edge weights and node features (user profiles). By ranking the attention weights, the system can identify the top N users most severely affected by that cell, enabling batch and precise support. N can be adaptively set according to usage requirements.

[0028] Furthermore, temporal features are also integrated into the nodes of the graph. For example, the system can detect that every Tuesday afternoon, users in both communities A and B experience slight perceptual degradation simultaneously. Specifically, for the same user node, instead of assigning a fixed feature vector, a dynamic feature is generated for each time window. At time t, the input feature of node v becomes Xv(t) = [Fstatic||Fdynamic(t)], where Fstatic is the user's fixed attribute, such as the service plan type, and Fdynamic(t) is the real-time perceptual indicator within that time window, such as the current speed and latency. In this way, the same user is a dynamic node with different features at different times. Further, combined with a temporal encoder, the time-series features of each node over a past period are extracted using temporal neural network models such as LSTM and TCN, compressed into a temporal feature vector, and then this temporal feature vector is used as the feature input to the GAT model. When both time and space are integrated into the graph structure, the GAT model will consider both temporal and spatial factors when calculating attention weights. For example, during a specific time window on Tuesday afternoon, when the GAT model is scoring attention, it will find that the temporal feature vectors of cell A and cell B are unusually similar at this time point, that is, the attention weight is extremely high. Even if the two cells are physically far apart, they can be linked together, thus determining that this is a group-wide pattern anomaly in a specific time period, rather than an occasional single point of failure.

[0029] In S120, the perceived score sequence is a continuous time series data reflecting a single user's network experience within a specific time period. The baseline tolerance is a preset standard or threshold for measuring a user's normal network experience; anything below this threshold is considered to have a compromised experience. The cumulative deviation is an indicator used to quantify long-term chronic degradation; it is obtained by summing the total deviations from the baseline tolerance over time.

[0030] In S130, a brief poor quality event refers to a network fluctuation event with an extremely short duration (less than a preset time threshold) and a perception score within a specific deterioration range.

[0031] Here, within the target area, short-lived poor-quality events with a duration less than a preset threshold and a score falling within a preset range are scanned and identified in real time, and their frequency of occurrence is counted.

[0032] In this embodiment, a spatiotemporal frequency statistics algorithm is used to perform frequency statistics and pattern analysis on transient quality deterioration events occurring in specific areas (cell clusters / hotspot areas). The specific steps are as follows: First, define transient quality deterioration events as short-lived (e.g., <30 seconds), with minimal single-event impact (perceived score drops to 60-70), but subjectively perceptible instantaneous degradation. Second, statistically analyze the frequency, duration distribution, and user impact range of transient quality deterioration events within each cell cluster according to regional and temporal dimensions. Third, utilize sliding window frequency statistics (window size defaults to 1 hour / day / week, parameters are configurable) to identify hotspot areas and hotspot time periods with abnormally high frequencies. When the regional frequency exceeds a threshold, a regional frequent quality deterioration alarm is triggered. This method can detect small-scale quality deterioration issues that occur repeatedly but are otherwise completely normal in a single test, making it particularly suitable for solving operational challenges where users frequently report issues but the metrics are not abnormal.

[0033] It is understandable that there are no strict timing restrictions between S120 and S130 during execution. S120 can be executed first and then S130, or S130 can be executed first and then S120, or S120 and S130 can be executed simultaneously.

[0034] In S140, the root cause cell is the underlying network node that causes user network experience degradation or frequent poor quality in the area, such as the cell covered by the base station.

[0035] Cihu implements a dual-trigger mechanism: when the cumulative deviation exceeds the deviation threshold, or the frequency of brief quality-poor events exceeds the frequency threshold, the system generates an anomaly alarm. Simultaneously, utilizing the constructed user-cell relationship graph and combining edge weights, the system traces back and locates the root cause cell leading to the anomaly.

[0036] In this embodiment, deep clustering and representation learning techniques are introduced to enhance analytical capabilities based on traditional clustering analysis methods (K-means, hierarchical clustering). Specifically, an autoencoder is used to reduce the dimensionality and extract features from the user-perceived feature sequence, obtaining a high-dimensional semantic feature representation of the user at the bottleneck layer of the autoencoder; density clustering is used in the feature representation space to automatically discover natural clusters of user-perceived behaviors. The contrastive learning framework SimCLR is used, with user-cell association relationships as positive sample pairs and no association relationships as negative sample pairs, to train contrastive learning models for user embeddings and cell embeddings, ensuring that the embedding vectors of users and their resident cells and strongly associated cells are close to each other in the representation space. This model can automatically calculate the association strength score between each user and the cell, supporting fine-grained cell-level perceived attribution analysis. Simultaneously, through cross-tabulation analysis and correlation testing, a statistical mapping relationship between users and their resident cells and associated cells is established, identifying key cells and network weaknesses affecting specific user groups.

[0037] In the specific implementation process, the user's perception index sequence is input into the autoencoder. After compression, the high-dimensional semantic features that best represent the user's network experience are extracted at the bottleneck layer. Positive sample pairs are those between the user and cells with which they are actually associated (e.g., resident cells, roaming cells). The model forces these cells to be very close in mathematical space. Conversely, negative sample pairs are those between the user and cells with no association. Based on this, a contrastive learning model is used to train the embedding vectors of users and cells. After the SimCLR model is trained, the user's perception index sequence is input into the autoencoder, and high-dimensional semantic feature vectors are extracted at the bottleneck layer. The network state of the cell and the associated user features are input into the encoder to generate the cell's feature vector. The cosine similarity between the user vector and the target cell vector is calculated as the association strength score. For a specific user, the scores between the user and all surrounding cells are calculated and sorted from highest to lowest. The cell ranked first is the user's strongest associated cell (primary resident cell), and the cells ranked second and third are roaming or edge-associated cells.

[0038] Optionally, the number of times or duration of the user actually connected to each cell within a specific time window can be counted. The correlation strength score calculated by AI and the actual dwell time percentage can be subjected to Pearson or Spearman correlation tests. Only when the score calculated by AI meets the score threshold and the statistical actual dwell time also meets the duration threshold will the cell be finally identified as the root cause cell.

[0039] Furthermore, the network anomaly detection method provided in this application supports data aggregation and analysis at multiple time granularities, including minute-level (real-time monitoring), hour-level (short-term trend), day-level (daily dimension assessment), and week-level (long-term trend). A temporal convolutional network is introduced to simultaneously extract temporal features at multiple time granularities, and a multi-task learning framework is used to share the underlying representation. Analysis results at different time granularities can mutually verify and complement each other, achieving full coverage from real-time alerts to long-term trends.

[0040] Specifically, based on the business scenario, the raw perception data is aggregated into four levels: Minute-level resolution preserves high-frequency details, enabling the capture of sudden network degradation and instantaneous congestion, and supporting real-time alerts; Hourly level, smoothing out minor spikes, reflects the overall load over a period of time, supporting short-term trend analysis, such as evening peak assessment; The daily level reflects the network health status on a single day and is used for daily-level assessment and performance evaluation. Weekly data filters out daily fluctuations, reflects the long-term evolution of the network, and supports insights into long-term trends, such as holiday effects and long-term benefit assessments after network expansion.

[0041] Furthermore, to efficiently process data of varying granularities, a Temporal Convolutional Network (TCN) is introduced. TCN employs causal convolution and dilated convolution, which significantly expands the receptive field without losing historical data. By setting different dilation rates, TCN can simultaneously extract minute-level local mutation features, as well as hourly and daily global macroscopic features within the same network structure. All analysis tasks share the same underlying TCN network. The basic network features extracted by this underlying network are used by all tasks. Different branches are then established on top of this shared underlying layer to output minute-level, hourly-level, daily-level, and weekly-level analysis results, respectively.

[0042] In the specific implementation process, the original perception index data is resampled and aggregated according to different time windows to generate input sequences with multiple time granularities. Fine-grained (minute-level) data retains the original high-frequency sampled data (e.g., 1-minute level) to capture instantaneous changes. Medium-grained (hour-level) data is aggregated through sliding windows, such as taking the mean or maximum value, to generate hourly sequences and smooth short-term noise. Coarse-grained (day / week-level) data is further downsampled to extract long-term macro trends. A shared TCN encoder is constructed as the underlying feature extractor. The above multi-granularity data or fused data is input into the shared TCN. The TCN utilizes its dilated convolution characteristics to expand the receptive field without increasing the number of parameters, extracting general temporal features across different time scales. On top of the shared TCN, a dedicated top-level network is assigned to each time-granularity task. The first branch receives the underlying features and outputs minute-level anomaly probability scores for real-time alerts. The second branch receives the underlying features and predicts or evaluates hourly congestion trends. The third branch receives the underlying features and outputs day / weekly network health scores. During the training phase, a weighted loss function is used to sum the prediction errors of each branch, and the parameters of the shared underlying layer and the dedicated branches are updated simultaneously through backpropagation. During the inference phase, the output results of different branches are cross-validated. If a minute-level branch triggers a sudden degradation alarm, but the daily / weekly branch shows that the current period is within the historically normal peak business period, it can be determined as normal business fluctuation, thereby suppressing false alarms. The minute-level branch captures the specific time point of the anomaly, while the weekly branch provides the macro background of the anomaly, indicating whether the anomaly is occasional or a periodic degradation that occurs regularly every week. The combination of the two provides operations personnel with a complete diagnostic report that includes both micro-details and macro-trends.

[0043] Optionally, after comprehensive evaluation by the diagnostic decision-making level, the above results are automatically used to generate a structured diagnostic report. The report format adopts a standardized JSON / XML structure and includes the following fields: user identifier (IMSI / MSISDN), problem type (overt anomaly / chronic degradation / frequent poor quality / comprehensive anomaly), severity level (urgent / high / medium / low), time interval (first occurrence time, most recent occurrence time, duration), list of associated cells (list of cell IDs and their respective contributions), root cause location (possible root cause types and confidence levels), recommended actions (suggested optimization measures), and historical treatment records.

[0044] Optionally, the diagnostic decision-making layer interfaces with the operations and maintenance (O&M) ticketing system via a standard API. When an urgent or high-level diagnostic conclusion is generated, the system automatically creates a ticket, fills in the structured diagnostic content, and automatically assigns it to the corresponding O&M team (Wireless Optimization Group / Core Network Group / Transmission Group / Customer Service Group) based on the problem type. The ticket includes complete contextual information and processing time limits.

[0045] Furthermore, after a work order is processed, the processing result is automatically reviewed and verified. The review process includes: within a preset observation window after processing (default 24 hours), reassessing the relevant perception indicators of the target SVIP user and comparing the changes in perception scores before and after processing; if the perception score recovers to a normal level (score ≥ 80) and remains stable (no further alarms triggered within 24 hours), the verification is considered successful, and the work order is automatically closed; if the perception score does not recover or an alarm is triggered again, the verification is considered unsuccessful, the work order is reopened, and the processing priority is upgraded. Simultaneously, the review results are automatically entered into the historical case library for subsequent optimization of the accuracy of judgment rules and recommended actions.

[0046] The network anomaly detection method provided in this application establishes a user-cell association graph with users and cells as nodes and dwell time percentage as weight. This overcomes the limitations of traditional methods that rely solely on cell or base station level monitoring, refining the monitoring granularity to the single-user level. This allows for a true and accurate reflection of the network experience of individual users, avoiding the problem of single-user perceived degradation being masked by overall cell metrics. Furthermore, for long-term chronic degradation issues, the method continuously calculates the cumulative deviation of user perception scores when they fall below the baseline tolerance. It accumulates small deviations and triggers an alarm when the cumulative deviation exceeds a threshold, effectively capturing hidden anomalies that, while not meeting the alarm criteria in a single instance, accumulate over time leading to a severe decline in experience. To address the issue of frequent and sporadic quality issues in a specific region, this application statistically analyzes the frequency of short-duration quality issues within the target area that occur within a specific range. Spatiotemporal joint statistics are used to mine recurring sporadic quality issue patterns in this region. When the frequency exceeds a threshold, an alarm is generated. This solves the problem that single, short-duration quality issues are difficult to detect, but frequent occurrences severely impact user satisfaction. Furthermore, after generating an anomaly alarm, root cause localization is performed based on a user-cell association graph. Since the association graph includes the connection relationships between users and cells and their residency weights, the system can quickly and accurately identify the specific root cause cell leading to cumulative user degradation or frequent regional quality issues. This provides reference data for network optimization, improving the accuracy of anomaly detection and operational efficiency. In summary, this application, by constructing a user-cell association graph and combining cumulative deviation value calculation with statistics on the frequency of short-duration quality issues, effectively identifies latent perceived problems such as long-term chronic degradation and frequent regional quality issues. Furthermore, it accurately locates the root cause cell based on the association graph, thereby improving the comprehensiveness of network anomaly detection and operational efficiency.

[0047] In an optional embodiment, the step of continuously calculating the user's cumulative deviation value based on the user's perceived rating sequence includes: The cumulative deviation value is initialized to zero; The tolerance value is determined based on the difference between the baseline mean and the tolerance offset, where the baseline mean is the mean of the user's historical perception scores, and the tolerance offset reflects the normal fluctuation range of the perception scores. When the user's perception score is lower than the tolerance value, the difference between the perception score and the tolerance value is added to the cumulative deviation value.

[0048] Here, the baseline mean is a benchmark value representing the user's historical normal network experience level, obtained by calculating the average of the user's historical perceived scores. The tolerance offset is a parameter reflecting the normal fluctuation range of the network, used to define the boundary between normal and degraded experience. The tolerance value is a dynamic threshold that triggers cumulative calculation, derived by subtracting the tolerance offset from the baseline mean.

[0049] In this embodiment, at the start of the monitoring period, the user's cumulative deviation value is reset to 0 to ensure that each evaluation is based on a completely new state; the user's historical perception score data is extracted, and its mean is calculated as the baseline mean. At the same time, a tolerance deviation is set or calculated in combination with the network environment; the baseline mean is subtracted from the tolerance deviation to obtain the tolerance value for the current evaluation period; the current perception score is obtained in real time. If the score is lower than the tolerance value, the difference between the two is calculated, i.e., the single deviation, and the difference is added to the cumulative deviation value. If it is higher than or equal to the tolerance value, no accumulation is performed or the deviation is attenuated according to the strategy.

[0050] Here, the Cumulative Sum (CUSUM) method is used to track the cumulative deviation of perceived metrics from the baseline profile. Specifically, for each SVIP user's perceived rating sequence S(t), the cumulative deviation value is calculated: C(t) = max(0, C(t-1) + (μ - δ) - S(t)); Where μ is the baseline mean and δ is the tolerance offset. When the cumulative deviation C(t) exceeds the set threshold, a chronic degradation alarm is triggered. The core value of this method lies in the fact that even if a single deviation is small (which may be judged as normal by IQR), the cumulative effect of multiple continuous deviations can be captured, thereby discovering gradual degradation that traditional methods cannot identify.

[0051] The network anomaly detection method provided in this application extracts the average of users' historical perception scores as the baseline average, customizes a baseline for each user, and uses a tolerance offset to accommodate the inherent normal jitter of the network. Accumulation is only triggered when the perception score falls below the dynamic boundary of the baseline average minus the tolerance offset, thereby effectively filtering out interference caused by normal network fluctuations and making alarms more accurate.

[0052] In an optional embodiment, the perception score is calculated based on the following steps: Multiple key perception indicators are weighted and fused to obtain the CEI score; Based on a pre-defined AI model, feature mapping scores are extracted from multimodal data; The CEI score and the feature mapping score are weighted and fused to obtain the perception score.

[0053] Here, key perception metrics are objective, quantitative data reflecting the basic operational status of the network and the user's service experience, such as latency, speed, packet loss rate, and retransmission rate. The CEI (Customer Experience Index) score is a comprehensive basic experience score obtained by weighted fusion of multiple key perception metrics. Multimodal data refers to heterogeneous data other than structured metrics in network operation and maintenance scenarios, such as network topology, alarm text logs, wireless parameter configurations, and signaling interaction sequences.

[0054] In the specific implementation process, a real-time perception score for a single user is calculated based on the comprehensive deviation between the current real-time indicator value and the AI-enhanced baseline profile. The score uses a 100-point scale, divided into five levels: Excellent (90-100), Good (75-89), Average (60-74), Poor (40-59), and Terrible (0-39). The score calculation employs a weighted fusion mechanism. Score = β × Score_CEI + (1-β) × Score_AI; Where Score_CEI is the weighted deviation score based on the CEI algorithm, Score_AI is the high-dimensional feature mapping score extracted by the AI ​​model (BERT-Based Perceptual Regression Model) from multimodal data (indicator data + signaling logs + user behavior), and β is the fusion weight coefficient, which defaults to 0.8 and can be dynamically adjusted according to the model confidence. The weight allocation is dynamically adjusted based on the service type (voice / internet / video) and the user's historical preferences.

[0055] The network anomaly detection method provided in this application uses an AI model to process multimodal data, which can deeply mine the complex relationships and implicit features between data, and quantify them through feature mapping scoring. This scoring is then integrated with CEI, which effectively makes up for the blind spots of CEI structured indicators, making the perception score more comprehensive and realistic.

[0056] In an optional embodiment, the weights of the key perception indicators are determined based on the following steps: The weight adjustment magnitude is determined based on the product of the gradient of the weights with respect to the loss function and the learning rate. The weights are adjusted based on the weight adjustment range.

[0057] In this embodiment, based on the existing CEI algorithm framework, key perception indicators affecting user network experience are selected, including but not limited to service latency, uplink / downlink speed, retransmission rate, RTT latency, call drop rate, access success rate, TCP connection establishment success rate, and initial buffer latency (for video services). Driven by an AI large-scale model, the CEI algorithm weight system is fine-tuned, and the weight adjustment range is defined as follows: Δw1 = α × L / w1, Where α is the learning rate (default 0.01). L / w1 is the gradient of the loss function with respect to the weights, and the learning rate is dynamically calculated using the Adam adaptive optimization algorithm. α = η × m̂_t / (√v̂_t + ε) Where η is the initial step size (0.001), m̂_t and v̂_t are the first-order and second-order momentum deviation correction terms, respectively, and ε is the smoothing term to avoid division by zero (1e-8). In the early stages, supervised pre-training was performed using manually labeled perceptual experience data (excellent / good / medium / poor / inferior) to make the weight allocation more closely match the user's actual perception. Later, continuous optimization was achieved using online feedback data.

[0058] Furthermore, each indicator is categorized and managed hierarchically according to data granularity (user-level / cell-level), data source (OMC / DPI / MR / XDR), and service type (voice / internet access / video). Specifically, different network services have completely different sensitivities to indicators, and the weight level of indicators is dynamically adjusted accordingly. For example, voice services are extremely sensitive to latency, jitter, and dropped call rate, so dropped call rate and RTT latency are given the highest priority, while the weight of uplink and downlink rates is significantly reduced. Video services are sensitive to initial buffer latency, stuttering rate, and downlink rate, so initial buffer latency is given the highest priority. Web browsing / gaming is sensitive to TCP connection success rate and first byte latency. Data collected by different network elements has different accuracy and reflects different dimensions of problems, so it is processed hierarchically. For example, MR (Measurement Report) data reflects the wireless physical environment of the terminal's location and belongs to the micro / environmental side indicator, used to locate wireless coverage problems. DPI (Deep Packet Inspection) directly captures real interaction data at the application layer, such as video stuttering and webpage inaccessibility, and belongs to the real experience side indicator, which is given the highest trust weight in the CEI algorithm. To support the aforementioned multi-time granularity and three-dimensional correlation analysis, the metrics need to be graded in both spatial and temporal dimensions. The user-level metrics focus on the end-to-end experience of a single SVIP user, used to trigger personalized alarms and attribution from the user to the cell. The cell-level metrics focus on the performance of a single base station, used to assess network capacity, hardware failures, or to conduct batch troubleshooting of users from the cell.

[0059] Furthermore, time series analysis is used to establish a dynamic perception baseline profile for each SVIP user. Building upon traditional sliding window statistics (with a default window size of 7 days), an AI prediction model is introduced to assist in baseline construction. The LightGBM time series prediction model is used to predict the expected perception level E[P(t)|X] at the current moment based on historical user data and the perception characteristics of similar user groups in the same community. The residual r(t) = P(t) - E[P(t)|X] between the model prediction and the actual observed value P(t) is used as a correction factor for baseline deviation. When r(t) is consistently negative, it indicates that the user's perception is systematically lower than the model's expectations, and even if the absolute value has not yet triggered the alarm threshold, it should be marked as a potential anomaly candidate. Simultaneously, the AI ​​model automatically learns contextual features such as holiday effects and user behavior periodicity (weekdays / weekends, daytime / nighttime), effectively avoiding misjudging normal fluctuations as anomalies. The calculation of the baseline profile clearly defines the entity (which user), granularity (single user / 15 minutes), numerator and denominator (e.g., rate = total traffic / total duration), time window (current window / historical window), and exclusion conditions (abnormal time period / maintenance window) for each indicator. Specifically, after the data comes in, it is first divided by entity, dirty data is filtered out by exclusion conditions, the true value is calculated by the rules of numerator and denominator, aligned to the 15-minute timestamp by granularity, and finally pushed into the time window for use by the AI ​​model.

[0060] The network anomaly detection method provided in this application constructs a closed-loop machine learning optimization mechanism through loss function, gradient and learning rate. The system can continuously learn from massive amounts of real user feedback and automatically calculate the weight combination that best reflects the mapping relationship between the current network state and user experience, so that the CEI score can accurately match the user's real subjective feeling.

[0061] In an optional embodiment, the network anomaly detection method further includes: For any of the key perception indicators, the interquartile range threshold and the AI ​​threshold are weighted and fused to obtain the anomaly detection threshold corresponding to the key perception indicator. The interquartile range threshold is a threshold calculated based on the interquartile range method, and the AI ​​threshold is a dynamic threshold calculated based on a neural network model. If the user's key perception indicators exceed the anomaly detection threshold corresponding to the key perception indicators, an anomaly alarm will be generated.

[0062] In this embodiment, the IQR (Interquartile Range) method is used. Based on Q1 (lower quartile) and Q3 (upper quartile) in the baseline profile, IQR = Q3 - Q1 is calculated. The lower bound for anomalies is set as Q1 - k×IQR, and the upper bound for anomalies is set as Q3 + k×IQR, where k is a sensitivity coefficient, defaulting to 1.5. Simultaneously, an AI model is used to calculate dynamic upper and lower bounds. The upper and lower bounds of the IQR and AI models are weighted and fused to obtain the final threshold upper and lower bounds: Threshold(t) = λ × Threshold_IQR ​​+ (1-λ) × Threshold_AI(t), where λ is the fusion ratio coefficient, defaulting to 0.5, which can be dynamically adjusted based on the recent accuracy of the two modules. Threshold_IQR ​​is the interquartile range threshold, and Threshold_AI(t) is the AI ​​threshold. This method eliminates the need for manual threshold setting and can automatically adapt to the fluctuation characteristics of perception indicators under different users, time periods, and network scenarios.

[0063] Furthermore, the aforementioned two implicit patterns are integrated with IQR explicit anomalies for analysis, forming a three-category anomaly classification system: explicit anomalies, chronic degradation, and frequent quality issues. Different alarm priorities are set for different types: severe anomalies > frequent quality issues > moderate anomalies > chronic degradation > mild anomalies, achieving intelligent alarm classification and noise reduction.

[0064] The network anomaly detection method provided in this application embodiment uses interquartile range (ICM) to provide statistical boundaries, ensuring basic accuracy, and AI threshold to have dynamic adaptability to complex nonlinear environments. By integrating the ICM method and AI model, the advantages of both are complementary, making the anomaly detection threshold both robust and sensitive.

[0065] In an optional embodiment, the AI ​​threshold includes an upper bound and a lower bound, and the AI ​​threshold is calculated based on the following steps: The context feature vector is input into the neural network model to obtain the dynamic multiplier factor output by the neural network model; The standard deviation of the key perception index is scaled based on the dynamic multiplier factor to obtain the multiplier standard deviation. The sum of the baseline mean and the multiple standard deviation is used as the upper bound of the AI ​​threshold, and the difference between the baseline mean and the multiple standard deviation is used as the lower bound of the AI ​​threshold.

[0066] Here, the context feature vector is a set of data representing the multidimensional state of the current network environment, such as time, location, business type, historical load, etc., which serves as the input features of the neural network model.

[0067] In this embodiment, the current network context features are collected in real time, constructed into a context feature vector, and input into a preset neural network model. The neural network model performs deep analysis on the input context features and outputs a dynamic multiple factor that matches the current environment. The historical standard deviation of the key perception indicator is obtained and multiplied by the dynamic multiple factor obtained in the previous step to calculate the multiple standard deviation. Taking the historical baseline mean of the indicator as the center, the baseline mean is added to the multiple standard deviation to obtain the upper bound of the AI ​​threshold, and the baseline mean is subtracted from the multiple standard deviation to obtain the lower bound of the AI ​​threshold, thereby forming a dynamic confidence interval.

[0068] In a specific embodiment, Threshold_AI(t) = μ(t) ± σ(t) × f(X_t; θ), where μ(t) is the baseline mean at time t, σ(t) is the standard deviation, and f(X_t; θ) is the dynamic multiplier factor output by the LSTM neural network model (with the context feature vector X_t at time t as input).

[0069] Furthermore, based on the IQR method and AI dynamic thresholds, multi-level anomaly judgment rules can be configured. Mild anomalies are defined as k=1.5 or f(X_t; θ)=1.0~1.5, exceeding the threshold by 1.5 times; moderate anomalies are defined as k=3.0 or f(X_t; θ)=1.5~2.5, exceeding the threshold by 3 times; severe anomalies are defined as k=4.5 or f(X_t; θ)≥2.5, exceeding the threshold by 4.5 times. These correspond to different alarm priorities and handling strategies. An XGBoost / Random Forest AI classifier is introduced to perform secondary verification of the identified anomalies. Input features include the deviation magnitude of the anomaly indicator, duration, historical similar patterns, and current network context (cell load / interference / congestion). The output is the probability distribution of whether the anomaly is a true anomaly, a false anomaly, or an atypical pattern, significantly reducing the false alarm rate.

[0070] Optionally, the anomaly detection rules support online updates and rapid iterations without requiring system downtime for upgrades. Rule iteration supports two modes: automatic iteration, where the system automatically adjusts core parameters such as the IQR sensitivity coefficient k, AI model parameters θ, and fusion coefficient λ based on historical data from the last N days and false positive / false negative feedback data, using an online learning algorithm. The parameter update formula is θ_{t+1} = θ_t - η_t × ∇L(θ_t), where θ_t is the parameter before the update, θ_{t+1} is the parameter after the update, L(θ_t) is the joint loss function including the false positive rate and the false negative rate, and η_t is the dynamic learning rate; and manual iteration, where operations and maintenance experts can adjust the sensitivity coefficient, add / disable specific detection rules, and upload new labeled data to trigger incremental model training through a visual interface. Rule updates take effect immediately, significantly shortening the traditional upgrade cycle.

[0071] Optionally, by combining time series decomposition methods, the perceived index is decomposed into a trend component T(t), reflecting long-term, slow changes, such as the gradual increase in overall network load as business develops; a seasonal component S(t), reflecting regular fluctuations in a fixed period, such as traffic surges during morning and evening peak hours, or differences in usage between weekends and weekdays; and a residual component R(t), which is the unexplained random fluctuation remaining after removing the trend and seasonality. Theoretically, if the network is perfectly normal, the residual should only be a small amount of white noise. An AI anomaly detection model is introduced for deep analysis on the residual component, employing an anomaly scoring model based on a temporal convolutional network (TCN): AnomalyScore(t) = g(R(t); ), where g is the TCN model, The model parameters are defined as follows, and the output is the anomaly probability at time t. Simultaneously, an attention-based Transformer model is employed to capture temporal dependencies over long periods, identifying periodic anomaly patterns, such as subtle degradation recurring at fixed times each week. The AI ​​model automatically incorporates normal trend changes (such as increased latency due to business volume growth) and seasonal fluctuations (such as peak traffic during holidays) into feature learning, triggering alarms only on genuine anomaly patterns. Compared to purely statistical methods, this further reduces the false alarm rate by more than 20%.

[0072] The network anomaly detection method provided in this application can perceive the current environmental context such as time and service load through context feature vectors and neural network models, and output a dynamic multiplier factor in real time. When the environment fluctuates greatly, the factor automatically increases and the threshold range widens accordingly. When the environment is stable, the factor decreases and the threshold range tightens, thereby ensuring that the threshold always matches the current network state.

[0073] The network anomaly detection device provided in the embodiments of this application is described below. The network anomaly detection device described below can be referred to in correspondence with the network anomaly detection method described above.

[0074] Figure 2 This is a schematic diagram of the network anomaly detection device provided in this application, as shown below. Figure 2 As shown, the network anomaly detection device may include, but is not limited to: Graph construction module 210 is used to: establish a user-cell association graph with users and cells as nodes, the connection relationship between users and cells as edges, and the proportion of time users spend in cells as the weight of the edges; The chronic degradation detection module 220 is used to: continuously calculate the cumulative deviation value of the user based on the user's perception score sequence, wherein the cumulative deviation value is the cumulative sum of the deviations when the perception score is continuously lower than the baseline tolerance; The frequent poor quality detection module 230 is used to: count the frequency of short-term poor quality events in the target area, wherein the short-term poor quality event is an event whose duration is less than a preset time threshold and whose perception score is within a preset score range; The root cause localization module 240 is used to: generate an abnormal alarm if the cumulative deviation value exceeds the deviation threshold or the frequency exceeds the frequency threshold, and locate the root cause cell that caused the abnormal alarm based on the user-cell association graph.

[0075] It should be noted that the network anomaly detection device provided in this application embodiment can execute the network anomaly detection method described in any of the above embodiments during actual operation, and this embodiment will not elaborate on this.

[0076] Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3 As shown, the electronic device may include: a processor 310, a communications interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communications interface 320, and the memory 330 communicate with each other via the communication bus 340. The processor 310 can call logical instructions in the memory 330 to execute a network anomaly detection method, which includes: A user-community relationship graph is constructed, with users and communities as nodes, the connection between users and communities as edges, and the percentage of time a user spends in a community as the weight of the edge. Based on the user's perceived rating sequence, the user's cumulative deviation value is continuously calculated. The cumulative deviation value is the sum of the cumulative deviations when the perceived rating is continuously below the baseline tolerance. The frequency of short-term poor quality events within the target area is counted. A short-term poor quality event is an event whose duration is less than a preset time threshold and whose perception score is within a preset score range. If the cumulative deviation value exceeds the deviation threshold, or the frequency exceeds the frequency threshold, an abnormal alarm is generated, and the root cause cell causing the abnormal alarm is located based on the user-cell association graph.

[0077] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0078] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to perform the network anomaly detection method provided by the above methods, the method including: A user-community relationship graph is constructed, with users and communities as nodes, the connection between users and communities as edges, and the percentage of time a user spends in a community as the weight of the edge. Based on the user's perceived rating sequence, the user's cumulative deviation value is continuously calculated. The cumulative deviation value is the sum of the cumulative deviations when the perceived rating is continuously below the baseline tolerance. The frequency of short-term poor quality events within the target area is counted. A short-term poor quality event is an event whose duration is less than a preset time threshold and whose perception score is within a preset score range. If the cumulative deviation value exceeds the deviation threshold, or the frequency exceeds the frequency threshold, an abnormal alarm is generated, and the root cause cell causing the abnormal alarm is located based on the user-cell association graph.

[0079] Furthermore, this application also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the network anomaly detection methods provided by the above-described methods, the method comprising: A user-community relationship graph is constructed, with users and communities as nodes, the connection between users and communities as edges, and the percentage of time a user spends in a community as the weight of the edge. Based on the user's perceived rating sequence, the user's cumulative deviation value is continuously calculated. The cumulative deviation value is the sum of the cumulative deviations when the perceived rating is continuously below the baseline tolerance. The frequency of short-term poor quality events within the target area is counted. A short-term poor quality event is an event whose duration is less than a preset time threshold and whose perception score is within a preset score range. If the cumulative deviation value exceeds the deviation threshold, or the frequency exceeds the frequency threshold, an abnormal alarm is generated, and the root cause cell causing the abnormal alarm is located based on the user-cell association graph.

[0080] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0081] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0082] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for detecting network anomalies, characterized in that, include: A user-community relationship graph is constructed, with users and communities as nodes, the connection between users and communities as edges, and the percentage of time a user spends in a community as the weight of the edge. Based on the user's perceived rating sequence, the user's cumulative deviation value is continuously calculated. The cumulative deviation value is the sum of the cumulative deviations when the perceived rating is continuously below the baseline tolerance. The frequency of short-term poor quality events within the target area is counted. A short-term poor quality event is an event whose duration is less than a preset time threshold and whose perception score is within a preset score range. If the cumulative deviation value exceeds the deviation threshold, or the frequency exceeds the frequency threshold, an abnormal alarm is generated, and the root cause cell causing the abnormal alarm is located based on the user-cell association graph.

2. The network anomaly detection method according to claim 1, characterized in that, The step of continuously calculating the user's cumulative deviation value based on the user's perceived rating sequence includes: The cumulative deviation value is initialized to zero; The tolerance value is determined based on the difference between the baseline mean and the tolerance offset, where the baseline mean is the mean of the user's historical perception scores, and the tolerance offset reflects the normal fluctuation range of the perception scores. When the user's perception score is lower than the tolerance value, the difference between the perception score and the tolerance value is added to the cumulative deviation value.

3. The network anomaly detection method according to claim 1, characterized in that, The perception score is calculated based on the following steps: Multiple key perception indicators are weighted and fused to obtain the CEI score; Based on a pre-defined AI model, feature mapping scores are extracted from multimodal data; The CEI score and the feature mapping score are weighted and fused to obtain the perception score.

4. The network anomaly detection method according to claim 3, characterized in that, The weights of the key perception indicators are determined based on the following steps: The weight adjustment magnitude is determined based on the product of the gradient of the weights with respect to the loss function and the learning rate. The weights are adjusted based on the weight adjustment range.

5. The network anomaly detection method according to claim 3, characterized in that, The network anomaly detection method further includes: For any of the key perception indicators, the interquartile range threshold and the AI ​​threshold are weighted and fused to obtain the anomaly detection threshold corresponding to the key perception indicator. The interquartile range threshold is a threshold calculated based on the interquartile range method, and the AI ​​threshold is a dynamic threshold calculated based on a neural network model. If the user's key perception indicators exceed the anomaly detection threshold corresponding to the key perception indicators, an anomaly alarm will be generated.

6. The network anomaly detection method according to claim 5, characterized in that, The AI ​​threshold includes an upper bound and a lower bound, and the AI ​​threshold is calculated based on the following steps: The context feature vector is input into the neural network model to obtain the dynamic multiplier factor output by the neural network model; The standard deviation of the key perception index is scaled based on the dynamic multiplier factor to obtain the multiplier standard deviation. The sum of the baseline mean and the multiple standard deviation is used as the upper bound of the AI ​​threshold, and the difference between the baseline mean and the multiple standard deviation is used as the lower bound of the AI ​​threshold.

7. A network anomaly detection device, characterized in that, include: The graph construction module is used to: establish a user-cell association graph with users and cells as nodes, the connection between users and cells as edges, and the percentage of time a user spends in a cell as the weight of the edge. The chronic degradation detection module is used to: continuously calculate the user's cumulative deviation value based on the user's perception score sequence, wherein the cumulative deviation value is the cumulative sum of the deviations when the perception score is continuously below the baseline tolerance; The frequent poor quality detection module is used to: count the frequency of short-term poor quality events in the target area, wherein the short-term poor quality event is an event whose duration is less than a preset time threshold and whose perception score is within a preset score range; The root cause localization module is used to: generate an abnormal alarm if the cumulative deviation value exceeds the deviation threshold or the frequency exceeds the frequency threshold, and locate the root cause cell that caused the abnormal alarm based on the user-cell association graph.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the network anomaly detection method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the network anomaly detection method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the network anomaly detection method as described in any one of claims 1 to 6.

Images