CN109639526A - Network Data Control method, apparatus, equipment and medium - Google Patents

Network Data Control method, apparatus, equipment and medium Download PDF

Info

Publication number
CN109639526A
CN109639526A CN201811531785.XA CN201811531785A CN109639526A CN 109639526 A CN109639526 A CN 109639526A CN 201811531785 A CN201811531785 A CN 201811531785A CN 109639526 A CN109639526 A CN 109639526A
Authority
CN
China
Prior art keywords
state
probability
network
data
network parameter
Prior art date
Application number
CN201811531785.XA
Other languages
Chinese (zh)
Inventor
王希
Original Assignee
中国移动通信集团福建有限公司
中国移动通信集团有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国移动通信集团福建有限公司, 中国移动通信集团有限公司 filed Critical 中国移动通信集团福建有限公司
Priority to CN201811531785.XA priority Critical patent/CN109639526A/en
Publication of CN109639526A publication Critical patent/CN109639526A/en

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00Arrangements for monitoring or testing packet switching networks
    • H04L43/04Processing of captured monitoring data
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00Arrangements for monitoring or testing packet switching networks
    • H04L43/08Monitoring based on specific metrics

Abstract

The embodiment of the invention provides a kind of Network Data Control method, apparatus, equipment and media, it include: the initial data for obtaining at least one network parameter, and according to data generation time, the corresponding status switch of initial data is obtained, status switch is for characterizing network parameter in the status attribute of different moments;Utilize the detection model and status switch of historical network data training, the observation sequence probability value that network parameter is in setting state in particular moment is obtained, detection model is used to characterize the relationship between the initial state probabilities, state transition probability and observation probability of network parameter;According to observation sequence probability value, monitor whether the corresponding initial data of the network parameter is abnormal.Using the state transition probability matrix and observation probability matrix between the initial data of the training algorithm learning network parameter of serializing, network data is monitored by state transition probability matrix and observation probability matrix, can effectively promote the accuracy of monitoring.

Description

Network Data Control method, apparatus, equipment and medium

Technical field

The present invention relates to wireless communication technology field more particularly to a kind of Network Data Control method, apparatus, equipment and Jie Matter.

Background technique

With the development of network technology, development of Mobile Internet technology brings great convenience to the production and living of people.For Guarantee network service quality, operator need the network data generated to mobile Internet to monitor in real time, in order to and When processing mobile Internet occur network failure.

In practical applications, common Network Data Control includes log analysis, network data inspection, large data files inspection It tests.Due to being interacted by mobile Internet and/or business processing will generate a large amount of data, then being directed to these data It can produce journal file.The network management personnel of operator can be judged by periodically analyzing these journal files Situations such as whether data recorded in journal file occur mistake or business processing are caused to fail.

For another example, the network platform can divide data file according to time granularity and spatial granularity, periodically to data file Size counted, and then judge whether data lack according to file size.

In conclusion there is a problem of that monitoring accuracy is low to Network Data Control at present.

Summary of the invention

The embodiment of the invention provides a kind of Network Data Control methods, for promoting the accuracy of Network Data Control.

In a first aspect, the embodiment of the invention provides a kind of Network Data Control method, method includes:

The initial data of at least one network parameter is obtained, and according to data generation time, obtains the initial data pair The status switch answered, the status switch is for characterizing the network parameter in the status attribute of different moments;

Using the detection model and the status switch of historical network data training, the network parameter is obtained when specific The observation sequence probability value for being in setting state is carved, the detection model is used to characterize initial state probabilities, the shape of network parameter Relationship between state transition probability and observation probability;

According to the observation sequence probability value, monitor whether the corresponding initial data of the network parameter is abnormal.

Second aspect, the embodiment of the invention provides a kind of Network Data Control device, device includes:

Acquiring unit obtains institute for obtaining the initial data of at least one network parameter, and according to data generation time The corresponding status switch of initial data is stated, the status switch is for characterizing the network parameter in the state category of different moments Property;

Monitoring unit obtains the net for the detection model and the status switch using historical network data training Network parameter is in the forward direction probability value of setting state in particular moment, and the detection model is used to characterize the initial shape of network parameter Relationship between state probability, state transition probability and observation probability;

Judging unit, for monitoring whether the corresponding initial data of the network parameter is sent out according to the forward direction probability value It is raw abnormal.

The third aspect, the embodiment of the invention provides a kind of Network Data Control equipment, comprising: at least one processor, At least one processor and computer program instructions stored in memory, when computer program instructions are executed by processor The method of first aspect in Shi Shixian such as above embodiment.

Fourth aspect, the embodiment of the invention provides a kind of computer readable storage mediums, are stored thereon with computer journey The method such as first aspect in above embodiment is realized in sequence instruction when computer program instructions are executed by processor.

Network Data Control method, apparatus, equipment and medium provided in an embodiment of the present invention, by obtaining at least one net The initial data of network parameter, and according to data generation time, obtain the corresponding status switch of the initial data, the state sequence Column are for characterizing the network parameter in the status attribute of different moments;Detection model and institute using historical network data training Status switch is stated, the observation sequence probability value that the network parameter is in setting state in particular moment, the detection mould are obtained Type is used to characterize the relationship between the initial state probabilities, state transition probability and observation probability of network parameter;According to the sight Column probability value is sequenced, monitors whether the corresponding initial data of the network parameter is abnormal.Technical solution provided by the invention Utilize the state transition probability matrix and observation probability square between the initial data of the training algorithm learning network parameter of serializing Battle array, the state transition probability matrix reflect the dependence between initial data, which reflects initial data The time-dependent relation between the time is recorded, network data is supervised by state transition probability matrix and observation probability matrix Control, can effectively promote the accuracy of monitoring.

Detailed description of the invention

In order to illustrate the technical solution of the embodiments of the present invention more clearly, will make below to required in the embodiment of the present invention Attached drawing is briefly described, for those of ordinary skill in the art, without creative efforts, also Other drawings may be obtained according to these drawings without any creative labor.

Fig. 1 shows the flow diagram of the Network Data Control method provided according to some embodiments of the invention;

Fig. 2 shows the correspondence diagrams between status switch and observation sequence;

Fig. 3 shows the structural schematic diagram of the Network Data Control device provided according to some embodiments of the invention;

Fig. 4 shows the structural schematic diagram of the Network Data Control equipment provided according to some embodiments of the invention.

Specific embodiment

The feature and exemplary embodiment of various aspects of the invention is described more fully below, in order to make mesh of the invention , technical solution and advantage be more clearly understood, with reference to the accompanying drawings and embodiments, the present invention is further retouched in detail It states.It should be understood that specific embodiment described herein is only configured to explain the present invention, it is not configured as limiting the present invention. To those skilled in the art, the present invention can be real in the case where not needing some details in these details It applies.Below the description of embodiment is used for the purpose of better understanding the present invention to provide by showing example of the invention.

It should be noted that, in this document, relational terms such as first and second and the like are used merely to a reality Body or operation are distinguished with another entity or operation, are deposited without necessarily requiring or implying between these entities or operation In any actual relationship or order or sequence.Moreover, the terms "include", "comprise" or its any other variant are intended to Non-exclusive inclusion, so that the process, method, article or equipment including a series of elements is not only wanted including those Element, but also including other elements that are not explicitly listed, or further include for this process, method, article or equipment Intrinsic element.In the absence of more restrictions, the element limited by sentence " including ... ", it is not excluded that including There is also other identical elements in the process, method, article or equipment of the element.

Fig. 1 is a kind of flow diagram of Network Data Control method provided in an embodiment of the present invention.The method can be with As follows.

Step 101: obtaining the initial data of at least one network parameter, and according to data generation time, obtain the original The corresponding status switch of beginning data, the status switch is for characterizing the network parameter in the status attribute of different moments.

In embodiments of the present invention, the initial data of heterogeneous networks parameter can be obtained from network data platform, here It is illustrated by taking a kind of network parameter as an example.The initial data that the network parameter is generated in different time may it is identical may not Together, therefore, the initial data of acquisition can be ranked up, obtained sequence is in this hair according to the generation time of initial data It can be referred to as status switch in bright embodiment.

Such as: upstream utilization parameter, for the same serving cell, morning, noon and the uplink benefit generated at night It is had differences with rate data, then the upstream utilization data of different time generation can be obtained sequentially in time.Assuming that every The upstream utilization data s that one moment generatesTIt indicates, then obtained status switch can be expressed as S={ s1、 s2、……、sT, T indicates the length of status switch.

In embodiment provided by the invention, each state generates an observation, then status switch will a corresponding sight Sequencing column.Still by taking upstream utilization as an example.Since not only there are strong correlation, Er Qieshang between uplink traffic for upstream utilization Line efficiency can also react the variation of uplink traffic, and the upstream utilization of cell itself has extremely strong timing.So exist When obtaining the status switch of upstream utilization, corresponding observation sequence, the i.e. corresponding sequence O=of uplink traffic can be determined (o1, o2..., oT).As shown in Fig. 2, the correspondence diagram between status switch and observation sequence.

Step 102: using the detection model and the status switch of historical network data training, obtaining the network parameter The observation sequence probability value of setting state is in particular moment, the detection model is used to characterize the original state of network parameter Relationship between probability, state transition probability and observation probability.

In embodiments of the present invention, the case where determining the detection model and the status switch of historical network data training Under, the observation sequence probability value that the network parameter is in setting state in particular moment is obtained in the following manner:

Wherein, P is observation sequence probability value, aT(i) indicate that the part moment T observation sequence O is o1, o2..., otAnd state For qiProbability be preceding to probability.

Specifically, in embodiment provided by the invention China, P (O | λ) is calculated using forward calculation algorithm.

First, it is assumed that the definition of forward direction probability is setting models λ, being defined into moment t part observation sequence is o1, o2..., otAnd state is qiProbability be it is preceding to probability, be denoted as

at(i)=P (o1, o2..., ot, it=qi|λ) (2)。

Secondly, to probability a before can recursively acquiringt(i) and observation sequence probability P (O | λ).Before sequence of calculation probability It is as follows to algorithmic procedure:

Step 1: to probability, i.e. the state i of initial time before initialization1=qiWith observation o1Joint probability: a1(i)= πibi(o1), i=1,2 ..., N (3).

Step 2: the recurrence formula of forward direction probability, calculating to moment t+1 part observation sequence is o1, o2..., ot, ot+1 And state q is in moment t+1iForward direction probability.Recursively t=1,2 ..., T-1 are calculated separately

It is last: to obtain

The following detailed description of how obtaining setting models λ.Here setting models λ can be referred to as detection model.

Specifically, it is assumed that Q is state set, and V is observation set:

Q={ q1, q2..., qN, V={ v1, v2..., vM} (5)

Wherein, N is status number, and M is observation number.

I is the status switch that length is T, and O is corresponding observation sequence:

I={ i1, i2..., iT, O={ o1, o2..., oT} (6)

Detection model is so trained in the following manner:

λ=(A, B, π) (7)

Wherein, λ is detection model, and A is state transition probability matrix, A=[aij]N×N, aij=P (it+1=qj|it=qi), I=1,2 ..., N;J=1,2 ..., N are characterized in moment t and are in state qiUnder conditions of in moment t+1 be transferred to state qj's Probability;

B is observation probability matrix, B=[bj(k)]N×M, bj(k)=P (ot=vk|it=qj), k=1,2 ..., M;J=1, 2 ..., N is characterized in moment t and is in state qjUnder conditions of generate observation vkProbability;

π is initial state probability vector.

By preliminary examination state probability vector π, state transition probability matrix A and observation probability matrix B are determined.π and A determines state Sequence, B determines observation sequence, therefore model λ can be indicated with ternary symbol, i.e.,

λ=(A, B, π).

Specifically, training obtains state transition probability a in the following mannerij:

The training data of network parameter is obtained, includes the similar observation sequence of S length and correspondence in the training data Status switch { O1, S1, { O1, I2..., { OS, IS};

Based on Maximum-likelihood estimation mode, state transition probability a is calculatedij:

Wherein, t indicates the moment, and i indicates state, AijIndicate that moment t is in state i, and moment t+1 is transferred to state j's Frequency.

Specifically, training obtains observation probability b in the following mannerj(k):

The training data of network parameter is obtained, includes the similar observation sequence of S length and correspondence in the training data Status switch { O1, S1, { O1, I2..., { OS, IS};

Based on Maximum-likelihood estimation mode, observation probability b is calculatedj(k):

Wherein, t indicates the moment, and i indicates state, BjkIt is j for state and is observed the frequency of k.

Step 103: according to the observation sequence probability value, monitoring whether the corresponding initial data of the network parameter occurs It is abnormal.

In embodiments of the present invention, in the case where the observation sequence probability value is less than given threshold, the net is determined The corresponding initial data of network parameter is abnormal.

It should be noted that since the length of observation sequence constantly increases, and calculated conditional probability P (O | λ) it can be more next It is smaller, it is difficult directly to judge data with the presence or absence of abnormal in this way.It more preferably, in embodiments of the present invention, can also be to observation sequence Column are split.Such as: setting segmentation length K is split observation sequence using setting segmentation length, respectively to each Short sequenceCalculating observation sequence probability.In addition, in order to protrude the difference between probability, ln P (O | λ) can also be used to make It whether there is data exception judge index for measurement.

The short sequence mark for taking logarithm to be compared with preset threshold value ∈ the probability of each short sequence, and ∈ being less than For exception.Then the abnormality degree of several continuous short sequences is counted:

Wherein, CaFor labeled as abnormal short sequence quantity, C is the sum of continuous short sequence.By this abnormality degree with it is another A preset threshold value δkIt is compared, if abnormality degree is greater than δk, then it is apparent abnormal to assert that data exist, needs to pay close attention to.

The technical solution provided through the embodiment of the present invention, obtains the initial data of at least one network parameter, and according to Data generation time obtains the corresponding status switch of the initial data, and the status switch is for characterizing the network parameter In the status attribute of different moments;Using the detection model and the status switch of historical network data training, the net is obtained Network parameter is in the observation sequence probability value of setting state in particular moment, and the detection model is used to characterize the first of network parameter Relationship between beginning state probability, state transition probability and observation probability;According to the observation sequence probability value, the net is monitored Whether the corresponding initial data of network parameter is abnormal.Technical solution provided by the invention is learnt using the training algorithm of serializing State transition probability matrix and observation probability matrix between the initial data of network parameter, state transition probability matrix reflection Dependence between initial data, the Time Dependent which reflected between the record time of initial data close System, is monitored network data by state transition probability matrix and observation probability matrix, can effectively promote the essence of monitoring True property.

Fig. 3 is a kind of structural schematic diagram of Network Data Control device provided in an embodiment of the present invention.The network data Monitoring device includes: acquiring unit 301, monitoring unit 302 and judging unit 303, in which:

Acquiring unit 301 is obtained for obtaining the initial data of at least one network parameter, and according to data generation time To the corresponding status switch of the initial data, the status switch is for characterizing the network parameter in the state of different moments Attribute;

Monitoring unit 302 obtains described for the detection model and the status switch using historical network data training Network parameter is in the forward direction probability value of setting state in particular moment, and the detection model is for characterizing the initial of network parameter Relationship between state probability, state transition probability and observation probability;

Judging unit 303, for whether monitoring the corresponding initial data of the network parameter according to the forward direction probability value It is abnormal.

In another embodiment of the present invention, the monitoring unit 302 trains detection model in the following manner:

λ=(A, B, π);

Wherein, λ is detection model, and A is state transition probability matrix, A=[aij]N×N, aij=P (it+1=qj|it=qi), I=1,2 ..., N;J=1,2 ..., N are characterized in moment t and are in state qiUnder conditions of in moment t+1 be transferred to state qj's Probability;

B is observation probability matrix, B=[bj(k)]N×M, bj(k)=P (ot=vk|it=qj), k=1,2 ..., M;J=1, 2 ..., N is characterized in moment t and is in state qjUnder conditions of generate observation vkProbability;

π is initial state probability vector.

In another embodiment of the present invention, the corresponding observation of described each state of monitoring unit 302.

In another embodiment of the present invention, training obtains state transfer to the monitoring unit 302 in the following manner Probability aij:

The training data of network parameter is obtained, includes the similar observation sequence of S length and correspondence in the training data Status switch { O1, S1, { O1, I2..., { OS, IS};

Based on Maximum-likelihood estimation mode, state transition probability a is calculatedij:

Wherein, t indicates the moment, and i indicates state, AijIndicate that moment t is in state i, and moment t+1 is transferred to state j's Frequency.

In another embodiment of the present invention, training obtains observation probability to the monitoring unit 302 in the following manner bj(k):

The training data of network parameter is obtained, includes the similar observation sequence of S length and correspondence in the training data Status switch { O1, S1, { O1, I2..., { OS, IS};

Based on Maximum-likelihood estimation mode, observation probability bj is calculated(K):

Wherein, t indicates the moment, and i indicates state, BjkIt is j for state and is observed the frequency of k.

In another embodiment of the present invention, the detection mould that the monitoring unit 302 is trained using historical network data Type and the status switch obtain the observation sequence probability value that the network parameter is in setting state in particular moment, comprising:

Wherein, P is observation sequence probability value, aT(i) indicate that the part moment T observation sequence O is o1, o2..., otAnd state For qiProbability be preceding to probability.

In another embodiment of the present invention, the judging unit 303 monitors institute according to the observation sequence probability value State whether the corresponding initial data of network parameter is abnormal, comprising:

In the case where the observation sequence probability value is less than given threshold, the corresponding original number of the network parameter is determined According to being abnormal.

It should be noted that Network Data Control device provided in an embodiment of the present invention can be realized by software mode, It can also be realized by hardware mode, be not specifically limited here.Network Data Control device utilizes the training algorithm serialized State transition probability matrix and observation probability matrix between the initial data of learning network parameter, the state transition probability matrix Reflect the dependence between initial data, which reflects the Time Dependent between the record time of initial data Relationship is monitored network data by state transition probability matrix and observation probability matrix, can effectively promote monitoring Accuracy.

In addition, the network data monitoring method in conjunction with Fig. 3 embodiment of the present invention described can be set by network data monitoring It is standby to realize.Fig. 4 shows the hardware structural diagram of network data monitoring equipment provided in an embodiment of the present invention.

Network data monitoring equipment may include processor 401 and the memory 402 for being stored with computer program instructions.

Specifically, above-mentioned processor 401 may include central processing unit (CPU) or specific integrated circuit (Application Specific Integrated Circuit, ASIC), or may be configured to implement implementation of the present invention One or more integrated circuits of example.

Memory 402 may include the mass storage for data or instruction.For example it rather than limits, memory 402 may include hard disk drive (Hard Disk Drive, HDD), floppy disk drive, flash memory, CD, magneto-optic disk, tape or logical With the combination of universal serial bus (Universal Serial Bus, USB) driver or two or more the above.It is closing In the case where suitable, memory 402 may include the medium of removable or non-removable (or fixed).In a suitable case, it stores Device 402 can be inside or outside data processing equipment.In a particular embodiment, memory 402 is nonvolatile solid state storage Device.In a particular embodiment, memory 402 includes read-only memory (ROM).In a suitable case, which can be mask ROM, programming ROM (PROM), erasable PROM (EPROM), the electric erasable PROM (EEPROM), electrically-alterable ROM of programming (EAROM) or the combination of flash memory or two or more the above.

Processor 401 is by reading and executing the computer program instructions stored in memory 402, to realize above-mentioned implementation Any one network data monitoring method in example.

In one example, network data monitoring equipment may also include communication interface 403 and bus 410.Wherein, such as Fig. 4 Shown, processor 401, memory 402, communication interface 403 connect by bus 410 and complete mutual communication.

Communication interface 403 is mainly used for realizing in the embodiment of the present invention between each module, device, unit and/or equipment Communication.

Bus 410 includes hardware, software or both, and the component of network data monitoring equipment is coupled to each other together.It lifts It for example rather than limits, bus may include accelerated graphics port (AGP) or other graphics bus, enhancing Industry Standard Architecture (EISA) bus, front side bus (FSB), super transmission (HT) interconnection, Industry Standard Architecture (ISA) bus, infinite bandwidth interconnect, are low Number of pins (LPC) bus, memory bus, micro- channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI- Express (PCI-X) bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association part (VLB) bus or The combination of other suitable buses or two or more the above.In a suitable case, bus 410 may include one Or multiple buses.Although specific bus has been described and illustrated in the embodiment of the present invention, the present invention considers any suitable bus Or interconnection.

In addition, in conjunction with the network data monitoring method in above-described embodiment, the embodiment of the present invention can provide a kind of computer Readable storage medium storing program for executing is realized.Computer program instructions are stored on the computer readable storage medium;The computer program refers to Enable any one the network data monitoring method realized in above-described embodiment when being executed by processor.

It should be clear that the invention is not limited to specific configuration described above and shown in figure and processing. For brevity, it is omitted here the detailed description to known method.In the above-described embodiments, several tools have been described and illustrated The step of body, is as example.But method process of the invention is not limited to described and illustrated specific steps, this field Technical staff can be variously modified, modification and addition after understanding spirit of the invention, or suitable between changing the step Sequence.

Functional block shown in structures described above block diagram can be implemented as hardware, software, firmware or their group It closes.When realizing in hardware, it may, for example, be electronic circuit, specific integrated circuit (ASIC), firmware appropriate, insert Part, function card etc..When being realized with software mode, element of the invention is used to execute program or the generation of required task Code section.Perhaps code segment can store in machine readable media program or the data-signal by carrying in carrier wave is passing Defeated medium or communication links are sent." machine readable media " may include any medium for capableing of storage or transmission information. The example of machine readable media includes electronic circuit, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), soft Disk, CD-ROM, CD, hard disk, fiber medium, radio frequency (RF) link, etc..Code segment can be via such as internet, inline The computer network of net etc. is downloaded.

It should also be noted that, the exemplary embodiment referred in the present invention, is retouched based on a series of step or device State certain methods or system.But the present invention is not limited to the sequence of above-mentioned steps, that is to say, that can be according in embodiment The sequence referred to executes step, may also be distinct from that the sequence in embodiment or several steps are performed simultaneously.

The above description is merely a specific embodiment, it is apparent to those skilled in the art that, For convenience of description and succinctly, the system, module of foregoing description and the specific work process of unit can refer to preceding method Corresponding process in embodiment, details are not described herein.It should be understood that scope of protection of the present invention is not limited thereto, it is any to be familiar with Those skilled in the art in the technical scope disclosed by the present invention, can readily occur in various equivalent modifications or substitutions, These modifications or substitutions should be covered by the protection scope of the present invention.

Claims (10)

1. a kind of Network Data Control method, which is characterized in that the described method includes:
The initial data of at least one network parameter is obtained, and according to data generation time, it is corresponding to obtain the initial data Status switch, the status switch is for characterizing the network parameter in the status attribute of different moments;
Using the detection model and the status switch of historical network data training, the network parameter is obtained at particular moment In the observation sequence probability value of setting state, the detection model is used to characterize the initial state probabilities of network parameter, state turns Move the relationship between probability and observation probability;
According to the observation sequence probability value, monitor whether the corresponding initial data of the network parameter is abnormal.
2. Network Data Control method according to claim 1, which is characterized in that training detection mould in the following manner Type:
λ=(A, B, π);
Wherein, λ is detection model, and A is state transition probability matrix, A=[aij]N×N, aij=P (it+1=qj|it=qi), i= 1,2 ..., N;J=1,2 ..., N are characterized in moment t and are in state qjUnder conditions of in moment t+1 be transferred to state qjIt is general Rate;
B is observation probability matrix, B=[bj(k)]N×M,
bj(k)=P (ot=vk|it=qj), k=1,2 ..., M;J=1,2 ..., N are characterized in moment t and are in state qjItem Observation v is generated under partkProbability;
π is initial state probability vector.
3. Network Data Control method according to claim 2, which is characterized in that the corresponding observation of each state.
4. Network Data Control method according to claim 2, which is characterized in that training obtains state in the following manner Transition probability aij:
The training data of network parameter is obtained, includes the similar observation sequence of S length and corresponding shape in the training data State sequence { O1, S1, { O1, I2..., { OS, IS};
Based on Maximum-likelihood estimation mode, state transition probability a is calculatedij:
Wherein, t indicates the moment, and i indicates state, AijIndicate that moment t is in state i, and moment t+1 is transferred to the frequency of state j.
5. Network Data Control method according to claim 2, which is characterized in that training is observed in the following manner Probability bj(k):
The training data of network parameter is obtained, includes the similar observation sequence of S length and corresponding shape in the training data State sequence { O1, S1, { O1, I2..., { OS, IS};
Based on Maximum-likelihood estimation mode, observation probability b is calculatedj(k):
Wherein, t indicates the moment, and i indicates state, BjkIt is j for state and is observed the frequency of k.
6. Network Data Control method according to any one of claims 1 to 5, which is characterized in that utilize web-based history number According to trained detection model and the status switch, the observation sequence that the network parameter is in setting state in particular moment is obtained Column probability value, comprising:
Wherein, P is observation sequence probability value, aT(i) indicate that the part moment T observation sequence O is o1, o2..., otAnd state is qi Probability be preceding to probability.
7. Network Data Control method according to claim 1, which is characterized in that according to the observation sequence probability value, Monitor whether the corresponding initial data of the network parameter is abnormal, comprising:
In the case where the observation sequence probability value is less than given threshold, the corresponding initial data hair of the network parameter is determined It is raw abnormal.
8. a kind of Network Data Control device, which is characterized in that described device includes:
Acquiring unit obtains the original for obtaining the initial data of at least one network parameter, and according to data generation time The corresponding status switch of beginning data, the status switch is for characterizing the network parameter in the status attribute of different moments;
Monitoring unit obtains the network ginseng for the detection model and the status switch using historical network data training Number is in the forward direction probability value of setting state in particular moment, and the original state that the detection model is used to characterize network parameter is general Relationship between rate, state transition probability and observation probability;
Judging unit, for according to the forward direction probability value, monitor the corresponding initial data of the network parameter whether occur it is different Often.
9. a kind of Network Data Control equipment characterized by comprising at least one processor, at least one processor and The computer program instructions of storage in the memory, are realized when the computer program instructions are executed by the processor Such as method of any of claims 1-7.
10. a kind of computer readable storage medium, is stored thereon with computer program instructions, which is characterized in that when the calculating Such as method of any of claims 1-7 is realized when machine program instruction is executed by processor.
CN201811531785.XA 2018-12-14 2018-12-14 Network Data Control method, apparatus, equipment and medium CN109639526A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201811531785.XA CN109639526A (en) 2018-12-14 2018-12-14 Network Data Control method, apparatus, equipment and medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201811531785.XA CN109639526A (en) 2018-12-14 2018-12-14 Network Data Control method, apparatus, equipment and medium

Publications (1)

Publication Number Publication Date
CN109639526A true CN109639526A (en) 2019-04-16

Family

ID=66073996

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201811531785.XA CN109639526A (en) 2018-12-14 2018-12-14 Network Data Control method, apparatus, equipment and medium

Country Status (1)

Country Link
CN (1) CN109639526A (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101060444A (en) * 2007-05-23 2007-10-24 西安交大捷普网络科技有限公司 Bayesian statistical model based network anomaly detection method
CN101615186A (en) * 2009-07-28 2009-12-30 东北大学 A kind of BBS user's abnormal behaviour auditing method based on Hidden Markov theory
CN101771758A (en) * 2008-12-31 2010-07-07 北京亿阳信通软件研究院有限公司 Dynamic determine method for normal fluctuation range of performance index value and device thereof
CN102176698A (en) * 2010-12-20 2011-09-07 北京邮电大学 Method for detecting abnormal behaviors of user based on transfer learning
US20180248905A1 (en) * 2017-02-24 2018-08-30 Ciena Corporation Systems and methods to detect abnormal behavior in networks

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101060444A (en) * 2007-05-23 2007-10-24 西安交大捷普网络科技有限公司 Bayesian statistical model based network anomaly detection method
CN101771758A (en) * 2008-12-31 2010-07-07 北京亿阳信通软件研究院有限公司 Dynamic determine method for normal fluctuation range of performance index value and device thereof
CN101615186A (en) * 2009-07-28 2009-12-30 东北大学 A kind of BBS user's abnormal behaviour auditing method based on Hidden Markov theory
CN102176698A (en) * 2010-12-20 2011-09-07 北京邮电大学 Method for detecting abnormal behaviors of user based on transfer learning
US20180248905A1 (en) * 2017-02-24 2018-08-30 Ciena Corporation Systems and methods to detect abnormal behavior in networks

Similar Documents

Publication Publication Date Title
Hung et al. An evaluation of aggregation techniques in crowdsourcing
Moghaddass et al. An integrated framework for online diagnostic and prognostic health monitoring using a multistate deterioration process
US7107187B1 (en) Method for modeling system performance
US8230262B2 (en) Method and apparatus for dealing with accumulative behavior of some system observations in a time series for Bayesian inference with a static Bayesian network model
US20140250032A1 (en) Methods, systems and processor-readable media for simultaneous sentiment analysis and topic classification with multiple labels
US8635498B2 (en) Performance analysis of applications
JP5962190B2 (en) Method and apparatus for predicting short-term power load
US7050950B2 (en) System, method and computer product for incremental improvement of algorithm performance during algorithm development
DE102012102770B9 (en) System and method for error isolation and error mitigation based on network modeling
Li et al. Failure event prediction using the Cox proportional hazard model driven by frequent failure signatures
JP4846923B2 (en) How to predict the timing of future service events for a product
US7693982B2 (en) Automated diagnosis and forecasting of service level objective states
US10671933B2 (en) Method and apparatus for evaluating predictive model
US8078913B2 (en) Automated identification of performance crisis
US8156377B2 (en) Method and apparatus for determining ranked causal paths for faults in a complex multi-host system with probabilistic inference in a time series
US8347144B2 (en) False alarm mitigation
US8291263B2 (en) Methods and apparatus for cross-host diagnosis of complex multi-host systems in a time series with probabilistic inference
TWI345153B (en) System to accelerate identification of hardware platform classes
US7243265B1 (en) Nearest neighbor approach for improved training of real-time health monitors for data processing systems
US7617313B1 (en) Metric transport and database load
WO2015099964A1 (en) Systems and methods for event detection and diagnosis
US9916194B2 (en) System component failure diagnosis
US20120304008A1 (en) Supervised fault learning using rule-generated samples for machine condition monitoring
US20100138694A1 (en) Root-Cause Analysis System And Associated Methods
KR20100021408A (en) Remote diagnosis modelling

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination