CN108055152B - Communication network information system abnormity detection method based on distributed service log - Google Patents
Communication network information system abnormity detection method based on distributed service log Download PDFInfo
- Publication number
- CN108055152B CN108055152B CN201711309778.0A CN201711309778A CN108055152B CN 108055152 B CN108055152 B CN 108055152B CN 201711309778 A CN201711309778 A CN 201711309778A CN 108055152 B CN108055152 B CN 108055152B
- Authority
- CN
- China
- Prior art keywords
- time
- node
- log
- nodes
- subset
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000004891 communication Methods 0.000 title claims abstract description 66
- 238000001514 detection method Methods 0.000 title abstract description 36
- 238000000034 method Methods 0.000 claims abstract description 24
- 238000001914 filtration Methods 0.000 claims abstract description 13
- 238000003745 diagnosis Methods 0.000 claims description 9
- 230000002123 temporal effect Effects 0.000 claims description 9
- 238000013507 mapping Methods 0.000 claims description 6
- 230000011218 segmentation Effects 0.000 claims description 6
- 230000005856 abnormality Effects 0.000 abstract description 13
- 238000011161 development Methods 0.000 abstract description 5
- 238000011156 evaluation Methods 0.000 abstract description 4
- 239000012530 fluid Substances 0.000 abstract 1
- 238000005065 mining Methods 0.000 description 7
- 230000002159 abnormal effect Effects 0.000 description 4
- 230000018109 developmental process Effects 0.000 description 4
- 238000010586 diagram Methods 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 2
- 238000012423 maintenance Methods 0.000 description 2
- 238000012360 testing method Methods 0.000 description 2
- 230000007547 defect Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000002474 experimental method Methods 0.000 description 1
- 239000000284 extract Substances 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 238000007781 pre-processing Methods 0.000 description 1
- 238000011160 research Methods 0.000 description 1
- 230000007704 transition Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/069—Management of faults, events, alarms or notifications using logs of notifications; Post-processing of notifications
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a communication network information system abnormity detection method based on distributed service logs, which can automatically compare real-time log streams with development templates by finding a comparison case during automatic abnormity detection by exploring service benchmarks in a network so as to achieve the purpose of detecting abnormity. The invention provides a time weight-based anomaly detection method for a control flow graph model, which generates a CFG (computational fluid dynamics) with good structural nodes through a set filtering scheme, and divides boundaries by utilizing the characteristic of interval disorder of nodes between loops or threads so as to further optimize the structure; the time weight of each edge is calculated, generating the TCFG. The TCFG can be compared with a real-time TCFG stream to find abnormality, and evaluation shows that the method has good accuracy and recall rate, and in a real environment, the accuracy rate is 80% and the recall rate is 65% on average.
Description
Technical Field
The invention relates to the technical field of communication network information anomaly detection, in particular to a distributed service log-based communication network information system anomaly detection method.
Background
With the development of networks, most network service systems need to provide services for 7 × 24 hours, and when the system is abnormal, if the problem cannot be detected and repaired in time, huge economic loss will be caused. When a system is abnormal, developers usually find and process the abnormality through log analysis. The log records the system operation information, which is one of the most common methods for analyzing system anomalies. However, since the system is over-scaled, the system logs are distributed on different servers, and the distribution of the servers is large-scale and scattered, a method for developers to find out the logs to be analyzed manually to detect the abnormality will take a lot of time. In order to reduce the workload of developers, it is meaningful to study an abnormality detection method based on automatic log analysis.
For distributed service anomaly detection, the patent places a focus on developing a time-weight-based control flow graph (TCFG) model. The model development firstly generates a Control Flow Graph (CFG) model, then divides a boundary optimization structure, and then calculates time weight by adopting a K mean algorithm. And finally, comparing the online log stream with the mined TCFG model to realize difference diagnosis.
In order to solve the development situation of the prior art, the existing papers and patents are searched, compared and analyzed, and the following technical information with high relevance to the invention is screened out:
the technical scheme 1: the patent of 'a communication abnormity detection device and method' with application publication number of CN106209496A relates to a method of an abnormity detection device, which is mainly completed by three steps of the device: first, a communication unit. A plurality of data frames are accepted through a communication interface of a communication unit. The unit needs to include at least one communication interface, and the at least one communication interface includes a first interface and a second interface to meet the requirement of anomaly detection of different parts. Second, the detecting unit includes a technical unit and a time length determining unit. The counting unit is used for counting the number of data from the data marked as one frame ending bit to the data marked as one frame starting bit received by the communication unit. The time length determining unit is used for determining the time length between two frames of received data according to the counting value of the counting unit. And thirdly, the determining unit compares the detected time length with a preset time interval, when the time length is in the time interval, the communication of the communication unit is normal, otherwise, the communication of the communication unit is abnormal and is sent to the management server by the sending unit.
The technical scheme 2 is as follows: the patent of 'a method and a device for detecting communication abnormity' with application publication number CN106713012A relates to a method and a device for detecting ATM communication abnormity, which are mainly completed by four steps of the device: firstly, sending heartbeat packets in an ATM according to a preset sending interval; secondly, detecting a real-time communication load parameter of a heartbeat response packet corresponding to the heartbeat packet, wherein the communication load parameter is a delay rate or a packet loss rate; thirdly, determining the current communication state in the ATM according to the communication load parameter, wherein the communication state adopts a five-level hierarchical system; fourth, the determined current communication state is output. The invention has the advantage of detecting the abnormality when no service data exists.
Technical scheme 3: a "communication abnormality detection device, communication abnormality detection method, and program" patent application publication No. CN105323017A relates to a communication abnormality detection device that detects an abnormality in communication performed between a master device and a plurality of slave devices, and is mainly completed by three steps of the device: first, a detection unit of a communication abnormality detection device constantly observes a communication voltage of a communication line between a master device and a slave device; secondly, when the communication voltage is lower than the set value, the notification unit notifies the master device of an ID for identifying the slave device to which the communication is to be made, in addition to the alarm; third, the master device displays an abnormality on the display unit to display a maintenance warning of a specific portion, and also displays a maintenance notice by displaying the display unit of the slave device specified by the ID.
Technical solution 1 adopts a method for detecting communication abnormality by three units, namely a communication unit, a detection unit, and a determination unit, wherein the communication unit is used for receiving a plurality of data frames; second, a detection unit for detecting a time length between adjacent data frames among the plurality of data frames received by the communication unit; and thirdly, the determining unit is used for comparing the time length detected by the detecting unit with a preset time interval, when the time length is in the time interval, the communication of the communication unit is normal, otherwise, the communication of the communication unit is abnormal. However, the anomaly detection can detect only anomalies caused by time, and the applicable range is limited.
The technical scheme 2 adopts a real-time communication detection mode of sending heartbeat packets and detecting response packets thereof in a non-service period. And sending heartbeat packets according to a preset time interval and detecting real-time communication load parameters of corresponding heartbeat response packets during the period without service. The traffic load parameter may reflect the real-time traffic status of the ATM. The display of the state adopts a grading system, and the five states of normal congestion, light congestion, moderate congestion, severe congestion and no heartbeat are respectively provided. The current communication state can be obtained by comparing the communication load parameter with the requirement parameters of the above five states. And finally, outputting the communication state through a communication state output module. The method is simple and effective, but the standard form is single, the reference factor is not comprehensive enough, and the method also has limitations on the scale and conditions of the use environment.
Technical solution 3 adopts a master-slave device communication detection method in a communication system. The detection unit detects the communication voltage between the master device and at least one slave device, namely reads the rectangular wave lifting voltage value in a communication line between the master device and the slave device to detect the voltage; a notification unit that, when detecting that the communication voltage is equal to or lower than the set voltage or when the communication voltage is expected to become smaller than the set voltage, notifies the host device of identification information for identifying a communication destination of the communication in addition to the warning information; the master device includes a communication unit configured to notify the slave device identified by the identification information that warning information has been notified; the slave device includes a display unit that displays the notification of the warning information when the notification of the warning information is notified. This method can always detect or predict the occurrence of a failure in the drop of the communication voltage in the communication line between the master device and the slave device, but the detectable failure is caused only by the voltage and is relatively simple in functionality.
Disclosure of Invention
In view of the above situation, and in order to overcome the defects of the prior art, the present invention aims to provide an anomaly detection method for a communication network information system based on a distributed service log, which can automatically compare a real-time log stream with a development template by finding a comparison case during automatic anomaly detection by discovering a service benchmark in a network, thereby achieving the purpose of detecting anomalies.
The technical scheme for solving the problem is that the method comprises three steps of log analysis, TCFG generation and automatic abnormality detection, firstly, the mapping and the template of an original log and a template are obtained by analyzing the log, when the log template is mapped, the log template index, the timestamp and the log template are recorded, then the TCFG is generated, and finally, the online log stream is compared with the excavated TCFG model to finish the difference diagnosis, and the method is characterized in that the TCFG generation comprises the following three steps,
s1, CFG edge mining, wherein in CFG or TCFG, the node represents a log template; the node comprises a subset, a direct subset and a time weight set; the subset is a set of subsequent nodes in the time window; the direct subset is a set of direct inheritors of the node; the set of temporal weights is a set of time intervals between a node and its immediate child node; the set of temporal weights is a candidate set of edge weights;
there are two key points in step S1, one being time t, which spans the value selection of the time window; long periods of time with accompanying noise, while short periods of time miss some of the correct successor nodes; the other point is how to calculate the occurrence times of the child nodes; the rule is set to calculate the occurrence times of the child nodes only once in a time window;
when the occurrence number of the child node is calculated, the filtering rule is used for determining a direct subsequent node of the node; filtering rule 1 is intended to filter noise based on the number of occurrences of a child node; the formula is described below;
Tnrepresenting a template node; n is the occurrence frequency of the log template node;
representing child nodes, MiIs the number of occurrences of the child node; setting a filtering threshold value of one child node as theta; if it is not
Will be filtered and deleted from the subset;
filter rule 2 is intended to select the immediate successor node according to the number of occurrences of the immediate child node; equation (2) is described below;
then, the direct subsequent node can be obtained using equation (3);
Ss＝Sd∩Sc(3)
Ss,Sd,Screspectively representing a set, a subset and a direct subset of directly subsequent nodes;
for each template node, once the direct subsequent node is calculated, the edge of the node is confirmed; then, all nodes and their edges may constitute a CFG;
s2, converting flow boundary segmentation, and determining whether the time interval between adjacent nodes is stable or not by calculating variance; equations (4) and (5) are described below;
deleting an edge between two adjacent nodes when the variance of the time interval between the two adjacent nodes is greater than a threshold; in order to filter the noise that accompanies a long time in step S1, the value of the threshold β is set large;
then checking whether a circulation exists in the CFG; the method is to calculate the variance of all sides forming the cycle and delete the side with the maximum variance;
s3, calculating the time weight of each edge in the TCFG, wherein the time weight of each edge represents the execution time between two log template nodes; the time weight can be used for detecting the abnormity, a time weight algorithm based on K mean value is adopted, and the input is a time interval set D ═ t1,t2,……,tmThe clustering number K is 3, and the output is the time weight;
the distribution of the time interval list of edges is very centralized; most elements are concentrated in one area, and other elements are dispersed in other areas; therefore, the time interval list is divided into 3 groups by adopting a K mean algorithm; the most numerous groups are adopted; the largest element in the set is the temporal weight;
the basis of the K-means algorithm is the sum of the squares of the minimum errors; the cost function (6) is:
wherein k represents a clustering grouping k, ciSet of elements representing the i-th group, x being ciBy any element in (1), it is meant a time interval,
represents a cluster ciE is the variance.
Due to the adoption of the technical scheme, compared with the prior art, the invention has the following advantages;
the technology is based on the discovery of network service reference, researches an automatic anomaly detection method, and provides the automatic anomaly detection method based on TCFG: first analyzing the original log to generate a template with a timestamp; then, a TCFG (time weighted control flow chart) is generated by analyzing the log of each service, which is responsible for recording the transition state of the system running in the service; in addition, according to the comparison TCFG, real-time log stream abnormity can be diagnosed; evaluation shows that the TCFG-based automatic anomaly detection method has good accuracy and recall rate, and in a real environment, the accuracy rate is 80% and the recall rate is 65% on average.
Drawings
Fig. 1 is a flowchart of an anomaly detection method for a communication network information system based on a distributed service log according to the present invention.
FIG. 2 is a TCFG mining diagram generated by a Hadoop log of the anomaly detection method for a communication network information system based on distributed service logs.
Fig. 3 is a TCFG mining diagram generated by the Zookeeper log of the distributed service log-based communication network information system anomaly detection method of the present invention.
Fig. 4 is a diagram illustrating the accuracy and recall rate of TCFG mining according to the method for detecting an anomaly in a communication network information system based on a distributed service log.
Fig. 5 is a diagram illustrating the accuracy and recall rate of anomaly detection in the anomaly detection method for a communication network information system based on distributed service logs according to the present invention.
Detailed Description
The foregoing and other technical matters, features and effects of the present invention will be apparent from the following detailed description of the embodiments, which is to be read in connection with the accompanying drawings of fig. 1 to 5. The structural contents mentioned in the following embodiments are all referred to the attached drawings of the specification.
The embodiment one, the communication network information system anomaly detection method based on distributed service log, including three steps of log analysis, TCFG generation and anomaly automatic detection, first, through analyzing the log (the log analysis uses the existing method, first, through preprocessing, each row of log divides words according to the blank space, and eliminates the number inside, then through clustering method divides the original log into a plurality of groups, finally, according to the similarity of a group of logs, extracts the log template, produces the mapping of the template and the log, obtains the mapping and template of the original log and template, when mapping the log template, records the log template index, the time stamp and the log template, then generates TCFG, finally compares the on-line log stream with the mined TCFG model, completes the difference diagnosis, characterized in that, the generation TCFG includes the following three steps,
s1, CFG edge mining, wherein in CFG or TCFG, the node represents a log template; the node comprises a subset, a direct subset and a time weight set; the subset is a set of subsequent nodes in the time window; the direct subset is a set of direct inheritors of the node; the set of temporal weights is a set of time intervals between a node and its immediate child node; the set of temporal weights is a candidate set of edge weights;
there are two key points in step S1, one being time t, which spans the value selection of the time window; long times with noise and short times missing some correct successor nodes; the other point is how to calculate the occurrence times of the child nodes; the rule is set to calculate the occurrence times of the child nodes only once in a time window;
when the occurrence number of the child node is calculated, the filtering rule is used for determining a direct subsequent node of the node; filtering rule 1 is intended to filter noise based on the number of occurrences of a child node; the formula is described below;
Tnrepresenting a template node; n is the occurrence frequency of the log template node;
representing child nodes, MiIs the number of occurrences of the child node; setting a filtering threshold value of one child node as theta; if it is not
Will be filtered and deleted from the subset;
filter rule 2 is intended to select the immediate successor node according to the number of occurrences of the immediate child node; equation (2) is described below;
then, the direct subsequent node can be obtained using equation (3);
Ss＝Sd∩Sc(3)
Ss,Sd,Screspectively representing a set, a subset and a direct subset of directly subsequent nodes;
for each template node, once the direct subsequent node is calculated, the edge of the node is confirmed; then, all nodes and their edges may constitute a CFG;
s2, converting flow boundary segmentation, and determining whether the time interval between adjacent nodes is stable or not by calculating variance; the formula (4) and the formula (5) are as follows;
deleting an edge between two adjacent nodes when the variance of the time interval between the two adjacent nodes is greater than a threshold; in order to filter the noise that accompanies a long time in step S1, the value of the threshold β is set large;
then checking whether a circulation exists in the CFG; the method is to calculate the variance of all sides forming the cycle and delete the side with the maximum variance;
s3, calculating the time weight of each edge in the TCFG, wherein the time weight of each edge represents the execution time between two log template nodes; the time weight can be used for detecting the abnormity, a time weight algorithm based on K mean value is adopted, and the input is a time interval set D ═ t1,t2,……,tmThe clustering number K is 3, and the output is the time weight;
the distribution of the time interval list of edges is very centralized; most elements are concentrated in one area, and other elements are dispersed in other areas; therefore, the time interval list is divided into 3 groups by adopting a K mean algorithm; the most numerous groups are adopted; the largest element in the set is the temporal weight;
the basis of the K-means algorithm is the sum of the squares of the minimum errors; the cost function is:
wherein k represents a clustering grouping k, ciSet of elements representing the ith group, also called x ciBy any element in (1), it is meant a time interval,
represents a cluster ciE is the variance.
When the method is used specifically, the TCFG mining and abnormity diagnosis are evaluated by using the laboratory environment log data set and the reality log data set, 70% of data are developed, 30% of data are used for evaluation test, and the details of the data are as follows:
hadoop log set: the laboratory environment is Hadoop2.0 version, two micro-services are operated, and an original log which is about 1.6GB for ten days is selected from one micro-service in the system as a data set;
zookeeper log set: the zookeeper system outputs about 20G logs each day based on the real world, and selects about 8GB original logs with eight hours as a data set from micro-services in the system;
the TCFG mining and anomaly diagnosis is evaluated by accuracy and recall, which are defined as follows.
True correct (TP) indicates that the correct case is considered correct, false correct (FP) indicates that the wrong case is considered correct, and false error (FN) indicates that the correct case is considered error.
Specific parameter settings are shown in table 1. The depth is the depth of the log search tree and the similarity threshold is the similarity threshold of the log template.
TABLE 1 parameter settings
FIGS. 2 and 3 are TCFGs mined from Hadoop and Zookeeper logs with bifurcated and linear sequences, followed by evaluation of TCFG and anomaly diagnosis efficiency using standard accuracy/recall indicators, first the patent manually generates a reference TCFG structure by source code, randomly adding some anomaly logs to the test set;
compared with the algorithm of the patent, the algorithm is an abnormity diagnosis method based on a mixed graph model (HGM) with a log, in the patent, in order to divide a boundary, the interval time between two tasks is set to be much longer than the execution time of each step in the tasks, so that a writer adopts the HGM in an experiment to highlight the advantage;
as can be seen from fig. 4, the accuracy of both algorithms is high, and the recall rate is lower than the accuracy. This is because the segmentation strategy cannot segment all boundaries, and in order to filter all noise, the threshold in the boundary segmentation strategy is set to be larger, and conversely, if the threshold is too small, normal edges are also filtered, and the algorithm of the present invention recalls 80% in Hadoop, which is higher than 75% of the HGM algorithm. Meanwhile, the algorithm recalls 75% in the Zookeeper and is higher than 65% of the HGM algorithm, so that the boundary segmentation strategy is superior to the HGM algorithm, and in addition, the superiority of the strategy is reflected in the abnormity diagnosis; as shown in fig. 5, the algorithm of this patent has 70% recall in Hadoop, which is higher than 65% of the HGM algorithm, and furthermore, the algorithm has 65% recall in Zookeeper, which is higher than 50% of the HGM algorithm. It can be concluded that the time-weighted algorithm based on K-means also plays a role.
While the invention has been described in further detail with reference to specific embodiments thereof, it is not intended that the invention be limited to the specific embodiments thereof; for those skilled in the art to which the present invention pertains and related technologies, the extension, operation method and data replacement should fall within the protection scope of the present invention based on the technical solution of the present invention.
Claims (1)
1. A method for detecting the abnormity of communication network information system based on distributed service log includes such steps as analyzing log to obtain the mapping between original log and template and the template, mapping the log template, recording the index of log template, time stamp and log template, generating TCFG time control flow graph, comparing the on-line log flow with the mined TCFG time control flow graph model to complete the difference diagnosis,
s1, the CFG control flow graph is mined, and in the CFG control flow graph or the TCFG time control flow graph, nodes represent log templates; the node comprises a subset, a direct subset and a time weight set; the subset is a set of subsequent nodes in the time window; the direct subset is a set of direct inheritors of the node; the set of temporal weights is a set of time intervals between a node and its immediate child node; the set of temporal weights is a candidate set of edge weights;
there are two key points in step S1, one being time t, which spans the value selection of the time window; long times with noise and short times missing some correct successor nodes; the other point is how to calculate the occurrence times of the child nodes; the rule is set to calculate the occurrence times of the child nodes only once in a time window;
when the occurrence number of the child node is calculated, the filtering rule is used for determining a direct subsequent node of the node; filtering rule 1 is intended to filter noise based on the number of occurrences of a child node; formula (1) is described below;
Tnrepresenting a template node; n is the occurrence frequency of the log template node;
sub-section of the presentationDot, MiIs the number of occurrences of the child node; setting a filtering threshold value of one child node as theta; if it is not
Will be filtered and deleted from the subset;
filter rule 2 is intended to select the immediate successor node according to the number of occurrences of the immediate child node; equation (2) is described below;
then, the direct subsequent node can be obtained using equation (3);
Ss＝Sd∩Sc(3)
Ss,Sd,Screspectively representing a set, a subset and a direct subset of directly subsequent nodes;
for each template node, once the direct subsequent node is calculated, the edge of the node is confirmed; then, all nodes and edges thereof can form a CFG control flow graph;
s2, converting flow boundary segmentation, and determining whether the time interval between adjacent nodes is stable or not by calculating variance; equations (4) and (5) are described below;
deleting an edge between two adjacent nodes when the variance of the time interval between the two adjacent nodes is greater than a threshold; in order to filter the noise that accompanies a long time in step S1, the value of the threshold β is set large;
then checking whether a loop exists in the CFG control flow graph; the method is to calculate the variance of all sides forming the cycle and delete the side with the maximum variance;
s3, calculating edge time weight, wherein the time weight of each edge in the TCFG time control flow graph represents the execution time between two log template nodes; the time weight can be used for detecting the abnormity, a time weight algorithm based on K mean value is adopted, and the input is a time interval set D ═ t1,t2,……,tmThe clustering number K is 3, and the output is the time weight;
the distribution of the time interval list of edges is very centralized; most elements are concentrated in one area, and other elements are dispersed in other areas; therefore, the time interval list is divided into 3 groups by adopting a K mean algorithm; the most numerous groups are adopted; the largest element in the set is the temporal weight;
the basis of the K-means algorithm is the sum of the squares of the minimum errors; the cost function (6) is:
wherein k represents a clustering grouping k, ciSet of elements representing the i-th group, x being ciBy any element in (1), it is meant a time interval,
represents a cluster ciE is the variance.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711309778.0A CN108055152B (en) | 2017-12-11 | 2017-12-11 | Communication network information system abnormity detection method based on distributed service log |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711309778.0A CN108055152B (en) | 2017-12-11 | 2017-12-11 | Communication network information system abnormity detection method based on distributed service log |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108055152A CN108055152A (en) | 2018-05-18 |
| CN108055152B true CN108055152B (en) | 2020-11-06 |
Family
ID=62123932
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711309778.0A Active CN108055152B (en) | 2017-12-11 | 2017-12-11 | Communication network information system abnormity detection method based on distributed service log |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108055152B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112000085A (en) * | 2020-09-08 | 2020-11-27 | 广州云也科技有限公司 | Network transmission performance diagnosis system based on 5G big data |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US11218498B2 (en) * | 2018-09-05 | 2022-01-04 | Oracle International Corporation | Context-aware feature embedding and anomaly detection of sequential log data using deep recurrent neural networks |
| CN109634699B (en) * | 2018-11-23 | 2022-04-05 | 中国人民解放军63789部队 | Spacecraft abnormal information clustering visualization and interaction method based on mulberry-based map |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106209405A (en) * | 2015-05-06 | 2016-12-07 | 中国移动通信集团内蒙古有限公司 | Method for diagnosing faults and device |
| CN107070726A (en) * | 2017-05-22 | 2017-08-18 | 郑州云海信息技术有限公司 | A kind of integrated management approach based on MDC |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP3996428B2 (en) * | 2001-12-25 | 2007-10-24 | 松下電器産業株式会社 | Abnormality detection device and abnormality detection system |
| CN103514398B (en) * | 2013-10-18 | 2016-08-17 | 中国科学院信息工程研究所 | A kind of real-time online log detection method and system |
| US10491460B2 (en) * | 2016-04-15 | 2019-11-26 | Arista Networks, Inc. | Method and system for detecting abnormalities in network element operation |
-
2017
- 2017-12-11 CN CN201711309778.0A patent/CN108055152B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106209405A (en) * | 2015-05-06 | 2016-12-07 | 中国移动通信集团内蒙古有限公司 | Method for diagnosing faults and device |
| CN107070726A (en) * | 2017-05-22 | 2017-08-18 | 郑州云海信息技术有限公司 | A kind of integrated management approach based on MDC |
Non-Patent Citations (1)
| Title |
|---|
| 《基于人工智能的电网企业信息安全防控体系》;李文萃;《电力信息与通信技术》;20170215;全文 * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112000085A (en) * | 2020-09-08 | 2020-11-27 | 广州云也科技有限公司 | Network transmission performance diagnosis system based on 5G big data |
| CN112000085B (en) * | 2020-09-08 | 2021-08-31 | 广州云也科技有限公司 | Network transmission performance diagnosis system based on 5G big data |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108055152A (en) | 2018-05-18 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107943668B (en) | Computer server cluster log monitoring method and monitor supervision platform | |
| CN109756364B (en) | Micro-service performance optimization system and analysis method based on log analysis | |
| US9213590B2 (en) | Network monitoring and diagnostics | |
| US8655623B2 (en) | Diagnostic system and method | |
| CN100589418C (en) | The generation method and the generation system of alarm correlation rule | |
| KR20180108446A (en) | System and method for management of ict infra | |
| US10177984B2 (en) | Isolation of problems in a virtual environment | |
| CN108055152B (en) | Communication network information system abnormity detection method based on distributed service log | |
| CN107872457B (en) | Method and system for network operation based on network flow prediction | |
| CN113553210A (en) | Alarm data processing method, device, equipment and storage medium | |
| CN101997709A (en) | Root alarm data analysis method and system | |
| CN104574219A (en) | System and method for monitoring and early warning of operation conditions of power grid service information system | |
| CN115118581B (en) | Internet of things data all-link monitoring and intelligent guaranteeing system based on 5G | |
| CN112769605B (en) | Heterogeneous multi-cloud operation and maintenance management method and hybrid cloud platform | |
| KR102041545B1 (en) | Event monitoring method based on event prediction using deep learning model, Event monitoring system and Computer program for the same | |
| JPWO2019116418A1 (en) | Fault analyzer, fault analysis method and fault analysis program | |
| CN109032904A (en) | Monitored, management server and data acquisition, analysis method and management system | |
| JP6252309B2 (en) | Monitoring omission identification processing program, monitoring omission identification processing method, and monitoring omission identification processing device | |
| CN109634808A (en) | A kind of chain type monitor event root cause analysis method based on association analysis | |
| US11815989B2 (en) | Automated methods and systems for identifying problems in data center objects | |
| JP2012108708A (en) | Failure detection device, information processing method, and program | |
| CN114911677A (en) | Monitoring method and device for containers in cluster and computer readable storage medium | |
| JP2022037107A (en) | Failure analysis device, failure analysis method, and failure analysis program | |
| Jha et al. | Holistic measurement-driven system assessment | |
| CN112732531A (en) | Monitoring data processing method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB03 | Change of inventor or designer information | ||
| CB03 | Change of inventor or designer information |
Inventor after: Shu Xinjian Inventor after: Xu Siya Inventor after: Sheng Lei Inventor after: Yue Gangyi Inventor after: Zhang Ningning Inventor after: Dong Gangsong Inventor after: Guo Shaoyong Inventor after: Jin Yi Inventor after: Wang Shiwen Inventor after: An Zhiyuan Inventor after: Luo Zhen Inventor after: Zhang Xiaojun Inventor after: Li Wencui Inventor before: Shu Xinjian Inventor before: Wang Shiwen Inventor before: An Zhiyuan Inventor before: Luo Zhen Inventor before: Zhang Xiaojun Inventor before: Li Wencui Inventor before: Sheng Lei Inventor before: Yue Gangyi Inventor before: Zhang Ningning |
|
| TA01 | Transfer of patent application right | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20201014 Address after: 450000 building C, office area, 87 South Road, 27 District, Henan, Songshan, Zhengzhou Applicant after: State Grid Henan electric power company information communication Co. Applicant after: Beijing University of Posts and Telecommunications Applicant after: State Grid Corporation of China Address before: 450000 building C, office building, 87 South Road, Zhengzhou, Henan, Songshan Applicant before: State Grid Henan electric power company information communication Co. Applicant before: State Grid Corporation of China |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |