CN109617715A

CN109617715A - Network fault diagnosis method, system

Info

Publication number: CN109617715A
Application number: CN201811427043.2A
Authority: CN
Inventors: 严睿
Original assignee: Unihub China Information Technology Co Ltd
Current assignee: Unihub China Information Technology Co Ltd; Zhongying Youchuang Information Technology Co Ltd
Priority date: 2018-11-27
Filing date: 2018-11-27
Publication date: 2019-04-12

Abstract

The present invention provides a kind of network fault diagnosis method, system, using in network history data symptom data collection and fault data collection to gradient promoted Tree Classifier prediction model be trained, then Tree Classifier prediction model is promoted using the gradient after training carry out network fault diagnosis, network fault diagnosis precision can be effectively improved, and can effectively shorten network failure diagnosis time, adapt to diversification production scene.

Description

Network fault diagnosis method, system

Technical field

The present invention relates to to-talk internet technical field more particularly to a kind of network fault diagnosis method, system, computers Equipment and computer readable storage medium.

Background technique

With the fast development of information technology, the scale of network system constantly expands, and complexity is also higher and higher, network In certain a part break down when can cause a series of symptoms, if fault point, whole network cannot be detected timely and accurately System function, reliability service, safety in production can all be affected, result even in network paralysis.Therefore, it timely and effectively examines Circuit network failure is particularly significant.

The method that early stage relies on expertise network failure has been difficult to ensure the steady of current extensive, high complexity network It is qualitative.Therefore, in large complicated network, intelligent diagnostics are widely applied, for example carry out failure point using NB Algorithm Class.

NB Algorithm (naive Bayes, abbreviation NB) is the supervised learning algorithm based on Bayes rule, it is abided by Bayesian assumption, also referred to as naive Bayesian conditional independence assumption are followed, which greatly simplifies the Bayes of the algorithm Network structure.But naive Bayesian conditional independence assumption is usually disagreed with true data cases in practice, leads to NB Nicety of grading it is low, and then cause the precision of network fault diagnosis low.

Summary of the invention

In view of this, the present invention provides a kind of network fault diagnosis method, system, computer equipment and computer-readable Storage medium can effectively improve network fault diagnosis precision.

To achieve the goals above, the present invention adopts the following technical scheme:

In a first aspect, providing a kind of network fault diagnosis method, comprising:

Network history data is read, which includes: symptom data collection and fault data collection；

Tree Classifier prediction model is promoted to gradient using the symptom data collection and fault data collection to be trained；

Tree Classifier prediction model, which is promoted, using the gradient after training carries out network fault diagnosis.

Further, this using the symptom data collection and fault data collection to gradient promoted Tree Classifier prediction model into Row training, comprising:

The symptom data collection and the fault data collection are inputted into the gradient and promote Tree Classifier prediction model, obtains and is somebody's turn to do Gradient promotes the corresponding multiple prediction results of more boosted trees in Tree Classifier prediction model；

The training objective that the gradient promotes Tree Classifier prediction model is calculated according to multiple prediction results；

More boosted trees are trained according to multiple prediction results and the training objective.

Further, this calculates the training objective packet that the gradient promotes Tree Classifier prediction model according to multiple prediction results It includes:

The penalty values of more boosted trees are calculated according to multiple prediction results, the fault data collection；

Summation operation is carried out to the penalty values of more boosted trees and obtains the training objective.

Further, the penalty values that more boosted trees are calculated according to multiple prediction results, the fault data collection, comprising:

The penalty values of first boosted tree are calculated according to the prediction result of first boosted tree and the fault data collection；

The residual error of the m-1 boosted tree is calculated according to multiple prediction results and the fault data collection；

According to the prediction result of the m boosted tree and the damage of the m boosted tree of residual computations of the m-1 boosted tree Mistake value；Wherein, m is the positive integer greater than 1.

Further, this is trained more boosted trees according to multiple prediction results and the training objective, comprising:

The gradient value of the boosted tree is calculated according to the prediction result of a boosted tree and the training objective；

The weight of the boosted tree is adjusted according to the gradient value.

Further, the prediction result according to a boosted tree and the training objective calculate the gradient value of the boosted tree, Include:

The derivative of training objective and n-th boosted tree under training dataset is calculated to arrange；

Derivative is arranged and is averaging, the gradient value of n-th tree is obtained.

Further, this includes: according to the weight that the gradient value adjusts the boosted tree

The gradient value is added to the weight after being adjusted in the weight of the boosted tree.

Further, which it is as follows to promote Tree Classifier prediction model:

In formula, F (x) is the prediction result that gradient promotes Tree Classifier prediction model, ρ_nIndicate the power of n-th boosted tree Weight, f_n(x) prediction result of n-th boosted tree is indicated, M indicates the total quantity of boosted tree, and K indicates total training round, and k indicates the K wheel training, wherein K value is determined by the stability of F (x).

Further, the network fault diagnosis method further include:

The gradient is generated using CART algorithm and promotes Tree Classifier prediction model.

Further, the network fault diagnosis method further include:

Corresponding troubleshooting suggestion is searched for simultaneously in troubleshooting suggestion database according to the result of network fault diagnosis Feed back to user.

Second aspect provides a kind of network fault diagnosis system, comprising:

Reading device reads network history data, which includes: symptom data collection and fault data Collection；

Training device promotes Tree Classifier prediction model to gradient using the symptom data collection and fault data collection and carries out Training；

Diagnostic device promotes Tree Classifier prediction model using the gradient after training and carries out network fault diagnosis.

Further, which includes:

The symptom data collection and the fault data collection are inputted the gradient and promote Tree Classifier prediction mould by prediction module Type obtains multiple prediction results corresponding with more boosted trees in gradient promotion Tree Classifier prediction model；

Computing module calculates the training objective that the gradient promotes Tree Classifier prediction model according to multiple prediction results；

Training module is trained more boosted trees according to multiple prediction results and the training objective.

Further, which includes:

Penalty values computing unit calculates the penalty values of more boosted trees according to multiple prediction results, the fault data collection；

Addition unit carries out summation operation to the penalty values of more boosted trees and obtains the training objective.

Further, which includes:

First calculator, according to the prediction result and the fault data collection first boosted tree of calculating of first boosted tree Penalty values；

Residual computations device calculates the residual error of the m-1 boosted tree according to multiple prediction results and the fault data collection；

Second calculator, according to the residual computations m of the prediction result of the m boosted tree and the m-1 boosted tree The penalty values of boosted tree；Wherein, m is the positive integer greater than 1.

Further, which includes:

Gradient value computing unit calculates the gradient of the boosted tree according to the prediction result of a boosted tree and the training objective Value；

Weight adjustment unit adjusts the weight of the boosted tree according to the gradient value.

Further, which includes:

Derived function device calculates the derivative of training objective and n-th boosted tree under training dataset and arranges；

Gradient value calculator arranges derivative and is averaging, and obtains the gradient value of n-th tree.

Further, the network fault diagnosis system further include:

Model generating means generate the gradient using CART algorithm and promote Tree Classifier prediction model.

Further, the network fault diagnosis system further include:

It is recommended that providing device, corresponding event is searched in troubleshooting suggestion database according to the result of network fault diagnosis Barrier excludes to suggest and feeds back to user.

The third aspect, provides a kind of computer equipment, including memory, processor and storage on a memory and can located The computer program processor run on reason device realizes the step of above-mentioned network fault diagnosis method when executing the computer program Suddenly.

Fourth aspect provides a kind of computer readable storage medium, is stored thereon with computer program, the computer program The step of above-mentioned network fault diagnosis method is realized when being executed by processor.

The present invention provides a kind of network fault diagnosis method, system, computer equipment and computer readable storage medium, Using in network history data symptom data collection and fault data collection to gradient promoted Tree Classifier prediction model instruct Practice, then promotes Tree Classifier prediction model using the gradient after training and carry out network fault diagnosis, network can be effectively improved Fault diagnosis precision, and can effectively shorten network failure diagnosis time, adapt to diversification production scene.

For above and other objects, features and advantages of the invention can be clearer and more comprehensible, preferred embodiment is cited below particularly, And cooperate institute's accompanying drawings, it is described in detail below.

Detailed description of the invention

In order to illustrate the technical solutions in the embodiments of the present application or in the prior art more clearly, to embodiment or will show below There is attached drawing needed in technical description to be briefly described, it should be apparent that, the accompanying drawings in the following description is the application Some embodiments for those of ordinary skill in the art without creative efforts, can also basis These attached drawings obtain other attached drawings.In the accompanying drawings:

Fig. 1 shows the architecture diagram of network system.

Fig. 2 a is the flow chart one of network fault diagnosis method of the embodiment of the present invention；

Fig. 2 b is the message subscribing schematic diagram between client and server；

Fig. 3 shows the specific steps of step S200 in Fig. 2；

Fig. 4 a is the structural schematic diagram that gradient promotes Tree Classifier prediction model in the embodiment of the present invention；

Fig. 4 b to Fig. 4 e, which is shown, promotes the schematic diagram that Tree Classifier prediction model realizes precise classification using gradient；

Fig. 5 shows the specific steps of step S220 in Fig. 3；

Fig. 6 shows the specific steps of step S221 in Fig. 5；

Fig. 7 shows the specific steps of step S230 in Fig. 3；

Fig. 8 shows the specific steps of step S231 in Fig. 7；

Fig. 9 is the flowchart 2 of network fault diagnosis method of the embodiment of the present invention；

Figure 10 shows the knot that a boosted tree in Tree Classifier prediction model is promoted using the gradient that CART method generates Structure schematic diagram.

Figure 11 shows the schematic diagram that cut operator is carried out to the boosted tree of generation.

Figure 12 is the flow chart 3 of network fault diagnosis method of the embodiment of the present invention；

Figure 13 is the structure chart one of network fault diagnosis system of the embodiment of the present invention；

Figure 14 is the structure chart two of network fault diagnosis system of the embodiment of the present invention；

Figure 15 is the structure chart three of network fault diagnosis system of the embodiment of the present invention；

Figure 16 is the structure chart four of network fault diagnosis system of the embodiment of the present invention；

Figure 17 is the structure chart of computer equipment of the embodiment of the present invention.

Specific embodiment

In order to make those skilled in the art more fully understand application scheme, below in conjunction in the embodiment of the present application Attached drawing, the technical scheme in the embodiment of the application is clearly and completely described, it is clear that described embodiment is only The embodiment of the application a part, instead of all the embodiments.Based on the embodiment in the application, ordinary skill people Member's every other embodiment obtained without making creative work, all should belong to the model of the application protection It encloses.

It should be understood by those skilled in the art that, the embodiment of the present invention can provide as method, system or computer program Product.Therefore, complete hardware embodiment, complete software embodiment or reality combining software and hardware aspects can be used in the present invention Apply the form of example.Moreover, it wherein includes the computer of computer usable program code that the present invention, which can be used in one or more, The computer program implemented in usable storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) produces The form of product.

It should be noted that term " includes " and " tool in the description and claims of this application and above-mentioned attached drawing Have " and their any deformation, it is intended that cover it is non-exclusive include, for example, containing a series of steps or units Process, method, system, product or equipment those of are not necessarily limited to be clearly listed step or unit, but may include without clear Other step or units listing to Chu or intrinsic for these process, methods, product or equipment.

It should be noted that in the absence of conflict, the features in the embodiments and the embodiments of the present application can phase Mutually combination.The application is described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

Modern network system has the characteristics that scale is big, network topology complexity is high.Certain a part breaks down in network, Can cause a series of symptoms, if accurately detecting fault point not in time, then the system function of whole network, reliability service, Safety in production can all be affected, and result even in network paralysis, therefore, timely and effectively diagnostic network failure is particularly significant.

To solve problems of the prior art, the embodiment of the present invention provide a kind of network fault diagnosis method, system, Computer equipment and computer readable storage medium, using the fault data sample in network history data to gradient boosted tree Classifier prediction model is trained, and realizes operation management experience accumulation precipitating, for former because of load abnormal, hardware in network Failure caused by barrier, network attack invasion, artificial incorrect operation and contingency etc., can be automatically positioned network without manpower intervention Failure, and can determine that failure root because realizing automation, intelligentized fault diagnosis, improving diagnosis efficiency, be suitable for application in large size In complex network, to reduce the artificial workload for carrying out malfunction elimination and processing response, ensure operation management standard in execution level Landing can be implemented, automation, the intelligent level of network O&M system is promoted, improves network operation efficiency.

Network fault diagnosis method provided in an embodiment of the present invention and system are mainly used in network system 10 shown in FIG. 1 In, which includes: network element 101, Network Management Equipment 102, monitoring device 103 and network fault diagnosis device 104.Its In, network element 101 refers to the network equipment or entity of complete independently one or more function, such as router, interchanger；Network management Equipment 102 is then mainly used for carrying out comprehensive management to network element 101, for example, Network Management Equipment 102 can pass through the fast automatic search of algorithm Network element 101, and the link relationship and operating status of real-time display Internet resources, the core parameter of real-time monitoring network element 101 are such as supervised Survey router and port flow, port utilization, memory usage, the routing table of interchanger etc., the operation shape of monitoring server The indexs such as state, starting situation, memory, disk, process, service；And monitoring device 103 is then mainly used for the application system to network And the operation conditions of application system is monitored；Network fault diagnosis device 104 is for executing the following net of the embodiment of the present invention Network method for diagnosing faults may be arranged on network element 101 or Network Management Equipment 102 with carrying out fault diagnosis to network system Device, it is also possible to be independently of network element 101 and Network Management Equipment 102 and with network element 101, Network Management Equipment 102 and monitoring device 103 devices that can be communicated, as shown in Figure 1, the present invention is not especially limit this.

Fig. 2 a is the flow chart one of network fault diagnosis method of the embodiment of the present invention.As shown in Figure 2 a, which examines Disconnected method includes:

Step S100: network history data is read.Wherein, which includes: symptom data collection and failure Data set.

The network history data is stored in the history data store framework based on distributed file system.

Wherein, symptom data collection (x₁~x_N) and corresponding fault data collection (y₁~y_N) respectively as sample data with And label data forms training data.

The symptom data collection is obtained by an Open Source Framework, for example is based on Redis (Remote Dictionary Server business datum) obtains framework.Redis is one and is stored by the key-value that Salvatore Sanfilippo writes System.Redis is being write using ANSI C language an of open source, abides by BSD agreement, support network, memory-based also may be used Log type, the Key-Value database of persistence, and the API of multilingual is provided.It is commonly known as data structure service Device, because value (value) can be character string (String), (sets) and ordered set are gathered in Hash (Map), list (list) Close types such as (sorted sets).

For the embodiment of the present invention, Redis frame is disposed in the position that each equipment generates interaction in network system, Redis receives the connection from client by way of monitoring a TCP port or Unix socket, when a company It will do it following some operations after connecing foundation, inside Redis:

Firstly, client socket can be arranged to non-blocking mode (because Redis is used in network event processing It is non-obstruction multiplexing model).

Then, TCP_NODELAY attribute is set for the socket, disables nagle algorithm；

Finally, the data that one readable file event of creation is used to monitor client socket are sent.

Person's mode that Redis uses message subscribing between a client and a server, as shown in Figure 2 b, client subscription service Device, and keep listening state.When server receive message provider sending message, relay to each client having subscribed End

In addition, data are carried out distributed storage for convenience, storage efficiency is improved, the data of Redis acquisition will adopt With Key-Value data structure.Key (key assignments) is the serial number for acquiring client operation, this serial number unique identification client Operation each time, Value (data) is the master data of the client or equipment operation, such as IP address, response time etc. Deng.The data acquired with specific data structure are uploaded to GFS distributed memory system

It is worth noting that it includes multiple attribute values that the symptom data, which concentrates every symptom data, it is worth noting that, Attribute include: IP address, hop count, input packet loss, output packet loss, interface operation, upstream delay, routing terminal away from From, gateway status, mode of operation, downlink delays, the response time, interface management state, router FS-BR-01 port Ping not Logical duration, first line of a couplet equipment fault situation, first line of a couplet equipment fault type etc..

Table 1 illustrates some attributes and its corresponding number:

Table 1:

Number	Attribute
		A1	IP address
A2	Hop count
		A3	Input packet loss
A4	Export packet loss
		A5	Interface operation
A6	Upstream delay
		A7	Route terminal distance
A8	Gateway status
		A9	Mode of operation
A10	Downlink delays

Table 2 enumerates a symptom data collection, which includes N symptom data x₁~x_N, wherein every symptom Data include 10 attribute values.

Table 2:

Serial number	A1	A2	……	A10
					x₁	192.168.1.3	3	……	3.090
x₂	59.37.152.129	3	……	0.918
					x₃	61.140.0.113	4	……	1.372
x₄	61.140.0.38	2	……	5.693
					x₅	192.168.1.3	2	……	4.539
x₆	59.37.152.129	5	……	1.058
					x₇	61.140.0.113	6	……	1.874
x₈	61.140.0.38	1	……	5.225
					……	……	……	……	……

The fault data collection tests and analyzes to obtain by expert, indicates the corresponding class of various failures.Wherein, failure is mainly wrapped Include equipment fault and traffic failure.Equipment fault includes: that equipment PU or memory usage continue high, equipment plate card and remove or again It opens, fan failure, power failure, device temperature exception, link congestion, Network Packet Loss, interface disconnect, port mismatches, route Failure etc..Traffic failure specifically includes that People Near Me interruption, VPN (virtual private net) service disconnection, VPLS (virtual private Local area network) service disconnection, address pool deficiency, route break, (PPOE is a kind of network communication protocol, one to dial up on the telephone to PPOE Kind of mode) service disconnection, WLAN (WLAN) Internet user can not obtain address, buffering is insufficient, bandwidth is insufficient, agreement not Matching, router FS-BR-01 port Down, the port router FS-BR-01 restarts, automatically replies, firewall ACL intercepts event Barrier, the damage of first line of a couplet equipment FS-CR-02-CRS board, first line of a couplet equipment FS-CR-02-CRS Port Management state Down failure, the first line of a couplet Equipment FS-CR-02-CRS Port Profile state Down failure etc..

Table 3 illustrates some failures and its corresponding class:

Table 3:

Table 4 gives the fault data collection corresponding to symptom data collection shown in table 2:

Table 4:

Serial number	Fault data (class)
		y₁	C1
y₂	C3
		y₃	C7
y₄	C5
		y₅	C5
y₆	C4
		y₇	C5
y₈	C3
		……	……

As an example it is assumed that { 3,500,2 } are a training datas, wherein be (3,500) symptom data, 2 be number of faults According to, wherein the symptom data corresponds to two attributes, i.e. attribute 1: hop count, attribute 2: the response time, 3 in symptom data The attribute value of attribute 1 is represented, i.e. hop count is 3 times, and 500 represent the attribute value of attribute 2, i.e. the response time is 500ms.Failure 2 representing fault type of data is the 2nd kind.

Step S200: Tree Classifier prediction model is promoted to gradient using the symptom data collection and fault data collection and is carried out Training.

Wherein, which is mainly that gradient promotes Tree Classifier prediction model to symptom data set (i.e. sample data) And its corresponding fault data collection carries out the process of supervised learning, operation management experience accumulation precipitating is realized, to instruct When promoting Tree Classifier prediction model progress network fault diagnosis using the gradient after the completion, the operation pipe learnt can be utilized Reason experience carries out intelligent diagnostics.

For example, by the way that symptom data collection (being equivalent to sample data) input gradient shown in table 2 is promoted Tree Classifier In prediction model, the corresponding prediction result of every symptom data is obtained, and by prediction result and fault data collection (phase shown in table 4 When in label data) it compares, the parameter of Tree Classifier prediction model is promoted according to comparison result regulating gradient, so as to adjust The prediction result that gradient afterwards promotes Tree Classifier prediction model can be realized to greatest extent close to fault data collection shown in table 4 Model training process.

Wherein, it is the training effect of assurance model, needs to promote gradient Tree Classifier prediction model and carry out more wheel training It is averaged, Tree Classifier prediction model is promoted with the gradient after being trained.

Step S300: Tree Classifier prediction model is promoted using the gradient after training and carries out network fault diagnosis.

Specifically, it can be put into real work after the completion of gradient promotes the training of Tree Classifier prediction model, it will be practical The input of the network operations data such as collected network element, the log of Network Management Equipment and monitoring device, alarm, configuration and KPI data should Gradient promotes Tree Classifier prediction model, which promotes Tree Classifier prediction model according to the operation pipe acquired in training process Reason experience can be diagnosed to be the failures such as abnormal network element and exception information, realize intelligent automatic trouble diagnosis.

It is worth noting that gradient promoted Tree Classifier prediction model need model training efficiency and model complexity it Between be balanced, that is, choose the quantity M of reasonable boosted tree.In order to guarantee that model training is abundant, the actual effect of model is improved, It needs to choose more boosted trees, but excessive boosted tree can not be chosen, because the quantity of boosted tree will excessively will lead to Fitting problems.Therefore, the embodiment of the present invention has chosen symptom data 700 shown in table 2, corresponding 700 fault datas, composition instruction Practice data, by training data respectively to the gradient containing 30,100,300,500 boosted trees promoted Tree Classifier prediction model into Then row training promotes Tree Classifier prediction model using the gradient after training and carries out network fault diagnosis, table 5, which is shown, to be contained 30, the gradient of 100,300,500 boosted trees promotes the fault diagnosis accuracy of Tree Classifier prediction model.

Table 5:

M	30	100	300	500
					Accuracy rate	83.43%	96.14%	96.14%	93.42%

As shown in Table 5 when training data is 700, accuracy rate highest when M is 100.

Therefore, in order to reach the balance between model training efficiency and model complexity, the embodiment of the present invention actually makes Used time, the quantity that gradient promotes boosted tree in Tree Classifier prediction model is chosen according to the item number of training data, such as root According to the ratio of the quantity of the item number and boosted tree of training data, alternatively, choosing several M values carries out test selection, the present invention is real Example is applied to this with no restriction.

In conclusion network fault diagnosis method provided in an embodiment of the present invention is pre- by using gradient promotion Tree Classifier Model is surveyed, the problem that computational complexity is high in existing network fault diagnosis, network diagnosis result error is big is can effectively solve the problem that, shows Write and improve the accuracy of network diagnosis, while keeping compared with low computational complexity, can reach preferable learning ability and Classification accuracy.

In addition, the network fault diagnosis method support router, interchanger, IPRAN equipment, OLT device, DSLAM equipment, Software defined network controller (such as Huawei's controller, in emerging controller and the arranging service device of some manufacturers), network security The fault diagnosis of the multiple networks equipment such as equipment and other purposes equipment (such as green alliance's safety equipment, firewall).

Fig. 3 shows the specific steps of step S200 in Fig. 2.As shown in figure 3, step S200 includes:

Step S210: the symptom data collection and the fault data collection are inputted into the gradient and promote Tree Classifier prediction mould Type obtains multiple prediction results corresponding with more boosted trees in gradient promotion Tree Classifier prediction model.

Wherein, the gradient promoted Tree Classifier prediction model T structure as shown in fig. 4 a, by M boosted tree Tree1~ TreeM composition.By symptom data collection (x₁~x_N) and corresponding fault data collection (y₁~y_N) respectively as sample data and Label data forms training data Train:

Train={ (x₁,y₁),(x₂,y₂),…,(x_N,y_N),

Training data Train is inputted the gradient to be promoted in Tree Classifier prediction model T, model T is trained.The ladder The final prediction result that degree promotes Tree Classifier prediction model T is to be weighted summation to 1~M of prediction result of M boosted tree Value obtained from being averaged later, promoting the process that Tree Classifier prediction model T is trained to gradient is actually to adjust respectively The process of the weight of boosted tree, so that the weight of the higher boosted tree of nicety of grading is higher, the lower boosted tree of nicety of grading Weight is lower, realizes that gradient promotes the precise classification of Tree Classifier prediction model T with this.

In the following, promoting Tree Classifier prediction model to gradient in conjunction with Fig. 4 b to 4e can be realized the principle progress of precise classification Illustrate, for being classified according to the symptom data collection containing two attribute of hop count and response time, Fig. 4 b to 4d shows Symptom data collection is mapped to two-dimensional space and classified by the assorting process for having gone out three different boosted trees, and horizontal axis indicates to ring Between seasonable, the longitudinal axis indicates that hop count, dash area indicate the decision that boosted tree is made, and the sample of zone circle indicates wrong report or leakage Sample is reported, three different boosted trees delimit different classifying rules, can as seen from the figure, three boosted trees fail to very Classify to data well.

Fig. 4 e is to combine the result of three boosted trees according to different weights, and it is pre- that composition gradient promotes Tree Classifier Obtained classification results after model are surveyed, specifically: it by the boosted tree shown in Fig. 4 b according to weight is promotion shown in 0.42, Fig. 4 c Tree according to weight is 0.65, the boosted tree shown in Fig. 4 d according to weight is 0.92 to be combined, that is: the prediction result of each boosted tree After being averaged according to the summation of corresponding Weight, final prediction result is obtained, three can be combined with as seen from the figure Model after boosted tree can well classify to data.Wherein, the weight of each boosted tree can be in successive ignition It is constantly adjusted in habit.

It is as follows that the gradient promotes Tree Classifier prediction model:

Wherein, it is averaged after training by carrying out more wheels to model, is capable of the training effect of assurance model, total training Round is determined by the stability of model, i.e., when model prediction result stability is preferable, can suitably reduce total training round, when When the prediction result stability of model is poor, need suitably to increase total training round, to increase the stability of model prediction.

Every boosted tree is tree, and the attribute based on symptom data classifies to symptom data, final To the corresponding class of symptom data (i.e. prediction result).

The training process of boosted tree be a kind of collection by symptom data based on inductive learning process, from out of order, random Symptom data collection then sets out, and derives the classifying rules of boosted tree representation, and then constructs classifier prediction model.

Boosted tree is made of node (Node) and directed edge (Directed Edge), and node includes a root node (in figure Indicated with diamond shape), several internal nodes (being indicated in figure with circle) and several leaf nodes (being indicated in figure with rectangle). Leaf node corresponds to prediction result, indicates the corresponding class of symptom data, other nodes then correspond to an attribute test, defeated Enter to the symptom data of node and is divided into child node according to the result of attribute test；Symptom data collection is input to root node. Path from root node to each leaf node has corresponded to a discriminating test sequence, and boosted tree the destination of study is to generate one Processing has no the strong boosted tree of example ability.

The essence of boosted tree study is that one group of correctly classification or prediction rule are extracted from training data.

Wherein, first boosted tree integrates (i.e. label data) with fault data and is learnt as target, first boosted tree Boosted tree later is learnt using the residual error of its previous boosted tree as target, i.e. latter boosted tree is fitted previous promotion The residual error of tree promotes the precision of Tree Classifier prediction model T so as to improve the gradient.

Step S220: the training objective that the gradient promotes Tree Classifier prediction model is calculated according to multiple prediction results.

That is: the gradient boosted tree point is calculated according to the prediction result that gradient promotes every one tree in Tree Classifier prediction model Total training objective of class device prediction model.

Step S230: more boosted trees are trained according to multiple prediction results and the training objective.

Specifically, promoting total training objective of Tree Classifier prediction model with the gradient is guidance, is instructed to model Practice.

To sum up, Tree Classifier prediction model and above-mentioned training method are promoted by using gradient, event can be effectively improved Hinder the precision and model training speed of diagnosis, reduces operand.

Fig. 5 shows the specific steps of step S220 in Fig. 3.As shown in figure 5, step S220 includes:

Step S221: the penalty values of more boosted trees are calculated according to multiple prediction results, the fault data collection.

Wherein, for for a certain boosted tree, which indicates the prediction result and the boosted tree of the boosted tree Learning objective between difference.Penalty values are smaller, illustrate that the precision of prediction of boosted tree is higher；Penalty values are bigger, illustrate to predict As a result the difference and between learning objective is bigger, and the precision of boosted tree is lower.

Step S222: summation operation is carried out to the penalty values of more boosted trees and obtains the training objective.

I.e. the training objective is calculated using following formula:

Wherein, J indicates the training objective, L_n(x) penalty values of n-th boosted tree are indicated, M indicates the sum of boosted tree Amount.

Fig. 6 shows the specific steps of step S221 in Fig. 5.As shown in fig. 6, step S221 includes:

Step S221a: according to the prediction result and the fault data collection first boosted tree of calculating of first boosted tree Penalty values.

Wherein, the penalty values L of first boosted tree₁(x) it is calculated using following formula:

L₁(y,f₁(x))=[y-f₁(x)]²/ 2,

Wherein, y indicates that fault data concentrates fault data, and x indicates that symptom data concentrates symptom data, f₁(x) the is indicated The prediction result of one boosted tree.

Step S221b: the residual error of the m-1 boosted tree is calculated according to multiple prediction results and the fault data collection.

Wherein, as m=2, the residual error Residual of the m-1 boosted tree (i.e. the 1st boosted tree)₁Using following formula It calculates:

Residual₁=y-f₁(x),

In formula, y indicates that the fault data that fault data is concentrated, x indicate the symptom data that symptom data is concentrated, f₁(x) table Show the prediction result of the 1st boosted tree.

As M > 2, the residual error Residual of the m-1 boosted tree_m-1It is calculated using following formula:

Residual_m-1=Residual_m-2-f_m-1(x),

Wherein, Residual_m-2Indicating the residual error of the m-2 boosted tree, x indicates the symptom data that symptom data is concentrated, f_m-1(x) prediction result of the m-1 boosted tree is indicated.

Step S221c: according to residual computations the m of the prediction result of the m boosted tree and the m-1 boosted tree The penalty values of boosted tree；Wherein, m is the positive integer greater than 1.

Wherein, the penalty values L of the m boosted tree_m(x) following formula is used:

L_m[Residual_m-1,f_m(x)]=[Residual_m-1-f_m(x)]²/ 2,

Wherein, Residual_m-1Indicate the residual error of the m-1 boosted tree, x indicates that symptom data concentrates symptom data, f_m (x) prediction result of the m boosted tree is indicated, m is the positive integer greater than 1.

Fig. 7 shows the specific steps of step S230 in Fig. 3.As shown in fig. 6, step S230 includes:

Step S231: the gradient value of the boosted tree is calculated according to the prediction result of a boosted tree and the training objective.

Step S232: the weight of the boosted tree is adjusted according to the gradient value.

Specifically: the gradient value is added to the weight after being adjusted in the weight of the boosted tree.

That is:

ρ_n'=ρ_n+g_n(x),

Wherein, ρ_n' indicate the weight adjusted of n-th boosted tree, ρ_nBefore the adjustment for indicating n-th boosted tree Weight, g_n(x) gradient value of n-th boosted tree is indicated.

Fig. 8 shows the specific steps of step S231 in Fig. 7.As shown in fig. 7, step S231 includes:

Step S231a: it calculates the derivative of the training objective and n-th boosted tree under training dataset and arranges.

Step S231b: arranging the derivative and be averaging, and obtains the gradient value of n-th tree.

That is: the gradient value of boosted tree is calculated using following formula:

Wherein, g_n(x) gradient value of n-th boosted tree is indicated,

IndexAverag is indicated to arrange data and is averaging, and y indicates that the fault data that fault data is concentrated, x indicate symptom number According to the symptom data of concentration, J indicates that the gradient promotes the training objective of Tree Classifier prediction model, f_n(x) n-th tree is indicated Prediction result.

Fig. 9 is the flowchart 2 of network fault diagnosis method of the embodiment of the present invention.As shown in figure 9, the network fault diagnosis Method comprising Fig. 2 shows network fault diagnosis method on the basis of, further includes:

Step S10: the gradient is generated using CART algorithm and promotes Tree Classifier prediction model.

Specifically, A1~AZ (is indicated, i.e. Z attribute forms attribute according to training data Train and corresponding property set Collection) using recursive process generation gradient promotion Tree Classifier prediction model:

First: generating node Node；

Secondly: the type of node Node is divided；Specifically: the symptom data collection in training data Train is defeated Enter node Node, if all symptom datas that obtained prediction result indicates that the node includes belong to same class failure, Think that node Node is labeled as leaf node at this time without classifying；If property set is in empty or all symptom datas Respective attributes value be equal, then it is assumed that the symptom data that node Node includes does not have attribute or attribute value identical, at this time without Method is classified according to attribute, then node Node is labeled as leaf node, and set several for the prediction result of the leaf node Measure most failures.

Above two special circumstances are removed, when the type to node Node divides, can be concentrated with computation attribute every The Gini value of a attribute selects the optimal dividing attribute of node Node according to Gini value；Then according to corresponding in symptom data The attribute value of optimal dividing attribute generates a branch node for node Node, it is corresponding that the attribute value is screened in training data Data the branch node is labeled as leaf node if the obtained data set of screening is sky, and by the prediction knot of the leaf node Fruit is set as the failure that quantity is most in training data contained by its father node, if the data set that screening obtains is not sky, continues to give birth to It at branch node, repeats the above steps, until forming leaf node.

Wherein, computation attribute concentrates the Gini value of each attribute in the following way:

For a certain attribute O, Geordie value can measure the purity of O:

In formula, k indicates the classification of the corresponding failure of the attribute, | y | indicate the corresponding fault category sum of the attribute, p_kTable Show accounting of such data in the data of all attributes.

Gini (O) is reflected and is randomly selected two samples from the data O of the attribute, inconsistent general of category label Rate.Therefore, Gini (O) is smaller, and the purity of the attribute is higher.

Above formula is extended into entire training data, for any attribute a in entire training data, the Geordie of attribute a refers to Number is defined as:

Wherein, v represents a certain attribute value of attribute a, and V indicates the sum of the attribute value of attribute a,Indicate a attribute Accounting of the quantity of a certain attribute value in all properties value total quantity, D indicate training data.

The attribute that Gini value has been calculated is added in candidate attribute set, selection makees the smallest attribute of Gini value after dividing For optimal dividing attribute a_*, i.e. a_*=argmin_a∈VGiniIndex(D,a)。

The boosted tree generated according to the method described above is as shown in Figure 10, and symptom data is inputted shown in Fig. 10 section Point, classifies to symptom data, the categorical attribute of root node are as follows: the router FS-BR-01 port Ping obstructed duration, The classifying rules of root node are as follows: if the router FS-BR-01 port Ping obstructed duration of symptom data less than 50, incites somebody to action Data classification obtains prediction failure 1 to leaf node 1；If the router FS-BR-01 port Ping of symptom data is obstructed lasting Between be more than or equal to 50 and be less than or equal to 100, then sort data into leaf node 2, obtain prediction failure 2；If the road of symptom data It is greater than 1000 by the device FS-BR-01 port Ping obstructed duration, then sorts data into internal node 1, utilize internal node 1 categorical attribute and classifying rules continues to classify to the data that the node includes.Wherein, leaf node 1 indicates the node packet Fault category containing data are as follows: router FS-BR-01 port Down, leaf node 2 indicate that the node includes the fault category of data Are as follows: router FS-BR-01 is restarted, is automatically replied in port.

The categorical attribute of internal node 1 are as follows: first line of a couplet equipment fault situation, classifying rules are as follows: if there are upper for symptom data Join equipment fault, then sorts data into internal node 1 and continue to classify；It, will if first line of a couplet equipment fault is not present in symptom data Data classification obtains prediction result 3 to leaf node 3.Wherein, leaf node 3 indicates that the node includes the fault category of data are as follows: anti- Wall with flues ACL intercepts failure.

The categorical attribute of internal node 2 are as follows: first line of a couplet equipment fault type, classifying rules are as follows: if the first line of a couplet of symptom data Equipment fault type is type 1, then sorts data into leaf node 4, obtain prediction result 4；If the first line of a couplet equipment of symptom data Failure mode is type 2, then sorts data into leaf node 5, obtain prediction result 5；If the first line of a couplet equipment fault of symptom data Type is type 3, then sorts data into leaf node 6, obtain prediction result 6.Wherein, leaf node 4 indicates that the node includes number According to fault category are as follows: the first line of a couplet equipment FS-CR-02-CRS board damage, leaf node 5 indicate the node include data failure classes Not are as follows: first line of a couplet equipment FS-CR-02-CRS Port Management state Down failure, leaf node 6 indicate that the node includes the failure of data Classification are as follows: first line of a couplet equipment FS-CR-02-CRS Port Profile state Down failure.

In an alternative embodiment, it after model training completion, also needs to cut the boosted tree in the model Branch operation.

Specifically, when beta pruning, since leaf node, beta pruning is carried out from the bottom up, it is whole before and after beta pruning to test each node The accuracy of judgement degree variation of tree, not can be carried out beta pruning if accuracy decline, and accuracy rises or constant, prove to cut Branch be it is feasible, as shown in figure 11, when carrying out beta pruning to the boosted tree, cut off the classification of the boosted tree before internal node 2 Precision is 75.1%, and the nicety of grading for cutting off the boosted tree after the node is 74.4%, then does not carry out beta pruning to the node；For For leaf node 4, if the nicety of grading for cutting off the boosted tree before the node is 57.1%, point of the boosted tree after the node is cut off Class precision is 71.4%, then cuts off the node.

The embodiment of the present invention uses rear prune approach, i.e. model training is completed and then takes out extra branch, kept away with this Exempt to waste system resource, while over-fitting can be avoided by cut operator, reduces branch excessive in boosted tree.

Figure 12 is the flow chart 3 of network fault diagnosis method of the embodiment of the present invention.As shown in figure 12, which examines Disconnected method comprising Fig. 2 shows network fault diagnosis method on the basis of, further includes:

Step S400: corresponding failure row is searched in troubleshooting suggestion database according to the result of network fault diagnosis Except suggesting and feed back to user.

Wherein, it by carrying out finishing collecting to expert opinion, forms fault category and troubleshooting suggestion is one-to-one Relation table, and be stored in troubleshooting suggestion database.

After being diagnosed to be network failure, determined and the failure that is diagnosed to be in relation table according to network fault diagnosis result Corresponding troubleshooting suggestion, and send troubleshooting suggestion to abnormal network element or Network Management Equipment or administrator and (for example automatic expand Hold address pool, automatic lifting broadband access network user uplink/downstream rate), to repair failure.

The embodiment of the present invention is able to ascend failure pretreatment potentiality, further promotes net by providing troubleshooting suggestion The fault recovery speed of network system.

In an alternative embodiment, which can also include: sample equalization step.

Specifically, after getting symptom data collection and fault data collection in historical data, to the symptom data collection It is counted with fault data collection, according to the ratio of positive example sample and negative example sample come the balance of training of judgement data, if just The ratio of example sample and negative example sample meets preset rules, then it is assumed that the harmony of training data is preferably.If positive example sample and negative The ratio of example sample does not meet preset rules, then it is assumed that training data lack of uniformity, at this time according to default processing mode to the disease Shape data set and fault data collection are handled, and are solved the problems, such as unbalanced and then are utilized harmonious preferable training data Model is trained, so as to improve the precision of model.

In an alternative embodiment, which can also include: training data cleaning step.

Specifically, by the preprocessing means such as data filtering, principal component analysis to the outlier in training data carry out into The processing of one step.Outlier refers to respective attributes in the far super other symptoms data of the attribute value of a certain attribute in a certain symptom data Attribute value particular point.Wherein, principal component analysis is a kind of statistical method, is effectively sieved by carrying out orthogonal transformation to data The outlier of data is selected, and outlier is removed from sample data.

By first cleaning to training data before being trained using training data to model, instruction can be rejected Practice the particular point in data, so as to improve the speed and precision of model training.

In an alternative embodiment, the network fault diagnosis method model training completion after, using training after Model carry out network fault diagnosis before, can also include: the step tested using test data the model after training Suddenly.

Specifically, after model training completion, by the test containing symptom data collection and its corresponding fault data collection In model after data input training, model prediction result is compared with the fault data collection, after testing training with this The prediction effect of model, if model prediction result is same or similar with the fault data collection, then it is assumed that the model essence after the training Degree is higher, satisfies the use demand；If model prediction result and the fault data collection difference are very big, then it is assumed that the model after the training Precision is lower, then needs to continue to be trained model.

In conclusion network fault diagnosis method provided in an embodiment of the present invention, using the symptom in network history data Data set and fault data collection promote Tree Classifier prediction model to gradient and are trained, and are then mentioned using the gradient after training It rises Tree Classifier prediction model and carries out network fault diagnosis, network fault diagnosis precision can be effectively improved, and can effectively contract Short network failure diagnosis time adapts to diversification production scene.

Based on the same inventive concept, the embodiment of the present application also provides a kind of network fault diagnosis system, it can be used for reality Method described in existing above-described embodiment, as described in the following examples.The original solved the problems, such as due to network fault diagnosis system Reason is similar to the above method, therefore the implementation of network fault diagnosis system may refer to the implementation of the above method, repeats place not It repeats again.Used below, the group of the software and/or hardware of predetermined function may be implemented in term " unit " or " module " It closes.Although device described in following embodiment is preferably realized with software, the combination of hardware or software and hardware Realization be also that may and be contemplated.

Figure 13 is the structure chart one of network fault diagnosis system of the embodiment of the present invention.As shown in figure 13, which examines Disconnected system 200 includes: reading device 210, training device 220 and diagnostic device 230.

Reading device 210 reads network history data, and the network history data includes: symptom data collection and number of faults According to collection.

The symptom data collection is obtained by an Open Source Framework, for example is based on Redis (Remote Dictionary Server business datum) obtains framework, also, it includes multiple attribute values that the symptom data, which concentrates every symptom data, value Must illustrate, attribute include: IP address, hop count, input packet loss, output packet loss, interface operation, upstream delay, Route terminal distance, gateway status, mode of operation, downlink delays, response time, interface management state etc..

The fault data collection tests and analyzes to obtain by expert, indicates the corresponding class of various failures.Wherein, failure is mainly wrapped Include equipment fault and traffic failure.Equipment fault includes: that equipment PU or memory usage continue high, equipment plate card and remove or again It opens, fan failure, power failure, device temperature exception, link congestion, Network Packet Loss, interface disconnect, port mismatches, route Failure etc..Traffic failure specifically includes that People Near Me interruption, VPN (virtual private net) service disconnection, VPLS (virtual private Local area network) service disconnection, address pool deficiency, route break, (PPOE is a kind of network communication protocol, one to dial up on the telephone to PPOE Kind of mode) service disconnection, WLAN (WLAN) Internet user can not obtain address, buffering is insufficient, bandwidth is insufficient, agreement not Matching etc..

Training device 220 promotes Tree Classifier prediction model to gradient using the symptom data collection and fault data collection It is trained.

For example, by the way that symptom data collection (being equivalent to sample data) input gradient is promoted Tree Classifier prediction model In, obtain the corresponding prediction result of every symptom data, and by prediction result and fault data collection (being equivalent to label data) into Row comparison, the parameter of Tree Classifier prediction model is promoted according to comparison result regulating gradient, so that the gradient boosted tree after adjusting The prediction result of classifier prediction model can be to greatest extent close to fault data collection, implementation model training process.

The training device 200 specifically includes: prediction module 221, computing module 222, training module 223, as shown in figure 14.

The symptom data collection and the fault data collection are inputted the gradient and promote Tree Classifier by prediction module 221 Prediction model obtains multiple prediction results corresponding with more boosted trees in gradient promotion Tree Classifier prediction model.

Wherein, which it is as follows to promote Tree Classifier prediction model:

Computing module 222 calculates the training mesh that the gradient promotes Tree Classifier prediction model according to multiple prediction results Mark.

Specifically, which includes: penalty values computing unit and addition unit.

Penalty values computing unit calculates the penalty values of more boosted trees according to multiple prediction results, the fault data collection. For a certain boosted tree, which is indicated between the prediction result of the boosted tree and the learning objective of the boosted tree Difference.Penalty values are smaller, illustrate that the precision of prediction of boosted tree is higher；Penalty values are bigger, illustrate prediction result and study mesh Difference between mark is bigger, and the precision of boosted tree is lower.

Wherein, penalty values computing unit includes: the first calculator, residual computations device and residual computations device.

First calculator calculates first promotion according to the prediction result of first boosted tree and the fault data collection The penalty values of tree.

L₁(y,f₁(x))=[y-f₁(x)]²/ 2,

Residual computations device calculates the residual error of the m-1 boosted tree according to multiple prediction results and the fault data collection.

Residual₁=y-f₁(x),

Residual_m-1=Residual_m-2-f_m-1(x),

Second calculator is according to the prediction result of the m boosted tree and the residual computations m of the m-1 boosted tree The penalty values of boosted tree；Wherein, m is the positive integer greater than 1.

L_m[Residual_m-1,f_m(x)]=[Residual_m-1-f_m(x)]²/ 2,

Wherein, Residual_m-1Indicate the residual error of the m-1 boosted tree, table x indicates that symptom data concentrates symptom data, f_m (x) prediction result of the m boosted tree is indicated, m is the positive integer greater than 1.

I.e. the training objective is calculated using following formula:

Training module 223 is trained more boosted trees according to multiple prediction results and the training objective.

Wherein, promoting total training objective of Tree Classifier prediction model with the gradient is guidance, is trained to model.

Specifically, which includes: gradient value computing unit and weight adjustment unit.

Gradient value computing unit calculates the ladder of the boosted tree according to the prediction result and the training objective of a boosted tree Angle value, and specifically include: ratio calculator and gradient value calculator.

Derived function device calculates the derivative of the training objective and n-th boosted tree under training dataset and arranges.

Gradient value calculator arranges the derivative and is averaging, and obtains the gradient value of n-th tree.

In conjunction with derived function device and gradient value calculator it is found that the gradient value that following formula calculates boosted tree can be used:

Wherein, g_n(x) gradient value of n-th boosted tree is indicated,

That is:

ρ_n'=ρ_n+g_n(x),

Through the above technical solution it is known that promoting Tree Classifier prediction model and above-mentioned training by using gradient Mode can effectively improve the precision and model training speed of fault diagnosis, reduce operand.

Diagnostic device 230 promotes Tree Classifier prediction model using the gradient after training and carries out network fault diagnosis.

It is worth noting that gradient promoted Tree Classifier prediction model need model training efficiency and model complexity it Between be balanced, that is, choose the quantity M of reasonable boosted tree.In order to guarantee that model training is abundant, the actual effect of model is improved, It needs to choose more boosted trees, but excessive boosted tree can not be chosen, because the quantity of boosted tree will excessively will lead to Fitting problems.Therefore, in order to reach the balance between model training efficiency and model complexity, the embodiment of the present invention actually makes Used time, the quantity that gradient promotes boosted tree in Tree Classifier prediction model is chosen according to the item number of training data, such as root According to the ratio of the quantity of the item number and boosted tree of training data, alternatively, choosing several M values carries out test selection, the present invention is real Example is applied to this with no restriction.

In conclusion network fault diagnosis system provided in an embodiment of the present invention is pre- by using gradient promotion Tree Classifier Model is surveyed, the problem that computational complexity is high in existing network fault diagnosis, network diagnosis result error is big is can effectively solve the problem that, shows Write and improve the accuracy of network diagnosis, while keeping compared with low computational complexity, can reach preferable learning ability and Classification accuracy.

In addition, the network fault diagnosis system support router, interchanger, IPRAN equipment, OLT device, DSLAM equipment, Software defined network controller (such as Huawei's controller, in emerging controller and the arranging service device of some manufacturers), network security The fault diagnosis of the multiple networks equipment such as equipment and other purposes equipment (such as green alliance's safety equipment, firewall).

Figure 15 is the structure chart three of network fault diagnosis system of the embodiment of the present invention.As shown in figure 15, which examines Disconnected system 200 also includes: model generating means 240 on the basis of comprising network fault diagnosis system shown in Figure 13.

Model generating means 240 generate the gradient using CART algorithm and promote Tree Classifier prediction model.

First: generating node Node；

For a certain attribute O, Geordie value can measure the purity of O:

In an alternative embodiment, which can also include pruning device, beta pruning dress It sets for carrying out cut operator to the boosted tree in the model after model training is completed.

Specifically, when beta pruning, since leaf node, beta pruning is carried out from the bottom up, it is whole before and after beta pruning to test each node The accuracy of judgement degree variation of tree, not can be carried out beta pruning if accuracy decline, and accuracy rises or constant, prove to cut Branch is feasible.

Figure 16 is the structure chart four of network fault diagnosis system of the embodiment of the present invention.As shown in figure 16, which examines Disconnected system 200 is on the basis of comprising network fault diagnosis system shown in Figure 13, further includes: it is recommended that providing device 250.

It is recommended that provide device 250 searched in troubleshooting suggestion database according to the result of network fault diagnosis it is corresponding Troubleshooting suggestion simultaneously feeds back to user.

In an alternative embodiment, which can also include: sample balancer, should Ratio of the sample equilibrium mold device for positive example sample and negative example sample in equalizing training data.

In an alternative embodiment, which can also include: training data cleaning dress Set, the training data cleaning device be used for using the preprocessing means such as data filtering, principal component analysis in training data from Group's point is further processed.

In an alternative embodiment, which can also include: test device, the test Before device is used for after model training completion, carries out network fault diagnosis using the model after training, test data is utilized Model after training is tested.

Meanwhile the network fault diagnosis system is capable of providing troubleshooting suggestion, realizes failure preprocessing function.

Figure 17 is the structure chart of computer equipment of the embodiment of the present invention.As shown in figure 17, which specifically can be with Including memory 7m, processor 6m, communication interface 8m, data/address bus 9m and it is stored on memory 7m and can be on processor 6m The computer program of operation, processor 6m realize that network failure described in any of the above-described embodiment is examined when executing computer program The step of disconnected method.

In addition, the embodiment of the present invention also provides a kind of computer readable storage medium, it is stored thereon with computer program, it should The step of network fault diagnosis method in above-described embodiment is realized when computer program is executed by processor.

To sum up, network fault diagnosis method provided in an embodiment of the present invention, system, computer equipment and computer-readable Storage medium, using in network history data symptom data collection and fault data collection to gradient promoted Tree Classifier predict mould Type is trained, and is then promoted Tree Classifier prediction model using the gradient after training and is carried out network fault diagnosis, can be effective Network fault diagnosis precision is improved, and can effectively shorten network failure diagnosis time, adapts to diversification production scene.

Embodiment of the method provided by the embodiment of the present application can be in mobile terminal, terminal, server or class As execute in arithmetic unit.

Although this application provides the method operating procedure as described in embodiment or flow chart, based on conventional or noninvasive The labour for the property made may include more or less operating procedure.The step of enumerating in embodiment sequence is only numerous steps One of execution sequence mode, does not represent and unique executes sequence.It, can when device or client production in practice executes To execute or parallel execute (such as at parallel processor or multithreading according to embodiment or method shown in the drawings sequence The environment of reason).

Each embodiment in this specification is described in a progressive manner, the same or similar portion between each embodiment Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.The whole of the application or Person part can be used in numerous general or special purpose computing system environments or configuration.Such as: personal computer, server calculate Machine, handheld device or portable device, mobile communication terminal, multicomputer system, based on microprocessor are at laptop device System, programmable electronic equipment, network PC, minicomputer, mainframe computer, the distribution including any of the above system or equipment Formula calculates environment etc..

Any suitable network protocol can be used between the server and the APP to be communicated, this Shen is included in It please the network protocol not yet developed of submitting day.The network protocol for example may include ICP/IP protocol, UDP/IP agreement, Http protocol, HTTPS agreement etc..Certainly, the network protocol for example can also include the RPC association used on above-mentioned agreement Discuss (Remote Procedure Call Protocol, remote procedure call protocol), REST agreement (Representational State Transfer, declarative state transfer protocol) etc..

Obviously, those skilled in the art should be understood that each module of above-mentioned the application or each step can be with general Computing device realize that they can be concentrated on a single computing device, or be distributed in multiple computing devices and formed Network on, optionally, they can be realized with the program code that computing device can perform, it is thus possible to which they are stored Be performed by computing device in the storage device, perhaps they are fabricated to each integrated circuit modules or by they In multiple modules or step be fabricated to single integrated circuit module to realize.In this way, the application be not limited to it is any specific Hardware and software combines.

Specific embodiment is applied in the present invention, and principle and implementation of the present invention are described, above embodiments Explanation be merely used to help understand method and its core concept of the invention；At the same time, for those skilled in the art, According to the thought of the present invention, there will be changes in the specific implementation manner and application range, in conclusion in this specification Appearance should not be construed as limiting the invention.Within the spirit and principles of this application, it is made it is any modification, equally replace It changes, improve, should be included within the scope of protection of this application.

Claims

1. a kind of network fault diagnosis method characterized by comprising

Network history data is read, the network history data includes: symptom data collection and fault data collection；

2. network fault diagnosis method according to claim 1, which is characterized in that it is described using the symptom data collection and Fault data collection promotes Tree Classifier prediction model to gradient and is trained, comprising:

The symptom data collection and the fault data collection are inputted into the gradient and promote Tree Classifier prediction model, obtain with The gradient promotes the corresponding multiple prediction results of more boosted trees in Tree Classifier prediction model；

3. network fault diagnosis method according to claim 2, which is characterized in that described to calculate institute according to multiple prediction results State gradient promoted Tree Classifier prediction model training objective include:

4. network fault diagnosis method according to claim 3, which is characterized in that it is described according to multiple prediction results, it is described Fault data collection calculates the penalty values of more boosted trees, comprising:

According to the loss of the prediction result of the m boosted tree and the m boosted tree of residual computations of the m-1 boosted tree Value；Wherein, m is the positive integer greater than 1.

5. network fault diagnosis method according to claim 2, which is characterized in that described according to multiple prediction results and institute Training objective is stated to be trained more boosted trees, comprising:

The weight of the boosted tree is adjusted according to the gradient value.

6. network fault diagnosis method according to claim 5, which is characterized in that the prediction result according to a boosted tree And the training objective calculates the gradient value of the boosted tree, comprising:

The derivative of the training objective and n-th boosted tree under training dataset is calculated to arrange；

The derivative is arranged and is averaging, the gradient value of n-th tree is obtained.

7. network fault diagnosis method according to claim 6, which is characterized in that described according to gradient value adjustment The weight of boosted tree includes:

The weight gradient value being added to after being adjusted in the weight of the boosted tree.

8. network fault diagnosis method according to claim 2, which is characterized in that the gradient promotes Tree Classifier and predicts mould Type is as follows:

In formula, F (x) is the prediction result that gradient promotes Tree Classifier prediction model, ρ_nIndicate the weight of n-th boosted tree, f_n (x) prediction result of n-th boosted tree is indicated, M indicates the total quantity of boosted tree, and K indicates total training round, and k indicates kth training in rotation Practice, wherein K value is determined by the stability of F (x).

9. network fault diagnosis method according to claim 1, which is characterized in that further include:

10. network fault diagnosis method according to claim 1, which is characterized in that further include:

Corresponding troubleshooting suggestion is searched in troubleshooting suggestion database according to the result of network fault diagnosis and is fed back To user.

11. a kind of network fault diagnosis system characterized by comprising

Reading device reads network history data, and the network history data includes: symptom data collection and fault data collection；

Training device promotes Tree Classifier prediction model to gradient using the symptom data collection and fault data collection and instructs Practice；

12. network fault diagnosis system according to claim 11, which is characterized in that the training device includes:

13. network fault diagnosis system according to claim 12, which is characterized in that the computing module includes:

14. 3 network fault diagnosis system according to claim 1, which is characterized in that the penalty values computing unit includes:

First calculator calculates first boosted tree according to the prediction result of first boosted tree and the fault data collection Penalty values；

Second calculator, according to residual computations the m of the prediction result of the m boosted tree and the m-1 boosted tree The penalty values of boosted tree；Wherein, m is the positive integer greater than 1.

15. network fault diagnosis system according to claim 12, which is characterized in that the training module includes:

16. network fault diagnosis system according to claim 15, which is characterized in that the gradient value computing unit includes:

Derived function device calculates the derivative of the training objective and n-th boosted tree under training dataset and arranges；

17. 6 network fault diagnosis system according to claim 1, which is characterized in that further include:

18. a kind of computer equipment including memory, processor and stores the meter that can be run on a memory and on a processor Calculation machine program, which is characterized in that the processor is realized described in any one of claims 1 to 10 when executing the computer program The step of network fault diagnosis method.

19. a kind of computer readable storage medium, is stored thereon with computer program, which is characterized in that the computer program The step of any one of the claims 1 to 10 network fault diagnosis method is realized when being executed by processor.