CN112769733B - Network early warning method, device and computer readable storage medium - Google Patents
Network early warning method, device and computer readable storage medium Download PDFInfo
- Publication number
- CN112769733B CN112769733B CN201911068283.2A CN201911068283A CN112769733B CN 112769733 B CN112769733 B CN 112769733B CN 201911068283 A CN201911068283 A CN 201911068283A CN 112769733 B CN112769733 B CN 112769733B
- Authority
- CN
- China
- Prior art keywords
- network
- learning model
- machine learning
- early warning
- state parameters
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 57
- 238000010801 machine learning Methods 0.000 claims abstract description 78
- 239000013598 vector Substances 0.000 claims abstract description 57
- 238000013528 artificial neural network Methods 0.000 claims description 48
- 238000012549 training Methods 0.000 claims description 27
- 238000007781 pre-processing Methods 0.000 claims description 9
- 239000000284 extract Substances 0.000 claims description 5
- 238000000605 extraction Methods 0.000 claims description 5
- 238000004590 computer program Methods 0.000 claims description 4
- 238000010586 diagram Methods 0.000 description 18
- 238000013135 deep learning Methods 0.000 description 11
- 230000000694 effects Effects 0.000 description 6
- 238000013473 artificial intelligence Methods 0.000 description 5
- 238000012545 processing Methods 0.000 description 5
- 239000006185 dispersion Substances 0.000 description 4
- 230000006870 function Effects 0.000 description 3
- 238000012905 input function Methods 0.000 description 3
- 230000008569 process Effects 0.000 description 3
- 238000013145 classification model Methods 0.000 description 2
- 238000013527 convolutional neural network Methods 0.000 description 2
- 238000005314 correlation function Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000004913 activation Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000003066 decision tree Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000014509 gene expression Effects 0.000 description 1
- 238000002372 labelling Methods 0.000 description 1
- 238000007477 logistic regression Methods 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 239000000203 mixture Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000006855 networking Effects 0.000 description 1
- 210000002569 neuron Anatomy 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/147—Network analysis or design for predicting network behaviour
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Physics & Mathematics (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- Data Mining & Analysis (AREA)
- Life Sciences & Earth Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Molecular Biology (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Computer Hardware Design (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The disclosure relates to a network early warning method, a network early warning device and a computer readable storage medium, and relates to the technical field of network security. The method comprises the following steps: predicting the state parameters of the network at the future time by utilizing a first machine learning model according to the state parameters of the network at the current time; extracting a predicted characteristic vector of the network by using a second machine learning model according to the state parameter at the future moment; and determining the early warning level of the network by utilizing a third machine learning model according to the predicted feature vector.
Description
Technical Field
The present disclosure relates to the field of network security technologies, and in particular, to a network early warning method, a network early warning apparatus, and a computer-readable storage medium.
Background
With the continuous development of network technology, the responsibility and pressure in the aspect of major risk operation management and control based on the network are increasingly greater, and network early warning gradually becomes an important link for ensuring network security. Therefore, how to comprehensively analyze the network according to the historical network use condition, the operation and maintenance work order processing condition and the network comprehensive alarm information effectively identifies the network equipment fault, realizes accurate network early warning and is particularly important for operators to ensure the network quality.
In the related art, the network threat is pre-warned by analyzing the network security situation.
Disclosure of Invention
The inventors of the present disclosure found that the following problems exist in the above-described related art: and the situation analysis is inaccurate, so that the early warning effect is poor.
In view of this, the present disclosure provides a network early warning technical scheme, which can improve the early warning effect.
According to some embodiments of the present disclosure, there is provided a network early warning method, including: predicting the state parameters of the network at the future time by utilizing a first machine learning model according to the state parameters of the network at the current time; extracting a predicted characteristic vector of the network by using a second machine learning model according to the state parameters at the future moment; and determining the early warning level of the network by utilizing a third machine learning model according to the predicted feature vector.
In some embodiments, before the step of predicting the state parameter of the network at the future time, the method further comprises: and training the first machine learning model by taking the statistical characteristic data of the state parameters of the network at the historical moment as input and taking the state parameters of the network at the target moment as output, wherein the target moment is later than the historical moment.
In some embodiments, before the step of predicting the state parameter of the network at a future time, the method further comprises: extracting a feature vector of the network by using a fourth machine learning model according to the statistical feature data of the state parameters of the network at the historical time and the state parameters of the network at the target time, wherein the target time is later than the historical time; and training a second machine learning model by taking the state parameters at the target moment as input and the characteristic vectors as output.
In some embodiments, extracting the feature vector of the network comprises: preprocessing statistical characteristic data of state parameters of the network at historical time by using a fuzzy control model;
and extracting the feature vector of the network by using a fourth machine learning model according to the preprocessed statistical feature data and the state parameters of the network at the target moment.
In some embodiments, before the step of predicting the state parameter of the network at the future time, the method further comprises: determining the early warning level of the network at the target moment by utilizing a fifth machine learning model according to the feature vector; and training a third machine learning model by taking the feature vector as input and the early warning level of the target moment as output.
In some embodiments, the status parameter includes at least one of traffic information, congestion information, connection number information, packet loss rate information of the network.
According to other embodiments of the present disclosure, there is provided a network early warning apparatus including: the prediction unit is used for predicting the state parameters of the network at the future time by utilizing the first machine learning model according to the state parameters of the network at the current time; an extraction unit configured to extract a predicted feature vector of the network using the second machine learning model according to the state parameter at the future time; and the determining unit is used for determining the early warning level of the network by utilizing the third machine learning model according to the predicted feature vector.
In some embodiments, the network early warning apparatus further includes: and the training unit is used for training the first machine learning model by taking the statistical characteristic data of the state parameters of the network at the historical moment as input and taking the state parameters of the network at the target moment as output, wherein the target moment is later than the historical moment.
In some embodiments, the network early warning apparatus further includes: and the training unit is used for extracting a feature vector of the network by utilizing a fourth machine learning model according to the statistical feature data of the state parameters of the network at the historical moment and the state parameters of the network at the target moment, wherein the target moment is later than the historical moment, the state parameters at the target moment are used as input, and the feature vector is used as output, so that the second machine learning model is trained.
In some embodiments, the training unit preprocesses the statistical characteristic data of the state parameters of the network at the historical time by using a fuzzy control model, and extracts the characteristic vector of the network by using a fourth machine learning model according to the preprocessed statistical characteristic data and the state parameters of the network at the target time.
In some embodiments, the training unit determines the early warning level of the network at the target time by using the fifth machine learning model according to the feature vector, and trains the third machine learning model by using the feature vector as input and the early warning level at the target time as output.
In some embodiments, the status parameter includes at least one of traffic information, congestion information, connection number information, packet loss rate information of the network.
According to still other embodiments of the present disclosure, there is provided a network early warning apparatus including: a memory; and a processor coupled to the memory, the processor configured to perform the network warning method of any of the above embodiments based on instructions stored in the memory device.
According to still further embodiments of the present disclosure, there is provided a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the network early warning method in any of the above embodiments.
In the embodiment, the future state is predicted according to the historical state of the network based on an artificial intelligence method, and the future state is deeply mined to extract the implicit network characteristics, so that the early warning level is determined. Therefore, the analysis precision of the network state can be improved, and the early warning effect is improved.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the disclosure and together with the description, serve to explain the principles of the disclosure.
The present disclosure can be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:
fig. 1 illustrates a flow diagram of some embodiments of a network early warning method of the present disclosure;
fig. 2 shows a flow diagram of further embodiments of a network warning method of the present disclosure;
fig. 3 illustrates a flow diagram of further embodiments of the network early warning method of the present disclosure;
fig. 4 shows a schematic diagram of some embodiments of a network early warning method of the present disclosure;
FIG. 5 illustrates a schematic diagram of some embodiments of fuzzy control model related parameters of the present disclosure;
FIG. 6 illustrates a schematic diagram of some embodiments of state parameter pre-processing results of the present disclosure;
fig. 7 illustrates a block diagram of some embodiments of a network early warning device of the present disclosure;
fig. 8 shows a block diagram of further embodiments of a network warning device of the present disclosure;
fig. 9 shows a block diagram of further embodiments of the network early warning apparatus of the present disclosure.
Detailed Description
Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that: the relative arrangement of the components and steps, the numerical expressions, and numerical values set forth in these embodiments do not limit the scope of the present disclosure unless specifically stated otherwise.
Meanwhile, it should be understood that the sizes of the respective portions shown in the drawings are not drawn in an actual proportional relationship for the convenience of description.
The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the disclosure, its application, or uses.
Techniques, methods, and apparatus known to those of ordinary skill in the relevant art may not be discussed in detail, but are intended to be part of the specification where appropriate.
In all examples shown and discussed herein, any particular value should be construed as merely illustrative, and not limiting. Thus, other examples of the exemplary embodiments may have different values.
It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, further discussion thereof is not required in subsequent figures.
Fig. 1 illustrates a flow diagram of some embodiments of a network early warning method of the present disclosure.
As shown in fig. 1, the method includes: step 110, predicting state parameters; step 120, extracting a prediction feature vector; and step 130, determining the early warning level.
In step 110, a state parameter of the network at a future time is predicted using the first machine learning model based on the state parameter of the network at the current time. For example, the status parameter may include at least one of traffic information, congestion information, connection number information, and packet loss rate information of the network. The first machine learning model may be a parametric neural network for predicting state parameters at a future time.
In some embodiments, prior to step 110, the first machine learning model may be trained using as input statistical characteristic data of state parameters of the network at historical times and as output state parameters of the network at target times, the target times being later than the historical times. For example, the target time may be a current time in the training process.
In some embodiments, statistical processing may be performed on the state parameters at a certain period of historical time, so as to obtain statistical characteristic data such as variance and mean of each state parameter as an early warning basis.
In some embodiments, the status parameter may be a traffic parameter of the backbone network, and an average value of the traffic parameter over a period of time (e.g., one day, one week, one month, etc.) may be obtained. The average value may be used as a baseline for the change in the flow parameter.
For example, if the backbone network traffic in Hebei province is 100T/day on average, then the traffic that the devices in Hebei province can bear is approximately 100T. Therefore, the more times that the instantaneous flow exceeds 100T/day, the larger the capacity expansion requirement of the backbone in Hebei province is, and the higher the early warning level is.
In some embodiments, the variance of the flow parameter can reflect the difference, i.e., the degree of dispersion, between the observed actual flow and the average flow. The degree of dispersion may also reflect the relationship between network capabilities and actual demand ahead. For example, if the degree of dispersion is not large, the flow rate is stable. If the dispersion degree is larger, the fluctuation of the flow rate is larger. Under the condition of large fluctuation, capacity expansion is not necessary, but early warning can be carried out, so that dynamic adjustment and distribution strategies of the flow are adopted in the following process to guarantee customer requirements.
In step 120, a predicted feature vector of the network is extracted using the second machine learning model based on the state parameters at the future time. For example, the second machine learning model may be a state neural network for extracting predictive feature vectors for the network to characterize future states of the network.
In some embodiments, the second machine learning model may be trained by the embodiment in fig. 2.
Fig. 2 shows a flow diagram of further embodiments of the network early warning method of the present disclosure.
As shown in fig. 2, the method may further include: step 210, extracting a feature vector of a network; and step 220, training a second machine learning model.
In step 210, a feature vector of the network is extracted by using a fourth machine learning model according to the statistical feature data of the state parameters of the network at the historical time and the state parameters of the network at the target time, wherein the target time is later than the historical time.
In some embodiments, the collected data needs to be classified first because the actually collected data (state parameters) is not the summarized data of several classes, but a group of unclassified data sets containing much content. For example, the data collected actually may be preliminarily classified by using a self-coding learning method, and then the data may be analyzed for regularity and trend by using the second machine learning model based on the preliminary classification result.
In some embodiments, the fourth machine learning model may be a self-coding learning model (e.g., a convolutional neural network model). The self-coding learning model can preliminarily classify a large amount of input data according to a certain rule (such as a convolutional neural network algorithm).
For example, the data is divided into IP data network data, transmission network management data, and the like according to the characteristic value of the data (such as statistical characteristic data of state parameters at historical time, state parameters at target time, and the like) by a self-coding learning model; and then, training a second machine learning model by using the classification result so as to analyze the regularity and the trend of the data.
In step 220, a second machine learning model is trained with the state parameters at the target time as inputs and the feature vectors as outputs.
In some embodiments, statistical characteristic data of state parameters of the network at historical times may be pre-processed using a fuzzy control model. For example, severity information for the corresponding network state for the state parameter may be obtained. And then, extracting a feature vector of the network by using a fourth machine learning model according to the preprocessed statistical feature data (such as severity information) and the state parameters of the network at the target moment. And extracting the predicted characteristic vector of the network by using the trained second machine learning model.
In the above embodiment, the self-coding learning model is a classification model that the machine learns by itself, and may not be accurate enough. The processing result of the self-coding learning model is used as training data, and the result of the self-coding learning model is corrected by adjusting parameters in the state neural network, so that the judgment precision can be further improved.
After the second machine learning model is trained, the warning can be continued by using other steps in fig. 1.
In step 130, the early warning level of the network is determined by using a third machine learning model according to the predicted feature vector. For example, the third machine learning model may be an early warning neural network for determining an early warning level of the network.
In some embodiments, a third machine learning model may be trained by the embodiment in fig. 3.
Fig. 3 illustrates a flow diagram of further embodiments of the network early warning method of the present disclosure.
As shown in fig. 3, the method may further include: step 310, determining the early warning level of the target moment; and step 320, training a third machine learning model.
In step 310, according to the feature vector, the early warning level of the network at the target moment is determined by using a fifth machine learning model. For example, the fifth machine learning model may be a deep learning classifier model.
In step 320, a third machine learning model is trained with the feature vector as input and the early warning level at the target time as output.
In the above embodiment, the deep learning classifier model is a classification model that the machine learns by itself, and may not be accurate enough. The processing result of the deep learning classifier model is used as training data, and the result of the deep learning classifier model is corrected by adjusting parameters in the early warning neural network, so that the judgment precision can be further improved.
Fig. 4 shows a schematic diagram of some embodiments of a network early warning method of the present disclosure.
As shown in fig. 4, the method may include: the first step, parameter acquisition (including acquiring network parameters); secondly, extracting characteristics (including constructing a historical data set and extracting network state characteristics); thirdly, classifying by a deep learning classifier (including the deep learning classifier); fourthly, building a neural network based on artificial intelligence (including building a parameter neural network, building a state neural network and building an early warning neural network); and fifthly, combining the constructed early warning neural network with the current network parameter information to realize network early warning (including network parameter prediction, network state prediction and network early warning).
In some embodiments, the deep learning classifier may be a neural network classifier, and the classifier algorithm may be a neural network algorithm. For example, the deep learning classifier can be a K-nearest neighbor algorithm, a bayesian algorithm, a logistic regression, a decision tree, and the like.
In the first step, the time interval of data acquisition can be configured so as to obtain the operation parameter information (status parameters) of different nodes of the current network at fixed time intervals.
In some embodiments, the acquired parameter information of different nodes may be statistically processed to acquire statistical characteristic data of the parameter information of the current network. For example, the parameter information may be connection number information, congestion information, packet loss rate information, or the like.
In the second step, a historical parameter data set is constructed by using the statistical characteristic data of the acquired parameter information. And performing parameter classification by combining a self-coding feature learning model of deep learning according to the historical parameter data set and the current network operation parameter information to obtain implicit network state features (feature vectors).
In some embodiments, the data in the historical parameter data set may be preprocessed, and then the network state features may be extracted by using the self-coding feature learning model according to the preprocessed data. For example, the data of the BER (Bit Error Rate) parameter may be preprocessed by using a Fuzzy control model (Fuzzy Logic) to obtain the rank information of the Bit Error Rate.
In some embodiments, the relevant parameter settings of the fuzzy control model are as shown in FIG. 5.
FIG. 5 illustrates a schematic diagram of some embodiments of fuzzy control model related parameters of the present disclosure.
As shown in fig. 5, the table shows relevant parameters and values of the fuzzy control model.
Name, used to record model Name (can be customized); type, for recording algorithm Type, for example, using Mamdani algorithm; inputs/Outputs, e.g., the number of Inputs and Outputs of a model are both 1; numInputMFs (number of input correlation functions), for example, the number is 3; numonsutmfs (number of output correlation functions), for example, the number is 3; numRules (number of rules), for example, the number is 3.
AndMethod (sum method used), e.g. taking the minimum value; orMethod (OR method used), e.g., taking the maximum value; impMethod (the inference method employed), e.g. taking the minimum value; aggtmethod set method, e.g. taking the maximum value; defuzzMethod (employed for the defuzzification method), for example, is based on the central method (centrrod).
Inlels (input label), e.g., BER; outLabels, such as Levels (bit error rate level information); inrange, e.g., 1-3; outRange, e.g., 0-5.
Immflabels (input function labels) which may be, for example, tiny (Minor), medium (Morderate), large (Severe); onmfLabels (output function tag) which may be, for example, zero (zero), micro (Minor), large (Lage); inMFTypes (input function type), which may be, for example, a double Gaussian mixture function (gauss 2 mf), bell shape (gbellmf); outMFTypes (output function type), e.g., bell shape; inMFParams (input function parameters), for example, may be [0.033 0.87 0.1934.315 ].
In some embodiments, after preprocessing the state data (or the statistical characteristic data of the state parameters) by using the fuzzy control model, the severity information of the corresponding network state of the state data can be obtained. For example, a fuzzy control model can be configured according to the parameters in the table, and is used for determining the Levels thereof according to the BER, and the Levels are used as the basis for extracting the feature vectors and performing network early warning.
In some embodiments, the frequency characteristics of the state parameters may be obtained by preprocessing. For example, the processing result as shown in fig. 6 can be obtained.
FIG. 6 illustrates a schematic diagram of some embodiments of state parameter pre-processing results of the present disclosure.
As shown in fig. 6, the status parameters include the number of connections in fig. 6a, the congestion information in fig. 6c, and what packet loss rate in fig. 6 e. After the preprocessing, the frequency information corresponding to each state parameter, that is, the frequency of occurrence of connection, packet loss and congestion within a certain time can be obtained. E.g. connection frequency in fig. 6b, congestion frequency in fig. 6d, packet loss frequency in fig. 6 f.
After the frequency information corresponding to each state parameter is obtained through preprocessing, the frequency information can be used as a basis for extracting feature vectors and carrying out network early warning. For example, the method of fig. 4 may continue to be utilized for early warning.
In a third step, a neural network classifier may be employed to extract feature vectors for the network. For example, a neural network formed by connecting a plurality of artificial neurons (perceptrons) can be adopted, and reasonable classification rules are obtained according to the fact that the network characteristic value of each element reaches a threshold value and activation matching is carried out. The optimal classification method can be found out according to the classification rule continuously optimized by the input characteristic value of the sample.
In some embodiments, the algorithm employed by the classifier may be a neural network algorithm. For example, a neural network can be divided into 3 layers: an input layer, a hidden layer, and an output layer. The classifier can adopt an unsupervised learning type, can utilize self information without manual labeling, and finishes a classification task through a clustering algorithm.
In the fourth step, a neural network is constructed for early warning based on artificial intelligence. For example, the neural network may be composed of three layers of neural networks: a first layer, a parametric neural network; a second layer, a state neural network; and the third layer is an early warning neural network.
In some embodiments, the parametric neural network is trained using historical operating parameter information as an input to the parametric neural network and using the currently acquired network operating parameters as an output of the parametric neural network.
In some embodiments, the state neural network is trained by using the current network parameter information as the neural network input value and using the network state classification obtained from the coding learning model as the neural network output value.
In some embodiments, the early warning neural network is trained by classifying the network state obtained from the coding learning model as an input value of the early warning neural network and by classifying the early warning output by the deep learning classifier as an output value.
In the fifth step, the trained neural networks are used for realizing network early warning.
In some embodiments, the current network operation parameter is taken as a parameter neural network input value, a parameter neural network output value is obtained, and network parameter information at a future moment is predicted.
In some embodiments, the predicted network parameter information at the next moment is used as an input value of the state neural network, and an output value of the state neural network is obtained and is used as network state information at a future moment.
In some embodiments, the obtained network state information at the next moment is used as an input value of the early warning neural network, and an output value of the early warning neural network is obtained and is used as network early warning information at a future moment.
In the embodiment, the parameter neural network is constructed according to the network operation parameter information, and the historical information is fully utilized. The amount of rich history information can improve the prediction effect.
Moreover, the embodiment can acquire the network parameters at the next moment, and can sense and analyze in advance and generate network early warning by combining the state neural network and the early warning neural network. Therefore, the early warning time can be shortened, and the accuracy can be improved.
In addition, the above embodiment constructs a parameter information database according to the network operation parameter information, and extracts the network status feature. In this way, network information can be utilized to the maximum extent.
Finally, the embodiment utilizes the deep learning classifier to classify, and realizes that the network operation parameters are known in advance. Therefore, network early warning can be realized according to accurate classification of the network operation state.
In the embodiment, the future state is predicted according to the historical state of the network based on an artificial intelligence method, and the future state is deeply mined to extract the implicit network characteristics, so that the early warning level is determined. Therefore, the analysis precision of the network state can be improved, and the early warning effect is improved.
Fig. 7 illustrates a block diagram of some embodiments of a network early warning device of the present disclosure.
As shown in fig. 7, the network early warning apparatus 7 includes a prediction unit 71, an extraction unit 72, and a determination unit 73.
The prediction unit 71 predicts the state parameters of the network at a future time using the first machine learning model based on the state parameters of the network at the current time. For example, the status parameter includes at least one of traffic information, congestion information, connection number information, and packet loss rate information of the network.
In some embodiments, network warning device 7 further includes training unit 74. The training unit 74 trains the first machine learning model using the statistical feature data of the state parameters of the network at the historical time as input and the state parameters of the network at the target time as output. The target time is later than the historical time.
The extraction unit 72 extracts the predicted feature vector of the network using the second machine learning model based on the state parameter at the future time.
In some embodiments, the training unit 74 utilizes the fourth machine learning model to extract feature vectors of the network based on statistical feature data of the state parameters of the network at historical times and the state parameters of the network at target times, the target times being later than the historical times, with the state parameters at the target times as inputs and the feature vectors as outputs, and trains the second machine learning model.
In some embodiments, the training unit 74 pre-processes the statistical feature data of the state parameters of the network at the historical time using a fuzzy control model, and extracts feature vectors of the network using a fourth machine learning model according to the pre-processed statistical feature data and the state parameters of the network at the target time.
The determination unit 73 determines the early warning level of the network using the third machine learning model according to the predicted feature vector.
In some embodiments, the training unit 74 determines the early warning level of the network at the target time using the fifth machine learning model based on the feature vector, and trains the third machine learning model with the feature vector as input and the early warning level at the target time as output.
In the embodiment, the future state is predicted according to the historical state of the network based on an artificial intelligence method, and the future state is deeply mined to extract the implicit network characteristics, so that the early warning level is determined. Therefore, the analysis precision of the network state can be improved, and the early warning effect is improved.
Fig. 8 shows a block diagram of further embodiments of the network early warning apparatus of the present disclosure.
As shown in fig. 8, the network early warning apparatus 8 of this embodiment includes: a memory 81 and a processor 82 coupled to the memory 81, the processor 82 being configured to execute the network warning method in any one of the embodiments of the present disclosure based on instructions stored in the memory 81.
The memory 81 may include, for example, a system memory, a fixed nonvolatile storage medium, and the like. The system memory stores, for example, an operating system, application programs, a boot loader, a database, and other programs.
Fig. 9 shows a block diagram of still other embodiments of the network warning device of the present disclosure.
As shown in fig. 9, the network early warning apparatus 9 of this embodiment includes: a memory 910 and a processor 920 coupled to the memory 910, the processor 920 being configured to execute the network warning method in any of the embodiments based on instructions stored in the memory 910.
The memory 910 may include, for example, system memory, fixed non-volatile storage media, and the like. The system memory stores, for example, an operating system, application programs, a boot loader, and other programs.
The network warning device 9 may further include an input/output interface 930, a network interface 940, a storage interface 950, and the like. These interfaces 930, 940, 950 and the memory 910 and the processor 920 may be connected, for example, by a bus 960. The input/output interface 930 provides a connection interface for input/output devices such as a display, a mouse, a keyboard, and a touch screen. The network interface 940 provides a connection interface for various networking devices. The storage interface 950 provides a connection interface for external storage devices such as an SD card and a usb disk.
As will be appreciated by one skilled in the art, embodiments of the present disclosure may be provided as a method, system, or computer program product. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-usable non-transitory storage media having computer-usable program code embodied therein.
So far, the network early warning method, the network early warning apparatus, and the computer-readable storage medium according to the present disclosure have been described in detail. Some details that are well known in the art have not been described in order to avoid obscuring the concepts of the present disclosure. It will be fully apparent to those skilled in the art from the foregoing description how to practice the presently disclosed embodiments.
The method and system of the present disclosure may be implemented in a number of ways. For example, the methods and systems of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order for the steps of the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above unless specifically stated otherwise. Further, in some embodiments, the present disclosure may also be embodied as programs recorded in a recording medium, the programs including machine-readable instructions for implementing the methods according to the present disclosure. Thus, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.
Although some specific embodiments of the present disclosure have been described in detail by way of example, it should be understood by those skilled in the art that the foregoing examples are for purposes of illustration only and are not intended to limit the scope of the present disclosure. It will be appreciated by those skilled in the art that modifications may be made to the above embodiments without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.
Claims (12)
1. A network early warning method comprises the following steps:
extracting a feature vector of the network by using a fourth machine learning model according to statistical feature data of state parameters of the network at a historical moment and the state parameters of the network at a target moment, wherein the target moment is later than the historical moment, and the fourth machine learning model is a self-coding learning model;
training a second machine learning model by taking the state parameters at the target moment as input and the feature vectors as output, wherein the second machine learning model is a state neural network;
predicting the state parameters of the network at the future time by utilizing a first machine learning model according to the state parameters of the network at the current time, wherein the first machine learning model is a parameter neural network;
extracting a predicted feature vector of the network by using the second machine learning model according to the state parameter at the future moment;
determining the early warning level of the network by utilizing a third machine learning model according to the predicted feature vector, wherein the third machine learning model is an early warning neural network;
the extracting the predicted feature vector of the network comprises:
and extracting the prediction characteristic vector of the network by using a neural network classifier.
2. The network early warning method of claim 1, further comprising, prior to the step of predicting the state parameters of the network at a future time:
and training the first machine learning model by taking the statistical characteristic data of the state parameters of the network at the historical moment as input and taking the state parameters of the network at the target moment as output, wherein the target moment is later than the historical moment.
3. The network warning method of claim 1, wherein the extracting the feature vector of the network comprises:
preprocessing statistical characteristic data of state parameters of the network at historical time by using a fuzzy control model;
and extracting the feature vector of the network by utilizing a fourth machine learning model according to the preprocessed statistical feature data and the state parameters of the network at the target moment.
4. The network early warning method of claim 1, further comprising, prior to the step of predicting the state parameters of the network at a future time:
determining the early warning level of the network at the target moment by utilizing a fifth machine learning model according to the feature vector;
and training the third machine learning model by taking the feature vector as input and the early warning grade of the target moment as output.
5. The network early warning method according to any one of claims 1 to 4,
the state parameter includes at least one of traffic information, congestion information, connection number information, and packet loss rate information of the network.
6. A network warning device, comprising:
the prediction unit is used for predicting the state parameters of the network at the future time by utilizing a first machine learning model according to the state parameters of the network at the current time, wherein the first machine learning model is a parametric neural network;
an extraction unit, configured to extract a predicted feature vector of the network by using a second machine learning model according to the state parameter at the future time, where the second machine learning model is a state neural network;
the determining unit is used for determining the early warning level of the network by utilizing a third machine learning model according to the predicted feature vector, wherein the third machine learning model is an early warning neural network;
the extraction unit extracts the prediction feature vector of the network by using a neural network classifier;
and the training unit is used for extracting a feature vector of the network by utilizing a fourth machine learning model according to the statistical feature data of the state parameters of the network at the historical moment and the state parameters of the network at the target moment, wherein the target moment is later than the historical moment, the fourth machine learning model is a self-coding learning model, the state parameters at the target moment are used as input, and the feature vector is used as output to train a second machine learning model.
7. The network warning apparatus of claim 6, further comprising:
and the training unit is used for training the first machine learning model by taking the statistical characteristic data of the state parameters of the network at the historical moment as input and taking the state parameters of the network at the target moment as output, wherein the target moment is later than the historical moment.
8. The network early warning apparatus of claim 6,
the training unit is used for preprocessing statistical characteristic data of the state parameters of the network at the historical moment by using a fuzzy control model, and extracting the characteristic vector of the network by using a fourth machine learning model according to the preprocessed statistical characteristic data and the state parameters of the network at the target moment.
9. The network early warning apparatus of claim 6,
and the training unit determines the early warning grade of the network at the target moment by using a fifth machine learning model according to the feature vector, and trains the third machine learning model by taking the feature vector as input and the early warning grade at the target moment as output.
10. The network early warning apparatus according to any one of claims 6 to 9,
the state parameter includes at least one of flow information, congestion information, connection number information, and packet loss rate information of the network.
11. A network warning device, comprising:
a memory; and
a processor coupled to the memory, the processor configured to perform the network warning method of any of claims 1-5 based on instructions stored in the memory device.
12. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the network warning method of any one of claims 1 to 5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911068283.2A CN112769733B (en) | 2019-11-05 | 2019-11-05 | Network early warning method, device and computer readable storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911068283.2A CN112769733B (en) | 2019-11-05 | 2019-11-05 | Network early warning method, device and computer readable storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112769733A CN112769733A (en) | 2021-05-07 |
| CN112769733B true CN112769733B (en) | 2023-04-07 |
Family
ID=75692591
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911068283.2A Active CN112769733B (en) | 2019-11-05 | 2019-11-05 | Network early warning method, device and computer readable storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112769733B (en) |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109462821A (en) * | 2018-11-19 | 2019-03-12 | 东软集团股份有限公司 | Method, apparatus, storage medium and the electronic equipment of predicted position |
| CN109873790A (en) * | 2017-12-04 | 2019-06-11 | 中国电信股份有限公司 | Network security detection method, device and computer readable storage medium |
Family Cites Families (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104486141B (en) * | 2014-11-26 | 2018-10-23 | 国家电网公司 | A kind of network security situation prediction method that wrong report is adaptive |
| CN109842563A (en) * | 2017-11-24 | 2019-06-04 | 中国电信股份有限公司 | Content delivery network flow dispatching method, device and computer readable storage medium |
| US10716017B2 (en) * | 2018-03-12 | 2020-07-14 | Adtran, Inc. | Telecommunications network troubleshooting systems |
| CN109242133B (en) * | 2018-07-11 | 2022-03-22 | 北京石油化工学院 | Data processing method and system for ground disaster early warning |
| CN109995592A (en) * | 2019-04-09 | 2019-07-09 | 中国联合网络通信集团有限公司 | Quality of service monitoring method and equipment |
| CN110213784B (en) * | 2019-07-05 | 2022-05-20 | 中国联合网络通信集团有限公司 | Flow prediction method and device |
-
2019
- 2019-11-05 CN CN201911068283.2A patent/CN112769733B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109873790A (en) * | 2017-12-04 | 2019-06-11 | 中国电信股份有限公司 | Network security detection method, device and computer readable storage medium |
| CN109462821A (en) * | 2018-11-19 | 2019-03-12 | 东软集团股份有限公司 | Method, apparatus, storage medium and the electronic equipment of predicted position |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112769733A (en) | 2021-05-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10877863B2 (en) | Automatic prediction system for server failure and method of automatically predicting server failure | |
| Ren et al. | Knowledge-maximized ensemble algorithm for different types of concept drift | |
| US20220255817A1 (en) | Machine learning-based vnf anomaly detection system and method for virtual network management | |
| Gama et al. | Recurrent concepts in data streams classification | |
| US20160042287A1 (en) | Computer-Implemented System And Method For Detecting Anomalies Using Sample-Based Rule Identification | |
| US20200334578A1 (en) | Model training apparatus, model training method, and program | |
| CN117421684B (en) | Abnormal data monitoring and analyzing method based on data mining and neural network | |
| Sharma et al. | Analysis of machine learning techniques based intrusion detection systems | |
| Kadwe et al. | A review on concept drift | |
| CN117041017B (en) | Intelligent operation and maintenance management method and system for data center | |
| CN104050361A (en) | Intelligent analysis early warning method for dangerousness tendency of prison persons serving sentences | |
| Zhang et al. | Applying big data analytics into network security: Challenges, techniques and outlooks | |
| CN112395168A (en) | Stacking-based edge side service behavior identification method | |
| CN116915710A (en) | Traffic early warning method, device, equipment and readable storage medium | |
| CN114881173A (en) | Resume classification method and device based on self-attention mechanism | |
| Chowdhury et al. | Internet of Things resource monitoring through proactive fault prediction | |
| KR20210011822A (en) | Method of detecting abnormal log based on artificial intelligence and system implementing thereof | |
| Inacio et al. | Fault diagnosis with evolving fuzzy classifier based on clustering algorithm and drift detection | |
| CN117422181A (en) | Fuzzy label-based method and system for early warning loss of issuing clients | |
| Hajizadeh et al. | Nearest neighbor classification with locally weighted distance for imbalanced data | |
| CN112769733B (en) | Network early warning method, device and computer readable storage medium | |
| Silva et al. | Applying neural networks for concept drift detection in financial markets | |
| CN110083508B (en) | Data monitoring method and device | |
| CN114818947A (en) | Training method and device of classifier and classification device | |
| Deshpande et al. | Concept drift identification using classifier ensemble approach |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| EE01 | Entry into force of recordation of patent licensing contract | ||
| EE01 | Entry into force of recordation of patent licensing contract |
Application publication date: 20210507 Assignee: Tianyiyun Technology Co.,Ltd. Assignor: CHINA TELECOM Corp.,Ltd. Contract record no.: X2024110000020 Denomination of invention: Network warning methods, devices, and computer-readable storage media Granted publication date: 20230407 License type: Common License Record date: 20240315 |