CN113379176B - Method, device, equipment and readable storage medium for detecting abnormal data of telecommunication network - Google Patents
Method, device, equipment and readable storage medium for detecting abnormal data of telecommunication network Download PDFInfo
- Publication number
- CN113379176B CN113379176B CN202010158291.2A CN202010158291A CN113379176B CN 113379176 B CN113379176 B CN 113379176B CN 202010158291 A CN202010158291 A CN 202010158291A CN 113379176 B CN113379176 B CN 113379176B
- Authority
- CN
- China
- Prior art keywords
- network
- data
- detected
- cells
- telecommunication network
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 145
- 238000000034 method Methods 0.000 title claims abstract description 63
- 238000001514 detection method Methods 0.000 claims abstract description 122
- 238000012549 training Methods 0.000 claims abstract description 71
- 238000004422 calculation algorithm Methods 0.000 claims description 52
- 230000007246 mechanism Effects 0.000 claims description 8
- 238000000513 principal component analysis Methods 0.000 claims description 7
- 238000005070 sampling Methods 0.000 claims description 7
- 238000003064 k means clustering Methods 0.000 claims description 6
- 238000004590 computer program Methods 0.000 claims description 5
- 230000005856 abnormality Effects 0.000 description 9
- 238000004891 communication Methods 0.000 description 8
- 230000006870 function Effects 0.000 description 5
- 238000010586 diagram Methods 0.000 description 4
- 230000008569 process Effects 0.000 description 4
- 230000006399 behavior Effects 0.000 description 3
- 238000004364 calculation method Methods 0.000 description 3
- AYFVYJQAPQTCCC-GBXIJSLDSA-N L-threonine Chemical compound C[C@@H](O)[C@H](N)C(O)=O AYFVYJQAPQTCCC-GBXIJSLDSA-N 0.000 description 2
- 230000008901 benefit Effects 0.000 description 2
- 238000010801 machine learning Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 238000007619 statistical method Methods 0.000 description 2
- 238000006243 chemical reaction Methods 0.000 description 1
- 238000012937 correction Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 238000013507 mapping Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000000926 separation method Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 230000009466 transformation Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0639—Performance analysis of employees; Performance analysis of enterprise or organisation operations
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
- G06F18/232—Non-hierarchical techniques
- G06F18/2321—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
- G06F18/23213—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions with fixed number of clusters, e.g. K-means clustering
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/243—Classification techniques relating to the number of classes
- G06F18/2433—Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
- G06Q50/40—Business processes related to the transportation industry
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Human Resources & Organizations (AREA)
- General Engineering & Computer Science (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Bioinformatics & Computational Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Strategic Management (AREA)
- Economics (AREA)
- General Business, Economics & Management (AREA)
- Marketing (AREA)
- Educational Administration (AREA)
- Entrepreneurship & Innovation (AREA)
- Tourism & Hospitality (AREA)
- Software Systems (AREA)
- Development Economics (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Probability & Statistics with Applications (AREA)
- Medical Informatics (AREA)
- Quality & Reliability (AREA)
- Operations Research (AREA)
- Game Theory and Decision Science (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Primary Health Care (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The embodiment of the invention provides a method, a device, equipment and a readable storage medium for detecting abnormal data of a telecommunication network, wherein the method comprises the following steps: acquiring network characteristic data corresponding to a cell to be detected in a telecommunication network; inputting network characteristic data corresponding to cells to be detected with the same network scene into a telecommunication network abnormal data detection model to obtain an abnormal detection result of the telecommunication network; the telecommunication network abnormal data detection model consists of a plurality of base learners; the base learner is obtained by training by taking network characteristic data corresponding to cells with the same network scene as training samples. According to the method, the device, the equipment and the readable storage medium for detecting the abnormal data of the telecommunication network, the abnormal data in the telecommunication network is detected by using the abnormal data detection model of the telecommunication network based on the ensemble learning, and the generalization capability of the detection model can be integrally improved according to the ensemble learning, so that the accuracy of detecting the abnormal data of the telecommunication network is improved.
Description
Technical Field
The present invention relates to the field of communications, and in particular, to a method, an apparatus, a device, and a readable storage medium for detecting abnormal data in a telecommunications network.
Background
In the daily management of a telecommunication network, it is important to detect abnormal data in the telecommunication network in a timely manner. However, as telecommunications networks evolve, the dimensionality of data in telecommunications networks is increasing. For example, the performance index type and calculation rule of the wireless network, the parameter information configuration data type of the base station, the coverage parameters of different base stations and the user distribution condition, and various complex data such as alarms, worksheets, plate information and the like related to network operation and maintenance greatly improve the complexity of the data of the telecommunication network, and meanwhile, the difficulty of detecting abnormal data from the complex data of the telecommunication network is also increased.
The prior art has adopted some machine learning methods for anomaly data detection of telecommunications networks. However, under the condition that the data complexity of the current telecommunication network is higher, any single machine learning algorithm is insufficient in generalization capability due to the limitation of the algorithm, and it is difficult to ensure that more accurate abnormal data detection results can be obtained for different telecommunication network detection scenes.
Disclosure of Invention
In view of at least one technical problem existing in the prior art, embodiments of the present invention provide a method, an apparatus, a device, and a readable storage medium for detecting abnormal data in a telecommunications network.
In a first aspect, an embodiment of the present invention provides a method for detecting abnormal data in a telecommunications network, including:
acquiring network characteristic data corresponding to a cell to be detected in a telecommunication network;
inputting network characteristic data corresponding to cells to be detected with the same network scene into a telecommunication network abnormal data detection model to obtain an abnormal detection result of the telecommunication network;
wherein the telecommunication network abnormal data detection model consists of a plurality of base learners;
the base learner is obtained by training by taking network characteristic data corresponding to cells with the same network scene as training samples.
Optionally, the method further comprises:
acquiring network characteristic data corresponding to cells with the same network scene;
sampling the network characteristic data corresponding to the cells with the same network scene in a put-back way by adopting a Bootstrapping method to obtain a base training set;
training a parallel detection algorithm by taking the basic training set as a training sample to obtain the basic learner;
integrating a plurality of the base learners to obtain the abnormal data detection model of the telecommunication network.
Optionally, the parallel detection algorithm is a K-means clustering algorithm, a gaussian kernel density estimation algorithm, a local anomaly factor algorithm, an isolated forest algorithm or a principal component analysis algorithm.
Optionally, inputting network feature data corresponding to cells to be detected with the same network scene into a telecommunication network abnormal data detection model to obtain an abnormal detection result of the telecommunication network, which includes:
inputting network characteristic data corresponding to cells to be detected with the same network scene into a plurality of base learners in a telecommunication network abnormal data detection model, and obtaining a preliminary detection result output by each base learner;
and determining the abnormal detection result by adopting a voting mechanism based on the preliminary detection result.
Optionally, the method further comprises:
and determining a network scene corresponding to the cell to be detected based on the network characteristic data corresponding to all the cells to be detected in the telecommunication network.
Optionally, determining a network scenario corresponding to the cell to be detected based on network feature data corresponding to all cells to be detected in the telecommunication network includes:
inquiring historical data of a telecommunication network, and acquiring network characteristic data of all cells to be detected in a plurality of time periods;
clustering network characteristic data of all cells to be detected in each time period of a plurality of time periods to obtain an initial network scene corresponding to the cells to be detected;
and determining the network scene corresponding to the cell to be detected based on the initial network scene obtained by each time period of the multiple time periods.
Optionally, the network characteristic data includes one or a combination of the following data: overlay class data, call setup class data, call hold class data, mobility management class data, latency class data, and system resource class data.
In a second aspect, an embodiment of the present invention provides a telecommunications network anomaly data detection apparatus, including:
the data acquisition module is used for acquiring network characteristic data corresponding to a cell to be detected in the telecommunication network;
the anomaly detection module is used for inputting network characteristic data corresponding to cells to be detected with the same network scene into a telecommunication network anomaly data detection model to obtain an anomaly detection result of the telecommunication network;
wherein the telecommunication network abnormal data detection model consists of a plurality of base learners;
the base learner is obtained by training by taking network characteristic data corresponding to cells with the same network scene as training samples.
In a third aspect, an embodiment of the invention provides an electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the steps of the method as provided in the first aspect when the program is executed.
In a fourth aspect, embodiments of the present invention provide a non-transitory computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the method as provided by the first aspect.
According to the method, the device, the equipment and the readable storage medium for detecting the abnormal data of the telecommunication network, the abnormal data in the telecommunication network is detected by using the abnormal data detection model of the telecommunication network based on the ensemble learning, and the generalization capability of the detection model can be integrally improved according to the ensemble learning, so that the accuracy of detecting the abnormal data of the telecommunication network is improved.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions of the prior art, the following description will briefly explain the drawings used in the embodiments or the description of the prior art, and it is obvious that the drawings in the following description are some embodiments of the present invention, and other drawings can be obtained according to these drawings without inventive effort for a person skilled in the art.
Fig. 1 is a flow chart of a method for detecting abnormal data in a telecommunication network according to an embodiment of the present invention;
FIG. 2 is a schematic flow chart of a method for detecting abnormal data in a telecommunication network according to an embodiment of the present invention;
FIG. 3 is a schematic flow chart of another embodiment of a method for detecting abnormal data in a telecommunication network;
fig. 4 is a schematic structural diagram of a device for detecting abnormal data in a telecommunication network according to an embodiment of the present invention;
fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the embodiments of the present invention more apparent, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is apparent that the described embodiments are some embodiments of the present invention, but not all embodiments of the present invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
Fig. 1 is a flow chart of a method for detecting abnormal data in a telecommunication network according to an embodiment of the present invention, as shown in fig. 1, the method includes:
s110, obtaining network characteristic data corresponding to a cell to be detected in a telecommunication network;
specifically, the detection of the abnormal data in the telecommunication network according to the embodiment of the present invention may be performed with a cell as a detection granularity, that is, it is detected which cell the abnormal data appears in. Therefore, the telecommunication network referred to in the embodiment of the present invention may be divided according to the granularity of the cells, and the telecommunication network to be detected is also composed of a plurality of cells to be detected.
Specifically, in the embodiment of the invention, abnormal data of a telecommunication network is detected, the data basis is network characteristic data corresponding to a cell to be detected in the telecommunication network, and whether the cell to be detected is a cell with abnormal data is judged through the network characteristic data corresponding to the cell to be detected. Network characteristic data is a collection of various parameters describing the operation of a telecommunications network. Therefore, in the method for detecting abnormal data of a telecommunication network in the embodiment of the invention, network characteristic data corresponding to a cell to be detected in the telecommunication network is required to be acquired first.
Further, the network characteristic data in the embodiment of the present invention may include one or a combination of the following data: overlay class data, call setup class data, call hold class data, mobility management class data, latency class data, and system resource class data.
Wherein the coverage class data comprises coverage of the telecommunications network reflecting availability of the network. The specific parameters may be RSRP (reference signal received power), RSRQ (reference signal received quality), coverage, etc.;
the call establishment type data reflects the user admittance capability of the eNB or the cell, and the system load condition is inspected, and specific parameters can be RRC connection establishment success rate, E-RAB connection establishment success rate, wireless connection rate and the like;
the call hold data reflects the communication hold capability of the system, is one of important performance indexes directly felt by a user, and specific parameters can be RRC connection abnormal call drop rate, E-RAB congestion rate and the like;
the mobility management data reflects the successful switching conditions of users and cells between base stations and between systems, is one of important indexes for users to directly feel, and specific parameters can be switching success rate of eNB, switching success rate of X2 port, switching success rate of S1 port, switching success rate between systems and the like;
the time delay type data reflects the access time delay feeling of the user network and measures the service quality of the user feeling network, and specific parameters can be the conversion time delay of the UE from the Idle state to the Active state, attach time delay, user plane time delay, X2 switching service interruption time in the system and the like;
the system resource class data reflects network load conditions, system processing capacity and system wireless resource utilization conditions, and specific parameters can be flow indexes, wireless resource utilization rate, system resource utilization rate and the like.
The method for detecting the abnormal data of the telecommunication network provided by the embodiment of the invention has the capability of processing high-dimensional data and characteristic learning, so that the abnormal data is detected more comprehensively. Therefore, in determining the specific content included in the network feature data, as many data dimensions as possible may be selected for the network feature data, and is not limited to the types of feature data listed in the embodiments of the present invention.
S120, inputting network characteristic data corresponding to cells to be detected with the same network scene into a telecommunication network abnormal data detection model to obtain an abnormal detection result of the telecommunication network;
specifically, after network feature data corresponding to a cell to be detected in a telecommunication network is acquired, the network feature data needs to be input into a telecommunication network abnormal data detection model as input data. The output data of the abnormal data detection model of the telecommunication network is the abnormal detection result of the telecommunication network. The form of the anomaly detection result of the telecommunication network in the embodiment of the present invention may be which cell to be detected in the input data is the cell containing the anomaly data, and it may be understood that the anomaly data in the input data is marked.
Specifically, after the network feature data corresponding to the cells to be detected in the telecommunication network are acquired, not all the network feature data corresponding to the cells to be detected are input into the telecommunication network abnormal data detection model, but the network feature data corresponding to the cells to be detected with the same network scene are input into the telecommunication network abnormal data detection model. The network scene is an attribute of each cell to be detected, specifically, the network scene of the cell is determined according to the service behaviors of the cell network, for example, the specific attribute of the network scene of the cell can be set to be high-traffic, more videos are seen, more foreign sites are visited, and the like. The network scene attribute specifically comprises specific network scenes, and can be set according to actual requirements, and the embodiment of the invention is not particularly limited.
For example, after obtaining network feature data corresponding to cells to be detected in a telecommunication network, the embodiment of the invention may input the network feature data corresponding to the cells to be detected with high network scene into a telecommunication network abnormal data detection model to obtain an abnormal detection result of the telecommunication network, that is, which cells in the cells to be detected with high network scene contain abnormal data. The characteristics of the network feature data corresponding to the cells to be detected with the same network scene should be similar under normal conditions, so that the abnormal data detection is performed in the cells to be detected with the same network scene, and the abnormal data can be found more efficiently.
Further, the telecommunications network anomaly data detection model is comprised of a plurality of base learners.
Specifically, the abnormal data detection model of the telecommunication network in the embodiment of the invention adopts the idea of integrated learning, and is different from the model formed by a single algorithm in the prior art, a plurality of base learners are integrated in the model, and each base learner can independently detect the abnormal data of the telecommunication network. It can be understood that the integrated learning method adopted by the embodiment of the invention is to combine different characteristics of a plurality of learners to obtain an abnormal data detection model with stronger generalization capability.
Further, the inputting the network feature data corresponding to the cells to be detected with the same network scene into a telecommunication network abnormal data detection model to obtain an abnormal detection result of the telecommunication network, which comprises the following steps: inputting network characteristic data corresponding to cells to be detected with the same network scene into a plurality of base learners in a telecommunication network abnormal data detection model, and obtaining a preliminary detection result output by each base learner; and determining the abnormal detection result by adopting a voting mechanism based on the preliminary detection result.
Specifically, since the plurality of base learners in the telecommunications network abnormal data detection model are each capable of independently obtaining the results of the respective abnormal data detection, it is subsequently necessary to determine the abnormal detection result of the entire telecommunications network abnormal data detection model from the preliminary detection results of the respective plurality of base learners. The voting mechanism is specifically adopted in the step.
The voting mechanism may be understood as that, for the network feature data input into the plurality of base learners, if the number of learners that determine that a cell has an abnormality is greater than the number of learners that determine that the cell is normal, the abnormality detection result is that the cell has abnormality data. The voting mechanism described in the embodiments of the present invention may be a weighted voting mechanism that assigns different weights to different learners, or other voting mechanisms that may be used in ensemble learning as will be understood by those skilled in the art, and the embodiments of the present invention are not limited in detail.
Further, the base learner is obtained by training by taking network characteristic data corresponding to cells with the same network scene as a training sample.
Specifically, each base learner in the abnormal data detection model of the telecommunication network in the embodiment of the invention is obtained by training a corresponding algorithm in the learner in an unsupervised training mode, and a training sample is network characteristic data corresponding to cells with the same network scene. Because the input data of the model is required to belong to the cells to be detected with the same network scene in the use process of the telecommunication network abnormal data detection model, it can be understood that the input data is required to belong to the cells with the same network scene in the training process of the base learner, and the effect of the model obtained by training in the aspect of detecting the abnormal data can be better.
According to the method for detecting the abnormal data of the telecommunication network, the abnormal data in the telecommunication network is detected by using the abnormal data detection model of the telecommunication network based on the integrated learning, and the generalization capability of the detection model can be integrally improved according to the integrated learning, so that the accuracy of detecting the abnormal data of the telecommunication network is improved.
Based on any of the foregoing embodiments, fig. 2 is a flow chart of a method for detecting abnormal data of a telecommunications network according to an embodiment of the present invention, and before step S110, the method further includes:
s210, acquiring network characteristic data corresponding to cells with the same network scene;
specifically, in the embodiment of the present invention, training data needs to be acquired before training a base learner in an abnormal data detection model of a telecommunication network. According to the foregoing embodiment, the cells belonging to the same network scenario are also required to be included in the input data during the training process of the base learner, so that the network feature data corresponding to the cells having the same network scenario are acquired from the network feature data corresponding to the cells according to the network scenario attribute of the cells. For example, network feature data corresponding to a cell with a high traffic network scenario is acquired.
S220, sampling the network characteristic data corresponding to the cells with the same network scene in a put-back way by adopting a Bootstrapping method to obtain a base training set;
specifically, the telecommunications network abnormal data detection model employed in the embodiment of the present invention includes a plurality of base learners, and thus, a training data set needs to be prepared for each of the base learners.
In this step, the Bootstrapping method is used to sample the network feature data acquired in step S220 with a put back sampling. The Bootstrapping method may refer to sampling the network feature data of a fixed number of cells from the network feature data acquired in step S210, but placing a sample back after sampling the network feature data of one cell. That is, the previously sampled data may continue to be collected after being put back. For this step, the number of cells included in the training data set prepared for each base learner is identical to the data acquired in step S210, that is, the base training set of the base learner is configured.
It will be appreciated that the number of cells contained in the base training set of each base learner is the same, but the data content contained in each base training set is different, depending on the randomness of the samples in the Bootstrapping method.
S230, training a parallel detection algorithm by taking a base training set as a training sample to obtain the base learner;
specifically, the telecommunications network abnormal data detection model adopted in the embodiment of the invention comprises a plurality of base learners, wherein each base learner is obtained by training a specific abnormal data detection algorithm, namely a parallel detection algorithm in the step. After the base training set is obtained in step S220, the base training set may be used as a training sample to train the parallel detection algorithm. It will be appreciated that a large amount of network characteristic data is contained in different network scenarios at different times in the telecommunication network, from which different base training sets can be obtained as training samples. And training the corresponding parallel detection algorithm in each base learner for multiple times through different training samples, and finally obtaining the trained base learner.
Further, the parallel detection algorithm in the embodiment of the present invention may be a K-means clustering algorithm, a gaussian kernel density estimation algorithm, a local anomaly factor algorithm, an isolated forest algorithm or a principal component analysis algorithm, and the process of anomaly data detection of these algorithms is described below. It should be noted that the parallel detection algorithm described in the embodiments of the present invention may be other anomaly detection algorithms as understood by those skilled in the art, which is not specifically limited herein.
One way to detect abnormal data in a telecommunications network is to group the data into similar clusters and then find in each cluster data items that differ in some way from other data items in the cluster. The K-means clustering algorithm is one of the longest and most widely used algorithms. The detection steps of abnormal data of the telecommunication network based on the K-means clustering algorithm are as follows:
step 1) training stage, training data set Y of sub-scene k And (5) inputting a K-means algorithm for clustering, and outputting a clustering result and a final clustering center cluster.
And 2) in the prediction stage, calculating the distance from each point to the center of each cluster, and obtaining the average distance L from all points to the center in the cluster.
Step 3) setting a threshold parameter thre, respectively calculating the distance S from each point in the cluster to the center of the cluster, and if S/L is more than thre, judging the point as an abnormal point, namely representing abnormal data.
Another method for detecting abnormal data of a telecommunication network is based on a statistical method, most of statistical methods for detecting the abnormal data are to construct a probability distribution model, and judge the abnormal degree of the model by fitting the model with a sample. Gaussian kernel density estimation is to fit data in a sample set using a smooth peak function to simulate a true probability distribution curve. The method for detecting the abnormal data of the telecommunication network by using the Gaussian kernel density estimation algorithm comprises the following steps:
step 1) training data set Y of the sub-scene through Gaussian kernel function k The data of each sample is taken as parameters of the kernel functions to obtain N kernel functions.
Step 2) obtaining a sub-scene training data set Y by linear superposition k Is a function of the kernel density estimation of (a).
Step 3) modeling by using a kernel density estimation algorithm, and training a training data set Y of the sub-scene in a training stage k Is a nuclear density estimation model of (1).
Step 4) training data set Y of the sub-scene k And inputting a trained model, and calculating the probability P of each sample, wherein the probability of the abnormality of the sample is 1-P. If the probability of the sample abnormality is greater than the preset value, the abnormal data is represented.
Another method of detecting abnormal data in a telecommunications network is a density-based method, from a density-based perspective, the abnormal points are samples located in areas of low density. The degree of abnormality of a sample point is the inverse of the density around the sample point.
The gaussian kernel density estimation algorithm determines the degree of abnormality of one sample point by calculating its relative density to surrounding neighboring sample points. The density-based local anomaly factor LOF (Local Outlier Factor) algorithm mainly involves the following four concepts.
k-proximity distance (k-dist): among the points closest to the data point p, the k-nearest point-to-point distance is referred to as the k-nearest distance of the point p, denoted as k-dist (p).
Reachable distance (rechability distance): given the parameter k, the reachable distance reach-dist (p, o) of data point p to data point o is the k-adjacent distance of data point o and the maximum of the direct distance between data point p and point o. Namely:
reach-dist(p,o)＝max(k-dist(o),d(p,o))
local reachable density (local rechability density): the definition of local reachable density is based on reachable distance, and for data point p, those data points with a distance from point p less than or equal to k-dist (p) are called its k-nearest-neighbor, denoted as |N k (p) |, the local reachable density of a data point p is the inverse of its average reachable distance from neighboring data points, i.e.:
local abnormality factor (local outlier factor): according to the definition of local reachable density, if one data point is far from the other, it is apparent that its local reachable density is small. However, the gaussian kernel density estimation algorithm measures the degree of anomaly of a data point and does not look at its absolute local density, but rather looks at its relative density to surrounding neighboring data points. This has the advantage of allowing for non-uniform data distribution and different densities. The local anomaly factor is defined by the local relative density. Local relative density (local anomaly factor) LOF of data point p k (p) is the ratio of the average local reachable density of neighbors of point p to the local reachable density of point p, namely:
the method for detecting abnormal data of the telecommunication network by using the Gaussian kernel density estimation algorithm comprises the following steps:
step 1) training data for each scene in the training phaseSet Y k Calculates its distance from all other points and orders it from near to far.
Step 2) during the prediction phase, training data set Y for each scene k Is found and a LOF score is calculated.
Another method of detecting abnormal data of a telecommunication network is an isolated forest algorithm, which judges the degree of abnormality of sample data by calculating the degree of "separation" of the sample data. The method for detecting the abnormal data of the telecommunication network by utilizing the isolated forest algorithm comprises the following steps:
step 1) training phase: constructing an isolated forest consisting of t iTrees.
Training data set Y from sub-scene k X sample specimens were randomly selected as a sub-sample set and placed into the root node of the tree.
A dimension is randomly selected in the current node data, and a cutting point p is randomly generated.
Generating a hyperplane by the cutting point, and dividing the current node data space into 2 subspaces: data smaller than p in the designated dimension is placed on the left of the current node, and data greater than or equal to p is placed on the right of the current node.
The above steps are recursively performed in the child nodes to continuously construct new child nodes, and the termination condition is two, one is that the data is not subdivided, and the other is that the depth of the tree reaches l=ceiling (log) 2 x)。
Repeating the steps t times, and constructing an isolated forest consisting of t iTrees.
Step 2) prediction stage: bisection scene training dataset Y k The outliers are calculated for the samples.
Bisection scene training dataset Y k To traverse each iTree.
The depth h (m) of the sample m at each iTree is calculated, yielding the average depth E (h (m)) of m at each iTree.
h(m)＝e+C(T.size)
In the formula, e represents the number of edges that data m passes from the root node to the leaf node of the tree, and C (t.size) can be considered a correction value representing the average path length in a binary tree constructed from t.size pieces of sample data. In general, the calculation formula of C (n) is as follows:
wherein H (n-1) can be estimated using ln (n-1) +0.5772156649, where the constant is the Euler constant.
The anomaly score Socre (m) of data m is as follows:
after calculating Socre (m) of each sample data, setting a threshold according to the obtained result, wherein the data lower than the threshold is abnormal.
Another method for detecting abnormal data of a telecommunication network is a principal component analysis algorithm, wherein the principal component analysis is used for carrying out linear transformation on the data and changing the original number into data with linear independence of each dimension, so as to find out the principal component with the maximum information content in the data. The principal component analysis algorithm can reduce noise, noise data, i.e., abnormal data in abnormal detection.
Based on the principle component analysis algorithm, abnormal data detection is carried out, data are mapped to a low-dimensional feature space, the deviation of each data with other data in different dimensions is calculated, and if one sample is larger in deviation with other data in certain dimensions, the sample can be an abnormal point.
The method for detecting the abnormal data of the telecommunication network by utilizing the principal component analysis algorithm comprises the following steps:
step 1) training data set Y of the sub-scene k Mapping to a low dimensional space.
Step 2) for a data sample x i And feature vector e j The degree of deviation of the data sample in the direction of the feature vector is d ij Thenλ j Is a normalized variable.
Step 3) data sample x i The degree of deviation in the direction of each characteristic vector is summed to obtain x i Is the anomaly score Socre (x) i )，
Step 4) calculating Socre (x) of each sample data i ) And setting a threshold according to the obtained result, wherein the data higher than the threshold is abnormal data.
S240, integrating a plurality of base learners to obtain the abnormal data detection model of the telecommunication network.
Specifically, the telecommunications network abnormal data detection model adopted by the embodiment of the invention is based on the idea of integrated learning and consists of a plurality of base learners. Therefore, after a plurality of base learners are trained, a plurality of base learners are integrated, and a telecommunication network abnormal data detection model adopted by the embodiment of the invention is obtained.
According to the method for detecting the abnormal data of the telecommunication network, provided by the embodiment of the invention, the plurality of training sets obtained by sampling through the Bootstrapping method respectively train the base learners corresponding to different parallel detection algorithms, so that the abnormal data detection model of the telecommunication network with better generalization capability is obtained, and the accuracy of detecting the abnormal data of the telecommunication network is improved.
Based on any of the foregoing embodiments, fig. 3 is a flow chart of a method for detecting abnormal data of a telecommunications network according to an embodiment of the present invention, and before step S120, the method further includes:
and S310, determining a network scene corresponding to the cell to be detected based on the network characteristic data corresponding to all the cells to be detected in the telecommunication network.
Specifically, since the network feature data corresponding to the cells to be detected having the same network scenario needs to be input into the telecommunications network abnormal data detection model in step S120, the network scenario corresponding to the cells to be detected, or which cells to be detected have the same network scenario, needs to be determined before that. In general, since the network usage behavior of a particular cell is relatively fixed, the network scenario to which the cell corresponds is also fixed. It can be seen that the network scenario can be considered as a fixed attribute that the cell has.
Further, step S310 specifically includes:
s311, inquiring historical data of a telecommunication network, and acquiring network characteristic data of all cells to be detected in a plurality of time periods;
specifically, multiple sets of data are required to be used in this step to determine the network scenario corresponding to the cell. Wherein the sources of the plurality of sets of data may be data of different time periods, with data of one time period being the set of data. Thus, network characteristic data of all cells to be detected in a plurality of time periods may be acquired, and a specific data acquisition source may be obtained by querying historical data of the telecommunication network.
S312, clustering the network characteristic data of all the cells to be detected in each time period of a plurality of time periods to obtain an initial network scene corresponding to the cells to be detected;
specifically, the clustering method adopted by the embodiment of the invention is a method for classifying a plurality of data according to a certain rule so as to aggregate a plurality of groups of data clusters. For this step, the network feature data of all the cells to be detected are clustered, and the initial network scenario corresponding to each cell to be detected is determined. The specific clustering method adopted in the embodiment of the present invention is not specifically limited herein. The following is an example of a K-means clustering algorithm.
Step 1) randomly selecting k data from the training data set Y as an initial clustering center c 1 、c 2 、……、c k 。
Step 2) c 1 、c 2 、……、c k As an initial clustering center, the training data set Y is clustered and divided according to the following principle: if d ij (x i ,c j )＜d im (x i ,c m ) Wherein m=1, 2, … …, k; j is not equal to m; i=1, 2, … …, n, then data sample x i Dividing into cluster c j Is a kind of medium.
Step 3) according to the formulaRecalculating cluster center of cluster>
Step 4) if for any j e {1,2, … …, k },the algorithm ends and ++> For the final cluster center cluster, otherwise let +.>Returning to the step 2) for execution. If the maximum iteration number is reached, the algorithm ends.
And 5) outputting a clustering result and a final clustering center cluster, and obtaining a scene of each sample in the training data set Y for the cell according to the clustering result.
And S313, determining the network scene corresponding to the cell to be detected based on the initial network scene obtained by each time period of the time periods.
Specifically, the initial network scenario of the cell to be detected, which is determined only for a specific time period, is obtained in step S312. In order to ensure that the network scene corresponding to the accurate detected cell is obtained, multiple times of calculation are required by using multiple groups of data corresponding to different time periods, so that multiple initial network scene values corresponding to a certain cell to be detected can be obtained. Therefore, based on the initial network scene obtained by each time period of the multiple time periods, the network scene corresponding to the cell to be detected can be determined, wherein the specific determination method can be based on the result with the largest occurrence number among the results of the multiple groups of data clustering.
According to the method for detecting the abnormal data of the telecommunication network, provided by the embodiment of the invention, the network scene of the cell is determined by the clustering method, so that the abnormal data can be detected aiming at the cell of the same network scene later, and the abnormal data can be found more efficiently.
Based on any of the foregoing embodiments, fig. 4 is a schematic structural diagram of a device for detecting abnormal data in a telecommunications network according to an embodiment of the present invention, where the device includes:
a data acquisition module 410, configured to acquire network feature data corresponding to a cell to be detected in a telecommunications network;
specifically, the detection of the abnormal data in the telecommunication network according to the embodiment of the present invention may be performed with a cell as a detection granularity, that is, it is detected which cell the abnormal data appears in. Thus, the telecommunications network referred to in the data acquisition module 410 is divided according to the granularity of cells, and the telecommunications network to be detected is also made up of a plurality of cells to be detected.
Specifically, in the embodiment of the invention, abnormal data of a telecommunication network is detected, the data basis is network characteristic data corresponding to a cell to be detected in the telecommunication network, and whether the cell to be detected is a cell with abnormal data is judged through the network characteristic data corresponding to the cell to be detected. Therefore, in the method for detecting abnormal data in a telecommunication network according to the embodiment of the present invention, the data acquisition module 410 is required to acquire the network characteristic data corresponding to the cell to be detected in the telecommunication network.
The anomaly detection module 420 is configured to input network feature data corresponding to cells to be detected, which have the same network scenario, into a telecommunications network anomaly data detection model to obtain an anomaly detection result of the telecommunications network;
specifically, after network feature data corresponding to a cell to be detected in a telecommunication network is acquired, the network feature data needs to be input into a telecommunication network abnormal data detection model as input data. The output data of the abnormal data detection model of the telecommunication network is the abnormal detection result of the telecommunication network. The result of the anomaly detection of the telecommunications network described in the anomaly detection module 420 may be which cell to be detected in the incoming data is the cell containing the anomaly data, and it is understood that the anomaly data in the incoming data is marked.
Specifically, after the network feature data corresponding to the cells to be detected in the telecommunication network are acquired, not all the network feature data corresponding to the cells to be detected are input into the telecommunication network abnormal data detection model, but the network feature data corresponding to the cells to be detected with the same network scene are input into the telecommunication network abnormal data detection model. The network scenario is an attribute of each cell to be detected, in particular a network scenario in which the cell is determined from its cell network usage traffic behavior.
Specifically, the telecommunications network anomaly data detection model in anomaly detection module 420 is comprised of a plurality of base learners; the base learner is obtained by training by taking network characteristic data corresponding to cells with the same network scene as training samples.
According to the abnormal data detection device for the telecommunication network, provided by the embodiment of the invention, the abnormal data in the telecommunication network is detected by using the abnormal data detection model of the telecommunication network based on the integrated learning, and the generalization capability of the detection model can be integrally improved according to the integrated learning, so that the accuracy of detecting the abnormal data of the telecommunication network is improved.
Fig. 5 illustrates a physical schematic diagram of an electronic device, as shown in fig. 5, which may include: processor 510, communication interface (Communications Interface) 520, memory 530, and communication bus 540, wherein processor 510, communication interface 520, memory 530 complete communication with each other through communication bus 540. Processor 510 may invoke logic instructions in memory 530 to perform the following method: acquiring network characteristic data corresponding to a cell to be detected in a telecommunication network; inputting network characteristic data corresponding to cells to be detected with the same network scene into a telecommunication network abnormal data detection model to obtain an abnormal detection result of the telecommunication network; wherein the telecommunication network abnormal data detection model consists of a plurality of base learners; the base learner is obtained by training by taking network characteristic data corresponding to cells with the same network scene as training samples.
Further, the logic instructions in the memory 530 described above may be implemented in the form of software functional units and may be stored in a computer-readable storage medium when sold or used as a stand-alone product. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in essence or a part contributing to the prior art or a part of the technical solution, in the form of a software product stored in a storage medium, including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method of the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.
In another aspect, an embodiment of the present invention further provides a non-transitory computer readable storage medium having stored thereon a computer program, which when executed by a processor is implemented to perform the method for detecting abnormal data of a telecommunications network provided in the above embodiments, for example, including: acquiring network characteristic data corresponding to a cell to be detected in a telecommunication network; inputting network characteristic data corresponding to cells to be detected with the same network scene into a telecommunication network abnormal data detection model to obtain an abnormal detection result of the telecommunication network; wherein the telecommunication network abnormal data detection model consists of a plurality of base learners; the base learner is obtained by training by taking network characteristic data corresponding to cells with the same network scene as training samples.
The apparatus embodiments described above are merely illustrative, wherein the elements illustrated as separate elements may or may not be physically separate, and the elements shown as elements may or may not be physical elements, may be located in one place, or may be distributed over a plurality of network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art will understand and implement the present invention without undue burden.
From the above description of the embodiments, it will be apparent to those skilled in the art that the embodiments may be implemented by means of software plus necessary general hardware platforms, or of course may be implemented by means of hardware. Based on this understanding, the foregoing technical solution may be embodied essentially or in a part contributing to the prior art in the form of a software product, which may be stored in a computer readable storage medium, such as ROM/RAM, a magnetic disk, an optical disk, etc., including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the method described in the respective embodiments or some parts of the embodiments.
Finally, it should be noted that: the above embodiments are only for illustrating the technical solution of the present invention, and are not limiting; although the invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims (7)
1. A method for detecting abnormal data in a telecommunications network, comprising:
acquiring network characteristic data corresponding to a cell to be detected in a telecommunication network, wherein the network characteristic data comprises one or a combination of the following data: overlay class data, call setup class data, call hold class data, mobility management class data, latency class data, and system resource class data;
determining a network scene corresponding to the cell to be detected based on network characteristic data corresponding to all cells to be detected in the telecommunication network;
inputting network characteristic data corresponding to cells to be detected with the same network scene into a telecommunication network abnormal data detection model to obtain an abnormal detection result of the telecommunication network;
wherein the telecommunication network abnormal data detection model consists of a plurality of base learners;
the base learner is obtained by training by taking network characteristic data corresponding to cells with the same network scene as training samples;
based on the network characteristic data corresponding to all the cells to be detected in the telecommunication network, determining the network scene corresponding to the cells to be detected comprises the following steps:
inquiring historical data of a telecommunication network, and acquiring network characteristic data of all cells to be detected in a plurality of time periods;
clustering network characteristic data of all cells to be detected in each time period of a plurality of time periods to obtain an initial network scene corresponding to the cells to be detected;
and determining the network scene corresponding to the cell to be detected based on the initial network scene obtained by each time period of the multiple time periods.
2. The telecommunications network anomaly data detection method of claim 1, wherein the method further comprises:
acquiring network characteristic data corresponding to cells with the same network scene;
sampling the network characteristic data corresponding to the cells with the same network scene in a put-back way by adopting a Bootstrapping method to obtain a base training set;
training a parallel detection algorithm by taking the basic training set as a training sample to obtain the basic learner;
integrating a plurality of the base learners to obtain the abnormal data detection model of the telecommunication network.
3. The method for detecting abnormal data of a telecommunication network according to claim 2, wherein the parallel detection algorithm is a K-means clustering algorithm, a gaussian kernel density estimation algorithm, a local anomaly factor algorithm, an isolated forest algorithm or a principal component analysis algorithm.
4. The method for detecting abnormal data of a telecommunication network according to claim 1, wherein inputting network characteristic data corresponding to cells to be detected with the same network scene into a telecommunication network abnormal data detection model to obtain an abnormal detection result of the telecommunication network comprises:
inputting network characteristic data corresponding to cells to be detected with the same network scene into a plurality of base learners in a telecommunication network abnormal data detection model, and obtaining a preliminary detection result output by each base learner;
and determining the abnormal detection result by adopting a voting mechanism based on the preliminary detection result.
5. A telecommunications network anomaly data detection apparatus, comprising:
the data acquisition module is used for acquiring network characteristic data corresponding to a cell to be detected in the telecommunication network, wherein the network characteristic data comprises one or a combination of the following data: overlay class data, call setup class data, call hold class data, mobility management class data, latency class data, and system resource class data;
a network scene determining module, configured to determine a network scene corresponding to a cell to be detected based on network feature data corresponding to all cells to be detected in the telecommunications network;
the anomaly detection module is used for inputting network characteristic data corresponding to cells to be detected with the same network scene into a telecommunication network anomaly data detection model to obtain an anomaly detection result of the telecommunication network;
wherein the telecommunication network abnormal data detection model consists of a plurality of base learners;
the base learner is obtained by training by taking network characteristic data corresponding to cells with the same network scene as training samples;
the network scene determination module includes:
a network characteristic data acquisition unit, configured to query historical data of a telecommunication network, and acquire network characteristic data of all cells to be detected in a plurality of time periods;
the network characteristic data clustering unit is used for clustering the network characteristic data of all the cells to be detected in each time period of the multiple time periods to obtain an initial network scene corresponding to the cells to be detected;
and the network scene determining unit is used for determining the network scene corresponding to the cell to be detected based on the initial network scene obtained by each time period of the time periods.
6. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor performs the steps of the method for detecting abnormal data of a telecommunication network according to any one of claims 1 to 4 when the program is executed.
7. A non-transitory computer readable storage medium having stored thereon a computer program, which when executed by a processor implements the steps of the telecommunications network anomaly data detection method of any one of claims 1 to 4.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010158291.2A CN113379176B (en) | 2020-03-09 | 2020-03-09 | Method, device, equipment and readable storage medium for detecting abnormal data of telecommunication network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010158291.2A CN113379176B (en) | 2020-03-09 | 2020-03-09 | Method, device, equipment and readable storage medium for detecting abnormal data of telecommunication network |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113379176A CN113379176A (en) | 2021-09-10 |
| CN113379176B true CN113379176B (en) | 2023-12-19 |
Family
ID=77568512
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010158291.2A Active CN113379176B (en) | 2020-03-09 | 2020-03-09 | Method, device, equipment and readable storage medium for detecting abnormal data of telecommunication network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113379176B (en) |
Families Citing this family (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114218051B (en) * | 2021-09-22 | 2022-07-22 | 成都网丁科技有限公司 | Time delay abnormity detection method |
| CN114039837B (en) * | 2021-11-05 | 2023-10-31 | 奇安信科技集团股份有限公司 | Alarm data processing method, device, system, equipment and storage medium |
| CN114124482B (en) * | 2021-11-09 | 2023-09-26 | 中国电子科技集团公司第三十研究所 | Access flow anomaly detection method and equipment based on LOF and isolated forest |
| CN114417940A (en) * | 2022-03-25 | 2022-04-29 | 阿里巴巴（中国）有限公司 | Equipment for detecting data center, method and device for obtaining equipment detection model |
| CN115174237B (en) * | 2022-07-08 | 2023-04-18 | 河北科技大学 | Method and device for detecting malicious traffic of Internet of things system and electronic equipment |
Citations (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102045357A (en) * | 2010-12-29 | 2011-05-04 | 深圳市永达电子股份有限公司 | Affine cluster analysis-based intrusion detection method |
| CN105095516A (en) * | 2015-09-16 | 2015-11-25 | 中国传媒大学 | Broadcast television subscriber grouping system and method based on spectral clustering integration |
| CN106503238A (en) * | 2016-11-07 | 2017-03-15 | 王昱淇 | The network map region clustering forecasting method that a kind of intensified learning drives |
| JP2017090606A (en) * | 2015-11-09 | 2017-05-25 | 日本電信電話株式会社 | Abnormal sound detection device, abnormal sound detection learning device, method thereof, and program |
| CN107248785A (en) * | 2017-08-06 | 2017-10-13 | 潘金文 | A kind of transformer substation grounding wire remote supervision system |
| CN107256237A (en) * | 2017-05-23 | 2017-10-17 | 中国电子科技集团公司第二十八研究所 | The LOF cluster datas abnormal point detecting method and detecting system optimized based on dynamic grid |
| CN108809974A (en) * | 2018-06-07 | 2018-11-13 | 深圳先进技术研究院 | A kind of Network Abnormal recognition detection method and device |
| CN109753991A (en) * | 2018-12-06 | 2019-05-14 | 中科恒运股份有限公司 | Abnormal deviation data examination method and device |
| CN110072017A (en) * | 2019-04-28 | 2019-07-30 | 济南大学 | Abnormal phone recognition methods and system based on feature selecting and integrated study |
| CN110247910A (en) * | 2019-06-13 | 2019-09-17 | 深信服科技股份有限公司 | A kind of detection method of abnormal flow, system and associated component |
| CN110351307A (en) * | 2019-08-14 | 2019-10-18 | 杭州安恒信息技术股份有限公司 | Abnormal user detection method and system based on integrated study |
| CN110505179A (en) * | 2018-05-17 | 2019-11-26 | 中国科学院声学研究所 | A kind of detection method and system of exception flow of network |
| CN110555455A (en) * | 2019-06-18 | 2019-12-10 | 东华大学 | Online transaction fraud detection method based on entity relationship |
| CN110868414A (en) * | 2019-11-14 | 2020-03-06 | 北京理工大学 | Industrial control network intrusion detection method and system based on multi-voting technology |
Family Cites Families (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101384054B (en) * | 2007-09-04 | 2012-01-11 | 中兴通讯股份有限公司 | Method for network exception condition monitoring through performance data |
| ES2906411T3 (en) * | 2015-06-29 | 2022-04-18 | Suez Groupe | Anomaly detection procedure in a water distribution system |
| US10318886B2 (en) * | 2015-10-30 | 2019-06-11 | Citrix Systems, Inc. | Anomaly detection with K-means clustering and artificial outlier injection |
| CN106101102B (en) * | 2016-06-15 | 2019-07-26 | 华东师范大学 | A kind of exception flow of network detection method based on PAM clustering algorithm |
| CN106371939B (en) * | 2016-09-12 | 2019-03-22 | 山东大学 | A kind of time series data method for detecting abnormality and its system |
| EP3376446A1 (en) * | 2017-03-18 | 2018-09-19 | Tata Consultancy Services Limited | Method and system for anomaly detection, missing data imputation and consumption prediction in energy data |
| CN109934354A (en) * | 2019-03-12 | 2019-06-25 | 北京信息科技大学 | Abnormal deviation data examination method based on Active Learning |
| CN112188532A (en) * | 2019-07-02 | 2021-01-05 | 中国移动通信集团贵州有限公司 | Training method of network anomaly detection model, network detection method and device |
| CN110753369B (en) * | 2019-10-23 | 2022-09-02 | 中国联合网络通信集团有限公司 | Method and device for detecting interrupt cell |
| CN112911627B (en) * | 2019-11-19 | 2023-03-21 | 中国电信股份有限公司 | Wireless network performance detection method, device and storage medium |
| CN111148142B (en) * | 2019-12-31 | 2022-07-12 | 重庆大学 | Dormant cell detection method based on anomaly detection and integrated learning |
-
2020
- 2020-03-09 CN CN202010158291.2A patent/CN113379176B/en active Active
Patent Citations (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102045357A (en) * | 2010-12-29 | 2011-05-04 | 深圳市永达电子股份有限公司 | Affine cluster analysis-based intrusion detection method |
| CN105095516A (en) * | 2015-09-16 | 2015-11-25 | 中国传媒大学 | Broadcast television subscriber grouping system and method based on spectral clustering integration |
| JP2017090606A (en) * | 2015-11-09 | 2017-05-25 | 日本電信電話株式会社 | Abnormal sound detection device, abnormal sound detection learning device, method thereof, and program |
| CN106503238A (en) * | 2016-11-07 | 2017-03-15 | 王昱淇 | The network map region clustering forecasting method that a kind of intensified learning drives |
| CN107256237A (en) * | 2017-05-23 | 2017-10-17 | 中国电子科技集团公司第二十八研究所 | The LOF cluster datas abnormal point detecting method and detecting system optimized based on dynamic grid |
| CN107248785A (en) * | 2017-08-06 | 2017-10-13 | 潘金文 | A kind of transformer substation grounding wire remote supervision system |
| CN110505179A (en) * | 2018-05-17 | 2019-11-26 | 中国科学院声学研究所 | A kind of detection method and system of exception flow of network |
| CN108809974A (en) * | 2018-06-07 | 2018-11-13 | 深圳先进技术研究院 | A kind of Network Abnormal recognition detection method and device |
| CN109753991A (en) * | 2018-12-06 | 2019-05-14 | 中科恒运股份有限公司 | Abnormal deviation data examination method and device |
| CN110072017A (en) * | 2019-04-28 | 2019-07-30 | 济南大学 | Abnormal phone recognition methods and system based on feature selecting and integrated study |
| CN110247910A (en) * | 2019-06-13 | 2019-09-17 | 深信服科技股份有限公司 | A kind of detection method of abnormal flow, system and associated component |
| CN110555455A (en) * | 2019-06-18 | 2019-12-10 | 东华大学 | Online transaction fraud detection method based on entity relationship |
| CN110351307A (en) * | 2019-08-14 | 2019-10-18 | 杭州安恒信息技术股份有限公司 | Abnormal user detection method and system based on integrated study |
| CN110868414A (en) * | 2019-11-14 | 2020-03-06 | 北京理工大学 | Industrial control network intrusion detection method and system based on multi-voting technology |
Non-Patent Citations (3)
| Title |
|---|
| Joint Detection and Recounting of Abnormal Events by Learning Deep Generic Knowledge;Ryota Hinami等;2017 IEEE international Conference on Computer Vision(ICCV);3639-3647 * |
| 基于聚类的兴趣区域间异常轨迹并行检测算法;许振等;南京师大学报（自然科学版）;第42卷(第1期);59-64 * |
| 基于集成方法的异常点检测;张志平;信息与电脑（理论版）;第31卷(第20期);48-49 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113379176A (en) | 2021-09-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN113379176B (en) | Method, device, equipment and readable storage medium for detecting abnormal data of telecommunication network | |
| US10931700B2 (en) | Method and system for anomaly detection and network deployment based on quantitative assessment | |
| Nikravesh et al. | Mobile network traffic prediction using MLP, MLPWD, and SVM | |
| CN108022171B (en) | Data processing method and equipment | |
| CN108768695B (en) | KQI problem positioning method and device | |
| CN115358487A (en) | Federal learning aggregation optimization system and method for power data sharing | |
| CN112214677B (en) | Point of interest recommendation method and device, electronic equipment and storage medium | |
| Zhang et al. | Hierarchical community detection based on partial matrix convergence using random walks | |
| CN117221078A (en) | Association rule determining method, device and storage medium | |
| Gao et al. | A deep learning framework with spatial-temporal attention mechanism for cellular traffic prediction | |
| CN111368858B (en) | User satisfaction evaluation method and device | |
| Tang et al. | Tackling system induced bias in federated learning: Stratification and convergence analysis | |
| CN115984742A (en) | Training method of video frame selection model, video processing method and device | |
| Qin et al. | Adaptive in-network collaborative caching for enhanced ensemble deep learning at edge | |
| CN104955059B (en) | Cellular network base stations state time-varying model method for building up based on Bayesian network | |
| CN114971504A (en) | Entity type determination method and related device | |
| Ma et al. | Modelling social characteristics of mobile radio networks | |
| Wang et al. | Deep Learning Based Traffic Prediction in Mobile Network-A Survey | |
| Reddy et al. | Experimental Testing of Primary User Detection Using Decision Tree Algorithm With Software Defined Radio Testbed | |
| Zhu et al. | A survey of big data and computational intelligence in networking | |
| CN114339859B (en) | Method and device for identifying WiFi potential users of full-house wireless network and electronic equipment | |
| Ickin | Automated Feature Selection with Local Gradient Trajectory in Split Learning | |
| Olsson et al. | Exploratory Data Analysis of Live 5G Radio Access Network Configuration Data Using Interpretable Machine Learning | |
| Ma et al. | Modeling mobile cellular networks based on social characteristics | |
| Das et al. | Active Semi-Supervised Learning for Diffusions on Graphs |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |