CN108494594A - A kind of analysis method and system of EIGRP route networks failure - Google Patents
A kind of analysis method and system of EIGRP route networks failure Download PDFInfo
- Publication number
- CN108494594A CN108494594A CN201810233540.2A CN201810233540A CN108494594A CN 108494594 A CN108494594 A CN 108494594A CN 201810233540 A CN201810233540 A CN 201810233540A CN 108494594 A CN108494594 A CN 108494594A
- Authority
- CN
- China
- Prior art keywords
- sample
- training
- eigrp
- fdemc
- classification
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
- G06F18/2155—Generating training patterns; Bootstrap methods, e.g. bagging or boosting characterised by the incorporation of unlabelled data, e.g. multiple instance learning [MIL], semi-supervised techniques using expectation-maximisation [EM] or naïve labelling
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
- G06F18/232—Non-hierarchical techniques
- G06F18/2321—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
- G06F18/23213—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions with fixed number of clusters, e.g. K-means clustering
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0823—Errors, e.g. transmission errors
Landscapes
- Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- Computer Vision & Pattern Recognition (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Artificial Intelligence (AREA)
- Life Sciences & Earth Sciences (AREA)
- Probability & Statistics with Applications (AREA)
- Environmental & Geological Engineering (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a kind of FDEMC failure analysis methods of EIGRP route networks, the FDEMC failure analysis methods are the clustering methods based on EM algorithms and gauss hybrid models GMM, realize the unsupervised analysis that data are route to EIGRP, this approach includes the following steps：The routing message acquired in the EIGRP route networks carries out feature extraction and data prediction, forms training sample set；The gauss hybrid models GMM is trained using the training sample set to obtain the Clustering Model of training completion；The test sample for obtaining the EIGRP route networks inputs the test sample in the Clustering Model that the training is completed, to obtain the classification results of the test sample.The analytical judgment to EIGRP route network fault types can be achieved by the execution of this method, it is particularly possible to analyze and determine to the unknown failure in EIGRP route networks.In addition, the invention also discloses a kind of FDEMC trouble analysis systems of EIGRP route networks.
Description
Technical field
The present invention relates to field of communication technology more particularly to a kind of analysis methods and system of route network failure.
Background technology
With the fast development of Internet technology, networking products are more and more universal in production and living, the network scale of construction and multiple
Miscellaneous degree constantly increases, and IP network is gradually to offer high-quality traffic direction development, quality and network product of the user to network service
More stringent requirements are proposed for matter, and IP network monitors a kind of important means for having become network management, due to the service quality of routing
Directly influence the running quality of whole network, thus the monitoring of routing failure is become one in network monitor it is important in
Hold.
Routing failure refers to the case where Routing Protocol operation deviates normal condition.Route network fault diagnosis can be divided by Autonomous Domain
For intra-area routes identification and inter-domain routing identification, enhanced interior gateway routing protoc EIGRP (Enhanced Interior
Gateway Protocol, EIGRP) belong to intra-area routes agreement, have many advantages, such as that deployment is simple, highly reliable, robustness is good,
It is commonly applied to high reliability, the network field of high security, such as banking system and military system.If eigrp routing protocol
It is abnormal in the process of running or failure, it will cause very serious consequence, therefore effectively in identification EIGRP route networks
The failure and exception of appearance, for safeguarding that the normal operation of network is of great significance.
ShaikhA et al. proposes two different ospfs (Open Shortest Path
First, OSPF) Routing Protocol monitoring method, one is the SNMP methods based on management platform, another kind be based on LSAR with
Control platform method has been applied to analyze OSPF in actual enterprise's ospf network with monitoring by the control platform method of LSAG
Various actions performance in the actual environment；The specific framework of this monitoring method has also been set forth in detail in ShaikhA et al., and
Realize this recognition methods.In recent years, machine learning is introduced in network fault diagnosis field, there is researcher will
Neural network algorithm and support vector machines in machine learning are applied in Network Fault Detecting and obtain good experimental result,
Demonstrate the feasibility that machine learning algorithm is applied in this field.However, the research in route network intelligent fault diagnosis field
OSPF Routing Protocols are all mainly concentrated on, the intelligent fault diagnosis of eigrp routing protocol network is studied still in missing shape
State；Further, the existing method based on neural network and support vector machines is on the sample basis including class label
Fault type is analyzed, i.e., they are a kind of recognition methods having supervision, being limited in that for this method can only identify
Some classifications (i.e. the class label), cannot identify new fault type in time, this can according to the differentiation of practical application
It can lead to the inaccurate and unreasonable of classification.
Information, which is transmitted, in eigrp routing protocol mainly finds by reliable transport protocol (RTP) and neighbours and restores two
Module is realized；The routing iinformation of router both is from direct-connected neighbor router in eigrp routing protocol network, each to route
Only there is neighbor router port routing information in device, and neighbor router can be in the same way from the adjoining direct-connected with them
Router obtains routing iinformation, and the operating mechanism of itself is different with traditional OSPF Routing Protocols, rip routing protocol, cannot
The method for diagnosing faults of other Routing Protocols is simply indiscriminately imitated, therefore, there is an urgent need for one kind can either diagnosing EIGRP routings by network administrator
Failure, and the intellectual analysis identification technology of unknown failure type can be identified in time.
Invention content
The present invention discloses a kind of FDEMC failures of the EIGRP route networks based on EM algorithms and gauss hybrid models GMM point
Method and system is analysed, solving can not be analyzed in the prior art for EIGRP routing failures, and cannot be identified in time unknown
The technical issues of routing failure.
In order to solve the above technical problems, one aspect of the present invention is to provide a kind of EIGRP route networks
FDEMC failure analysis methods, the FDEMC failure analysis methods are the cluster sides based on EM algorithms and gauss hybrid models GMM
Method is realized the unsupervised analysis to the EIGRP route networks known fault and unknown failure, is included the following steps：Step S1,
The routing message acquired in the EIGRP route networks carries out feature extraction and data prediction, forms training sample set；Step
S2 trains the gauss hybrid models GMM to obtain the Clustering Model of training completion using the training sample set；The training is complete
At Clustering Model be the gauss hybrid models GMM for having optimized parameter, and the optimized parameter is calculated by using EM algorithms
It arrives；Step S3 obtains the test sample of the EIGRP route networks, and the test sample is inputted the poly- of the training completion
In class model, to obtain the classification results of the test sample and then identify the operation conditions of the EIGRP route networks；Into one
It walks, the feature extracted in the step S1 includes at least operation code, label, confirms sequence number, self-aid system number, K value fields, AS
Domain field, summarize automatically, IP address is discontinuous, source router, destination router, the feature for indicating not same area router setting.
In another embodiment of the FDEMC failure analysis methods of EIGRP route networks of the present invention, the step S2 includes
Following steps：The training sample set is divided into m sample set by step S21, and each sample set indicates a classification,
Three mean value of each classification, covariance and weight initial parameter values are calculated on the basis of the m sample set to be formed
The initial parameter vector set of the m classificationIts
InThe weight initial value of the m classification is indicated respectively,The m is indicated respectively
The mean value initial value of a classification,The covariance initial value of the m classification is indicated respectively；Step S22,
Following two steps operation is repeatedly carried out, until the log-likelihood function of the gauss hybrid models GMM is restrained：E steps：Described
Training sample set and the estimation of parameter current vector setGiven situation
Under, calculate the conditional expectation of the log-likelihood function of the training sample set：
The wijIndicate that i-th of sample belongs to the probability of jth class, x indicates that the sample of d dimensions, θ indicate Gaussian Mixture
The parameter vector set of model, t=0,1 ..., J indicate that the current iteration number of EM algorithms, J indicate that the maximum in EM algorithms changes
Generation number；Parameter value of the kth class under current t values iteration in expression parameter vector set；Indicate kth class in current t values
Weight under iteration；Indicate sample average of the kth class under current t values iteration；Indicate kth class in current t values iteration
Under covariance matrix；
M steps：Update the parameter of gauss hybrid modelsMake the conditional expectation of the log-likelihood function
Value maximizes：
WhereinIt is the weight of jth class,It is the mean value of jth class, is d dimensional vectors,It is the covariance matrix of jth class,
For d rank symmetric positive definite matrixs, d indicates that the dimension of training sample, N indicate the number of training sample in the training sample.
In another embodiment of the FDEMC failure analysis methods of EIGRP route networks of the present invention, the step S21 is adopted
The model start-up parameter that the gauss hybrid models GMM is obtained with random initializtion method, specifically includes following steps：First,
The center for being arbitrarily designated m sample as cluster is concentrated in training sample, m is classification sum herein, and m is positive integer；Second, point
Not Ji Suan training sample concentrate at a distance from m sample of other samples and this, each sample is divided into m using apart from nearest principle
In one type in class, and distribute identical class label；Third is calculated according to all kinds of all sample values per a kind of power
Weight, mean value and covariance matrix.
In another embodiment of the FDEMC failure analysis methods of EIGRP route networks of the present invention, when progress Gaussian Mixture
When model GM M training, the maximum iteration of EM algorithms is set as 50 times.
In another embodiment of the FDEMC failure analysis methods of EIGRP route networks of the present invention, according to training sample set
Actual conditions, cluster cluster quantity be arranged ranging from 3 to 10.
Further, the present invention also proposes a kind of FDEMC trouble analysis systems of EIGRP route networks, the FDEMC failures
Analysis system includes preprocessing module, model execution module, cluster result output module, to realize to the EIGRP routing networks
The unsupervised analysis of network known fault and unknown failure, wherein：Preprocessing module, for acquiring in the EIGRP route networks
Routing message carry out feature extraction and data prediction, form training sample set；Model execution module, for using the instruction
Practice sample set and trains the gauss hybrid models GMM to obtain the Clustering Model of training completion；The Clustering Model that the training is completed
It is there is the gauss hybrid models GMM of optimized parameter, and the optimized parameter is calculated by using EM algorithms；Cluster result is defeated
Go out module, the test sample is inputted the poly- of the training completion by the test sample for obtaining the EIGRP route networks
In class model, to obtain the classification results of the test sample and then identify the operation conditions of the EIGRP route networks；Into one
Step, the feature of preprocessing module extraction include at least operation code, label, confirm sequence number, self-aid system number, K value fields,
The domains AS field summarizes, the spy that IP address is discontinuous, router is arranged in source router, destination router and representative domain automatically
Sign.
In another embodiment of the FDEMC trouble analysis systems of EIGRP route networks of the present invention, the model executes mould
Block is specifically included with lower unit：The training sample set is divided into m sample set, each sample by initial computation unit
One classification of set representations, at the beginning of the mean value, covariance and weight three of each classification are calculated on the basis of the m sample set
Beginning parameter value is to form the initial parameter vector set of the m classificationWhereinThe weight initial value of the m classification is indicated respectively,The m is indicated respectively
The mean value initial value of a classification,The covariance initial value of the m classification is indicated respectively；Convergence calculates
Unit repeatedly carries out following two steps operation, until the log-likelihood function of the gauss hybrid models GMM is restrained：E steps：
Estimate in the training sample set and parameter current vector setIt gives
In the case of fixed, the conditional expectation of the log-likelihood function of the training sample set is calculated：
The wijIndicate that i-th of sample belongs to the probability of jth class, x indicates that the sample of d dimensions, θ indicate Gaussian Mixture
The parameter vector set of model, t=0,1 ..., J indicate that the current iteration number of EM algorithms, J indicate that the maximum in EM algorithms changes
Generation number；Parameter value of the kth class under current t values iteration in expression parameter vector set；Indicate kth class in current t values
Weight under iteration；Indicate sample average of the kth class under current t values iteration；Indicate kth class in current t values iteration
Under covariance matrix；
M steps：Update the parameter of gauss hybrid modelsMake the conditional expectation of the log-likelihood function
Value maximizes：
WhereinIt is the weight of jth class,It is the mean value of jth class, is d dimensional vectors,It is the covariance matrix of jth class,
For d rank symmetric positive definite matrixs, d indicates that the dimension of training sample, N indicate the number of training sample in the training sample.
In another embodiment of the FDEMC trouble analysis systems of EIGRP route networks of the present invention, the initial calculation list
Member obtains the model start-up parameter of the gauss hybrid models GMM using random initializtion method, specifically includes following steps：The
One, the center for being arbitrarily designated m sample as cluster is concentrated in training data, m is classification sum herein；Second, it calculates separately
At a distance from m sample of other samples and this, each sample is divided into the one type in m classes using apart from nearest principle,
And distribute identical class label；Third is calculated according to all kinds of all sample values per a kind of weight, mean value and covariance square
Battle array.
In another embodiment of the FDEMC trouble analysis systems of EIGRP route networks of the present invention, when progress Gaussian Mixture
When model GM M training, the maximum iteration of EM algorithms is set as 50 times.
In another embodiment of the FDEMC trouble analysis systems of EIGRP route networks of the present invention, according to training sample set
Actual conditions, cluster cluster quantity be arranged ranging from 3 to 10.
The beneficial effects of the invention are as follows：The present invention provides a kind of FDEMC analysis methods of EIGRP route networks failure,
The analysis method is a kind of unsupervised clustering based on EM algorithms and gauss hybrid models GMM, is not only realized to EIGRP
The real-time analytical judgment of route network failure can also analyze the unknown failure in eigrp network.Further, this hair
The bright feature being also creatively extracted for clustering improves reliability, the robustness of this method in practical applications
And adaptability.In addition, the invention also provides a kind of FDEMC analysis systems of EIGRP route networks failure.
Description of the drawings
Fig. 1 is the route network monitoring mould for the FDEMC failure analysis methods of application EIGRP route networks of the present invention
Type；
Fig. 2 is the flow chart of an embodiment of the FDEMC failure analysis methods of EIGRP route networks of the present invention；
Fig. 3 is the initial method flow chart according to the FDEMC failure analysis methods of EIGRP route networks of the present invention；
Fig. 4 is the classification under different iterations according to the FDEMC failure analysis methods of EIGRP route networks of the present invention
Precision schematic diagram；
Fig. 5 is the classification essence under different number of clusters amounts according to the FDEMC failure analysis methods of EIGRP route networks of the present invention
Spend schematic diagram；
Fig. 6 is the FDEMC trouble analysis system composition figures of EIGRP route networks of the present invention.
Specific implementation mode
To facilitate the understanding of the present invention, in the following with reference to the drawings and specific embodiments, the present invention will be described in more detail.
The preferred embodiment of the present invention is given in attached drawing.But the present invention can realize in many different forms, and it is unlimited
In this specification described embodiment.Make to the disclosure on the contrary, purpose of providing these embodiments is
Understand more thorough and comprehensive.
It should be noted that unless otherwise defined, all technical and scientific terms used in this specification with belong to
The normally understood meaning of those skilled in the art of the present invention is identical.Used term in the description of the invention
It is to be not intended to the limitation present invention to describe the purpose of specific embodiment.Term "and/or" packet used in this specification
Include any and all combinations of one or more relevant Listed Items.
Gauss hybrid models GMM (Gaussian Mixed Model, GMM) refers to the linear of multiple gauss of distribution function
Combination, theoretically gauss hybrid models GMM can fit any type of distribution, commonly used in solving the number under identity set
The case where according to comprising multiple and different distributions, wherein cluster is one of its common scene, clustering algorithm refers to not having a pile
The data of label are divided into classes of method automatically.Gauss hybrid models GMM is mixed by the Gaussian Profile with different model parameters
It is combined into, by calculating the weighted sum of several Gaussian probability-density functions, the distribution situation of input data set is described,
It can be with the Density Distribution of smoothed approximation arbitrary shape.
When using gauss hybrid models GMM come when clustering, it is assumed that the data that we have had are by gauss hybrid models
What GMM was generated, as long as releasing the probability distribution of gauss hybrid models GMM according to data come then high at this time
The K Component of this mixed model GMM has actually just corresponded to K group or class (cluster).It is calculated according to data
Probability density is commonly referred to as density estimation (density estimation), particularly, when we are at known (or hypothesis)
The form of probability density function, and to estimate the process of parameter therein and be referred to as " parameter Estimation ".
It is now assumed that we have N number of data point, and assume that they obey some distribution (being denoted as p (x)), it is now in determining
The value of some parameters in face, for example, in gauss hybrid models GMM, we are just it needs to be determined that πk、μkAnd ΣkThese parameters.It is main
The idea wanted is to find such one group of parameter, and probability distribution determined by it generates the maximum probability of these given data points,
And this probability is actually equal toThis product is referred to as likelihood function (likelihood by we
function).Probability all very littles of usual a single point, the number of many very littles be multiplied get up easily caused in computer it is floating
Points underflow, therefore we would generally take logarithm to it, and product is become to sum it upObtain log-likelihood function
log‐likelihood function.Next we as long as by this function maximization, (common practice is that derivation and enabling is led
Number is equal to zero, then solves equation), that is, such one group of parameter value is found, it allows likelihood function to obtain maximum value, we are considered as
This is most suitable parameter, and this completes the processes of parameter Estimation.
According to the above, we can obtain the log-likelihood function log- of gauss hybrid models GMM
Likelihood function are：
Due to having adduction inside log-likelihood function (1), the method that we cannot directly be solved equation with derivation is directly asked
Obtain maximum value.Therefore, EM (Expectation Maximization Algorithm) algorithms are introduced to solve Gaussian Mixture
The log-likelihood function of model GM M.
EM algorithms it is expected very big algorithm, are a kind of iterative algorithms.It is expected that very big algorithm is suitable for containing hidden variable probability
Model carries out maximum a posteriori estimate to the parameter in model.The each iterative process of EM algorithms is divided into two steps, referred to as E
Step and M steps, E steps it is expected that M steps are used for maximizing for asking, and E steps and M walk continuous alternating iteration to increase total log-likelihood
Until convergence, while solving the problems, such as that maximum value is absorbed in local optimum by way of successive ignition.E is walked：For training sample
Each sample concentrated calculates the probability that the sample belongs to each cluster, and is weighed result of calculation as the sample of the sample
Weight：As soon as if the possibility that sample belongs to some cluster is very big, the corresponding probability value of the sample is disposed proximate to 1；When going out
When a case where existing data sample belongs to two or more clusters occurs, it is necessary to establish a probability for different clusters point
Cloth.M is walked：The sample weights that each sample is concentrated in conjunction with input sample estimate the relevant parameters such as variance, mean value in each cluster
Meter；The probability that each sample is calculated using in back passes through calculating as weight, similar K-MEANS cluster algorithms
The mean value and variance of each cluster are obtained, and further calculates the maximum likelihood of cluster, obtains final result.That is, ought be seemingly
When right function is bounded function, it is expected that very big algorithm makes likelihood function value increase by iteration calculating, until likelihood function
Value converges to a stability boundaris.Due to the extremely simple calculating process of EM algorithms and conveniently characteristic, in medical diagnosis and sample
The various fields such as this cluster are used widely.
Specifically, it is assumed that mixed distribution P, P, which are distributed by k independent Gaussian and (are referred to as Component), to be formed, and is led to
The mode for crossing mixed distribution creates the set of data samples D that sample is tieed up comprising N number of d, then by the weighted average of k Gaussian density function
The distribution P of represented probability density function description is：
Wherein
Wherein, formula (2) is referred to as gauss hybrid models, may also be referred to as Gaussian Mixture Model Probability Density, i.e., by multiple gaussian densities
The limited set of composition.In the gauss hybrid models, x indicates random sample, θ expression parameter vector set, πjIndicate Gauss
The weight of basic mode type Gaussian density function, μ in mixed modeljRepresent the mean value of jth class sample；ΣjIndicate the association of jth class sample
Variance matrix.
It is similar with clustering method, there is different initiation parameters, each different Gauss in Gaussian density function
Model is considered as a cluster or classification.After data sample x inputs, by model formation (2) and (3) result of calculation, then
It is compared with result of calculation using a preset threshold value, judges whether data sample x belongs to the Gauss model.
As shown in the above, the gauss hybrid models GMM based on EM algorithms can be used for Unsupervised clustering analysis.This
A kind of FDEMC (the Fault Detection based on Expectation of EIGRP route networks of disclosure of the invention
Maximization Clustering) failure analysis methods are exactly a kind of event based on EM algorithms and gauss hybrid models GMM
Hinder analysis method, data can be route to the EIGRP of collection and carry out unsupervised analysis, it can also be to EIGRP route networks
Unknown failure carries out diagnostic analysis, improves the reasonability and accuracy to EIGRP route network accident analyses.
Fig. 1 shows the route network monitoring of the EIGRP route network FDEMC failure analysis methods for the application present invention
Model.
Route network monitoring model in the present invention by more routers, monitoring node PC, eigrp routing protocol and
Other procotols such as OSPF, routing information protocol RIP (Routing Information Protocol) form.In the present invention
Route network it is more complicated, more meet the situation in true environment.Route network is made of multiple domains AS, disposes OSPF, RIP
With the Routing Protocols such as Border Gateway Protocol (BGP) (Border Gateway Protocol).With the increase of route network scale,
According to the characteristic of eigrp routing protocol, monitoring node quantity is consequently increased.When disposing monitoring node, by itself and route network
In core router be connected, so as to collect the routing message for flowing through this network to greatest extent.
Information, which is transmitted, in eigrp routing protocol mainly finds by reliable transport protocol (RTP) and neighbours and restores two
Module is realized；Routing table in each router only has the Port IP of neighbor router, the router in EIGRP route systems
Neighbor router is all relied on routing iinformation, and neighbor router obtains routing letter from their neighbor router there
Breath.Therefore when disposing monitoring node, generally it is connected with the center router of route network, to realize capture quantities of messages
It maximizes.In practical operation, monitoring node is incorporated to by monitored route system by hub, monitoring node is avoided to influence road
By the normal operation of system.
In route network monitoring model shown in Fig. 1, EIGRP route monitorings network is by 20 Cisco's C3640 routers
It is formed with 2 monitoring hosts, wherein 16 routers separately constitute the domains AS1 171, the domains AS2 172, the domains AS3 173 and the domains AS4 174,
There are 4 routers 10 in each domains AS；Wherein eigrp routing protocol, 174 middle part of the domains AS4 are disposed in the domains AS1 171 and the domains AS3 173
OSPF Routing Protocols are affixed one's name to, RIP agreements are disposed in the domains AS2 172；In addition to intra-area routes, also router 11, router 12, road
By inter domain routers such as device 13, routers 14, BGP inter-domain routing protocols are disposed in these inter domain routers；In whole network
Two monitoring hosts of middle deployment, monitoring node 15 are connected with router 12, and monitoring node 16 is connected with router 11, collects respectively
All routing messages transmitted by core router 12,11.
Further, it manually resets the relevant parameter in each router, reappears failure in EIRGP route systems and different
Often, and while failure occurs, the routing data message being monitored in router is collected using sniffer, after carrying out
Continuous clustering.
Fig. 2 is the flow chart of an embodiment of the FDEMC failure analysis methods of EIGRP route networks of the present invention.In Fig. 2
In, the FDEMC failure analysis methods of the EIGRP route networks include the following steps：
Step S1, the routing message acquired in the EIGRP route networks carry out feature extraction and data prediction, are formed
Training sample set；
For machine learning algorithm, since sample data is unable to the sample data under limit all situations,
Therefore feature extraction it is appropriate whether to a certain extent on the learning effect of machine learning influence it is very big, in the prior art
There are many articles to show for same training sample, when the feature difference of extraction, the classifying quality brought also can be different,
Therefore, correctly the feature of extraction EIGRP route networks is just particularly important.The feature extraction of EIGRP route networks and data
Pretreatment refer to be by the EIGRP of capture routing Message processing can be with the choosing of the sample set of training machine learning model, including feature
It takes and the arrangement of data format.Collected routing message amount is more in the present invention, and is also contaminated with OSPF routing reports
The noise datas such as text, so the data progress data prediction to acquisition is most important, on the one hand pretreatment can improve data
Quality, on the other hand data can be allowed to be better suited for analyzing.The routing message acquired in the present invention is from as shown in Figure 1
It is acquired in EIGRP route monitoring networks.
Preferably, EIGRP, which route the field in message included, version, operation code, verification and label, sequence number, confirmation
The field of the various description routing iinformations such as sequence number, self-aid system number, failure route version in message, verification and sequence number etc.
This kind of field is not different with normal routing message, so this kind of field will not be chosen as data sample feature.
Preferably, existing known fault type has six kinds, is that syntople establishes failure, routing publication failure, road respectively
Failure is redistributed by installation failure, route flapping failure, Route summary failure, routing.The reason of syntople can not be established has K
Value is different or not in the same domains AS, the K value fields routeing in message and the domains AS field will be selected as sample characteristics at this time,
To identify adjacent failure.Remaining failure, which all refers to router, can not receive or issue rational routing entry, and reason has certainly
It is dynamic summarize, IP address is discontinuous etc., so summarize automatically, whether IP address is continuously chosen as sample characteristics, to distinguish these
Routing failure caused by reason.In addition, message length field contributes to fault distinguishing, therefore the field is also chosen as sample spy
Sign.
Preferably, correlated characteristic is extracted in conjunction with primary routing message and EIGRP phenomena of the failure, in the routing message of acquisition,
The field values such as sourceIP, destinationIP are invalid for actual analysis, and actual IP can constantly change, and can not pass through tool
The IP address of body judges EIGRP routing failure reasons, so this kind of field is converted into useful feature information, such as will
Two Continuous valued attributes of sourceIP and destinationIP be converted to sourceRoute and adjacencyRoute it is this kind of from
Scattered classification value；In addition, in EIGRP route networks, the router setting in the different domains AS is different, these settings can't be
It is embodied in routing message, but route network can be caused to be abnormal, this kind of setting needs are manually extracted as sample characteristics.Feature
After the completion of extraction, initial data message is converted to the CSV formatted data files that can carry out machine learning analysis.Table 1 is shown
All sample characteristics and its meaning selected in the present invention.
Table 1
By the analysis to routeing message in EIGRP route networks, the present invention proposes EIGRP route networks for identification
The feature of failure includes at least operation code in the feature, label, confirms sequence number, self-aid system number, K value fields, the domains AS word
Section, summarize automatically, IP address is discontinuous, source router, destination router, the setting of same area router.
In addition, when route network breaks down or is abnormal, by the data packet of capture it is found that there was only a small number of data packets
In information can change, cause exceptional sample quantity be far less than normal sample quantity, make in sample set occur data not
Equilibrium appearance has an impact accident analysis and model accuracy.There are many kinds of the methods of data balancing, can generally pass through receipts
Collect more data and carry out balance sample collection, but eigrp routing protocol is in usual stable operation, even if breaking down or abnormal
When, it is to be still HELLO data packets to be transmitted in route network at most, and fault data packet quantity does not have too big variation.
So the method for taking oversampling in the present invention carries out data balancing, oversampling is by increasing minority class sample in sample set
For quantity come to realize sample equilibrium, simplest method be exactly to replicate minority class sample to form a plurality of record, this method is easy, straight
It connects, but the disadvantage is that if sample characteristics are less, is likely to result in over-fitting.Under normal circumstances, imbalanced training sets can also be led
Cause feature distribution unbalanced, but group very this measurer has certain scale, then the distribution of its characteristic value is more uniform, passes through
The cooperation of the feature with notable type is selected to participate in solving the problems, such as imbalanced training sets.In the data packet acquired in the present invention in addition to
The data packet of EIGRP also wants the data packet of the Routing Protocols such as OSPF, RIP and BGP, these data packets are medium in training sample set
It is same as noise data.Due to the presence of these noises, over-fitting can be prevented to a certain extent.
Step S2：The gauss hybrid models GMM is trained using the training sample set to obtain the cluster of training completion
Model；The Clustering Model that the training is completed is the gauss hybrid models GMM for having optimized parameter, and the optimized parameter by using
EM algorithms are calculated.
Preferably, the step S2 includes：
The training sample set is divided into m sample set by step S21, and each sample set indicates a classification,
Three mean value of each classification, covariance and weight initial parameter values are calculated on the basis of the m sample set to be formed
State the initial parameter vector set of m classificationIts
InThe weight initial value of the m classification is indicated respectively,The m is indicated respectively
The mean value initial value of a classification,The covariance initial value of the m classification is indicated respectively；
Step S22 repeatedly carries out following two steps operation, until the log-likelihood function of the gauss hybrid models GMM
Convergence：
E steps：Estimate in the training sample set and parameter current vector set
In the case of given, the conditional expectation of the log-likelihood function of the training sample set is calculated：
The wijIndicate that i-th of sample belongs to the probability of jth class；θ expression parameter vector set；X is indicated in sample set
A sample；T=0,1 ..., J indicate that the current iteration number of EM algorithms, J indicate the maximum iteration in EM algorithms；Parameter value of the kth class under current t values iteration in expression parameter vector set；Indicate kth class under current t values iteration
Weight；Indicate sample average of the kth class under current t values iteration；Indicate association of the kth class under current t values iteration
Variance matrix；
M steps：Update the parameter of gauss hybrid modelsMake the conditional expectation of the log-likelihood function
Value maximizes：
WhereinIt is the weight of jth class,It is the mean value of jth class, is d dimensional vectors,It is the covariance matrix of jth class,
For d rank symmetric positive definite matrixs, d indicates that the dimension of training sample, N indicate the number of training sample in the training sample.
Step S3 obtains the test sample of the EIGRP route networks, and the test sample input training is completed
Clustering Model in, to obtain the classification results of the test sample and then identify the operation conditions of the EIGRP route networks.
The wherein test sample, can be identical with training sample, can also be different with training sample.It has been trained generally for determination
The test effect of the Clustering Model of completion, can select the test sample different with training sample to be tested.
The FDEMC failure analysis methods of EIGRP routing networks proposed by the present invention are a kind of unsupervised clustering learning sides
Method can analyze the fault type and reason of EIGRP route networks in real time, can also to unknown failure and reason into
On the one hand row automatic identification can help the exception occurred in network related personnel's real-time oversight network and failure etc., another party
Face can improve people to unknown abnormal understanding in network, management and maintenance of the optimum management personnel to network.Further, it ties
Close the feature extracted of the present invention, can improve FDEMC failure analysis methods adaptability in practical applications, reliability and
Robustness.
Preferably, when presorting to training sample set, the type number presorted can be pre-set.When setting
It is 1 to set the type number presorted, at this time the pseudocode of the FDEMC failure analysis methods of the EIGRP route networks
It can indicate as follows：
Fig. 3 shows the specific implementation of the initial method of the FDEMC failure analysis methods of EIGRP route networks of the present invention
Mode.When the FDEMC failure analysis methods initialization operation, in order to obtain the initial parameter value of each sample class, i.e. mean value
With covariance matrix etc. it is necessary to carrying out operation of presorting to sample set.The performance of FDEMC failure analysis methods is largely
It can be influenced by initiation parameter, on the one hand appropriate initiation parameter can accelerate the establishment speed of model, on the other hand
Model table can be made to reveal excellent clustering performance.
FDEMC failure analysis methods are when calculating the initiation parameter of gauss hybrid models GMM, using random initializtion side
Method, this method, which has, calculates the characteristics such as simple, operation is convenient.FDEMC failure analysis methods specifically include following steps：Step
S31, it is assumed that the classification sum that input sample is concentrated is m, and center of the m sample as m cluster is randomly selected from sample set；Step
Rapid S32 calculates in sample set all remaining samples with m cluster center at a distance from, relatively more each residue sample and m cluster center
The residue sample is divided with apart from nearest cluster center in same class, and marks identical category by distance；Step S33, according to
Data sample included in each cluster, calculates the weight of each cluster, mean value and covariance matrix parameter.
In another embodiment of the invention, in order to evaluate the clustering performance of FDEMC failure analysis methods, based on identical
Training sample set, iterations and test sample collection are carried out at the same time the experimental analysis of K-MEANS algorithms and DBSCAN algorithms；K‐
MEANS is most common cluster algorithm, when the sample concentrated to training sample carries out practical cluster, according to sample and sample
Euclidean distance size between this is classified；DBSCAN belongs to a kind of density clustering algorithm, the data sample selected from some
It sets out as cluster center, constantly calculates the density at cluster center and other samples, expand to the reachable region of density to cluster range
, finally obtain a maximization region for including core sample point and boundary sample point, any two in the same area
Density is connected (i.e. density is reachable) between data sample.Experimental result is as shown in table 2, from Table 2, it can be seen that K-MEANS and
The classification error rate of DBSCAN is both greater than 50%, and Clustering Effect is undesirable；Compared to the common clustering algorithm model of first two,
The classification performance of FDEMC cluster algorithms is excellent, and error rate is far below first two Clustering Model.It can also be seen that from table 2
The number of clusters that three kinds of models finally create is essentially identical.
2 model experiment results of table compare
Fig. 4 shows the FDEMC cluster analysis results under different iterations.Figure 4, it is seen that FDEMC failures
The sample misclassification rate of the analysis not linear decrease with the increase of iterations, when iterations are set as 50 times and 500 times,
Lower value is presented in sample misclassification rate；When iterations rise to 200 times to 450 times, sample misclassification rate highest, Clustering Model
Classification performance show at this time it is worst；When iterations are set greater than 500 times, sample misclassification rate also rises therewith.Cause
This, when carrying out gauss hybrid models GMM training, in order to obtain optimum cluster performance, operation iterations should be set as 50 times.
Fig. 5 shows influence result of the different number of clusters amounts to FDEMC failure analysis methods.In clustering, cluster
(cluster) quantity can both be automatically generated by algorithm, can also be needed manually to be arranged according to experiment.It can from Fig. 5
To find out, when cluster quantity differences, model misclassification rate also will produce variation.When cluster number is 5, model
Misclassification rate is minimum, and only 24% or so；According to the actual conditions of training sample set, the zone of reasonableness of cluster quantity arrives for 3
10, when cluster number is other values, misclassification rate is all higher than 30%, illustrates in current training set and test set, gathers
When the number of clusters of class model is 5, Clustering Model best performance.
Fig. 6 shows an a kind of embodiment of the FDEMC trouble analysis systems of EIGRP route networks of the present invention.In Fig. 6
In, the FDEMC trouble analysis systems 61 of EIGRP route networks include preprocessing module 62, model execution module 63, cluster result
Output module 64.The routing message that wherein preprocessing module 62 is used to acquire in the EIGRP route networks carries out feature extraction
And data prediction, form training sample set；
For machine learning algorithm, since sample data is unable to the sample data under limit all situations,
Therefore feature extraction it is appropriate whether to a certain extent on the learning effect of machine learning influence it is very big, in the prior art
There are many articles to show for same training sample, when the feature difference of extraction, the classifying quality brought also can be different,
Therefore, correctly the feature of extraction EIGRP route networks is just particularly important.The feature extraction of EIGRP route networks and data
Pretreatment refer to be by the EIGRP of capture routing Message processing can be with the choosing of the sample set of training machine learning model, including feature
It takes and the arrangement of data format.Collected routing message amount is more in the present invention, and is also contaminated with OSPF routing reports
The noise datas such as text, so the data progress data prediction to acquisition is most important, on the one hand pretreatment can improve data
Quality, on the other hand data can be allowed to be better suited for analyzing.The routing message acquired in the present invention is from as shown in Figure 1
It is acquired in EIGRP route monitoring networks.
Preferably, EIGRP, which route the field in message included, version, operation code, verification and label, sequence number, confirmation
The field of the various description routing iinformations such as sequence number, self-aid system number, failure route version in message, verification and sequence number etc.
This kind of field is not different with normal routing message, so this kind of field will not be chosen as data sample feature.
Preferably, existing known fault type has six kinds, is that syntople establishes failure, routing publication failure, road respectively
Failure is redistributed by installation failure, route flapping failure, Route summary failure, routing.The reason of syntople can not be established has K
Value is different or not in the same domains AS, the K value fields routeing in message and the domains AS field will be selected as sample characteristics at this time,
To identify adjacent failure.Remaining failure, which all refers to router, can not receive or issue rational routing entry, and reason has certainly
It is dynamic summarize, IP address is discontinuous etc., so summarize automatically, whether IP address is continuously chosen as sample characteristics, to distinguish these
Routing failure caused by reason.In addition, message length field contributes to fault distinguishing, therefore the field is also chosen as sample spy
Sign.
Preferably, correlated characteristic is extracted in conjunction with primary routing message and EIGRP phenomena of the failure, in the routing message of acquisition,
The field values such as sourceIP, destinationIP are invalid for actual analysis, and actual IP can constantly change, and can not pass through tool
The IP address of body judges EIGRP routing failure reasons, so this kind of field is converted into useful feature information, such as will
Two Continuous valued attributes of sourceIP and destinationIP be converted to sourceRoute and adjacencyRoute it is this kind of from
Scattered classification value；In addition, in EIGRP route networks, the router setting in the different domains AS is different, these settings can't be
It is embodied in routing message, but route network can be caused to be abnormal, this kind of setting needs are manually extracted as sample characteristics.Feature
After the completion of extraction, initial data message is converted to the CSV formatted data files that can carry out machine learning analysis.In the present invention
All sample characteristics and its meaning of selection such as aforementioned table 1 are shown.
By the analysis to routeing message in EIGRP route networks, the present invention proposes EIGRP route networks for identification
The feature of failure includes at least operation code in the feature, label, confirms sequence number, self-aid system number, K value fields, the domains AS word
Section, summarize automatically, IP address is discontinuous, source router, destination router, the setting of same area router.
In addition, when route network breaks down or is abnormal, by the data packet of capture it is found that there was only a small number of data packets
In information can change, cause exceptional sample quantity be far less than normal sample quantity, make in sample set occur data not
Equilibrium appearance has an impact accident analysis and model accuracy.There are many kinds of the methods of data balancing, can generally pass through receipts
Collect more data and carry out balance sample collection, but eigrp routing protocol is in usual stable operation, even if breaking down or abnormal
When, it is to be still HELLO data packets to be transmitted in route network at most, and fault data packet quantity does not have too big variation.
So the method for taking oversampling in the present invention carries out data balancing, oversampling is by increasing minority class sample in sample set
For quantity come to realize sample equilibrium, simplest method be exactly to replicate minority class sample to form a plurality of record, this method is easy, straight
It connects, but the disadvantage is that if sample characteristics are less, is likely to result in over-fitting.Under normal circumstances, imbalanced training sets can also be led
Cause feature distribution unbalanced, but group very this measurer has certain scale, then the distribution of its characteristic value is more uniform, passes through
The cooperation of the feature with notable type is selected to participate in solving the problems, such as imbalanced training sets.In the data packet acquired in the present invention in addition to
The data packet of EIGRP also wants the data packet of the Routing Protocols such as OSPF, RIP and BGP, these data packets are medium in training sample set
It is same as noise data.Due to the presence of these noises, over-fitting can be prevented to a certain extent.
Model execution module 63, for training the gauss hybrid models GMM using the training sample set to obtain instruction
Practice the Clustering Model completed；The Clustering Model that the training is completed is the gauss hybrid models GMM for having optimized parameter, and this is optimal
Parameter is calculated by using EM algorithms.
Preferably, the model execution module 63 is specifically included with lower unit：
The training sample set is divided into m sample set by initial computation unit 631, and each sample set indicates one
A classification calculates three mean value, covariance and weight initial parameter values of each classification on the basis of the m sample set
To form the initial parameter vector set of the m classificationIts
InThe weight initial value of the m classification is indicated respectively,The m is indicated respectively
The mean value initial value of a classification,The covariance initial value of the m classification is indicated respectively；
Computing unit 632 is restrained, following two steps operation is repeatedly carried out, until the logarithm of the gauss hybrid models GMM
Likelihood function is restrained：
E steps：Estimate in the training sample set and parameter current vector setIn the case of given, the training is calculated
The conditional expectation of the log-likelihood function of sample set：
The wijIndicate that i-th of sample belongs to the probability of jth class；θ expression parameter vector set；X is indicated in sample set
A sample；T=0,1 ..., J indicate the current iteration number of EM algorithms；J indicates the maximum iteration in EM algorithms；Parameter value of the kth class under current t values iteration in expression parameter vector set；Indicate kth class under current t values iteration
Weight；Indicate sample average of the kth class under current t values iteration；Indicate association of the kth class under current t values iteration
Variance matrix；
M steps：Update the parameter of gauss hybrid modelsMake the conditional expectation of the log-likelihood function
Value maximizes：
WhereinIt is the weight of jth class,It is the mean value of jth class, is d dimensional vectors,It is the covariance matrix of jth class,
For d rank symmetric positive definite matrixs, d indicates that the dimension of training sample, N indicate the number of training sample in the training sample.
Cluster result output module 64, the test sample for obtaining the EIGRP route networks, by the test sample
It inputs in the Clustering Model that the training is completed, to obtain the classification results of the test sample and then identify the roads EIGRP
By the operation conditions of network.The wherein test sample, can be identical with training sample, can also be different with training sample.
Generally for the test effect for having trained the Clustering Model completed is determined, the test sample different with training sample can be selected to carry out
Test.
The FDEMC trouble analysis systems of EIGRP routing networks proposed by the present invention are a kind of based on Unsupervised clustering study
The system that method is realized, can analyze the fault type and reason of EIGRP route networks in real time, can also be to unknown
Failure and reason carry out automatic identification, on the one hand can help the exception occurred in network related personnel's real-time oversight network and event
Barrier etc., on the other hand can improve people to unknown abnormal understanding in network, management and dimension of the optimum management personnel to network
Shield.Further, in conjunction with the feature extracted of the present invention, the FDEMC failure analysis methods in practical applications suitable can be improved
Ying Xing, reliability and robustness.
Preferably, the execution modules of FDEMC models described in Fig. 6 63 are in the initiation parameter for calculating gauss hybrid models GMM
When, initial computation unit 631 uses random initializtion method, and this method, which has, calculates the characteristics such as simple, operation is convenient.Specific step
It is rapid as follows：The first step, it is assumed that the classification sum that input sample is concentrated is m, and m sample is randomly selected from sample set as m
The center of cluster；Second step calculates all remaining samples in sample set and compares each remaining sample and m at a distance from m cluster center
The residue sample is divided with apart from nearest cluster center in same class, and marks identical category by the distance at a cluster center；The
Three steps carry out the parameters such as the weight, mean value and covariance matrix of each cluster according to data sample included in each cluster
It calculates.
Fig. 4 shows the FDEMC cluster analysis results under different iterations.Figure 4, it is seen that FDEMC failures
The sample misclassification rate of the analysis not linear decrease with the increase of iterations, when iterations are set as 50 times and 500 times,
Lower value is presented in sample misclassification rate；When iterations rise to 200 times to 450 times, sample misclassification rate highest, point of model
Class performance shows worst at this time；When iterations are set greater than 500 times, sample misclassification rate also rises therewith.Therefore, when
When carrying out gauss hybrid models GMM training, in order to obtain optimum cluster performance, operation iterations should be set as 50 times.
Fig. 5 shows influence result of the different number of clusters amounts to FDEMC accident analyses.In clustering, cluster
(cluster) quantity can both be automatically generated by algorithm, can also be needed manually to be arranged according to experiment.It can from Fig. 5
To find out, when cluster quantity differences, Clustering Model misclassification rate also will produce variation.When cluster number is 5, gather
The misclassification rate of class model is minimum, and only 24% or so；According to the actual conditions of training sample set, cluster quantity it is reasonable
Ranging from 3 to 10, when cluster number is other values, misclassification rate is all higher than 30%, illustrates in current training set and survey
Examination is concentrated, and when the number of clusters of Clustering Model is 5, model performance is optimal.
It can be seen that the present invention provides a kind of FDEMC routing failures based on EM algorithms and gauss hybrid models GMM point
Analyse method and system.FDEMC methods belong to unsupervised learning, and the sample that training and test sample are concentrated is without category label；Due to
The Clustering features that FDEMC has can not only diagnose known fault, while can also gather to unknown failure sample
Class, it can be found that unknown route network failure.I.e. the present invention is realized by FDEMC methods to the real-time of routing network failure
Analysis, meets the requirement in practical application.In addition, by the feature in reasonable drawing EIGRP route networks, effectively increase
The recognition effect of FDEMC clusters, improves reliability, robustness and the adaptability of the FDEMC failure analysis methods and system.
Example the above is only the implementation of the present invention is not intended to limit the scope of the invention, every to utilize this hair
Equivalent structure transformation made by bright specification and accompanying drawing content is applied directly or indirectly in other relevant technical fields,
Similarly it is included within the scope of the present invention.
Claims (10)
1. a kind of FDEMC failure analysis methods of EIGRP route networks, the FDEMC failure analysis methods are to be based on EM algorithms
With the clustering method of gauss hybrid models GMM, realize to the unsupervised of the EIGRP route networks known fault and unknown failure
Analysis, which is characterized in that include the following steps：
Step S1, the routing message acquired in the EIGRP route networks carry out feature extraction and data prediction, form training
Sample set；
Step S2 trains the gauss hybrid models GMM to obtain the Clustering Model of training completion using the training sample set；
The Clustering Model that the training is completed is the gauss hybrid models GMM for having optimized parameter, and the optimized parameter is calculated by using EM
Method is calculated；
Step S3 obtains the test sample of the EIGRP route networks, and the test sample is inputted the poly- of the training completion
In class model, to obtain the classification results of the test sample and then identify the operation conditions of the EIGRP route networks；
Further, the feature extracted in the step S1 includes at least operation code, label, confirms sequence number, self-aid system number, K
Value field, the domains AS field, summarize automatically, IP address is discontinuous, source router, destination router, indicates that same area router is not set
The feature set.
2. a kind of FDEMC failure analysis methods of EIGRP route networks according to claim 1, which is characterized in that described
Step S2 includes the following steps：
The training sample set is divided into m sample set by step S21, and each sample set indicates a classification, described
Three mean value, covariance and weight initial parameter values of each classification are calculated on the basis of m sample set to form the m
The initial parameter vector set of classification
WhereinThe weight initial value of the m classification is indicated respectively,Institute is indicated respectively
The mean value initial value of m classification is stated,The covariance initial value of the m classification is indicated respectively；
Step S22 repeatedly carries out following two steps operation, until the log-likelihood function of the gauss hybrid models GMM is restrained：
E steps：Estimate in the training sample set and parameter current vector set
In the case of given, the trained sample is calculated
The conditional expectation of the log-likelihood function of this collection：
The wijIndicate that i-th of sample belongs to the probability of jth class, x indicates that the sample of d dimensions, θ indicate gauss hybrid models
Parameter vector set；T=0,1 ..., J indicate that the current iteration number of EM algorithms, J indicate the greatest iteration time in EM algorithms
Number；Parameter value of the kth class under current t values iteration in expression parameter vector set；Indicate kth class in current t values iteration
Under weight；Indicate sample average of the kth class under current t values iteration；Indicate kth class under current t values iteration
Covariance matrix；
M steps：Update the parameter of gauss hybrid models GMMMake the conditional expectation of the log-likelihood function
It maximizes：
WhereinIt is the weight of jth class,It is the mean value of jth class,It is the covariance matrix of jth class, N indicates the trained sample
The number of training sample in this.
3. the FDEMC failure analysis methods of EIGRP route networks according to claim 2, which is characterized in that step S21
The model start-up parameter that the gauss hybrid models GMM is obtained using random initializtion method, specifically includes following steps：
First, it concentrates the center for being arbitrarily designated m sample as cluster, wherein m to indicate classification sum in training sample, is just whole
Number；
Second, it calculates separately training sample and concentrates at a distance from m sample of other samples and this, using will be each apart from nearest principle
Sample is divided into the one type in m classes, and distributes identical class label；
Third is calculated according to all kinds of all sample values per a kind of weight, mean value and covariance matrix.
4. the FDEMC failure analysis methods of EIGRP route networks according to claim 1, which is characterized in that high when carrying out
When the GMM training of this mixed model, the maximum iteration of EM algorithms is set as 50 times.
5. the FDEMC failure analysis methods of EIGRP route networks according to claim 1, which is characterized in that according to training
The actual conditions of sample set, the quantity for clustering cluster are arranged ranging from 3 to 10.
6. a kind of FDEMC trouble analysis systems of EIGRP route networks, which is characterized in that the FDEMC trouble analysis systems packet
Preprocessing module, model execution module, cluster result output module are included, to realize to the EIGRP route networks known fault
With the unsupervised analysis of unknown failure, wherein：
Preprocessing module carries out feature extraction and data prediction for acquiring the routing message in the EIGRP route networks,
Form training sample set；
Model execution module, for training the gauss hybrid models GMM to obtain trained completion using the training sample set
Clustering Model；The Clustering Model that the training is completed is the gauss hybrid models GMM for having optimized parameter, and the optimized parameter is logical
It crosses and is calculated using EM algorithms；
The test sample is inputted institute by cluster result output module, the test sample for obtaining the EIGRP route networks
In the Clustering Model for stating training completion, to obtain the classification results of the test sample and then identify the EIGRP route networks
Operation conditions；
Further, the feature of preprocessing module extraction include at least operation code, label, confirm sequence number, self-aid system number,
K value fields, the domains AS field, summarize automatically, IP address is discontinuous, router in source router, destination router and representative domain
The feature of setting.
7. the FDEMC trouble analysis systems of EIGRP route networks according to claim 6, which is characterized in that the model
Execution module is specifically included with lower unit：
The training sample set is divided into m sample set by initial computation unit, and each sample set indicates a classification,
Three mean value of each classification, covariance and weight initial parameter values are calculated on the basis of the m sample set to be formed
The initial parameter vector set of the m classificationIts
InThe weight initial value of the m classification is indicated respectively,The m is indicated respectively
The mean value initial value of a classification,The covariance initial value of the m classification is indicated respectively；
Computing unit is restrained, following two steps operation is repeatedly carried out, until the log-likelihood function of the gauss hybrid models GMM
Convergence：
E steps：Estimate in the training sample set and parameter current vector setIt gives
In the case of fixed, the conditional expectation of the log-likelihood function of the training sample set is calculated：
The wijIndicate that i-th of sample belongs to the probability of jth class, x indicates that the sample of d dimensions, θ indicate gauss hybrid models
Parameter vector set, t=0,1 ..., J indicate that the current iteration number of EM algorithms, J indicate the greatest iteration time in EM algorithms
Number；Parameter value of the kth class under current t values iteration in expression parameter vector set；Indicate kth class in current t values iteration
Under weight；Indicate sample average of the kth class under current t values iteration；Indicate kth class under current t values iteration
Covariance matrix；
M steps：Update the parameter of gauss hybrid modelsKeep the conditional expectation of the log-likelihood function maximum
Change：
WhereinIt is the weight of jth class,It is the mean value of jth class,It is the covariance matrix of jth class, N indicates the trained sample
The number of training sample in this.
8. the FDEMC trouble analysis systems of EIGRP route networks according to claim 7, which is characterized in that described initial
Computing unit obtains the model start-up parameter of the gauss hybrid models GMM using random initializtion method, specifically includes following
Step：
First, the center for being arbitrarily designated m sample as cluster is concentrated in training data, N is classification sum herein；
Second, it calculates separately at a distance from m sample of other samples and this, each sample is divided into m using apart from nearest principle
In one type in class, and distribute identical class label；
Third is calculated according to all kinds of all sample values per a kind of weight, mean value and covariance matrix.
9. the FDEMC trouble analysis systems of EIGRP route networks according to claim 6, which is characterized in that high when carrying out
When the GMM training of this mixed model, the maximum iteration of EM algorithms is set as 50 times.
10. the FDEMC trouble analysis systems of EIGRP route networks according to claim 6, which is characterized in that according to instruction
The actual conditions for practicing sample set, the quantity for clustering cluster are arranged ranging from 3 to 10.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810233540.2A CN108494594A (en) | 2018-03-21 | 2018-03-21 | A kind of analysis method and system of EIGRP route networks failure |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810233540.2A CN108494594A (en) | 2018-03-21 | 2018-03-21 | A kind of analysis method and system of EIGRP route networks failure |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN108494594A true CN108494594A (en) | 2018-09-04 |
Family
ID=63318832
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810233540.2A Pending CN108494594A (en) | 2018-03-21 | 2018-03-21 | A kind of analysis method and system of EIGRP route networks failure |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108494594A (en) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110309492A (en) * | 2019-06-29 | 2019-10-08 | 河北工业大学 | Wind power generating set health degree appraisal procedure based on scatter diagram Data Dimensionality Reduction technology |
| CN110879971A (en) * | 2019-10-23 | 2020-03-13 | 上海宝信软件股份有限公司 | Method and system for predicting abnormal operation condition of industrial production equipment |
| CN111077876A (en) * | 2019-12-11 | 2020-04-28 | 湖南大唐先一科技有限公司 | Power station equipment state intelligent evaluation and early warning method, device and system |
| CN111614518A (en) * | 2020-05-20 | 2020-09-01 | 中国电子科技集团公司第五十四研究所 | Automatic safety testing method based on OSPF protocol |
| CN112488371A (en) * | 2020-11-20 | 2021-03-12 | 国网福建省电力有限公司厦门供电公司 | Pipeline intelligent early warning method and system based on big data |
| CN114630352A (en) * | 2020-12-11 | 2022-06-14 | 中国移动通信集团湖南有限公司 | Fault monitoring method and device of access equipment |
| CN115430815A (en) * | 2022-08-09 | 2022-12-06 | 衡阳镭目科技有限责任公司 | Crystallizer liquid level control method and device, electronic equipment and storage medium |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107483267A (en) * | 2017-09-19 | 2017-12-15 | 中国人民解放军防空兵学院 | A kind of EIGRP routing failures recognition methods |
-
2018
- 2018-03-21 CN CN201810233540.2A patent/CN108494594A/en active Pending
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107483267A (en) * | 2017-09-19 | 2017-12-15 | 中国人民解放军防空兵学院 | A kind of EIGRP routing failures recognition methods |
Non-Patent Citations (2)
| Title |
|---|
| 张德喜等: "一种适合于大数据集处理的混合EM算法", 《计算机应用》 * |
| 陈英: "高斯混合模型聚类及其优化算法研究", 《中国优秀硕士毕业论文全文数据库信息科技辑》 * |
Cited By (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110309492A (en) * | 2019-06-29 | 2019-10-08 | 河北工业大学 | Wind power generating set health degree appraisal procedure based on scatter diagram Data Dimensionality Reduction technology |
| CN110309492B (en) * | 2019-06-29 | 2020-08-04 | 河北工业大学 | Wind generating set health degree evaluation method based on diffusion map data dimension reduction technology |
| CN110879971A (en) * | 2019-10-23 | 2020-03-13 | 上海宝信软件股份有限公司 | Method and system for predicting abnormal operation condition of industrial production equipment |
| CN110879971B (en) * | 2019-10-23 | 2023-06-13 | 上海宝信软件股份有限公司 | Industrial production equipment operation abnormal condition prediction method and system |
| CN111077876A (en) * | 2019-12-11 | 2020-04-28 | 湖南大唐先一科技有限公司 | Power station equipment state intelligent evaluation and early warning method, device and system |
| CN111077876B (en) * | 2019-12-11 | 2021-06-08 | 湖南大唐先一科技有限公司 | Power station equipment state intelligent evaluation and early warning method, device and system |
| CN111614518A (en) * | 2020-05-20 | 2020-09-01 | 中国电子科技集团公司第五十四研究所 | Automatic safety testing method based on OSPF protocol |
| CN111614518B (en) * | 2020-05-20 | 2021-08-31 | 中国电子科技集团公司第五十四研究所 | Automatic safety testing method based on OSPF protocol |
| CN112488371A (en) * | 2020-11-20 | 2021-03-12 | 国网福建省电力有限公司厦门供电公司 | Pipeline intelligent early warning method and system based on big data |
| CN114630352A (en) * | 2020-12-11 | 2022-06-14 | 中国移动通信集团湖南有限公司 | Fault monitoring method and device of access equipment |
| CN114630352B (en) * | 2020-12-11 | 2023-08-15 | 中国移动通信集团湖南有限公司 | Fault monitoring method and device for access equipment |
| CN115430815A (en) * | 2022-08-09 | 2022-12-06 | 衡阳镭目科技有限责任公司 | Crystallizer liquid level control method and device, electronic equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108494594A (en) | A kind of analysis method and system of EIGRP route networks failure | |
| Verma et al. | Evaluation of network intrusion detection systems for RPL based 6LoWPAN networks in IoT | |
| Zhang et al. | Social influence locality for modeling retweeting behaviors | |
| Wang et al. | On credibility estimation tradeoffs in assured social sensing | |
| De Donato et al. | Traffic identification engine: an open platform for traffic classification | |
| CN110414555A (en) | Detect the method and device of exceptional sample | |
| US20160212163A1 (en) | Method and Apparatus to Identify the Source of Information or Misinformation in Large-Scale Social Media Networks | |
| Le et al. | Data analytics on network traffic flows for botnet behaviour detection | |
| Sun et al. | An intrusion detection model for wireless sensor networks with an improved V-detector algorithm | |
| CN107241358A (en) | A kind of smart home intrusion detection method based on deep learning | |
| Zhang et al. | A data set accuracy weighted random forest algorithm for IoT fault detection based on edge computing and blockchain | |
| CN108632269A (en) | Detecting method of distributed denial of service attacking based on C4.5 decision Tree algorithms | |
| CN108683564B (en) | Network simulation system reliability evaluation method based on multidimensional decision attributes | |
| CN108650649B (en) | Abnormal data detection method suitable for wireless sensor network | |
| Du et al. | LTrust: An adaptive trust model based on LSTM for underwater acoustic sensor networks | |
| CN106060039B (en) | A kind of classification and Detection method of network-oriented abnormal data stream | |
| Xiao et al. | A traffic classification method with spectral clustering in SDN | |
| Atli | Anomaly-based intrusion detection by modeling probability distributions of flow characteristics | |
| Eunice et al. | Network anomaly detection technology based on deep learning | |
| Guo et al. | FullSight: A feasible intelligent and collaborative framework for service function chains failure detection | |
| CN112291226B (en) | Method and device for detecting abnormity of network flow | |
| Tran | Network anomaly detection | |
| Choukri et al. | A novel deep learning-based framework for blackhole attack detection in unsecured RPL networks | |
| CN114866301B (en) | Encryption traffic identification and classification method and system based on direct push graph | |
| Rahman et al. | ANFIS based cyber physical attack detection system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20180904 |