CN112532467A

CN112532467A - Method, device and system for realizing fault detection

Info

Publication number: CN112532467A
Application number: CN201910877726.6A
Authority: CN
Inventors: 李�浩; 王仲宇; 薛莉; 张彦芳; 万华冬
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2019-09-17
Filing date: 2019-09-17
Publication date: 2021-03-19
Anticipated expiration: 2039-09-17
Also published as: CN112532467B

Abstract

The embodiment of the application provides a method, a device and a system for realizing fault detection. The method comprises the following steps: the controller sends an anomaly detection model to a plurality of network devices in the detected network; then receiving the abnormal detection results of at least two network devices in the plurality of network devices, wherein the abnormal detection result of each network device is the detection result of the data sequence which is detected as abnormal by the network device by using the abnormal detection model; and finally, carrying out fault detection on the at least two network devices according to the abnormal detection results of the at least two network devices. By adopting the method, the controller only carries out fault detection on the network equipment according to the detection result of the data sequence which is sent by the network equipment and detected as abnormal, thereby greatly reducing the operation amount of the controller, improving the detection efficiency of the controller, having more accurate detection and higher accuracy of the detection result.

Description

Method, device and system for realizing fault detection

Technical Field

The present application relates to the field of communications technologies, and in particular, to a method, an apparatus, and a system for implementing fault detection.

Background

The operation and maintenance of the telecommunication network is a necessary link for ensuring the normal operation of the communication network, and for the problem of the fault of the network equipment (network equipment for short) at the service side, a telecommunication operator can process the fault in time only if the fault is correctly detected.

Currently, a telecom operator receives data, which is reported by a network device and used for representing the performance of the network device, through a controller, and after receiving the data reported by the network device, performs fault detection on the network device according to all the data reported by the network device, so as to process a fault of the network device.

However, because the amount of data reported by the network device is large and the data is relatively cluttered, on one hand, the controller needs to perform a large amount of operations, which affects the detection efficiency of the controller, resulting in low detection efficiency, and on the other hand, the data is cluttered, which affects the accuracy of the calculation result of the controller, resulting in low accuracy of the detection result.

Disclosure of Invention

The embodiment of the application provides a method, a device and a system for realizing fault detection, and aims to solve the problems of low detection efficiency and low accuracy of detection results in the current fault detection.

In a first aspect, an embodiment of the present application provides a method for implementing fault detection, where the method includes: the controller sends an anomaly detection model to a plurality of network devices in a detected network, wherein the anomaly detection model is used for detecting whether a data sequence of each network device is abnormal, and data forming the data sequence is used for representing the performance of the network device;

the controller receives the abnormal detection results of at least two network devices in the plurality of network devices, wherein the abnormal detection result of each network device is the detection result of the data sequence which is detected as abnormal by the network device by using the abnormal detection model;

and the controller detects the faults of the at least two network devices according to the abnormal detection results of the at least two network devices.

In this implementation, the controller first sends an anomaly detection model to the plurality of network devices, then receives a detection result of a data sequence that is detected as an anomaly by at least two network devices using the anomaly detection model, and finally performs fault detection on the at least two network devices according to the detection result. By adopting the method, the network equipment firstly detects the data sequence of the network equipment according to the abnormal detection model sent by the controller, and then sends the detection result of the data sequence detected as abnormal to the controller, and the controller only carries out fault detection on the network equipment according to the detection result of the data sequence detected as abnormal sent by the network equipment, thereby greatly reducing the operation amount of the controller and improving the detection efficiency of the controller.

With reference to the first aspect, in a first possible implementation manner of the first aspect, the anomaly detection result of each network device includes a data type and an acquisition time of a data sequence detected as an anomaly by the network device using the anomaly detection model; the data type is used for determining the fault type, and the acquisition time is used for determining the fault occurrence time.

In this implementation manner, the anomaly detection result obtained by the controller includes the data type and the acquisition time of the data sequence detected as the anomaly, and the fault type and the fault occurrence time of the network device with the fault can be determined according to the data type and the acquisition time, so that the detection result is more accurate.

With reference to the first aspect, in a second possible implementation manner of the first aspect, the performing, by the controller, fault detection on the at least two network devices according to the abnormal detection results of the at least two network devices includes:

and the controller sequentially uses a plurality of mutually associated fault identification conditions related to the data type corresponding to each acquisition time according to the sequence of the acquisition time to carry out fault detection on the at least two network devices.

In the implementation mode, the controller sequentially uses a plurality of mutually associated fault identification conditions related to the data type corresponding to each acquisition time to perform fault detection on the at least two network devices, in the fault detection process, the relevance between the network devices is fully considered, the network devices are not subjected to fault detection only according to the data of one network device, and the fault detection accuracy is higher.

With reference to the first aspect, in a third possible implementation manner of the first aspect, the multiple interrelated fault identification conditions are set according to an association relationship between different data types.

In the implementation mode, a plurality of mutually-associated fault identification conditions are set according to the association relation among different data types, and the data can represent the performance of the network equipment, so that the relevance among the performances of the network equipment is fully considered in the fault detection process of the network equipment by the controller, and the fault detection accuracy is further improved.

With reference to the first aspect, in a fourth possible implementation manner of the first aspect, the method further includes:

the controller acquires fault information, wherein the fault information comprises a first device identifier of a network device with a fault in the plurality of network devices, a first fault time for indicating the fault occurrence time and a first type identifier for indicating the fault type;

the controller sends data request information to the network equipment corresponding to the first equipment identifier, wherein the data request information comprises the first failure time and the first type identifier;

the controller receives an abnormal data sequence; the abnormal data sequence refers to a data sequence which is determined by the network equipment corresponding to the first equipment identifier according to the data request information and corresponds to the first fault time and the first type identifier;

the controller updating the anomaly detection model using the anomaly data sequence;

and the controller sends the updated anomaly detection model to the network equipment corresponding to the first equipment identifier.

In the implementation mode, the controller obtains fault information besides performing fault detection on the network equipment by using the received abnormal detection result of the network equipment, receives the abnormal data sequence sent by the faulty network equipment according to the fault information, updates the abnormal detection model by using the received abnormal data sequence, and sends the updated abnormal detection model to the faulty network equipment, so that the faulty network equipment can perform abnormal detection on the data sequence of the faulty network equipment by using a more accurate abnormal detection model in the subsequent fault detection process, and the accuracy of subsequent fault detection is improved.

With reference to the first aspect, in a fifth possible implementation manner of the first aspect, the performing, by the controller, fault detection on the at least two network devices according to the abnormal detection results of the at least two network devices includes:

and if the controller determines that the at least two network devices have the network device with the fault according to the abnormal detection results of the at least two network devices, the controller outputs a second device identifier of the network device with the fault, a second fault time for indicating the fault occurrence time and a second type identifier for indicating the fault type.

In the implementation mode, the controller determines the equipment identifier, the fault time and the fault type of the network equipment with the fault according to the abnormal detection results of the at least two network equipment, and the fault detection result is more accurate.

With reference to the first aspect, in a sixth possible implementation manner of the first aspect, the outputting, by the controller, a second device identifier of a network device in which a fault occurs, and a second fault time indicating a fault occurrence time and a second type identifier indicating a fault type includes:

and the controller generates an alarm message, wherein the alarm message comprises the second equipment identifier, the second failure time and the second type identifier.

In this implementation manner, the controller may notify the network management side that the network device corresponding to the second device identifier has the fault of which the fault type is the second type identifier at the second fault time by generating the alarm message, so that the network management side may perform fault processing on the faulty network device in time according to the alarm message.

With reference to the first aspect, in a seventh possible implementation manner of the first aspect, the anomaly detection result of each network device further includes a data sequence detected as an anomaly by the network device using the anomaly detection model.

In this implementation manner, the anomaly detection result of the network device includes the data sequence detected as the anomaly, so that the controller can determine the fault condition of the network device according to the variation trend of the data in the data sequence, thereby improving the accuracy of fault detection.

With reference to the first aspect, in an eighth possible implementation manner of the first aspect, the performing, by the controller, fault detection on the at least two network devices according to the abnormal detection result of the at least two network devices includes:

if the controller determines that the at least two network devices have no network device with fault according to the abnormal detection results of the at least two network devices, the controller marks the data sequence detected as abnormal as a normal data sequence;

the controller updating the anomaly detection model using the normal data sequence;

the controller sends the updated anomaly detection model to the plurality of network devices.

In the implementation mode, the controller updates the abnormal detection model by using the normal data sequence of the network equipment without fault identification, and sends the updated abnormal detection model to the network equipment, so that the network equipment can use the more accurate abnormal detection model to perform abnormal detection on the data sequence of the network equipment in the subsequent fault detection process, and the accuracy of subsequent fault detection is improved.

With reference to the first aspect, in a ninth possible implementation manner of the first aspect, the anomaly detection model is obtained by the controller through training according to a historical data sequence of the plurality of network devices.

In the implementation mode, the anomaly detection model is obtained by training according to the historical data sequence of the network equipment, and the accuracy of the model is higher.

With reference to the first aspect, in a tenth possible implementation manner of the first aspect, the historical data sequence is formed by arranging, according to the order of acquisition time, to-be-trained data and N first historical data that are acquired before the to-be-trained data and are closest to the to-be-trained data; the data to be trained is data which is detected to be abnormal and marked to be normal or abnormal; the first historical data is data which is detected abnormally and marked as normal; the data type of the first historical data is the same as that of the data to be trained.

In the implementation mode, the historical data sequence is composed of the data to be trained and N pieces of historical data which are collected before the data to be trained and marked as normal, the problem of diversification of the historical data sequence is solved, on one hand, the model training process is simpler, and on the other hand, an anomaly detection model generated by training is more accurate.

In a second aspect, an embodiment of the present application provides a method for implementing fault detection, where the method includes: the method comprises the steps that the network equipment receives an abnormality detection model sent by a controller, the abnormality detection model is used for detecting whether a data sequence of the network equipment is abnormal or not, and data forming the data sequence is used for representing the performance of the network equipment;

the network equipment acquires an abnormal detection result, wherein the abnormal detection result refers to a detection result of a data sequence which is detected as abnormal by the network equipment by using the abnormal detection model;

and the network equipment sends the abnormal detection result to the controller, and the abnormal detection result is used for the controller to carry out fault detection on the network where the network equipment is located.

In this implementation manner, the network device receives the anomaly detection model sent by the controller, and sends the detection result of the data sequence detected as an anomaly by using the anomaly detection model to the controller, so that the controller can perform fault detection on the network where the network device is located according to the anomaly detection result, thereby improving the accuracy of the controller in detecting the network fault.

With reference to the second aspect, in a first possible implementation manner of the second aspect, the data sequence of the network device is formed by arranging, according to the order of acquisition time, data to be detected and N second historical data that are acquired before the data to be detected and are closest to the data to be detected; the data to be detected is data which is not subjected to abnormal detection, and the second historical data is data which is subjected to abnormal detection and marked as normal; the data type of the second historical data is the same as that of the data to be detected.

In the implementation mode, the data sequence of the network equipment is composed of the data to be detected and N pieces of historical data which are collected before the data to be detected and marked as normal, the problem of data sequence diversification is avoided, on one hand, the process of carrying out abnormity detection on the data sequence by using an abnormity detection model is simpler, and on the other hand, the detection result obtained after detection is more accurate.

With reference to the second aspect, in a second possible implementation manner of the second aspect, the data sequence of the network device is a key performance indicator KPI data sequence.

In the implementation mode, the data sequence formed by the KPI data of the network equipment is used as the data sequence of the network equipment, and the KPI data can accurately represent various performances of the network equipment, so that the detection result obtained after the KPI data sequence is used for carrying out fault detection on the network equipment is more accurate.

With reference to the second aspect, in a third possible implementation manner of the second aspect, the anomaly detection result is obtained by inputting the data sequence or the feature vector of the data sequence into the anomaly detection model by the network device.

In the implementation mode, the network equipment can acquire the self abnormal detection result according to the data sequence or the characteristic vector of the data sequence, the implementation mode is more various, and the applicability is better.

In a third aspect, an embodiment of the present application provides a controller for implementing fault detection, where the controller includes: a sending module, configured to send an anomaly detection model to multiple network devices in a detected network, where the anomaly detection model is used to detect whether a data sequence of each network device is abnormal, and data forming the data sequence is used to characterize performance of the network device;

a receiving module, configured to receive an anomaly detection result of at least two network devices in the multiple network devices, where the anomaly detection result of each network device is a detection result of a data sequence detected as an anomaly by the network device using the anomaly detection model;

and the processing module is used for carrying out fault detection on the at least two network devices according to the abnormal detection results of the at least two network devices.

In this implementation, the controller may send an abnormality detection model to the plurality of network devices, then receive a detection result of a data sequence that is detected as abnormal by at least two network devices using the abnormality detection model, and finally perform fault detection on the at least two network devices according to the detection result. When the controller is used for carrying out fault detection on the network equipment, the network equipment firstly detects a data sequence of the network equipment according to an abnormal detection model sent by the controller, then sends a detection result of the data sequence detected as abnormal to the controller, and the controller only carries out fault detection on the network equipment according to the detection result of the data sequence detected as abnormal sent by the network equipment, so that the operation amount of the controller is greatly reduced, the detection efficiency of the controller is improved, in addition, as the controller only carries out fault detection on the network equipment according to the detection result of the data sequence detected as abnormal, the detection is more accurate, and the accuracy of the detection result is higher.

With reference to the third aspect, in a first possible implementation manner of the third aspect, the abnormality detection result of each network device includes a data type and a collection time of a data sequence detected as an abnormality by the network device using the abnormality detection model; the data type is used for determining the fault type, and the acquisition time is used for determining the fault occurrence time.

With reference to the third aspect, in a second possible implementation manner of the third aspect, the processing module is specifically configured to:

and according to the sequence of the acquisition time, sequentially using a plurality of mutually associated fault identification conditions related to the data type corresponding to each acquisition time to carry out fault detection on the at least two network devices.

In this implementation manner, the controller may sequentially use a plurality of mutually associated fault identification conditions related to the data type corresponding to each acquisition time to perform fault detection on the at least two network devices, in the process of fault detection, the relevance between the network devices is fully considered, the network devices are no longer subjected to fault detection only according to the data of one network device, and the accuracy of fault detection is higher.

With reference to the third aspect, in a third possible implementation manner of the third aspect, the multiple interrelated fault identification conditions are set according to an association relationship between different data types.

In the implementation mode, a plurality of mutually-associated fault identification conditions are set according to the association relation among different data types, the data can represent the performance of the network equipment, and the controller fully considers the association among the performances of the network equipment in the fault detection process of the network equipment, so that the fault detection accuracy is further improved.

With reference to the third aspect, in a fourth possible implementation manner of the third aspect, the receiving module is further configured to obtain fault information, where the fault information includes a first device identifier of a network device that has a fault among the multiple network devices, a first fault time indicating a fault occurrence time, and a first type identifier indicating a fault type;

the sending module is further configured to send data request information to the network device corresponding to the first device identifier, where the data request information includes the first failure time and the first type identifier;

the receiving module is further used for receiving an abnormal data sequence; the abnormal data sequence refers to a data sequence which is determined by the network equipment corresponding to the first equipment identifier according to the data request information and corresponds to the first fault time and the first type identifier;

the processing module is further configured to update the anomaly detection model using the anomaly data sequence;

the sending module is further configured to send the updated anomaly detection model to the network device corresponding to the first device identifier.

With reference to the third aspect, in a fifth possible implementation manner of the third aspect, the processing module is specifically configured to:

and if the processing module determines that the at least two network devices have the network device with the fault according to the abnormal detection results of the at least two network devices, outputting a second device identifier of the network device with the fault, a second fault time for indicating the fault occurrence time and a second type identifier for indicating the fault type.

With reference to the third aspect, in a sixth possible implementation manner of the third aspect, the processing module is configured to output a second device identifier of the failed network device, a second failure time indicating a failure occurrence time, and a second type identifier indicating a type of the failure, and includes:

the processing module is configured to generate an alarm message, where the alarm message includes the second device identifier, the second failure time, and the second type identifier.

With reference to the third aspect, in a seventh possible implementation manner of the third aspect, the abnormality detection result of each network device further includes a data sequence detected as abnormal by the network device using the abnormality detection model.

In this implementation manner, since the anomaly detection result of the network device includes the data sequence detected as the anomaly, the controller can determine the fault condition of the network device according to the variation trend of the data in the data sequence, thereby improving the accuracy of fault detection.

With reference to the third aspect, in an eighth possible implementation manner of the third aspect, the processing module is specifically configured to:

if the processing module determines that the at least two network devices have no network device with a fault according to the abnormal detection results of the at least two network devices, marking the data sequence detected as abnormal as a normal data sequence;

updating the anomaly detection model using the normal data sequence;

the sending module is further configured to send the updated anomaly detection model to the plurality of network devices.

With reference to the third aspect, in a ninth possible implementation manner of the third aspect, the anomaly detection model is obtained by the processing module through training according to historical data sequences of the multiple network devices.

With reference to the third aspect, in a tenth possible implementation manner of the third aspect, the historical data sequence is formed by arranging, according to the order of acquisition time, to-be-trained data and N first historical data that are acquired before the to-be-trained data and are closest to the to-be-trained data; the data to be trained is data which is detected to be abnormal and marked to be normal or abnormal; the first historical data is data which is detected abnormally and marked as normal; the data type of the first historical data is the same as that of the data to be trained.

In the implementation mode, the historical data sequence is composed of the data to be trained and N pieces of historical data which are collected before the data to be trained and marked as normal, the problem of diversification of the historical data sequence is solved, on one hand, the process of training the model by the controller is simpler, and on the other hand, the abnormal detection model generated by the training of the controller is more accurate.

In a fourth aspect, an embodiment of the present application provides a network device, where the network device includes: the receiving module is used for receiving an anomaly detection model sent by the controller, the anomaly detection model is used for detecting whether a data sequence of the network equipment is abnormal, and data forming the data sequence is used for representing the performance of the network equipment;

the processing module is used for acquiring an abnormal detection result, wherein the abnormal detection result refers to a detection result of a data sequence which is detected as abnormal by the network equipment by using the abnormal detection model;

and the sending module is used for sending the abnormal detection result to the controller, and the abnormal detection result is used for the controller to carry out fault detection on the network where the network equipment is located.

In this implementation manner, the network device may receive the anomaly detection model sent by the controller, and send the detection result of the data sequence detected as an anomaly by using the anomaly detection model to the controller, so that the controller may perform fault detection on the network where the network device is located according to the anomaly detection result, thereby improving the accuracy of the controller in detecting the network fault.

With reference to the fourth aspect, in a first possible implementation manner of the fourth aspect, the data sequence of the network device is formed by arranging, according to the order of acquisition time, data to be detected and N second historical data that are acquired before the data to be detected and are closest to the data to be detected; the data to be detected is data which is not subjected to abnormal detection, and the second historical data is data which is subjected to abnormal detection and marked as normal; the data type of the second historical data is the same as that of the data to be detected.

In the implementation mode, the data sequence of the network equipment is composed of the data to be detected and N pieces of historical data which are collected before the data to be detected and marked as normal, and the problem of data sequence diversification is avoided.

With reference to the fourth aspect, in a second possible implementation manner of the fourth aspect, the data sequence of the network device is a key performance indicator KPI data sequence.

In this implementation, the data sequence of the network device is a data sequence composed of KPI data of the network device, and since the KPI data can accurately represent various performances of the network device, a detection result obtained after the network device is subjected to fault detection by using the KPI data sequence is more accurate.

With reference to the fourth aspect, in a third possible implementation manner of the fourth aspect, the anomaly detection result is obtained by inputting the data sequence or the feature vector of the data sequence into the anomaly detection model by the network device.

In this implementation, the network device may obtain its own anomaly detection result according to the data sequence or the feature vector of the data sequence, and the manner of obtaining the anomaly detection result is more various and the applicability is better.

In a fifth aspect, an embodiment of the present application provides a system for implementing fault detection, where the system includes: a controller and a plurality of network devices;

wherein the controller is to:

sending an anomaly detection model to the plurality of network devices, wherein the anomaly detection model is used for detecting whether the data sequence of each network device is abnormal, and the data forming the data sequence is used for representing the performance of the network device;

receiving the abnormal detection results of at least two network devices in the plurality of network devices, wherein the abnormal detection result of each network device is the detection result of the data sequence which is detected as abnormal by the network device by using the abnormal detection model;

and carrying out fault detection on the at least two network devices according to the abnormal detection results of the at least two network devices.

In the implementation mode, the network equipment in the system detects the data sequence of the network equipment according to the abnormal detection model sent by the controller, then sends the detection result of the data sequence detected as abnormal to the controller, and the controller only carries out fault detection on the network equipment according to the detection result of the data sequence detected as abnormal sent by the network equipment, so that the operation amount of the controller is greatly reduced, the detection efficiency of the controller is improved, in addition, as the controller only carries out fault detection on the network equipment according to the detection result of the data sequence detected as abnormal, the detection is more accurate, and the accuracy of the detection result is higher.

In a sixth aspect, an embodiment of the present application provides an apparatus, which includes a processor, which is coupled to a memory, reads an instruction in the memory, and executes the first aspect, various possible implementations of the first aspect, the second aspect, and a method in the various possible implementations of the second aspect according to the instruction.

In a seventh aspect, an embodiment of the present application provides a computer storage medium, where instructions are stored, and when the instructions are executed on a computer, the computer is caused to perform some or all of the steps of the first aspect, the various possible implementations of the first aspect, the second aspect, and the various possible implementations of the second aspect.

In an eighth aspect, embodiments of the present application provide a computer program product, which when run on a computer, causes the computer to execute some or all of the steps of the method in the first aspect, the various possible implementations of the first aspect, the second aspect, and the various possible implementations of the second aspect.

In order to solve the problem that the detection efficiency and the accuracy of a detection result are low in the current fault detection, the embodiment of the application provides a method, a device and a system for realizing fault detection. In the method, a controller firstly sends an abnormality detection model to a plurality of network devices, then receives the detection result of a data sequence which is detected as abnormal by at least two network devices by using the abnormality detection model, and finally carries out fault detection on the at least two network devices according to the detection result. By adopting the method, the network equipment firstly detects the data sequence of the network equipment according to the abnormal detection model sent by the controller, and then sends the detection result of the data sequence detected as abnormal to the controller, and the controller only carries out fault detection on the network equipment according to the detection result of the data sequence detected as abnormal sent by the network equipment, thereby greatly reducing the operation amount of the controller and improving the detection efficiency of the controller.

Drawings

FIG. 1 is a schematic diagram of a network architecture according to an embodiment of the present disclosure;

FIG. 2 is a schematic flow chart diagram illustrating one embodiment of a method for implementing fault detection provided herein;

FIG. 3 is a block diagram of an embodiment of a controller for implementing fault detection provided herein;

FIG. 4 is a block diagram of an embodiment of a network device provided herein;

fig. 5 is a block diagram of a system for implementing fault detection according to an embodiment of the present disclosure.

Detailed Description

The technical solution of the present application is described below with reference to the accompanying drawings.

Before explaining the technical scheme of the present application, an application scenario of the present application is explained with reference to the accompanying drawings.

The method for implementing fault detection provided by the present application can be implemented in the network architecture provided by the present application. Referring to fig. 1, fig. 1 is a schematic structural diagram of an embodiment of a network architecture provided in the present application. As can be seen from fig. 1, the network architecture includes: a controller 10 and a plurality of network devices 20; wherein the controller 10 may be disposed at a network management side, such as a control center of a telecommunication operator or a mobile operator, for performing fault detection on the plurality of network devices 20 in the network architecture. Each network device 20 may communicate with the controller 10 through a bus or wireless transmission, and a plurality of network devices 20 may also communicate with each other through a bus or wireless transmission. The network device 20 may be a router, a switch, etc., among others.

The following describes an embodiment of a method for implementing fault detection provided by the present application, taking a specific network architecture as an example, where the network architecture includes a controller, and a first network device and a second network device that communicate with the controller. Referring to fig. 2, fig. 2 is a schematic flow chart of an embodiment of a method for implementing fault detection provided in the present application. As can be seen from fig. 2, the method includes:

step 101, the first network device and the second network device respectively obtain their own data sequences.

Generally, the performance of the network device may be represented by using data of the network device, and the data of the network device may be Key Performance Indicator (KPI) data of the network device, or may be log data of the network device.

Based on the fact that the performance types of the network devices are more, the data of the network devices also include data of multiple data types, and the data of each data type corresponds to one performance of the network device, taking KPI data as an example, the data type of KPI data is referred to as KPI type for short in this application, and similarly, KPI types also include multiple types, for example, the number of lost packets due to Time To Live (TTL) timeout, the number of lost packets of unknown reasons, the number of data packets failed to be forwarded due to unavailability of a next hop send-in port, the number of port process packets, the utilization rate of a Central Processing Unit (CPU), the packet loss rate, time delay, and the like.

The data type may be used to determine a fault type of the network device, where the fault type of the network device also includes multiple types, for example, a port fault, a module fault, a backplane fault, a software fault, a packet forwarding fault, a connectivity fault, and the like.

In the process of fault detection of a first network device and a second network device by a controller, the first network device and the second network device continuously acquire respective data according to an acquisition cycle with the duration being a first preset duration, after each data is acquired, the data is used as data to be detected, the data to be detected and N pieces of historical data which are acquired before the data to be detected and are closest to the data to be detected are arranged into a data sequence according to the sequence of acquisition time, and the data sequence is correspondingly stored together with the acquisition time of the data to be detected, equipment identification (such as equipment ID of the network device) and data type (such as KPI type). The data to be detected is data which is not subjected to anomaly detection and is not marked as normal or abnormal, the second historical data is data which is subjected to anomaly detection and is marked as normal, the data type of the second historical data is the same as that of the data to be detected, N is a positive integer greater than or equal to 1, and the first preset time length can be set according to an actual application scene.

The data collection time may be used to determine the time when the network device fails, and specific implementation manners may refer to the contents of subsequent embodiments, which are not described in detail herein.

Step 102, the controller sends an anomaly detection model to the first network device and the second network device.

In some alternative embodiments, the controller may train to generate the anomaly detection model before sending the anomaly detection model to the first network device and the second network device.

Optionally, the controller may train to generate the anomaly detection model according to the following manner: the controller trains a preset network model, such as a decision tree model, by using a plurality of historical data sequences of the first network device and the second network device to obtain an anomaly detection model. The anomaly detection model may be used to detect whether a data sequence of each of the first network device and the second network device is anomalous.

Each historical data sequence is formed by arranging the data to be trained and N pieces of historical data which are acquired before the data to be trained and are closest to the data to be trained according to the sequence of acquisition time, and for the convenience of distinguishing, the historical data in the scene is simply referred to as first historical data. The data to be trained is data that has undergone anomaly detection, and may be data marked as normal or data marked as abnormal. The first historical data is data which is marked as normal after being subjected to abnormal detection, and the data type of the first historical data is the same as that of the data to be trained.

In some optional embodiments, the controller may further store a pre-trained abnormality detection model in the system, and when step 102 is executed, the preset abnormality detection model is directly called from the system, so that the fault detection efficiency of the controller may be improved.

And 103, the first network device and the second network device respectively use the anomaly detection model to detect own data sequences to obtain own anomaly detection results.

Optionally, after receiving the anomaly detection model sent by the controller, the first network device and the second network device each input their own data sequences into the received anomaly detection model, extract the feature vector of the data sequence using the anomaly detection model, determine whether the data sequence is abnormal according to the feature vector, and determine the data sequence with the abnormal determination result and the device identifier, the acquisition time, and the data type corresponding to the data sequence as their own anomaly detection result.

Optionally, the first network device and the second network device receive the anomaly detection model sent by the controller, respectively input each data sequence of themselves into the received anomaly detection model, extract the feature vector of the data sequence using the anomaly detection model, and determine whether the data sequence is abnormal according to the feature vector, and then determine the feature vector of the data sequence with the abnormal determination result, and the device identifier, the acquisition time, and the data type corresponding to the data sequence as the anomaly detection result of themselves.

Optionally, the first network device and the second network device may further extract a feature vector of each data sequence of the first network device and the second network device in advance, then after receiving the anomaly detection model sent by the controller, input the feature vector of each data sequence into the anomaly detection model, determine whether the data sequence is abnormal by using the anomaly detection model according to the feature vector, and determine the data sequence with the abnormal determination result and the device identifier, the acquisition time, and the data type corresponding to the data sequence as the anomaly detection result of the first network device and the second network device.

Optionally, the first network device and the second network device may further extract a feature vector of each data sequence of the first network device and the second network device in advance, then after receiving the anomaly detection model sent by the controller, input the feature vector of each data sequence into the anomaly detection model, determine whether the data sequence is abnormal by using the anomaly detection model according to the feature vector, and determine the feature vector of the data sequence with the abnormal determination result, and the device identifier, the acquisition time, and the data type corresponding to the data sequence as the anomaly detection result of the first network device and the second network device.

Optionally, the feature vector may be a vector of one or more of statistical features, fitted features, or frequency domain features.

After the first network device and the second network device respectively obtain the own abnormal detection result, the own abnormal detection result is sent to the controller.

And 104, the controller acquires an abnormal detection result of the first network equipment and/or the second network equipment.

After sending the anomaly detection model to the first network device and the second network device, the controller continuously receives anomaly detection results sent by the first network device and the second network device, and sorts the device identification, the data type and the data sequence (or the feature vector of the data sequence) contained in the received anomaly detection results according to the corresponding acquisition time. For example, the controller may sort the device identifiers, the data types, and the data sequences (or feature vectors of the data sequences) included in the received anomaly detection results in the manner shown in table 1 below.

TABLE 1

Device ID	KPI type	Time of acquisition	Data sequence
				2	Name_a	08:15	Num_x
1	Name_b	08:16	Num_y
				2	Name_a	08:16	Num_z

After the fault detection is started, the controller performs fault detection on the first network device and/or the second network device according to a time window with the duration being a second preset duration.

In each detection time window, the controller first determines the anomaly detection result obtained in the detection time window. The anomaly detection result obtained by the controller in each detection time window may only include the anomaly detection result of the first network device, or may include both the anomaly detection result of the first network device and the anomaly detection result of the second network device.

And 105, the controller detects the fault of the first network equipment and/or the second network equipment according to the obtained abnormal detection result.

And after the controller acquires the abnormal detection result in each detection time window, fault detection is carried out on the first network equipment and/or the second network equipment according to the acquired abnormal detection result.

Optionally, the controller performs fault detection on the first network device and/or the second network device according to the obtained abnormal detection result, which may be implemented as follows: the controller sequentially uses a plurality of mutually associated fault identification conditions related to the data type corresponding to each acquisition time according to the sequence of the acquisition time contained in the obtained abnormal detection result to perform fault detection on the first network equipment and/or the second network equipment until the first network equipment and the second network equipment are determined to have fault network equipment, and then the controller outputs equipment identification, type identification and fault time of the fault network equipment, wherein the type identification is used for indicating the fault type, and the fault time is used for indicating the fault time, so that the equipment identification, the type identification and the fault time of the fault network equipment in the scene are respectively referred to as the second equipment identification, the second type identification and the second fault time for convenience; or, the controller determines that neither the first network device nor the second network device fails if any one of the first network device and the second network device fails after the first network device and/or the second network device is subjected to failure detection using a plurality of identification conditions associated with each other and related to the data type corresponding to the last acquisition time.

The plurality of mutually-associated fault identification conditions related to the data type corresponding to each acquisition time are set according to the association relation among different data types and can be summarized according to actual experience.

In the following, a specific example will be described for a process of the controller performing fault detection on the first network device and/or the second network device according to the obtained abnormality detection result.

In this example, the controller obtains 10 abnormality detection results, which include an abnormality detection result of a first network device (abbreviated as device a) with a device identifier a and an abnormality detection result of a second network device (abbreviated as device B) with a device identifier B, where the acquisition cycles of the device a and the device B are both 1 minute.

Firstly, the controller arranges the device identifiers, the data types and the data sequences contained in the obtained 10 abnormal detection results into a mode shown in the following table 2 according to the sequence of the acquisition time.

TABLE 2

Then, the controller performs fault detection on the device a and/or the device B by using, as a root detection result, an abnormality detection result with the most advanced collection time sequence, for example, an abnormality detection result corresponding to number 1 in table 2, and using a plurality of correlated fault identification conditions related to KPI types of the root detection result, for example, a plurality of correlated fault identification conditions related to the number of data packets with forwarding failure caused by unavailability of a next hop ingress port, specifically including:

first, a first failure recognition condition related to the KPI type of the root detection result, for example, a first failure recognition condition related to the number of data packets of which forwarding fails due to the next hop ingress port being unavailable is used: and judging whether the equipment corresponding to the root detection result obtains an abnormal detection result with the same data type as that of the root detection result in each acquisition cycle in a time period with the time length being greater than or equal to a third preset time length (for example, the third preset time length is 3 minutes) according to all the input abnormal detection results, and carrying out fault detection on the equipment A and/or the equipment B.

When the first fault identification condition is used to perform fault detection on the device a and/or the device B, by judging all the abnormal detection results in the table 2, it can be known that the device a corresponding to the root detection result obtains the abnormal detection result with the data type being the number of the data packets with forwarding failure caused by the unavailability of the next hop send-in port at the acquisition time 00:31, 00:32, 00:33, 00:34 and 00:35, that is, the device a obtains the abnormal detection result with the data type being the same as that of the root detection result in each acquisition cycle within a time period with the time length being greater than or equal to 3 minutes, and thus it can be known that the detection result obtained by performing fault detection on the device a and/or the device B using the first fault identification condition is: is.

Then, according to the association relationship between the data types, for example, the data type of the number of data packets with forwarding failure caused by the unavailability of the next hop ingress/egress port and the data type of the number of packets processed by the ingress port have an association in determining the device port failure, based on which, when the detection result obtained after the failure detection is performed by using the first failure identification condition is yes, the associated second failure identification condition is usually used: and in all the input abnormal detection results, whether the data type is the abnormal detection result of the number of the processing packets of the input port exists or not is judged, and the fault detection is carried out on the equipment A and/or the equipment B.

When the second fault identification condition is used to perform fault detection on the device a and/or the device B, the judgment on all the abnormal detection results in the table 2 can be used to know that the device B has an abnormal detection result with the data type being the number of packets processed by the ingress port, so that the detection result obtained by performing fault detection on the device a and/or the device B using the second fault identification condition is: if yes, device B has an exception detection result of type ingress port handling packet count.

Thereafter, a third fault identification condition associated with the second detection result is used: and whether the last bit data of the data sequence contained in the root detection result is greater than the last bit data of the data sequence, which is obtained after the root detection result and is closest to the root detection result, wherein the data type is that the ingress port processes the last bit data of the data sequence of the packet number, and fault detection is carried out on the equipment A and/or the equipment B.

When the third failure recognition condition is used to detect a failure in the device a and/or the device B, it can be known from the judgment of all the abnormal detection results in table 2 that the data sequence included in the root detection result is [0,0, 240,13221], the last bit data thereof is 13221, the data sequence obtained after the root detection result and having the data type of the ingress port processing packet number closest to the root detection result is [30921,33523,29878,29335,0], the last bit data thereof is 0, and the detection result obtained by performing failure detection on the device a and/or the device B using the third failure recognition condition is that: is.

Thereafter, a fourth fault identification condition associated with the third detection result is used: whether the device with the anomaly detection result of the type of the ingress port processing packet number obtains the anomaly detection result of the data type of the ingress port processing packet number in each acquisition cycle in a time period of which the time length is greater than or equal to a fourth preset time length (for example, the fourth preset time length is 3 minutes), and fault detection is performed on the device A and/or the device B, wherein the last-bit data of a data sequence contained in each anomaly detection result obtained in the time period is less than 100.

When the fourth fault identification condition is used to perform fault detection on the device a and/or the device B, it can be known that the device B obtains the abnormal detection results with the data types of the ingress port processing packets at the acquisition times 00:31, 00:32, 00:33, 00:34, and 00:35 by judging all the abnormal detection results in the table 2, and the last-bit data of the data sequence included in each abnormal detection result is 0 and is less than 100, so that it can be known that the detection result obtained by performing fault detection on the device a and/or the device B using the fourth fault identification condition is: is.

And finally, according to the fault detection result corresponding to the fourth detection result: the method comprises the following steps that a device with an abnormal detection result of which the data type is the number of the processing packets of an input port generates port faults in the acquisition time corresponding to a root detection result, and a detection result for carrying out fault detection on the device A and/or the device B is obtained: device B has a port failure at 00:31, controller outputs B, 00:31 and port failure.

Because the network equipment with faults in the equipment A and the equipment B is determined when the fault detection is carried out on the equipment A and/or the equipment B by using the plurality of mutually-associated fault identification conditions related to the data types of the abnormal detection results with the most front collection time sequence, the fault detection is carried out on the equipment A and/or the equipment B without using the plurality of mutually-associated fault identification conditions related to the data types of the other 9 abnormal detection results in the table 2.

Assuming that the controller uses a plurality of mutually associated fault identification conditions related to the data type of the abnormality detection result numbered 1 in table 2, when the controller performs fault detection on the device a and/or the device B, and does not recognize that any one of the device a and the device B fails, the controller continues to use the plurality of mutually associated fault identification conditions related to the data type of the abnormality detection result numbered 2 in table 2 to perform fault detection on the device a and/or the device B, and the specific implementation manner may refer to the contents of the foregoing embodiment, which is not listed one by one here until it is determined that the network device having the fault exists in the device a and the device B, and the controller outputs a second device identifier, a second type identifier, and a second fault time of the network device having the fault; or until the fault detection is performed on the device a and/or the device B by using a plurality of mutually associated fault identification conditions related to the data type of the abnormal detection result with the number of 10, and if the fault of any one network device in the device a and the device B is not identified, the controller determines that neither the device a nor the device B has the fault.

In the above example, a plurality of mutually associated fault identification conditions related to the KPI type of the root detection result are set according to the association relationship among the data type, the data sequence, and the acquisition time of the network device. Optionally, a plurality of mutually associated fault identification conditions related to each data type may also be set only according to the association relationship between the data type of the data sequence of the network device and the acquisition time. For example, still taking the anomaly detection results shown in table 2 above as an example, the controller may perform fault detection on the device a and/or the device B according to the anomaly detection results, and may be implemented as follows:

the controller performs fault detection on the device a and/or the device B by using, as a root detection result, an abnormality detection result with the most advanced collection time sequence, for example, an abnormality detection result corresponding to the number 1 in table 2, and using a plurality of interrelated fault identification conditions related to the KPI type of the root detection result, for example, a plurality of interrelated fault identification conditions related to the number of data packets with forwarding failure caused by the unavailability of the next hop transmit-receive port, and specifically includes:

Thereafter, a third fault identification condition associated with the second detection result is used: whether the device with the abnormal detection result of the type of the ingress port processing packet number obtains the abnormal detection result of the data type of the ingress port processing packet number in each acquisition cycle in a time period of which the time length is greater than or equal to a fourth preset time length (for example, the fourth preset time length is 3 minutes), and fault detection is performed on the device a and/or the device B.

When the third fault identification condition is used to perform fault detection on the device a and/or the device B, it can be known by determining all the abnormal detection results in the table 2 that the device B obtains the abnormal detection result with the data type of the ingress port processing packet number at the acquisition time 00:31, 00:32, 00:33, 00:34, and 00:35, that is, the device B obtains the abnormal detection result with the data type of the ingress port processing packet number at each acquisition cycle in a time period with the duration of greater than or equal to 3 minutes, and thus it can be known that the detection result obtained by performing fault detection on the device a and/or the device B using the third fault identification condition is: is.

And finally, according to a fault detection result corresponding to the third detection result: the method comprises the following steps that a device with an abnormal detection result of which the data type is the number of the processing packets of an input port generates port faults in the acquisition time corresponding to a root detection result, and a detection result for carrying out fault detection on the device A and/or the device B is obtained: device B has a port failure at 00:31, controller outputs B, 00:31 and port failure.

Similarly, since the network device with the fault in the device a and the device B is determined when the fault detection is performed on the device a and/or the device B by using the plurality of mutually associated fault identification conditions related to the data type of the abnormality detection result with the most advanced collection time sequence, the fault detection is performed on the device a and/or the device B without using the plurality of mutually associated fault identification conditions related to the data types of the other 9 abnormality detection results in table 2.

Optionally, the controller may output the second device identifier, the second type identifier, and the second failure time of the failed network device in the following manner: the controller generates an alarm message, wherein the alarm message includes a second device identifier, a second failure time and a second type identifier, so as to notify the network management side that the network device corresponding to the second device identifier has a failure with the failure type of the second type identifier at the second failure time.

Optionally, if the controller determines that neither the first network device nor the second network device has a fault according to the obtained abnormal detection result, the controller may further mark a data sequence included in the abnormal detection result obtained in the detection time window as a normal data sequence.

Optionally, the controller may further update the abnormality detection model by using the normal data sequence, and send the updated abnormality detection model to the first network device and the second network device, so that the first network device and the second network device may perform abnormality detection on their own data sequences by using the more accurate abnormality detection model in a subsequent fault detection process, thereby improving accuracy of subsequent fault detection.

Step 106, the controller obtains failure information, where the failure information includes a first device identifier, a first failure time, and a first type identifier of a network device that has failed in the first network device and the second network device.

The controller may continuously obtain the fault information, where the fault information includes a device identifier, a fault time, and a type identifier of a network device that has a fault in the first network device and the second network device, and in order to facilitate the distinction, the device identifier, the fault time, and the type identifier of the network device that has a fault in the fault information in this scenario are respectively referred to as the first device identifier, the first fault time, and the first type identifier for short. The fault information may be fault information input to the controller through the input device, or fault information sent to the controller by other devices.

Step 107, the controller sends request information to the network device corresponding to the first device identifier, where the request information includes the first failure time and the first type identifier.

After the controller acquires the fault information each time, the controller analyzes the fault information to obtain a first device identifier, a first fault time and a first type identifier contained in the fault information, then generates request information according to the fault information, the request information contains the first fault time and the first type identifier, determines a network device corresponding to the first device identifier in the first network device and the second network device, and finally sends the request information to the network device.

And step 108, the network equipment corresponding to the first equipment identification determines the abnormal data sequence of the network equipment according to the request information.

After receiving request information sent by a controller, network devices corresponding to a first device identifier in a first network device and a second network device analyze the request information to obtain a first type identifier and first failure time, then according to a preset corresponding relation between the first type identifier and a data type, a data sequence corresponding to the first type identifier and having the same acquisition time as the first failure time is extracted from a stored data sequence, the data sequence is determined as an abnormal data sequence of the network device, and the abnormal data sequence is sent to the controller.

Step 109, the controller receives the abnormal data sequence sent by the network device corresponding to the first device identifier.

Step 110, the controller updates the anomaly detection model using the anomaly data sequence.

And step 111, the controller sends the updated anomaly detection model to the network equipment corresponding to the first equipment identifier.

After the controller updates the anomaly detection model by using the anomaly data sequence, the updated anomaly detection model is sent to the network equipment corresponding to the first equipment identifier, so that the network equipment corresponding to the first equipment identifier can use the more accurate anomaly detection model to perform anomaly detection on the data sequence of the network equipment in the subsequent fault detection process, and the accuracy of subsequent fault detection is improved.

It should be noted that, the present application does not limit the execution sequence of steps 102 to 105 and steps 106 to 109, and steps 102 to 105 may be executed first, and then steps 106 to 109 are executed, or steps 106 to 109 may be executed first, and then steps 102 to 105 are executed.

In the method for implementing fault detection provided by the application, a controller firstly sends an abnormality detection model to a plurality of network devices, then receives a detection result of a data sequence which is detected as abnormal by at least two network devices by using the abnormality detection model, and finally carries out fault detection on the at least two network devices according to the detection result. By adopting the method, the network equipment firstly detects the data sequence of the network equipment according to the abnormal detection model sent by the controller, and then sends the detection result of the data sequence detected as abnormal to the controller, and the controller only carries out fault detection on the network equipment according to the detection result of the data sequence detected as abnormal sent by the network equipment, thereby greatly reducing the operation amount of the controller and improving the detection efficiency of the controller.

Embodiments of the apparatus corresponding to the above-described embodiments of the method are described below.

Referring to fig. 3, fig. 3 is a block diagram of a structure of an implementation of a controller for implementing fault detection according to an embodiment of the present application. As can be seen in fig. 3, the controller 300 includes:

a sending module 301, configured to send an anomaly detection model to multiple network devices in a detected network, where the anomaly detection model is used to detect whether a data sequence of each network device is abnormal, and data forming the data sequence is used to characterize performance of the network device;

a receiving module 302, configured to receive an anomaly detection result of at least two network devices in the multiple network devices, where the anomaly detection result of each network device is a detection result of a data sequence detected as an anomaly by the network device using the anomaly detection model;

the processing module 303 is configured to perform fault detection on the at least two network devices according to the abnormal detection results of the at least two network devices.

The controller for realizing fault detection can send an abnormality detection model to a plurality of network devices, then receive the detection result of a data sequence which is detected to be abnormal by at least two network devices by using the abnormality detection model, and finally carry out fault detection on the at least two network devices according to the detection result. When the controller is used for carrying out fault detection on the network equipment, the network equipment firstly detects a data sequence of the network equipment according to an abnormal detection model sent by the controller, then sends a detection result of the data sequence detected as abnormal to the controller, and the controller only carries out fault detection on the network equipment according to the detection result of the data sequence detected as abnormal sent by the network equipment, so that the operation amount of the controller is greatly reduced, the detection efficiency of the controller is improved, in addition, as the controller only carries out fault detection on the network equipment according to the detection result of the data sequence detected as abnormal, the detection is more accurate, and the accuracy of the detection result is higher.

Optionally, the anomaly detection result of each network device includes a data type and an acquisition time of a data sequence detected as an anomaly by the network device using the anomaly detection model; the data type is used for determining the fault type, and the acquisition time is used for determining the fault occurrence time.

Optionally, the processing module 303 is specifically configured to: and according to the sequence of the acquisition time, sequentially using a plurality of mutually associated fault identification conditions related to the data type corresponding to each acquisition time to carry out fault detection on the at least two network devices.

Optionally, the multiple interrelated fault identification conditions are set according to an association relationship between different data types.

Optionally, the receiving module 302 is further configured to obtain fault information, where the fault information includes a first device identifier of a network device that has a fault among the plurality of network devices, a first fault time indicating a fault occurrence time, and a first type identifier indicating a fault type;

the sending module 301 is further configured to send data request information to a network device corresponding to the first device identifier, where the data request information includes the first failure time and the first type identifier;

the receiving module 302 is further configured to receive an abnormal data sequence; the abnormal data sequence refers to a data sequence which is determined by the network equipment corresponding to the first equipment identifier according to the data request information and corresponds to the first fault time and the first type identifier;

the processing module 303 is further configured to update the anomaly detection model using the anomaly data sequence;

the sending module 301 is further configured to send the updated anomaly detection model to the network device corresponding to the first device identifier.

Optionally, the processing module 303 is specifically configured to: if the processing module 303 determines that there is a failed network device in the at least two network devices according to the abnormality detection result of the at least two network devices, a second device identifier of the failed network device, a second failure time indicating the failure occurrence time, and a second type identifier indicating the failure type are output.

Optionally, the processing module 303 is configured to output a second device identifier of the failed network device, a second failure time indicating a time when the failure occurs, and a second type identifier indicating a type of the failure, and includes: the processing module 303 is configured to generate an alarm message, where the alarm message includes the second device identifier, the second failure time, and the second type identifier.

Optionally, the anomaly detection result of each network device further includes a data sequence detected as an anomaly by the network device using the anomaly detection model.

Optionally, the processing module 303 is specifically configured to:

if the processing module 303 determines that there is no network device with a fault in the at least two network devices according to the abnormal detection results of the at least two network devices, marking the data sequence detected as abnormal as a normal data sequence;

updating the anomaly detection model using the normal data sequence;

the sending module 301 is further configured to send the updated anomaly detection model to the plurality of network devices.

Optionally, the anomaly detection model is obtained by training the processing module according to the historical data sequences of the plurality of network devices.

Optionally, the historical data sequence is formed by arranging N pieces of first historical data, which are acquired before the data to be trained and are closest to the data to be trained, according to the sequence of acquisition time; the data to be trained is data which is detected to be abnormal and marked to be normal or abnormal; the first historical data is data which is detected abnormally and marked as normal; the data type of the first historical data is the same as that of the data to be trained.

Referring to fig. 4, fig. 4 is a block diagram of a network device according to an embodiment of the present disclosure. As can be seen in conjunction with fig. 4, the network device 400 includes:

a receiving module 401, configured to receive an anomaly detection model sent by a controller, where the anomaly detection model is used to detect whether a data sequence of the network device is abnormal, and data forming the data sequence is used to characterize performance of the network device;

a processing module 402, configured to obtain an anomaly detection result, where the anomaly detection result is a detection result of a data sequence that is detected as an anomaly by the network device using the anomaly detection model;

a sending module 403, configured to send the abnormal detection result to the controller, where the abnormal detection result is used for the controller to perform fault detection on the network where the network device is located.

The network equipment provided by the application can receive the abnormity detection model sent by the controller, and sends the detection result of the data sequence detected as abnormity by using the abnormity detection model to the controller, so that the controller can detect the fault of the network where the network equipment is located according to the abnormity detection result, and the accuracy of the controller in detecting the network fault is improved.

Optionally, the data sequence of the network device is formed by arranging data to be detected and N second historical data which are acquired before the data to be detected and are closest to the data to be detected according to the sequence of acquisition time; the data to be detected is data which is not subjected to abnormal detection, and the second historical data is data which is subjected to abnormal detection and marked as normal; the data type of the second historical data is the same as that of the data to be detected.

Optionally, the data sequence of the network device is a key performance indicator KPI data sequence.

Optionally, the anomaly detection result is obtained by inputting the data sequence or the feature vector of the data sequence into the anomaly detection model by the network device.

Referring to fig. 5, fig. 5 is a block diagram illustrating a structure of an embodiment of a system for implementing fault detection provided in the present application. As can be seen in conjunction with fig. 5, the system 500 includes: a controller 501 and a plurality of network devices 502; the controller 501 may communicate with each network device 502 through a bus (as shown in fig. 5) or a wireless transmission manner, and the network devices 502 may also communicate with each other through a bus (as shown in fig. 5) or a wireless transmission manner.

The controller 501 is configured to:

sending an anomaly detection model to the plurality of network devices 502, where the anomaly detection model is used to detect whether the data sequence of each network device 502 is abnormal, and the data composing the data sequence is used to characterize the performance of the network device 502;

receiving the abnormal detection results of at least two network devices of the plurality of network devices 502, where the abnormal detection result of each network device 502 refers to a detection result of a data sequence detected as abnormal by the network device 502 using the abnormal detection model;

and performing fault detection on the at least two network devices 502 according to the abnormal detection results of the at least two network devices 502.

The system for realizing fault detection provided by the application can implement the method for realizing fault detection provided by the application and obtain the same beneficial effects.

In a specific implementation, an embodiment of the present application further provides a computer storage medium, where the computer storage medium may store a program, where the program includes instructions, and when executed, the program may include some or all of the steps of the method for implementing fault detection provided in the present application. The computer storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), a Random Access Memory (RAM), or the like.

In the above embodiments, all or part may be implemented by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loaded and executed on a computer, cause the processes or functions described herein to occur, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, from one website site, computer, server, or data center to another website site, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device, such as a server, a data center, etc., that incorporates one or more of the available media. The usable medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., Solid State Disk (SSD)), among others.

It should be understood that, in the embodiments of the present application, the execution sequence of each step should be determined by its function and inherent logic, and the size of the sequence number of each step does not mean the execution sequence, and does not limit the implementation process of the embodiments.

Further, in the description of the present application, "a plurality" means two or more than two unless otherwise specified. In addition, in order to facilitate clear description of technical solutions of the embodiments of the present application, in the embodiments of the present application, terms such as "first" and "second" are used to distinguish the same items or similar items having substantially the same functions and actions. Those skilled in the art will appreciate that the terms "first," "second," etc. do not denote any order or quantity, nor do the terms "first," "second," etc. denote any order or importance.

All parts of the specification are described in a progressive mode, the same and similar parts of all embodiments can be referred to each other, and each embodiment is mainly introduced to be different from other embodiments. In particular, for the embodiments of the controller, the network device and the system, since they are substantially similar to the method embodiments, the description is relatively simple, and for the relevant points, reference may be made to the description in the method embodiments.

While the preferred embodiments of the present application have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, it is intended that the appended claims be interpreted as including preferred embodiments and all alterations and modifications as fall within the scope of the application.

The above-described embodiments of the present application do not limit the scope of the present application.

Claims

1. A method for implementing fault detection, comprising:

the controller sends an anomaly detection model to a plurality of network devices in a detected network, wherein the anomaly detection model is used for detecting whether a data sequence of each network device is abnormal, and data forming the data sequence is used for representing the performance of the network device;

2. The method according to claim 1, wherein the anomaly detection result of each network device comprises a data type and a collection time of a data sequence detected as an anomaly by the network device using the anomaly detection model; the data type is used for determining the fault type, and the acquisition time is used for determining the fault occurrence time.

3. The method of claim 2, wherein the controller performs fault detection on the at least two network devices according to the abnormal detection results of the at least two network devices, and comprises:

4. The method according to claim 3, wherein the plurality of interrelated fault identification conditions are set according to an association relationship between different data types.

5. The method of any one of claims 1 to 4, further comprising:

6. The method according to any one of claims 1 to 5, wherein the controller performs fault detection on the at least two network devices according to the abnormal detection results of the at least two network devices, and comprises:

7. The method of claim 6, wherein the controller outputs a second device identification of the failed network device, and a second time to failure indicating a time when the failure occurred and a second type identification indicating a type of the failure, comprising:

8. The method according to any one of claims 2 to 7, wherein the anomaly detection result of each of the network devices further comprises a data sequence detected as an anomaly by the network device using the anomaly detection model.

9. The method of claim 8, wherein the controller performs fault detection on the at least two network devices according to the abnormal detection results of the at least two network devices, and comprises:

10. The method according to any one of claims 1 to 9, wherein the anomaly detection model is obtained by training the controller according to a historical data sequence of the plurality of network devices.

11. The method according to claim 10, wherein the historical data sequence is formed by arranging data to be trained and N first historical data which are acquired before the data to be trained and are closest to the data to be trained according to the sequence of acquisition time; the data to be trained is data which is detected to be abnormal and marked to be normal or abnormal; the first historical data is data which is detected abnormally and marked as normal; the data type of the first historical data is the same as that of the data to be trained.

12. A method for implementing fault detection, comprising:

the method comprises the steps that the network equipment receives an abnormality detection model sent by a controller, the abnormality detection model is used for detecting whether a data sequence of the network equipment is abnormal or not, and data forming the data sequence is used for representing the performance of the network equipment;

13. The method according to claim 12, wherein the data sequence of the network device is formed by arranging data to be detected and N second historical data which are acquired before the data to be detected and are closest to the data to be detected according to the sequence of acquisition time; the data to be detected is data which is not subjected to abnormal detection, and the second historical data is data which is subjected to abnormal detection and marked as normal; the data type of the second historical data is the same as that of the data to be detected.

14. The method according to claim 12 or 13, characterized in that the data sequence of the network device is a key performance indicator, KPI, data sequence.

15. The method according to any one of claims 12 to 14, wherein the anomaly detection result is obtained by inputting the data sequence or a feature vector of the data sequence into the anomaly detection model by the network device.

16. A controller for implementing fault detection, comprising:

a sending module, configured to send an anomaly detection model to multiple network devices in a detected network, where the anomaly detection model is used to detect whether a data sequence of each network device is abnormal, and data forming the data sequence is used to characterize performance of the network device;

17. The controller according to claim 16, wherein the anomaly detection result of each of the network devices includes a data type and a collection time of a data sequence detected as an anomaly by the network device using the anomaly detection model; the data type is used for determining the fault type, and the acquisition time is used for determining the fault occurrence time.

18. The controller according to claim 17, wherein the processing module is specifically configured to:

19. The controller according to claim 18, wherein the plurality of interrelated fault identification conditions are set according to an associative relationship between different data types.

20. The controller according to claim 16 to 19,

the receiving module is further configured to obtain fault information, where the fault information includes a first device identifier of a network device that has a fault among the plurality of network devices, a first fault time indicating a fault occurrence time, and a first type identifier indicating a fault type;

21. The controller according to any one of claims 16 to 20, wherein the processing module is specifically configured to:

22. The controller of claim 21, wherein the processing module is configured to output a second device identification of the failed network device, and a second failure time indicating a time when the failure occurred and a second type identification indicating a type of the failure, and comprises:

23. The controller according to any one of claims 17 to 22, wherein the anomaly detection result of each of the network devices further comprises a data sequence detected as an anomaly by the network device using the anomaly detection model.

24. The controller according to claim 23, wherein the processing module is specifically configured to:

updating the anomaly detection model using the normal data sequence;

25. The controller according to any one of claims 16 to 24, wherein the anomaly detection model is trained by the processing module based on a historical data sequence of the plurality of network devices.

26. The controller according to claim 25, wherein the historical data sequence is formed by arranging data to be trained and N first historical data which are acquired before the data to be trained and are closest to the data to be trained according to the sequence of acquisition time; the data to be trained is data which is detected to be abnormal and marked to be normal or abnormal; the first historical data is data which is detected abnormally and marked as normal; the data type of the first historical data is the same as that of the data to be trained.

27. A network device, comprising:

the receiving module is used for receiving an anomaly detection model sent by the controller, the anomaly detection model is used for detecting whether a data sequence of the network equipment is abnormal, and data forming the data sequence is used for representing the performance of the network equipment;

28. The network device according to claim 27, wherein the data sequence of the network device is formed by arranging data to be detected and N second historical data which are acquired before the data to be detected and are closest to the data to be detected according to an order of acquisition time; the data to be detected is data which is not subjected to abnormal detection, and the second historical data is data which is subjected to abnormal detection and marked as normal; the data type of the second historical data is the same as that of the data to be detected.

29. The network device according to claim 27 or 28, wherein the data sequence of the network device is a key performance indicator, KPI, data sequence.

30. The network device according to any one of claims 27 to 29, wherein the anomaly detection result is obtained by inputting the data sequence or a feature vector of the data sequence into the anomaly detection model by the network device.

31. A system for implementing fault detection, comprising: a controller and a plurality of network devices;

wherein the controller is to:

32. An apparatus comprising a processor, the processor configured to couple to a memory, read instructions in the memory, and execute the method of any one of claims 1-15 according to the instructions.

33. A computer storage medium comprising instructions which, when executed on a computer, cause the computer to perform the method of any one of claims 1 to 15.

34. A computer program product, for causing a computer to perform the method of any one of claims 1 to 15 when the computer program product is run on the computer.