CN110995461A - Network fault diagnosis method - Google Patents
Network fault diagnosis method Download PDFInfo
- Publication number
- CN110995461A CN110995461A CN201911031015.3A CN201911031015A CN110995461A CN 110995461 A CN110995461 A CN 110995461A CN 201911031015 A CN201911031015 A CN 201911031015A CN 110995461 A CN110995461 A CN 110995461A
- Authority
- CN
- China
- Prior art keywords
- kpi
- vector
- attribute
- real
- network fault
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
Abstract
The invention discloses a network fault diagnosis method and a medium, wherein the method comprises the following steps: acquiring a real-time sequence flow of the KPI, and performing window interception processing on the real-time sequence flow of the KPI to acquire a real-time sequence vector of the KPI; performing K-S distribution inspection on the real-time sequence vector of the KPI and the normal attribute vector of the KPI trained in advance to judge whether the real-time sequence vector of the KPI is normally distributed or not; when the real-time sequence vector distribution of any one KPI in all KPI is abnormal, arranging deviation values of all KPI in K-S distribution test in sequence to form a deviation value vector; acquiring a network fault category with the highest similarity to the deviation value vector according to the deviation value vector by adopting a novel gravity clustering model, and taking the network fault category as a network fault diagnosis result; therefore, the diagnosis process of the network fault can be realized without manual intervention, and the efficiency and convenience of intelligent operation and maintenance of the network are greatly improved.
Description
Technical Field
The invention relates to the technical field of computers, in particular to a network fault diagnosis method.
Background
With the rapid development of information technology, the scale of a network system is continuously enlarged, the complexity is higher and higher, and although the existing network fault diagnosis can monitor dynamic indexes by means of a machine, once a network fault is found, manual analysis processing is needed to confirm the type of the network fault, so that time and labor are wasted, and the network fault diagnosis efficiency is greatly reduced.
Disclosure of Invention
The present invention is directed to solving, at least to some extent, one of the technical problems in the art described above. Therefore, an object of the present invention is to provide a network fault diagnosis method, which monitors KPI indicators in a communication network in real time, and determines a network fault type by using a novel gravity clustering model when the KPI indicators are abnormal, so that a network fault diagnosis process can be implemented without manual intervention, and the efficiency and convenience of network intelligent operation and maintenance are greatly improved.
A second object of the invention is to propose a computer-readable storage medium.
In order to achieve the above object, an embodiment of a first aspect of the present invention provides a network fault diagnosis method, including the following steps: acquiring a real-time sequence flow of a KPI, and performing window interception processing on the real-time sequence flow of the KPI to acquire a real-time sequence vector of the KPI; performing K-S distribution inspection on the real-time sequence vector of the KPI and the pre-trained normal attribute vector of the KPI to judge whether the real-time sequence vector of the KPI is normally distributed or not; when the real-time sequence vector distribution of any one KPI in all KPI is abnormal, arranging deviation values of all KPI in K-S distribution test in sequence to form a deviation value vector; and acquiring a network fault category with the highest similarity to the deviation value vector according to the deviation value vector by adopting a novel gravity clustering model, and taking the network fault category as a network fault diagnosis result.
According to the network fault diagnosis method provided by the embodiment of the invention, firstly, a real-time sequence flow of a KPI is obtained, and window interception processing is carried out on the real-time sequence flow of the KPI so as to obtain a real-time sequence vector of the KPI; then, performing K-S distribution inspection on the real-time sequence vector of the KPI and the normal attribute vector of the KPI trained in advance to judge whether the real-time sequence vector of the KPI is normally distributed or not; when the real-time sequence vector distribution of any one KPI in all KPI is abnormal, arranging deviation values of all KPI in K-S distribution test in sequence to form a deviation value vector; finally, a novel gravity clustering model is adopted, the network fault category with the highest similarity to the deviation value vector is obtained according to the deviation value vector, and the network fault category is used as a network fault diagnosis result; therefore, by monitoring the KPI in the communication network in real time, when the KPI is abnormal, the novel gravity cluster model is adopted to judge the network fault type, so that the diagnosis process of the network fault can be realized without manual intervention, and the high efficiency and convenience of network intelligent operation and maintenance are greatly improved.
In addition, the network fault diagnosis method proposed according to the above embodiment of the present invention may further have the following additional technical features:
optionally, performing window truncation on the real-time sequence stream of the KPI indicator to obtain a real-time sequence vector of the KPI indicator, includes: and performing segmentation processing on the real-time sequence flow of the KPI by adopting a sliding window mode so as to divide the real-time sequence flow of the KPI into real-time sequence vectors with the sizes of a plurality of segments of attribute learning windows.
Optionally, the normal attribute vector of the KPI indicator is trained according to the following steps: s1, acquiring a normal sequence flow of the KPI, dividing the normal sequence flow of the KPI into a plurality of sequences with the size of an attribute learning window by adopting a sliding window, and calculating an empirical distribution function of each sequence to form an attribute candidate set; s2, calculating pairwise distances between the attributes in the attribute candidate set by adopting a bilateral comparison method to generate a distance matrix, wherein the ith row in the distance matrix comprises the distances between all the attributes except the ith attribute and the ith attribute, and the distances between the attributes are 0; s3, calculating the dominance ability of each attribute in the attribute candidate set according to the column sequence of the distance matrix, acquiring the attribute with the strongest dominance ability as a first attribute, and deleting the other attributes in the dominance ability to update the attribute candidate set; s4, repeating the steps S2-S3 to generate the normal attribute vector of the KPI.
Optionally, the determining whether the real-time sequence vectors of the KPI indicators are distributed normally includes: calculating an experience distribution function of the real-time sequence vector of the KPI, and calculating the distance between the experience distribution function of the real-time sequence vector of the KPI and the experience distribution function of each attribute in the normal attribute vector of the KPI to generate a distance set; searching the minimum distance in the distance set, and judging whether the minimum distance exceeds a preset first threshold value; if not, setting the deviation value of the KPI index as 0; if so, taking the minimum distance as a deviation value of the KPI; and judging that the real-time sequence vector of the KPI is abnormal when the deviation value exceeds a preset first threshold value.
Optionally, a novel gravity clustering model is adopted, and a network fault category with the highest similarity to the deviation value vector is obtained according to the deviation value vector, including: calculating the gravity value of each network fault category corresponding to the deviation value vector by the following formula:
F(x，j)=Mj*sim(x，C(j))，
wherein F (x, j) represents the gravity value of the deviation value vector x and the network fault category j, MjCentroid parameters, C, for network fault class j obtained for pre-training(j)The central vector of the deviation value vector corresponding to each network fault category obtained for pre-training, and,
wherein n represents the number of KPI indexes, k represents the kth dimension of the deviation value vector, and mu represents the number of whether the elements in the deviation value vector and the elements in the corresponding positions in the central vector are simultaneously 0 or simultaneously non-0 divided by the total number of the KPI indexes; and taking the network fault category with the maximum gravity value as the network fault category with the highest similarity.
Optionally, step S3 includes: comparing the ith row elements in the distance matrix with a preset second threshold, and counting the number of all the ith row elements which are less than or equal to the second threshold to take the number as the dominance capability of the ith attribute, wherein the larger the number is, the stronger the dominance capability of the attribute is; and acquiring the attribute with the strongest domination capacity as a first attribute, and deleting the attribute with the distance from the attribute with the strongest domination capacity to the attribute with the second threshold value or less in the column corresponding to the attribute with the strongest domination capacity so as to update the attribute candidate set.
Optionally, the steps S2-S3 are repeatedly executed to prune the attributes in the attribute candidate set until all elements except 0 in the distance matrix are greater than the third threshold, and the remaining attributes are output as the normal attribute vector of the KPI index.
To achieve the above object, a second embodiment of the present invention provides a computer-readable storage medium, on which a network fault diagnosis program is stored, and the network fault diagnosis program, when executed by a processor, implements the network fault diagnosis method as described above.
According to the computer-readable storage medium of the embodiment of the invention, the network fault diagnosis program is stored, so that the network fault diagnosis program is implemented by the network fault diagnosis program method when the network fault diagnosis program is executed by the processor, and therefore, by monitoring the KPI in the communication network in real time, when the KPI is abnormal, the network fault type is judged by adopting the novel gravity clustering model, so that the diagnosis process of the network fault can be realized without manual intervention, and the efficiency and convenience of network intelligent operation and maintenance are greatly improved.
Drawings
Fig. 1 is a schematic flow chart of a network fault diagnosis method according to an embodiment of the present invention;
fig. 2 is a schematic diagram of a network fault diagnosis method according to an embodiment of the present invention.
Detailed Description
Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to the same or similar elements or elements having the same or similar function throughout. The embodiments described below with reference to the drawings are illustrative and intended to be illustrative of the invention and are not to be construed as limiting the invention.
In order to better understand the technical solution, the technical solution will be described in detail with reference to the drawings and the specific embodiments.
Fig. 1 is a flowchart illustrating a network fault diagnosis method according to an embodiment of the present invention. As shown in fig. 1, the network fault diagnosis method according to the embodiment of the present invention includes the following steps:
It should be noted that, as shown in fig. 2, a communication network has a plurality of KPI indicators, including KPI indicator 1 and KPI indicator 2 … … indicator n, and obtains a real-time sequence flow of each KPI indicator individually, and performs window-cutting processing on the real-time sequence flow of each KPI indicator to obtain a real-time sequence vector corresponding to each KPI indicator.
As one embodiment, the real-time sequence flow of the KPI is segmented in a sliding window manner to divide the real-time sequence flow of the KPI into real-time sequence vectors with the sizes of a plurality of segments of attribute learning windows.
It should be noted that, the real-time sequence flow of each KPI indicator is segmented by using a sliding window manner, so as to divide the real-time sequence flow of each KPI indicator into real-time sequence vectors with the sizes of multiple segments of attribute learning windows, thereby obtaining the real-time sequence vectors corresponding to each KPI indicator.
That is to say, the KPI indicator 1 obtains a real-time sequence vector corresponding to the KPI indicator 1 after being processed in a sliding window manner, the KPI indicator 2 obtains a real-time sequence vector corresponding to the KPI indicator 2 after being processed in a sliding window manner, and the KPI indicator n obtains a real-time sequence vector corresponding to the KPI indicator n after being processed in a sliding window manner.
As a specific embodiment, an input sequence of KPI indicators with a certain length is divided into several segments with the size of an attribute learning window, and the segmentation of the sequence is implemented by sliding a window, for example, if the start position of the input sequence of K is t1, the size of the attribute learning window is t, and the data acquisition resolution is p, the first segment subsequence is data between t1 and t1+ t, and the second segment updates the window position to t1+ p, so as to obtain a sequence between t1+ p and t1+ p + t, and so on.
And 102, performing K-S distribution inspection on the real-time sequence vector of the KPI and the normal attribute vector of the KPI trained in advance to judge whether the real-time sequence vector of the KPI is normally distributed.
Further, as an embodiment, the normal attribute vector of the KPI indicator is trained according to the following steps:
s1, acquiring a normal sequence flow of the KPI, dividing the normal sequence flow of the KPI into a plurality of sequences with the size of an attribute learning window by adopting a sliding window, and calculating an empirical distribution function of each sequence to form an attribute candidate set;
s2, calculating pairwise distances between the attributes in the attribute candidate set by adopting a bilateral comparison method to generate a distance matrix, wherein the ith row in the distance matrix comprises the distances between all the attributes except the ith attribute and the ith attribute, and the distances between the attributes are 0;
s3, calculating the dominance ability of each attribute in the attribute candidate set according to the column sequence of the distance matrix, acquiring the attribute with the strongest dominance ability as a first attribute, and deleting the rest attributes in the dominance ability to update the attribute candidate set;
s4, repeating the steps S2-S3 to generate the normal attribute vector of the KPI.
It should be noted that, before the network fault diagnosis method is performed, relationships between several KPI indicators and network faults, that is, numerical characteristic variation relationships of some KPI indicators at the time of a network fault, are also studied in advance.
That is, according to the research result, the KPI index sequence when the network is normal is obtained as a sample for training the normal attribute vector, and the normal attribute vector corresponding to each KPI index is trained through the above steps.
As an embodiment, the step S3 includes:
comparing the ith row elements in the distance matrix with a preset second threshold, and counting the number of all the ith row elements which are less than or equal to the second threshold to take the number as the dominance capability of the ith attribute, wherein the larger the number of the ith row elements is, the stronger the dominance capability of the attribute is;
and acquiring the attribute with the strongest domination ability as a first attribute, and deleting the attribute with the distance from the attribute with the strongest domination ability to the attribute with the distance less than or equal to a second threshold value in the column corresponding to the attribute with the strongest domination ability so as to update the attribute candidate set.
It should be noted that, because the elements in each column of the distance matrix include the distances between the attributes themselves and the distances between all the attributes and the attributes, the dominance capability of each column of the distance matrix corresponding to one attribute is calculated by comparing each column of elements in the distance matrix with a second threshold preset according to experience, and counting the number of all the elements in the column that is less than or equal to the second threshold until all the numbers of the columns of the distance matrix are counted, and the dominance capability of the attribute corresponding to each column is determined according to the size of the number corresponding to each column, and the larger the number of the elements that is less than or equal to the second threshold, the stronger the dominance capability is.
After the attribute of the most dominant capability is obtained, all elements with distances smaller than or equal to the second threshold in the column of the distance matrix corresponding to the attribute are acquired, the distance between the attribute and the attribute is determined for all elements with distances smaller than or equal to the second threshold, and the corresponding attribute is deleted, that is, other attributes in the attribute dominant capability are deleted.
It should be noted that, by repeatedly executing steps S2-S3, the attributes in the attribute candidate set are pruned until all elements except 0 in the distance matrix are greater than the second threshold, and the remaining attributes are output as the normal attribute vector of the KPI index.
Further, as an embodiment, the determining whether the real-time sequence vectors of the KPI indicators are distributed normally includes:
calculating an empirical distribution function of a real-time sequence vector of the KPI, and calculating the distance between the empirical distribution function of the real-time sequence vector of the KPI and the empirical distribution function of each attribute in a normal attribute vector of the KPI to generate a distance set;
searching the minimum distance in the distance set, and judging whether the minimum distance exceeds a preset first threshold value;
if not, setting the deviation value of the KPI index as 0;
if so, taking the minimum distance as a deviation value of the KPI;
and judging the real-time sequence vector abnormality of the KPI when the deviation value exceeds a preset first threshold value.
That is to say, the obtained real-time sequence vector of the KPI index is calculated to obtain an empirical distribution function of the real-time sequence vector of the KPI index, and then the distances between the empirical distribution function of the real-time sequence vector of the KPI index and each attribute in the normal attribute vector of the KPI index are obtained to generate a distance set; searching the minimum distance in the distance set, and judging whether the minimum distance exceeds a preset first threshold value; if so, taking the minimum distance as the deviation value of the KPI; if not, setting the deviation value of the KPI index as 0; and judging the real-time sequence vector abnormality of the KPI when the deviation value exceeds a preset first threshold value.
It should be noted that the first threshold value here is set according to the actual operating environment; the second threshold value is set according to actual working process experience.
That is, if the deviation value of the KPI indicator exceeds a preset first threshold, it is determined that the real-time sequence vector of the KPI indicator is abnormal; otherwise, judging that the real-time sequence vector distribution of the KPI is normal.
It should be noted that, as shown in fig. 2, each KPI indicator calculates a corresponding deviation value by performing the above steps to determine whether the real-time sequence vector of each KPI indicator is distributed normally.
And 103, when the real-time sequence vector distribution of any one KPI in all KPI is abnormal, arranging the deviation values of all KPI in the K-S distribution test in sequence to form a deviation value vector.
That is, after calculating the deviation values of all KPI indicators, determining whether the real-time sequence vector distribution of the corresponding KPI indicator is abnormal according to the deviation values, and if the real-time sequence vector distribution of one KPI indicator is abnormal, arranging the deviation values of all KPI indicators in the K-S distribution test in sequence to form a deviation value vector.
And step 104, acquiring a network fault category with the highest similarity to the deviation value vector according to the deviation value vector by adopting a novel gravity clustering model, and taking the network fault category as a network fault diagnosis result.
As a specific embodiment, the method for acquiring the network fault category with the highest similarity to the offset vector according to the offset vector by using the novel gravity clustering model includes:
calculating the gravity value of each network fault category corresponding to the deviation value vector by the following formula:
F(x，j)=Mj*sim(x，C(j))，
wherein F (x, j) represents the gravity value of the deviation value vector x and the network fault category j, MjCentroid parameters, C, for network fault class j obtained for pre-training(j)The central vector of the deviation value vector corresponding to each network fault category obtained for pre-training, and,
wherein n represents the number of KPI indexes, k represents the kth dimension of the deviation value vector, and mu represents the number of whether the elements in the deviation value vector and the elements in the corresponding positions in the central vector are simultaneously 0 or simultaneously non-0 divided by the total number of the KPI indexes;
and taking the network fault category with the maximum gravity value as the network fault category with the highest similarity.
As one embodiment, assuming that the center vector is [ 00.90000 ] and the offset vector is [ 000.30.200 ], then μ for the center vector [ 00.90000 ] and the offset vector [ 000.30.200 ] is 0.5; alternatively, assuming the center vector is [ 00.90000 ] and the offset vector is [ 00.70000 ], then μ for the center vector [ 00.90000 ] and the offset vector [ 00.70000 ] is 1.
As a specific embodiment, the central vector of the offset vector corresponding to each network fault category is trained in advance according to the following formula:
wherein, | CjI represents the number of samples, x, of the class j(i)Denotes the ith sample, x denotes the unlabelled sample, and j denotes the fault class.
As a specific embodiment, the centroid parameter of the network fault category j is trained in advance according to the following steps:
therefore, after all the steps are executed, whether each KPI is normal or not is continuously observed in real time, once abnormity is found, fault diagnosis is carried out again to generate an alarm, and then observation … … is carried out to run back and forth in the mode, so that real-time intelligent diagnosis of network faults through KPI indexes is realized.
It should be noted that the computational complexity of the present invention is relatively low, the requirements for the computational capability and storage capability of the device are relatively low, and the implementation is convenient; the related attribute sequence, reference vector and characteristic parameter which need to be trained in advance are convenient and feasible (the normal attribute vector of KPI index and the central vector and centroid parameter of the KPI deviation value vector of fault need to be trained in advance), and the algorithm complexity is low, so that the method can adapt to the network environment in real time to carry out updating training in a certain period, and a better real-time monitoring effect is achieved; and the K-S inspection distribution algorithm is embedded and used in the algorithm, so that the numerical difference among all KPI indexes can be avoided, consistent and standardized data can be obtained after the K-S inspection, the algorithm work of a subsequent model is facilitated, and the operation expense of equipment is also saved.
In summary, according to the network fault diagnosis method of the embodiment of the present invention, first, the real-time sequence flow of the KPI indicator is obtained, and the real-time sequence flow of the KPI indicator is subjected to window interception processing to obtain the real-time sequence vector of the KPI indicator; then, performing K-S distribution inspection on the real-time sequence vector of the KPI and the normal attribute vector of the KPI trained in advance to judge whether the real-time sequence vector of the KPI is normally distributed or not; when the real-time sequence vector distribution of any one KPI in all KPI is abnormal, arranging deviation values of all KPI in K-S distribution test in sequence to form a deviation value vector; finally, a novel gravity clustering model is adopted, the network fault category with the highest similarity to the deviation value vector is obtained according to the deviation value vector, and the network fault category is used as a network fault diagnosis result; therefore, by monitoring the KPI in the communication network in real time, when the KPI is abnormal, the novel gravity cluster model is adopted to judge the network fault type, so that the diagnosis process of the network fault can be realized without manual intervention, and the high efficiency and convenience of network intelligent operation and maintenance are greatly improved.
In order to implement the foregoing embodiments, a second aspect of the present invention provides a computer-readable storage medium, on which a network fault diagnosis program is stored, and the network fault diagnosis program implements the network fault diagnosis method as described above when executed by a processor.
According to the computer-readable storage medium of the embodiment of the invention, the network fault diagnosis program is stored, so that the network fault diagnosis program is implemented by the network fault diagnosis program method when the network fault diagnosis program is executed by the processor, and therefore, by monitoring the KPI in the communication network in real time, when the KPI is abnormal, the network fault type is judged by adopting the novel gravity clustering model, so that the diagnosis process of the network fault can be realized without manual intervention, and the efficiency and convenience of network intelligent operation and maintenance are greatly improved.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
It should be noted that in the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by one and the same item of hardware. The usage of the words first, second and third, etcetera do not indicate any ordering. These words may be interpreted as names.
While preferred embodiments of the present invention have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, it is intended that the appended claims be interpreted as including preferred embodiments and all such alterations and modifications as fall within the scope of the invention.
It will be apparent to those skilled in the art that various changes and modifications may be made in the present invention without departing from the spirit and scope of the invention. Thus, if such modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include such modifications and variations.
In the description of the present invention, it is to be understood that the terms "first", "second" and the like are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implying any number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of the present invention, "a plurality" means two or more unless specifically defined otherwise.
In the present invention, unless otherwise expressly stated or limited, the terms "mounted," "connected," "secured," and the like are to be construed broadly and can, for example, be fixedly connected, detachably connected, or integrally formed; can be mechanically or electrically connected; either directly or indirectly through intervening media, either internally or in any other relationship. The specific meanings of the above terms in the present invention can be understood by those skilled in the art according to specific situations.
In the present invention, unless otherwise expressly stated or limited, the first feature "on" or "under" the second feature may be directly contacting the first and second features or indirectly contacting the first and second features through an intermediate. Also, a first feature "on," "over," and "above" a second feature may be directly or diagonally above the second feature, or may simply indicate that the first feature is at a higher level than the second feature. A first feature being "under," "below," and "beneath" a second feature may be directly under or obliquely under the first feature, or may simply mean that the first feature is at a lesser elevation than the second feature.
In the description herein, references to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the terms used above should not be understood to necessarily refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, various embodiments or examples and features of different embodiments or examples described in this specification can be combined and combined by one skilled in the art without contradiction.
Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention, and that variations, modifications, substitutions and alterations can be made to the above embodiments by those of ordinary skill in the art within the scope of the present invention.
Claims (8)
1. A network fault diagnosis method is characterized by comprising the following steps:
acquiring a real-time sequence flow of a KPI, and performing window interception processing on the real-time sequence flow of the KPI to acquire a real-time sequence vector of the KPI;
performing K-S distribution inspection on the real-time sequence vector of the KPI and the pre-trained normal attribute vector of the KPI to judge whether the real-time sequence vector of the KPI is normally distributed or not;
when the real-time sequence vector distribution of any one KPI in all KPI is abnormal, arranging deviation values of all KPI in K-S distribution test in sequence to form a deviation value vector;
and acquiring a network fault category with the highest similarity to the deviation value vector according to the deviation value vector by adopting a novel gravity clustering model, and taking the network fault category as a network fault diagnosis result.
2. The method according to claim 1, wherein performing a window-cutting process on the real-time sequence flow of the KPI indicators to obtain the real-time sequence vector of the KPI indicators comprises:
and performing segmentation processing on the real-time sequence flow of the KPI by adopting a sliding window mode so as to divide the real-time sequence flow of the KPI into real-time sequence vectors with the sizes of a plurality of segments of attribute learning windows.
3. The method of network fault diagnosis according to claim 1, characterized in that the normal attribute vector of the KPI indicator is trained according to the following steps:
s1, acquiring a normal sequence flow of the KPI, dividing the normal sequence flow of the KPI into a plurality of sequences with the size of an attribute learning window by adopting a sliding window, and calculating an empirical distribution function of each sequence to form an attribute candidate set;
s2, calculating pairwise distances between the attributes in the attribute candidate set by adopting a bilateral comparison method to generate a distance matrix, wherein the ith row in the distance matrix comprises the distances between all the attributes except the ith attribute and the ith attribute, and the distances between the attributes are 0;
s3, calculating the dominance ability of each attribute in the attribute candidate set according to the column sequence of the distance matrix, acquiring the attribute with the strongest dominance ability as a first attribute, and deleting the other attributes in the dominance ability to update the attribute candidate set;
s4, repeating the steps S2-S3 to generate the normal attribute vector of the KPI.
4. The method according to claim 1, wherein the determining whether the real-time sequence vectors of the KPI indicators are distributed normally comprises:
calculating an experience distribution function of the real-time sequence vector of the KPI, and calculating the distance between the experience distribution function of the real-time sequence vector of the KPI and the experience distribution function of each attribute in the normal attribute vector of the KPI to generate a distance set;
searching the minimum distance in the distance set, and judging whether the minimum distance exceeds a preset first threshold value;
if not, setting the deviation value of the KPI index as 0;
if so, the minimum distance is used as a deviation value of the KPI, and the real-time sequence vector of the KPI is judged to be abnormal when the deviation value exceeds a preset first threshold value.
5. The method of claim 1, wherein the obtaining the network fault category with the highest similarity to the offset vector according to the offset vector by using a novel gravity clustering model comprises:
calculating the gravity value of each network fault category corresponding to the deviation value vector by the following formula:
F(x，j)＝Mj*sim(x，C(j))，
wherein F (x, j) represents the gravity value of the deviation value vector x and the network fault category j, MjCentroid parameters, C, for network fault class j obtained for pre-training(j)The central vector of the deviation value vector corresponding to each network fault category obtained for pre-training, and,
wherein n represents the number of KPI indexes, k represents the kth dimension of the deviation value vector, and mu represents the number of whether the elements in the deviation value vector and the elements in the corresponding positions in the central vector are simultaneously 0 or simultaneously non-0 divided by the total number of the KPI indexes;
and taking the network fault category with the maximum gravity value as the network fault category with the highest similarity.
6. The network fault diagnosis method according to claim 3, wherein the step S3 includes:
comparing the ith row elements in the distance matrix with a preset second threshold, and counting the number of all the ith row elements which are less than or equal to the second threshold to take the number as the dominance capability of the ith attribute, wherein the larger the number is, the stronger the dominance capability of the attribute is;
and acquiring the attribute with the strongest domination capacity as a first attribute, and deleting the attribute with the distance from the attribute with the strongest domination capacity to the attribute with the second threshold value or less in the column corresponding to the attribute with the strongest domination capacity so as to update the attribute candidate set.
7. The method of claim 6, wherein the steps S2-S3 are repeated to prune the attributes in the attribute candidate set until all elements except 0 in the distance matrix are greater than the third threshold, and the remaining attributes are output as a normal attribute vector of the KPI indicator.
8. A computer-readable storage medium, having stored thereon a network fault diagnosis program which, when executed by a processor, implements the network fault diagnosis method according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911031015.3A CN110995461B (en) | 2019-10-28 | 2019-10-28 | Network fault diagnosis method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911031015.3A CN110995461B (en) | 2019-10-28 | 2019-10-28 | Network fault diagnosis method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110995461A true CN110995461A (en) | 2020-04-10 |
| CN110995461B CN110995461B (en) | 2021-06-22 |
Family
ID=70082549
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911031015.3A Active CN110995461B (en) | 2019-10-28 | 2019-10-28 | Network fault diagnosis method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110995461B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114363933A (en) * | 2021-12-29 | 2022-04-15 | 中国电信股份有限公司 | Network diagnosis method and device, electronic equipment and storage medium |
| CN116433255A (en) * | 2023-06-15 | 2023-07-14 | 建信金融科技有限责任公司 | Method, device, equipment and medium for determining suspicion of bill |
Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1874272A (en) * | 2005-06-03 | 2006-12-06 | 华为技术有限公司 | Method for recognizing failure node in network |
| US20110289042A1 (en) * | 2005-06-29 | 2011-11-24 | Board Of Trustees Of Michagn State University | Integrative Framework for Three-Stage Integrative Pathway Search |
| CN102355691A (en) * | 2011-06-30 | 2012-02-15 | 北京中创信测科技股份有限公司 | User experience quality sensing method of mobile data network |
| CN103200133A (en) * | 2013-03-21 | 2013-07-10 | 南京邮电大学 | Flow identification method based on network flow gravitation cluster |
| CN104809722A (en) * | 2015-04-13 | 2015-07-29 | 国家电网公司 | Electrical device fault diagnosis method based on infrared thermography |
| CN105487526A (en) * | 2016-01-04 | 2016-04-13 | 华南理工大学 | FastRVM (fast relevance vector machine) wastewater treatment fault diagnosis method |
| CN106685750A (en) * | 2015-11-11 | 2017-05-17 | 华为技术有限公司 | System anomaly detection method and device |
| CN107155089A (en) * | 2017-04-19 | 2017-09-12 | 国网辽宁省电力有限公司抚顺供电公司 | A kind of electric power unifies video monitoring platform equipment fault diagnosis method for early warning |
| CN109710983A (en) * | 2018-12-04 | 2019-05-03 | 北京大学 | A kind of cylinder of diesel engine hierarchical fault diagnosis method based on Key Performance Indicator |
| CN110062410A (en) * | 2019-03-28 | 2019-07-26 | 东南大学 | A kind of cell outage detection localization method based on adaptive resonance theory |
-
2019
- 2019-10-28 CN CN201911031015.3A patent/CN110995461B/en active Active
Patent Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1874272A (en) * | 2005-06-03 | 2006-12-06 | 华为技术有限公司 | Method for recognizing failure node in network |
| US20110289042A1 (en) * | 2005-06-29 | 2011-11-24 | Board Of Trustees Of Michagn State University | Integrative Framework for Three-Stage Integrative Pathway Search |
| CN102355691A (en) * | 2011-06-30 | 2012-02-15 | 北京中创信测科技股份有限公司 | User experience quality sensing method of mobile data network |
| CN103200133A (en) * | 2013-03-21 | 2013-07-10 | 南京邮电大学 | Flow identification method based on network flow gravitation cluster |
| CN104809722A (en) * | 2015-04-13 | 2015-07-29 | 国家电网公司 | Electrical device fault diagnosis method based on infrared thermography |
| CN106685750A (en) * | 2015-11-11 | 2017-05-17 | 华为技术有限公司 | System anomaly detection method and device |
| CN105487526A (en) * | 2016-01-04 | 2016-04-13 | 华南理工大学 | FastRVM (fast relevance vector machine) wastewater treatment fault diagnosis method |
| CN105487526B (en) * | 2016-01-04 | 2019-04-09 | 华南理工大学 | A kind of Fast RVM sewage treatment method for diagnosing faults |
| CN107155089A (en) * | 2017-04-19 | 2017-09-12 | 国网辽宁省电力有限公司抚顺供电公司 | A kind of electric power unifies video monitoring platform equipment fault diagnosis method for early warning |
| CN109710983A (en) * | 2018-12-04 | 2019-05-03 | 北京大学 | A kind of cylinder of diesel engine hierarchical fault diagnosis method based on Key Performance Indicator |
| CN110062410A (en) * | 2019-03-28 | 2019-07-26 | 东南大学 | A kind of cell outage detection localization method based on adaptive resonance theory |
Non-Patent Citations (3)
| Title |
|---|
| LIANFEN HUANG 等: "Plate Recognition Based on Deep Learning", 《IEEE》 * |
| 涂光辉: "基于机器学习的网络故障诊断技术研究与应用", 《中国优秀硕士学位论文全文数据库》 * |
| 黄联芬等: "基于路测的 TD ⁃ LTE 网络优化分析", 《现代电子技术》 * |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114363933A (en) * | 2021-12-29 | 2022-04-15 | 中国电信股份有限公司 | Network diagnosis method and device, electronic equipment and storage medium |
| CN114363933B (en) * | 2021-12-29 | 2024-04-05 | 中国电信股份有限公司 | Network diagnosis method, device, electronic equipment and storage medium |
| CN116433255A (en) * | 2023-06-15 | 2023-07-14 | 建信金融科技有限责任公司 | Method, device, equipment and medium for determining suspicion of bill |
| CN116433255B (en) * | 2023-06-15 | 2023-08-25 | 建信金融科技有限责任公司 | Method, device, equipment and medium for determining suspicion of bill |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110995461B (en) | 2021-06-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11216741B2 (en) | Analysis apparatus, analysis method, and non-transitory computer readable medium | |
| US10613960B2 (en) | Information processing apparatus and information processing method | |
| CN108960434B (en) | Method and device for analyzing data based on machine learning model interpretation | |
| CN112393931B (en) | Detection method, detection device, electronic equipment and computer readable medium | |
| CN110995461B (en) | Network fault diagnosis method | |
| CN112911627B (en) | Wireless network performance detection method, device and storage medium | |
| US9070203B2 (en) | Identification and quantification of microtextured regions in materials with ordered crystal structure | |
| CN111650453A (en) | Power equipment diagnosis method and system based on windowing characteristic Hilbert imaging | |
| CN107679089A (en) | A kind of cleaning method for electric power sensing data, device and system | |
| CN112541510A (en) | Intelligent fault diagnosis method based on multi-channel time series data | |
| CN107766695B (en) | A kind of method and device obtaining peripheral blood genetic model training data | |
| CN110232130B (en) | Metadata management pedigree generation method, apparatus, computer device and storage medium | |
| CN116306806A (en) | Fault diagnosis model determining method and device and nonvolatile storage medium | |
| CN113218537B (en) | Training method, training device, training equipment and training storage medium for temperature anomaly detection model | |
| CN113918433A (en) | Adaptive intelligent network equipment performance index abnormity detection device and method | |
| KR102187344B1 (en) | Method and apparatus for diagnosis in clinical inspection of pets using decision tree | |
| CN115690590B (en) | Crop growth abnormity monitoring method, device, equipment and storage medium | |
| CN116738261A (en) | Numerical characteristic discretization attribution analysis method and device based on clustering and binning | |
| CN107861082B (en) | Calibration interval determining method and device of electronic measuring equipment | |
| CN115441456A (en) | Fault diagnosis method and device for power grid dispatching support system | |
| CN113033845B (en) | Construction method and device for power transmission resource co-construction and sharing | |
| CN113255440B (en) | Crop leaf abnormity detection method and system based on machine learning | |
| CN114416410A (en) | Anomaly analysis method and device and computer-readable storage medium | |
| CN114660931A (en) | Method and system for diagnosing and identifying petrochemical process fault | |
| CN113035363B (en) | Probability density weighted genetic metabolic disease screening data mixed sampling method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20210901 Address after: Siming District of Xiamen city in Fujian Province, 361000 South Siming Road No. 422 Patentee after: XIAMEN University Patentee after: Jingxin Network System Co.,Ltd. Address before: 361000 Siming South Road, Xiamen, Fujian Province, No. 422 Patentee before: XIAMEN University Patentee before: COMBA TELECOM SYSTEMS (GUANGZHOU) Ltd. |