CN114501520A - Network anomaly detection method and device and network equipment - Google Patents
Network anomaly detection method and device and network equipment Download PDFInfo
- Publication number
- CN114501520A CN114501520A CN202011154046.0A CN202011154046A CN114501520A CN 114501520 A CN114501520 A CN 114501520A CN 202011154046 A CN202011154046 A CN 202011154046A CN 114501520 A CN114501520 A CN 114501520A
- Authority
- CN
- China
- Prior art keywords
- cell
- measurement report
- scatter diagram
- signal intensity
- report data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 52
- 238000010586 diagram Methods 0.000 claims abstract description 68
- 238000000034 method Methods 0.000 claims abstract description 60
- 238000005259 measurement Methods 0.000 claims abstract description 54
- 238000000605 extraction Methods 0.000 claims abstract description 24
- 238000010276 construction Methods 0.000 claims abstract description 12
- 239000013598 vector Substances 0.000 claims description 15
- 230000002159 abnormal effect Effects 0.000 claims description 14
- 238000012545 processing Methods 0.000 claims description 13
- 238000007781 pre-processing Methods 0.000 claims description 10
- 238000004590 computer program Methods 0.000 claims description 3
- 230000000875 corresponding effect Effects 0.000 description 11
- 230000008569 process Effects 0.000 description 4
- 238000004891 communication Methods 0.000 description 3
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 230000000694 effects Effects 0.000 description 3
- 238000007689 inspection Methods 0.000 description 3
- 230000005856 abnormality Effects 0.000 description 2
- 230000006399 behavior Effects 0.000 description 2
- 238000000354 decomposition reaction Methods 0.000 description 2
- 238000005215 recombination Methods 0.000 description 2
- 230000006798 recombination Effects 0.000 description 2
- 230000011218 segmentation Effects 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000023402 cell communication Effects 0.000 description 1
- 230000002596 correlated effect Effects 0.000 description 1
- 238000013480 data collection Methods 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 230000009467 reduction Effects 0.000 description 1
- 238000013024 troubleshooting Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W24/00—Supervisory, monitoring or testing arrangements
- H04W24/08—Testing, supervising or monitoring using real traffic
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
- G06F18/232—Non-hierarchical techniques
- G06F18/2321—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
- G06F18/23213—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions with fixed number of clusters, e.g. K-means clustering
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W24/00—Supervisory, monitoring or testing arrangements
- H04W24/10—Scheduling measurement reports ; Arrangements for measurement reports
Landscapes
- Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Theoretical Computer Science (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Bioinformatics & Computational Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Artificial Intelligence (AREA)
- Life Sciences & Earth Sciences (AREA)
- Probability & Statistics with Applications (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
The embodiment of the invention provides a method, a device and network equipment for detecting network abnormity, wherein the method comprises the following steps: acquiring measurement report data and engineering parameter data of a cell in a first area; constructing a signal intensity information scatter diagram according to the measurement report data and the engineering parameter data; performing feature extraction on the signal intensity information scatter diagram to construct a detection feature library; and performing network anomaly detection based on the detection feature library. According to the embodiment of the invention, the measurement report data and the engineering parameter data are subjected to graph construction and structural information extraction, a large amount of user behavior information is borne, network abnormity can be checked without accurate prior information and professional experience, network problems can be rapidly checked at the initial stage of network construction, and the network quality is optimized and improved.
Description
Technical Field
The present invention relates to the field of communications technologies, and in particular, to a method and an apparatus for detecting network anomalies, and a network device.
Background
In the prior art, for the detection of network anomaly, reasonable experience threshold values are set for certain characteristics based on historical data, and when threshold values are met, the network anomaly is determined. For the work parameter inspection, the inspection and the check are needed to be carried out on the station, or the inspection is carried out by adopting an unmanned aerial vehicle and a machine vision method, so that the cost and the difficulty are high.
However, the method for carrying out anomaly detection based on historical data, artificial division and threshold optimization has certain subjectivity, cannot establish a complex model, can only carry out judgment based on a limited number of characteristics, and has certain limitations and information loss problems.
Disclosure of Invention
The invention provides a method and a device for detecting network anomaly and network equipment, which are used for solving the problems of limitation and information loss of a network anomaly detection mode in the prior art.
To solve the above technical problem, an embodiment of the present invention provides the following solutions:
the embodiment of the invention provides a method for detecting network abnormality, which comprises the following steps:
acquiring measurement report data and engineering parameter data of a cell in a first area;
constructing a signal intensity information scatter diagram according to the measurement report data and the engineering parameter data;
performing feature extraction on the signal intensity information scatter diagram to construct a detection feature library;
and performing network anomaly detection based on the detection feature library.
Optionally, the performing feature extraction on the signal strength information scatter diagram to construct a detection feature library, including:
performing feature extraction on the signal intensity information scatter diagram based on at least one of image statistical features, plane characteristics of geometric distribution and two-dimensional characteristics of geometric distribution;
and processing the extracted features according to a preset format or sequence to obtain a detection feature library.
Optionally, the image statistical characteristics include at least one of: the method comprises the following steps of scattered point centroid coordinates, scattered point fitting straight line slope, signal intensity difference mean, signal intensity difference median, signal intensity difference mode and scattered point number.
Optionally, the feature extraction of the signal intensity information scattergram based on the plane characteristics of the geometric distribution includes:
dividing the signal intensity information scatter diagram into m × n area grids based on the plane characteristics of the geometric distribution;
and counting the number of scatter points in each area grid to obtain an m-n-dimensional feature vector of the signal intensity information scatter diagram.
Optionally, the feature extraction of the signal intensity information scattergram based on the two-dimensional characteristics of the geometric distribution includes:
dividing a horizontal axis of the signal intensity information scatter diagram into p intervals and dividing a vertical axis of the signal intensity information scatter diagram into q intervals based on the plane characteristics of the geometric distribution;
and respectively counting the number of scatter points in p intervals of the horizontal axis and q intervals of the vertical axis to obtain a horizontal axis feature vector and a vertical axis feature vector of the signal intensity information scatter diagram.
Optionally, based on the detection feature library, performing network anomaly detection includes:
performing clustering processing according to the characteristics in the detection characteristic library to obtain a clustering result;
and determining the corresponding network abnormal state according to the clustering result.
Optionally, determining a corresponding network abnormal state according to the clustering result, where the corresponding network abnormal state includes at least one of the following:
when the clustering result is that the difference value of the horizontal and vertical coordinates of the center of mass of the scattered points is larger than a first threshold value and the slope of a fitted straight line of the scattered points is smaller than a second threshold value, the unreasonable distance between the base stations or the direction of the base station antenna is not in counterpoint hit is determined;
when the clustering result is that the difference value of the horizontal and vertical coordinates of the center of mass of the scattered point is larger than a first threshold value, the slope of a fitted straight line of the scattered point is smaller than a second threshold value, the distance between the base stations is reasonable, and the antenna directions of the base stations are opposite, the engineering parameters are determined to be unreasonable;
and when the clustering result is that scattered points with the distance from the class center larger than a third threshold value exist, determining that an abnormal adjacent cell exists.
Optionally, the measurement report data includes at least one of the following parameters: the method comprises the following steps of adjacent cell frequency points, Physical Cell Identification (PCI) and cell signal strength parameters, wherein the cell signal strength parameters comprise: at least one of reference signal received power, RSRP, reference signal received quality, RSRQ, and signal to interference and noise ratio, SINR;
the engineering parameter data comprises at least one of the following parameters: cell station height, cell longitude and latitude, cell direction angle and cell downtilt angle.
Optionally, constructing a signal strength information scattergram according to the measurement report data and the engineering parameter data, including:
preprocessing the measurement report data and the engineering parameter data to obtain a signal quality value group of a serving cell and an adjacent cell;
and constructing a signal strength information scatter diagram according to the signal quality value group of the serving cell and the adjacent cell.
Optionally, the preprocessing the measurement report data and the engineering parameter data to obtain a signal quality value set of a serving cell and an adjacent cell includes:
determining the base station cell identification ECI of the adjacent cell according to the frequency point and the PCI of the adjacent cell in the measurement report data and the engineering parameter data;
grouping the measurement report data based on the ECI to obtain a set of signal quality values of a serving cell and a neighboring cell.
Optionally, the obtaining measurement report data of the cell in the first area includes:
receiving measurement report data reported by a first terminal, wherein the first terminal comprises: and the first area is a plurality of continuous areas.
The embodiment of the present invention further provides a device for detecting network anomaly, including:
an acquisition module, configured to acquire measurement report data and engineering parameter data of a cell in a first area;
the first construction module is used for constructing a signal intensity information scatter diagram according to the measurement report data and the engineering parameter data;
the second construction module is used for extracting the characteristics of the signal intensity information scatter diagram and constructing a detection characteristic library;
and the detection module is used for detecting network abnormity based on the detection feature library.
An embodiment of the present invention further provides a network device, including: a processor, a memory storing a computer program which, when executed by the processor, performs the above-described method.
Embodiments of the present invention also provide a computer-readable storage medium, which includes instructions that, when executed on a computer, cause the computer to perform the above-mentioned method.
The scheme of the invention at least comprises the following beneficial effects:
according to the scheme, the measurement report data and the engineering parameter data are subjected to graph construction and structural information extraction, a large amount of user behavior information is borne, network abnormity can be checked without accurate prior information and professional experience, network problems can be rapidly checked at the initial stage of network construction, and network quality is optimized and improved.
Drawings
FIG. 1 is a flowchart illustrating a method for detecting network anomalies according to an embodiment of the present invention;
FIG. 2 is another flow chart illustrating a method for detecting network anomalies according to an embodiment of the present invention;
fig. 3 is one of scatter plots based on a set of serving cell-neighbor cell RSRP values according to an embodiment of the present invention;
fig. 4 is a second scatter plot based on a set of serving cell-neighbor cell RSRP values according to an embodiment of the present invention;
fig. 5 is a third scatter plot based on a set of serving cell-neighbor cell RSRP values according to an embodiment of the present invention;
FIG. 6 is a schematic diagram of scatter clustering in accordance with an embodiment of the present invention;
FIG. 7 is a schematic diagram of signal strength clustering for the cluster classes in the circle in FIG. 6;
FIG. 8 is a block diagram of an apparatus for detecting network anomalies according to an embodiment of the present invention;
fig. 9 is a block diagram of a network device according to an embodiment of the present invention.
Detailed Description
Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.
As shown in fig. 1, an embodiment of the present invention provides a method for detecting a network anomaly, including:
step 11: measurement report data and engineering parameter data of cells within the first region are obtained.
The first area is a plurality of continuous areas, and the first area comprises a plurality of cells. The measurement report data may comprise at least one of the following parameters: frequency points of adjacent cells, Physical Cell Identifiers (PCIs), and Cell signal strength parameters. Wherein, the cell signal strength parameter includes: at least one of Reference Signal Receiving Power (RSRP), Reference Signal Receiving Quality (RSRQ), and Signal to Interference Noise Ratio (SINR). The engineering parameter data includes at least one of the following parameters: the station height of the cell, the longitude and latitude of the cell, the direction angle of the cell, the downward inclination angle of the cell and the like.
Step 12: and constructing a signal intensity information scatter diagram according to the measurement report data and the engineering parameter data.
The signal strength information scatter diagram is the signal strength information scatter diagram of all cells measured and reported by all terminals in all cells in the first area, and may be used to characterize the actual signal strength (cell communication quality) of each cell in the first area.
Step 13: and (4) performing feature extraction on the signal intensity information scatter diagram to construct a detection feature library.
Wherein, step 13 may include: performing feature extraction on the signal intensity information scatter diagram based on at least one of image statistical features, plane characteristics of geometric distribution and two-dimensional characteristics of geometric distribution; and processing the extracted features according to a preset format or sequence to obtain a detection feature library.
Step 14: and performing network anomaly detection based on the detection feature library.
A detection feature library is formed by extracting structural features of the signal strength information scatter diagram, a certain feature set is selected by combining additional information such as engineering parameter data of each cell and a specific strategy to carry out anomaly detection analysis, and a positioned network anomaly neighbor cell combination is output.
As shown in fig. 2, the method for detecting network anomaly according to the embodiment of the present invention specifically includes:
step 21: and (6) collecting data.
The data collection is to obtain measurement report data and engineering parameter data for cells within the first area. That is, Measurement Report data (MR) reported by all terminals in a certain connected area within a period of time and engineering parameter data of a corresponding cell are collected. Wherein the step of obtaining measurement report data for cells within the first area comprises: receiving measurement report data reported by a first terminal, wherein the first terminal comprises: and the terminals under all the cells in the first area are a plurality of continuous areas.
Step 22: and (4) preprocessing data.
Step 22 comprises: and preprocessing the measurement report data and the engineering parameter data to obtain a signal quality value group of the serving cell and the adjacent cell.
The step of preprocessing the measurement report data and the engineering parameter data to obtain the signal quality value group of the serving cell-the neighboring cell comprises the following steps: determining a base station Cell identifier (eNB Cell ID, ECI) of the adjacent Cell according to the frequency point and the PCI of the adjacent Cell in the measurement report data and the engineering parameter data; grouping the measurement report data based on the ECI to obtain a set of signal quality values of the serving cell-the neighbor cell.
Optionally, since the neighbor measurement information reported in the MR only includes the frequency point and PCI of the neighbor, the value of the neighbor measurement information cannot uniquely determine the neighbor, and a certain method is required to map and determine the unique identifier ID of the cell, such as ECI. The step of determining the ECI of the neighboring cell according to the neighboring cell frequency point, the PCI and the engineering parameter data in the measurement report data may be: for a certain MR measurement sample, all cells which are within a preset distance (for example, 3 kilometers) around a service cell and conform to the frequency point and the PCI corresponding to the neighbor cell measured by the MR are searched based on the work parameter table, if one cell which is closest to the service cell conforms to the conditions, the cell is considered as the neighbor cell measured by the sample, and then the ECI of the neighbor cell is obtained from the work parameter table.
Grouping the measurement report data based on the ECI to obtain a set of signal quality values of the serving cell-neighbor cell may be: for each serving cell SC in a celliAccording to frequency point and PCI of adjacent cell in MR data, SC is convertediThe ECI value groups mapped by the MR reported by all the terminals in the system extract the RSRP value of each group of service cells and adjacent cells, namely for each pair of service cells SCiAnd neighbor cell NCjForming a serving cell-neighbor cell RSRP value set { { RSRPn_SCi},{RSRPn_NCj}}。
Step 23: and (4) constructing a graph and extracting structural features.
The step of constructing a signal strength information scatter diagram according to the measurement report data and the engineering parameter data comprises the following steps: preprocessing the measurement report data and the engineering parameter data to obtain a signal quality value group of a serving cell and an adjacent cell; and constructing a signal strength information scatter diagram according to the signal quality value group of the service cell and the adjacent cell.
The step of constructing a signal strength information scatter diagram according to the set of signal quality values of the serving cell-the neighboring cell comprises: set { { RSRP) based on serving cell-neighbor cell RSRP valuen_SCi},{RSRPn_NCj}, plotted as RSRPn_SCiThe sequence isAbscissa value, RSRPn_NCjThe sequence is a signal strength information scatter diagram of ordinate values.
Step 24: and constructing a feature library.
Step 24 comprises: the method comprises the following steps of carrying out feature extraction on a signal intensity information scatter diagram to construct a detection feature library, wherein the step can be implemented by a plurality of methods according to different analysis targets, or the plurality of methods are simultaneously implemented to construct a combined feature library, and possible implementation methods are as follows: performing feature extraction on the signal strength information scatter diagram based on at least one of the following items: image statistical characteristics, plane characteristics of geometric distribution and two-dimensional characteristics of geometric distribution; and processing the extracted features according to a preset format or sequence to obtain a detection feature library. These three construction modes will be further explained below.
Method I, extracting based on image statistical characteristics
Set { { RSRP) based on serving cell-neighbor cell RSRP valuen_SCi},{RSRPn_NCj} drawing a scatter plot with RSRPn_SCiThe sequence being abscissa value, RSRPn_NCjThe sequences are ordinate values, as shown in FIG. 3. Wherein the image statistical features include at least one of: the method comprises the following steps of scattered point centroid coordinates, scattered point fitting straight line slope, signal intensity difference mean, signal intensity difference median, signal intensity difference mode and scattered point number. Then, according to the serving cell-neighbor cell RSRP value set { { RSRPn_SCi},{RSRPn_NCjAnd (4) extracting representative features of the scatter diagram, such as a scatter centroid coordinate, a scatter fitting straight line, a slope and the like, from statistical information of the scatter diagram, wherein key features and meanings which may be contained in the scatter diagram are as follows in table 1:
TABLE 1
Method two, plane feature extraction based on geometric distribution
Based on the plane characteristics of the geometric distribution, the step of extracting the characteristics of the signal intensity information scatter diagram comprises the following steps: dividing the signal intensity information scatter diagram into m × n area grids based on the plane characteristics of the geometric distribution; and counting the number of scatter points in each area grid to obtain an m-n-dimensional feature vector of the signal intensity information scatter diagram.
Also based on the serving cell-neighbor cell RSRP value set { { RSRPn_SCi},{RSRPn_NCj}, at RSRPn_SCiThe sequences are abscissa values, RSRPn_NCjThe sequence is used for drawing a scatter diagram by a vertical coordinate value, the scatter diagrams of all service cells are unified with the value range of horizontal and vertical coordinates, each scatter diagram is divided into m-n area grids, the number of scatter points in each grid is counted in sequence, and therefore grid feature vectors with the length of m-n can be obtained from the scatter diagrams. For example, as shown in fig. 4, 8-by-8 mesh segmentation is performed on the scatter diagram, the number of scatter points in each small mesh is calculated, so that a feature vector can be formed, and a 64-dimensional feature vector of the scatter diagram can be obtained as V _ SCi_NCj＝[0,0,…,86,107,121,…,0,0]m*n。
Mode three, two-dimensional feature extraction based on geometric distribution
Based on the two-dimensional characteristics of the geometric distribution, the step of extracting the features of the signal intensity information scatter diagram comprises the following steps: dividing a horizontal axis of the signal intensity information scatter diagram into p intervals and a vertical axis of the signal intensity information scatter diagram into q intervals based on the plane characteristics of the geometric distribution; and respectively counting the number of scatter points in p intervals of the horizontal axis and q intervals of the vertical axis to obtain a horizontal axis feature vector and a vertical axis feature vector of the signal intensity information scatter diagram. Similarly to the second mode, the value ranges of the horizontal and vertical coordinates are unified for the scattergrams of all the serving cells, as shown in fig. 5, the horizontal and vertical coordinates are divided into p and q sections, the scattergrams are projected to the horizontal and vertical coordinates, and the number of scattergrams falling in the p sections of the horizontal axis and the q sections of the vertical axis are counted respectively to form two eigenvectors of the horizontal and vertical coordinates: vx _ SCi_NCj＝[0,0,79,514,1082,679,101,0]m，Vy_SCi_NCj＝[1,1,182,1135,1294,550,93,0]n。
And performing feature extraction on the signal intensity information scatter diagram by at least one of the three modes, then forming a feature library by the extracted structural features according to a certain format and sequence, and performing necessary feature preprocessing, such as normalization, combination, dimension reduction and the like.
Step 25: feature selection is performed in a feature library.
Step 26: based on the selected features, anomaly detection is performed.
The steps 23, 25, and 26 are performed and implemented based on the respective policy controls. Step 25 and step 26 are: network anomaly detection is carried out based on the detection feature library, and the steps comprise: performing clustering processing according to the characteristics in the detection characteristic library to obtain a clustering result; and determining the corresponding network abnormal state according to the clustering result. Optionally, two features of the slope k of the scatter point fitting straight line and the centroid horizontal and vertical coordinate difference diff _ avg are extracted and combined to be a clustering object (ki, diff _ avgi), and a hierarchical clustering algorithm is adopted for clustering. Performing clustering processing according to the features in the detected feature library to obtain a clustering result, wherein the step of obtaining the clustering result may include: (1) regarding each object as a class, and calculating the minimum distance between every two objects; (2) merging the two classes with the minimum distance into a new class; (3) recalculating the distances between the new class and all classes; (4) repeating (2) and (3) until a classification end condition is specified, such as a given number of classes or a threshold of minimum distance between two classes is reached, and obtaining a clustering result as shown in fig. 6. Wherein the points of different gray levels represent different classes (k)i,diff_avgi) Namely, the adjacent cell relations of different categories, and further carrying out anomaly detection based on the clustering result.
Step 27: and outputting the result of the abnormality detection.
Based on a certain strategy, a feature complete set or a feature subset in a feature library is selected, and a certain judgment rule or an unsupervised model is adopted for carrying out anomaly detection. For example, as for a certain category in the clustering result, as shown by a circle in fig. 6, the category is characterized by a larger difference between the horizontal and vertical coordinates of the centroid of the scatter diagram and a smaller slope of the fitted straight line, as shown in fig. 7, the RSRP of the serving cell and the RSRP of the neighboring cells are weakly correlated. Determining a corresponding network abnormal state according to the clustering result, wherein the step comprises at least one of the following steps:
when the clustering result is that the difference value of the horizontal and vertical coordinates of the centroids of the scattered points is larger than a first threshold value and the slope of a fitted straight line of the scattered points is smaller than a second threshold value, the unreasonable distance between the base stations or the direction of the base station antennas is not hit; and (4) analyzing the engineering parameter configuration rule of the class main service cell and the adjacent cell, wherein the distance of the base station is longer or the antenna direction angles are not opposite.
When the clustering result is that the difference value of the horizontal and vertical coordinates of the barycenter of the scattered points is larger than a first threshold value, the slope of a fitted straight line of the scattered points is smaller than a second threshold value, the distance between the base stations is reasonable, and the antenna directions of the base stations are opposite-hit, the engineering parameters are determined to be unreasonable; when the cluster distribution occurs and the current network cluster is searched for the cells in the neighboring cell relation, if the antenna pair or the angle coincidence degree in the engineering parameters is high and the base station position is close, the filling of the engineering parameters is likely to be problematic, and the accuracy of the engineering parameters needs to be searched for the abnormal situation of the network.
And when the clustering result is that scattered points with the distance from the category center larger than a third threshold exist, determining that an abnormal adjacent region exists. The method comprises the steps of taking a specific threshold, finding outlier sample points with distances greater than the threshold from the center of each category, judging the outlier sample points as abnormal neighbors, and configuring key attention and troubleshooting possible problems by combining outlier parameters.
According to the method for detecting the network anomaly, disclosed by the embodiment of the invention, the graph construction and the structural information extraction are carried out on the measurement report data and the engineering parameter data, a large amount of user behavior information is borne, the network anomaly can be detected without accurate prior information and professional experience, the network problem can be rapidly checked at the initial stage of network construction, and the network quality is optimized and improved.
The embodiments of the method for detecting network anomaly are introduced above, and the embodiments of the apparatus corresponding to the method will be further described with reference to the drawings.
An embodiment of the present invention further provides a device for detecting a network anomaly, as shown in fig. 8, the device includes:
an obtaining module 810, configured to obtain measurement report data and engineering parameter data of a cell in a first area;
a first constructing module 820, configured to construct a signal strength information scatter diagram according to the measurement report data and the engineering parameter data;
the second construction module 830 is configured to perform feature extraction on the signal strength information scatter diagram, and construct a detection feature library;
the detection module 840 is configured to perform network anomaly detection based on the detection feature library.
Optionally, the second building block 830 comprises:
a first extraction sub-module, configured to perform feature extraction on the signal strength information scatter diagram based on at least one of: image statistical characteristics, plane characteristics of geometric distribution and two-dimensional characteristics of geometric distribution;
and the first processing submodule is used for processing the extracted features according to a preset format or sequence to obtain a detection feature library.
Optionally, the image statistical features comprise at least one of: the method comprises the following steps of scattered point centroid coordinates, scattered point fitting straight line slope, signal intensity difference mean, signal intensity difference median, signal intensity difference mode and scattered point number.
Optionally, the first extraction sub-module includes:
the first segmentation unit is used for segmenting the signal intensity information scatter diagram into m × n area grids based on the plane characteristics of the geometric distribution;
and the first statistical unit is used for counting the number of scatter points in each area grid to obtain an m-n-dimensional feature vector of the signal intensity information scatter diagram.
Optionally, the first extraction sub-module further includes:
a second dividing unit, configured to divide a horizontal axis of the signal intensity information scattergram into p sections and a vertical axis of the signal intensity information scattergram into q sections based on a planar characteristic of the geometric distribution;
and the second statistical unit is used for respectively counting the number of the scatter points in p sections of the horizontal axis and q sections of the vertical axis to obtain a horizontal axis feature vector and a vertical axis feature vector of the signal intensity information scatter diagram.
Optionally, the detection module 840 includes:
the clustering submodule is used for clustering according to the characteristics in the detection characteristic library to obtain a clustering result;
and the determining submodule is used for determining the corresponding network abnormal state according to the clustering result.
Optionally, the determining sub-module comprises at least one of:
the first determining unit is used for determining that the distance between the base stations is unreasonable or the antenna directions of the base stations are not aligned when the clustering result is that the difference value of the horizontal and vertical coordinates of the center of mass of the scattered points is larger than a first threshold and the slope of the fitted straight line of the scattered points is smaller than a second threshold;
the second determining unit is used for determining that the engineering parameters are unreasonable when the clustering result is that the difference value of the horizontal and vertical coordinates of the center of mass of the scattered points is larger than the first threshold value, the slope of the fitted straight line of the scattered points is smaller than the second threshold value, the distance between the base stations is reasonable, and the antenna directions of the base stations are opposite;
and the third determining unit is used for determining that an abnormal adjacent cell exists when the clustering result is that scattered points with the distance from the center of the category larger than a third threshold exist.
Optionally, the measurement report data comprises at least one of the following parameters: adjacent cell frequency point, physical cell identification PCI and cell signal strength parameter, wherein, cell signal strength parameter includes: at least one of reference signal received power, RSRP, reference signal received quality, RSRQ, and signal to interference and noise ratio, SINR;
the engineering parameter data includes at least one of the following parameters: cell station height, cell longitude and latitude, cell direction angle and cell downtilt angle.
Optionally, the first building block 820 comprises:
the second processing submodule is used for preprocessing the measurement report data and the engineering parameter data to obtain a signal quality value group of a serving cell and an adjacent cell;
and the constructing submodule is used for constructing a signal strength information scatter diagram according to the signal quality value group of the serving cell and the adjacent cell.
Optionally, the second processing sub-module includes:
a fourth determining unit, configured to determine, according to the neighboring cell frequency point and the PCI in the measurement report data and the engineering parameter data, a base station cell identifier ECI of the neighboring cell;
and the grouping unit is used for grouping the measurement report data based on the ECI to obtain the signal quality value group of the serving cell and the adjacent cell.
Optionally, the obtaining module 810 includes:
a receiving submodule, configured to receive measurement report data reported by a first terminal, where the first terminal includes: and the terminals under all the cells in the first area are a plurality of continuous areas.
The device embodiment of the present invention is a product embodiment corresponding to the method embodiment, and all application examples of the method embodiment are applicable to the device embodiment and can achieve the same or similar technical effects, so that the detailed description thereof is omitted.
An embodiment of the present invention further provides a network device, as shown in fig. 9, where the network device includes: a processor 910, a memory 920 storing a computer program which, when executed by the processor, performs the method as described above. All the implementation manners in the above method embodiment are applicable to this embodiment, and the same technical effect can be achieved.
Embodiments of the present invention also provide a computer-readable storage medium comprising instructions which, when executed on a computer, cause the computer to perform the method as described above. All the implementation manners in the above method embodiment are applicable to this embodiment, and the same technical effect can be achieved.
Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
In the embodiments provided in the present invention, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit.
The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: various media capable of storing program codes, such as a U disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.
Furthermore, it is to be noted that in the device and method of the invention, it is obvious that the individual components or steps can be decomposed and/or recombined. These decompositions and/or recombinations are to be regarded as equivalents of the present invention. Also, the steps of performing the series of processes described above may naturally be performed chronologically in the order described, but need not necessarily be performed chronologically, and some steps may be performed in parallel or independently of each other. It will be understood by those skilled in the art that all or any of the steps or elements of the method and apparatus of the present invention may be implemented in any computing device (including processors, storage media, etc.) or network of computing devices, in hardware, firmware, software, or any combination thereof, which can be implemented by those skilled in the art using their basic programming skills after reading the description of the present invention.
Thus, the objects of the invention may also be achieved by running a program or a set of programs on any computing device. The computing device may be a general purpose device as is well known. The object of the invention is thus also achieved solely by providing a program product comprising program code for implementing the method or the apparatus. That is, such a program product also constitutes the present invention, and a storage medium storing such a program product also constitutes the present invention. It is to be understood that the storage medium may be any known storage medium or any storage medium developed in the future. It is further noted that in the apparatus and method of the present invention, it is apparent that each component or step can be decomposed and/or recombined. These decompositions and/or recombinations are to be regarded as equivalents of the present invention. Also, the steps of executing the series of processes described above may naturally be executed chronologically in the order described, but need not necessarily be executed chronologically. Some steps may be performed in parallel or independently of each other.
While the foregoing is directed to the preferred embodiment of the present invention, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention as defined in the appended claims.
Claims (14)
1. A method for detecting network anomaly, comprising:
acquiring measurement report data and engineering parameter data of a cell in a first area;
constructing a signal intensity information scatter diagram according to the measurement report data and the engineering parameter data;
extracting the characteristics of the signal intensity information scatter diagram to construct a detection characteristic library;
and performing network anomaly detection based on the detection feature library.
2. The method according to claim 1, wherein the extracting the features of the signal strength information scatter diagram to construct a detection feature library comprises:
performing feature extraction on the signal intensity information scatter diagram based on at least one of image statistical features, plane characteristics of geometric distribution and two-dimensional characteristics of geometric distribution;
and processing the extracted features according to a preset format or sequence to obtain a detection feature library.
3. The method of claim 2, wherein the image statistics comprise at least one of: the method comprises the following steps of scattered point centroid coordinates, scattered point fitting straight line slope, signal intensity difference mean, signal intensity difference median, signal intensity difference mode and scattered point number.
4. The method according to claim 2, wherein the performing feature extraction on the signal strength information scatter diagram based on the plane characteristics of the geometric distribution comprises:
dividing the signal intensity information scatter diagram into m × n area grids based on the plane characteristics of the geometric distribution;
and counting the number of scatter points in each area grid to obtain an m-n-dimensional feature vector of the signal intensity information scatter diagram.
5. The method according to claim 2, wherein the performing feature extraction on the signal strength information scattergram based on the two-dimensional characteristics of the geometric distribution comprises:
dividing a horizontal axis of the signal intensity information scatter diagram into p intervals and a vertical axis of the signal intensity information scatter diagram into q intervals based on the plane characteristics of the geometric distribution;
and respectively counting the number of scatter points in p intervals of the horizontal axis and q intervals of the vertical axis to obtain a horizontal axis feature vector and a vertical axis feature vector of the signal intensity information scatter diagram.
6. The method for detecting network anomaly according to claim 1, wherein the network anomaly detection is performed based on the detection feature library, and comprises:
performing clustering processing according to the characteristics in the detection characteristic library to obtain a clustering result;
and determining the corresponding network abnormal state according to the clustering result.
7. The method according to claim 6, wherein determining the corresponding network abnormal state according to the clustering result comprises at least one of:
when the clustering result is that the difference value of the horizontal and vertical coordinates of the centroids of the scattered points is larger than a first threshold value and the slope of a scattered point fitting straight line is smaller than a second threshold value, the unreasonable distance between the base stations or the direction of the base station antennas is not hit;
when the clustering result is that the difference value of the horizontal and vertical coordinates of the center of mass of the scattered point is larger than a first threshold value, the slope of a fitted straight line of the scattered point is smaller than a second threshold value, the distance between the base stations is reasonable, and the antenna directions of the base stations are opposite, the engineering parameters are determined to be unreasonable;
and when the clustering result is that scattered points with the distance from the class center larger than a third threshold value exist, determining that an abnormal adjacent cell exists.
8. The method according to any of claims 1 to 7, wherein the measurement report data comprises at least one of the following parameters: the method comprises the following steps of adjacent cell frequency points, Physical Cell Identification (PCI) and cell signal strength parameters, wherein the cell signal strength parameters comprise: at least one of reference signal received power, RSRP, reference signal received quality, RSRQ, and signal to interference and noise ratio, SINR;
the engineering parameter data comprises at least one of the following parameters: cell station height, cell longitude and latitude, cell direction angle and cell downtilt angle.
9. The method of claim 8, wherein constructing a signal strength information scatter plot from the measurement report data and the engineering parameter data comprises:
preprocessing the measurement report data and the engineering parameter data to obtain a signal quality value group of a serving cell and an adjacent cell;
and constructing a signal strength information scatter diagram according to the signal quality value group of the serving cell and the adjacent cell.
10. The method of claim 9, wherein the preprocessing the measurement report data and the engineering parameter data to obtain the set of signal quality values of serving cell-neighbor cell comprises:
determining the base station cell identification ECI of the adjacent cell according to the frequency point and the PCI of the adjacent cell in the measurement report data and the engineering parameter data;
and grouping the measurement report data based on the ECI to obtain a signal quality value group of a service cell and an adjacent cell.
11. The method of claim 8, wherein obtaining measurement report data for cells in the first area comprises:
receiving measurement report data reported by a first terminal, wherein the first terminal comprises: and the first area is a plurality of continuous areas.
12. An apparatus for detecting network anomaly, comprising:
an acquisition module, configured to acquire measurement report data and engineering parameter data of a cell in a first area;
the first construction module is used for constructing a signal intensity information scatter diagram according to the measurement report data and the engineering parameter data;
the second construction module is used for extracting the characteristics of the signal intensity information scatter diagram and constructing a detection characteristic library;
and the detection module is used for detecting network abnormity based on the detection feature library.
13. A network device, comprising: a processor, a memory storing a computer program which, when executed by the processor, performs the method of any of claims 1 to 11.
14. A computer-readable storage medium comprising instructions which, when executed on a computer, cause the computer to perform the method of any one of claims 1 to 11.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011154046.0A CN114501520A (en) | 2020-10-26 | 2020-10-26 | Network anomaly detection method and device and network equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011154046.0A CN114501520A (en) | 2020-10-26 | 2020-10-26 | Network anomaly detection method and device and network equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114501520A true CN114501520A (en) | 2022-05-13 |
Family
ID=81471201
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011154046.0A Pending CN114501520A (en) | 2020-10-26 | 2020-10-26 | Network anomaly detection method and device and network equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114501520A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115412851A (en) * | 2022-08-30 | 2022-11-29 | 中国联合网络通信集团有限公司 | Indoor positioning method, device, server and storage medium |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20160165469A1 (en) * | 2014-12-09 | 2016-06-09 | Futurewei Technologies, Inc. | Method and apparatus for determining cell states to adjust antenna configuration parameters |
| CN106535114A (en) * | 2016-09-29 | 2017-03-22 | 中国普天信息产业北京通信规划设计院 | Method and system for positioning terminal on high-speed railway and the monitoring method and system for high-speed railway network |
| CN108616900A (en) * | 2016-12-12 | 2018-10-02 | 中国移动通信有限公司研究院 | A kind of differentiating method and the network equipment of indoor and outdoor measurement report |
| CN110267209A (en) * | 2019-06-28 | 2019-09-20 | 深圳数位传媒科技有限公司 | A kind of indoor orientation method and device based on WiFi longitude and latitude |
| CN111065046A (en) * | 2019-11-21 | 2020-04-24 | 东南大学 | LoRa-based outdoor unmanned aerial vehicle positioning method and system |
| CN111817868A (en) * | 2019-04-12 | 2020-10-23 | 中国移动通信集团河南有限公司 | Method and device for positioning network quality abnormity |
-
2020
- 2020-10-26 CN CN202011154046.0A patent/CN114501520A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20160165469A1 (en) * | 2014-12-09 | 2016-06-09 | Futurewei Technologies, Inc. | Method and apparatus for determining cell states to adjust antenna configuration parameters |
| CN106535114A (en) * | 2016-09-29 | 2017-03-22 | 中国普天信息产业北京通信规划设计院 | Method and system for positioning terminal on high-speed railway and the monitoring method and system for high-speed railway network |
| CN108616900A (en) * | 2016-12-12 | 2018-10-02 | 中国移动通信有限公司研究院 | A kind of differentiating method and the network equipment of indoor and outdoor measurement report |
| CN111817868A (en) * | 2019-04-12 | 2020-10-23 | 中国移动通信集团河南有限公司 | Method and device for positioning network quality abnormity |
| CN110267209A (en) * | 2019-06-28 | 2019-09-20 | 深圳数位传媒科技有限公司 | A kind of indoor orientation method and device based on WiFi longitude and latitude |
| CN111065046A (en) * | 2019-11-21 | 2020-04-24 | 东南大学 | LoRa-based outdoor unmanned aerial vehicle positioning method and system |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115412851A (en) * | 2022-08-30 | 2022-11-29 | 中国联合网络通信集团有限公司 | Indoor positioning method, device, server and storage medium |
| CN115412851B (en) * | 2022-08-30 | 2024-05-14 | 中国联合网络通信集团有限公司 | Indoor positioning method, device, server and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107948930B (en) | Indoor positioning optimization method based on position fingerprint algorithm | |
| CN111867049B (en) | Positioning method, positioning device and storage medium | |
| CN106646338A (en) | Rapidly accurate indoor location method | |
| CN108375363B (en) | Antenna azimuth deflection checking method, device, equipment and medium | |
| CN103916820A (en) | Wireless indoor locating method based on access point stability degree | |
| CN110995153B (en) | Abnormal data detection method and device for photovoltaic power station and electronic equipment | |
| CN108241853A (en) | A kind of video frequency monitoring method, system and terminal device | |
| CN112911627A (en) | Wireless network performance detection method, device and storage medium | |
| CN111738348B (en) | Power data anomaly detection method and device | |
| CN105335956A (en) | Homologous image verification method and device | |
| CN102129685A (en) | Method for detecting irregular circle based on Gauss pyramid decomposition | |
| CN111475746B (en) | Point-of-interest mining method, device, computer equipment and storage medium | |
| CN113792725A (en) | Component detection device and method | |
| CN109246728B (en) | Method and device for identifying coverage abnormal cell | |
| CN114501520A (en) | Network anomaly detection method and device and network equipment | |
| CN111899279A (en) | Method and device for detecting motion speed of target object | |
| CN114828026A (en) | Base station planning method, device, equipment, storage medium and program product | |
| CN116821777B (en) | Novel basic mapping data integration method and system | |
| CN112818596A (en) | Intelligent interference identification positioning method and system thereof | |
| CN108574927B (en) | Mobile terminal positioning method and device | |
| CN106658533B (en) | Airspace flow characteristic extraction method considering user distribution | |
| CN115979215A (en) | Floor identification method and device and computer readable storage medium | |
| CN114554535B (en) | Method, device, equipment and storage medium for intelligently identifying co-coverage cell pairs | |
| CN110913408B (en) | Indoor weak coverage positioning analysis method and system based on MRO | |
| Zhang et al. | Anomaly detection of target dynamics based on clustering |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |