CN115705282A - Cell network anomaly detection method and device and computer readable storage medium - Google Patents
Cell network anomaly detection method and device and computer readable storage medium Download PDFInfo
- Publication number
- CN115705282A CN115705282A CN202110919607.XA CN202110919607A CN115705282A CN 115705282 A CN115705282 A CN 115705282A CN 202110919607 A CN202110919607 A CN 202110919607A CN 115705282 A CN115705282 A CN 115705282A
- Authority
- CN
- China
- Prior art keywords
- index
- abnormal
- data
- performance index
- index data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 150
- 230000002159 abnormal effect Effects 0.000 claims abstract description 146
- 238000004458 analytical method Methods 0.000 claims abstract description 53
- 238000000034 method Methods 0.000 claims abstract description 44
- 230000005856 abnormality Effects 0.000 claims abstract description 38
- 230000000737 periodic effect Effects 0.000 claims description 14
- 238000001228 spectrum Methods 0.000 claims description 9
- 230000008859 change Effects 0.000 claims description 6
- 238000004590 computer program Methods 0.000 claims description 6
- 238000012935 Averaging Methods 0.000 claims 1
- 238000012549 training Methods 0.000 description 6
- 230000000694 effects Effects 0.000 description 5
- 238000010586 diagram Methods 0.000 description 4
- 238000004364 calculation method Methods 0.000 description 3
- 238000004891 communication Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 238000004422 calculation algorithm Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000006467 substitution reaction Methods 0.000 description 2
- 206010063385 Intellectualisation Diseases 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 238000003066 decision tree Methods 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 230000014759 maintenance of location Effects 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
- 238000000638 solvent extraction Methods 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 230000007723 transport mechanism Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0681—Configuration of triggering conditions
Abstract
The invention provides a cell network anomaly detection method, a cell network anomaly detection device and a computer readable storage medium; the cell network anomaly detection method comprises the following steps: acquiring performance index data of a cell; determining an index attribute of the performance index data, and performing abnormal index analysis on the performance index data through an abnormal detection model corresponding to the index attribute to determine a first abnormal detection result of the performance index data; classifying the performance index data to obtain a plurality of data categories; determining a first abnormal degree value of each data category according to the first abnormal detection result; obtaining a second abnormal detection result of the cell according to the plurality of first abnormal degree values; by adopting an index classification method and a multi-model anomaly detection method, the anomaly detection is more targeted, and the efficiency and the accuracy of the anomaly detection can be improved; and multiple indexes are adopted for carrying out abnormality detection, so that the abnormality detection is more comprehensive.
Description
Technical Field
Embodiments of the present invention relate to, but not limited to, the field of communications technologies, and in particular, to a method and an apparatus for detecting cell network anomaly, and a computer-readable storage medium.
Background
With the deepening of network operation and maintenance, the importance of anomaly detection on a cell network is increasingly improved, but the cell network has the conditions of multiple domains, multiple interfaces and multiple protocols, so that a real-time dynamic network is complex and changeable, and the following problems are caused at the same time: key Performance Indicators (KPI) are numerous, and it is difficult for a person to comprehensively monitor various indicators; for different KPI indexes, if the classification is not accurate, the subsequent abnormal detection is influenced; meanwhile, due to inaccurate KPI index classification, the abnormal detection of the cell network can be performed only according to a small number of indexes, which results in over-detection.
Disclosure of Invention
The following is a summary of the subject matter described in detail herein. This summary is not intended to limit the scope of the claims.
The embodiment of the invention provides a cell network anomaly detection method, a cell network anomaly detection device and a computer readable storage medium.
In a first aspect, an embodiment of the present invention provides a method for detecting an abnormal cell network, where the method includes:
acquiring performance index data of a cell;
determining an index attribute of the performance index data, and performing abnormal index analysis on the performance index data through an abnormal detection model corresponding to the index attribute to determine a first abnormal detection result corresponding to the performance index data;
classifying the performance index data to obtain a plurality of data categories;
determining a first abnormal degree value corresponding to each data category according to the first abnormal detection result;
and obtaining a second abnormal detection result of the cell according to the plurality of first abnormal degree values.
In a second aspect, an embodiment of the present invention further provides a device for detecting a cell network anomaly, including: a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the cell network anomaly detection method as described above when executing the computer program.
In a third aspect, an embodiment of the present invention further provides a computer-readable storage medium, where executable instructions are stored in the computer-readable storage medium, and when executed by a processor, the computer-readable storage medium implements the cell network anomaly detection method as described above.
The embodiment of the invention comprises the following steps: acquiring performance index data of a cell; determining an index attribute of the performance index data, and performing anomaly index analysis on the performance index data through an anomaly detection model corresponding to the index attribute to determine a first anomaly detection result corresponding to the performance index data; classifying the performance index data to obtain a plurality of data categories; determining a first abnormal degree value corresponding to each data category according to the first abnormal detection result; obtaining a second abnormal detection result of the cell according to the plurality of first abnormal degree values; by adopting an index classification method and a multi-model anomaly detection method, the anomaly detection is more targeted, and the efficiency and the accuracy of the anomaly detection can be improved; and multiple indexes are adopted for carrying out abnormality detection, so that the abnormality detection is more comprehensive.
Additional features and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by the practice of the invention. The objectives and other advantages of the invention will be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.
Drawings
The accompanying drawings are included to provide a further understanding of the present invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the example serve to explain the principles of the invention and do not constitute a limitation thereof.
Fig. 1 is a flowchart of a method for detecting an abnormality in a cell network according to an embodiment of the present invention;
FIG. 2 is a flowchart of the determine an indicator attribute step of the performance indicator data;
fig. 3 is a block diagram of an apparatus for detecting cell network abnormality according to an embodiment of the present invention;
fig. 4 is another structural diagram of a cell network abnormality detection apparatus according to an embodiment of the present invention;
fig. 5 is a block diagram of an apparatus for detecting an abnormality in a cellular network according to another embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
It should be noted that although functional blocks are partitioned in a schematic diagram of an apparatus and a logical order is shown in a flowchart, in some cases, the steps shown or described may be performed in a different order than the partitioning of blocks in the apparatus or the order in the flowchart. The terms first, second and the like in the description and in the claims, and the drawings described above, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. In the description of the present invention, the meaning of a plurality of means is one or more, the meaning of a plurality of means is two or more, and larger, smaller, larger, etc. are understood as excluding the number, and larger, smaller, inner, etc. are understood as including the number.
The embodiment of the invention comprises the following steps: acquiring performance index data of a cell; determining an index attribute of the performance index data, and performing abnormal index analysis on the performance index data through an abnormal detection model corresponding to the index attribute to determine a first abnormal detection result corresponding to the performance index data; classifying the performance index data to obtain a plurality of data categories; determining a first abnormal degree value corresponding to each data category according to the first abnormal detection result; obtaining a second abnormal detection result of the cell according to the plurality of first abnormal degree values; by adopting an index classification method and a multi-model anomaly detection method, the anomaly detection is more targeted, and the efficiency and the accuracy of the anomaly detection can be improved; and multiple indexes are adopted for carrying out abnormality detection, so that the abnormality detection is more comprehensive.
Referring to fig. 1, an embodiment of a first aspect of the present invention provides a cell network anomaly detection method.
The cell network anomaly detection method comprises the following steps:
and S100, acquiring performance index data of the cell.
For step S100, the performance index data of the cell is obtained in real time from the network manager of the operator. Specifically, the performance indicator data is a KPI time series.
Step S200, determining an index attribute of the performance index data, and performing abnormal index analysis on the performance index data through an abnormal detection model corresponding to the index attribute to determine a first abnormal detection result corresponding to the performance index data.
Referring to fig. 2, the index attribute of the deterministic performance index data in step S200 specifically includes step S211, step S212, and step S213. The index attributes of the KPI time series mainly comprise a non-volatility index, a non-periodicity index, a periodicity index and a trend index.
Step S211, performing mobility analysis on the performance index data to determine an index attribute corresponding to the performance index data as a non-volatility index or a volatility index.
For step S211, in particular, a first mean value μ of the KPI time series is calculated 1 And first square difference sigma 1 (ii) a According to the first mean value mu 1 And the first square difference σ 1 And carrying out mobility analysis on the performance index data. The volatility was analyzed as follows: when the first mean value mu 1 And first square difference sigma 1 Satisfy sigma 1 <λμ 1 Or σ 1 <10 -5 Determining the index attribute corresponding to the performance index data as a non-fluctuating index; otherwise, determining the index attribute corresponding to the performance index data as a volatility index. Where λ is a hyperparameter, typically set to 0.05. The value of lambda can be specifically adjusted according to actual conditions.
Step S212, periodically analyzing the performance index data with the index attribute being a volatility index, so as to change the index attribute corresponding to the performance index data into a periodic index or an aperiodic index.
For step S212, specifically, for a KPI time series whose indicator attribute is a volatility indicator, a periodicity analysis parameter of the KPI time series is calculated, where the periodicity analysis parameter includes an autocorrelation coefficient, an amplitude spectrum, and an amplitude spectrum maximum value max Second mean value mu 2 The second variance σ 2 Maximum peak value peak of main peak of sum amplitude spectrum max . When the volatility index data meets a first discriminant constructed based on the periodicity analysis parameters, the index attribute is changed into a periodicity index, and specifically, the first discriminant is value max >(μ 2 +3σ 2 )&peak max >λ*2*(μ 2 +σ 2 ) And the lambda is a hyper-parameter, and the numerical value of the lambda can be finely adjusted according to the actual situation. And when the volatility index data does not meet the first discriminant, or the autocorrelation coefficient is smaller than a first discriminant threshold, or the amplitude spectrum has no peak, the index attribute is changed into an aperiodic index. The first determination threshold is set based on the history data.
The magnitude spectrum is obtained by performing Fourier transform on a KPI time sequence, moving a zero-frequency component to the center of a frequency spectrum and then calculating.
Step S213, trend analysis is performed on the performance index data with the index attribute being a periodic index, so as to change the index attribute corresponding to the performance index data into a non-trend index or a trend index.
For step S213, specifically, for the KPI time series with the periodic index as the index attribute, the period of the KPI time series is calculated, and the KPI time series S1 in each period is averaged to obtain a first analysis time series; for example, if the period of the KPI time series S1 is 24 hours, i.e. 24 hours of granularity points, the KPI time series S1 of 24 hours are averaged to obtain a new first analysis time series S2. For the first analysis time sequence S2, the numerical values corresponding to two adjacent points are subjected to difference calculation to obtain a second analysis time sequence S3; and (3) calculating the difference of the numerical values corresponding to the two adjacent points, namely subtracting the point at the previous moment from the point at the next moment. Calculating a trend analysis parameter of the second analysis time series S3, wherein the trend analysis parameter comprises a first maximum value max First minimum value min Third mean value mu 3 And third party difference σ 3 . When the second analysis time sequence S3 meets a second judgment formula constructed based on trend analysis parameters, the index attribute of the KPI time sequence S1 is changed into a trend index; when it comes toThe analysis time sequence does not satisfy a second judgment formula constructed based on trend analysis parameters, and the index attribute of the KPI time sequence S1 is changed into a non-trend index; specifically, the second criterion is value max <λ 1 μ&value min >λ 2 μ&σ<λ 3 Mu; wherein λ is 1 、λ 2 、λ 3 Is a hyperparameter, λ 1 Is set to 1.2, lambda 2 Is set to 0.8, lambda 3 Set to 0.1. Lambda [ alpha ] 1 、λ 2 、λ 3 The numerical value of (2) can be finely adjusted according to the actual situation.
Note that there is only one case of the indicator attribute of the KPI time series, that is, the indicator attribute of the KPI time series is any one of a non-volatility indicator, a non-periodicity indicator, a periodicity indicator, and a trend indicator.
The method specifically includes, for the step S200, performing anomaly index analysis on the performance index data through the anomaly detection model corresponding to the index attribute, and determining a first anomaly detection result corresponding to the performance index data, and includes the steps S221, S222, S223, and S224. Different anomaly detection models are respectively adopted for analyzing the anomaly indexes aiming at the performance index data with different index attributes, so that the method is more pertinent, and the accuracy rate of anomaly detection can be effectively improved
Step S221, when the index attribute of the performance index data is a non-fluctuating index, performing abnormal index analysis by using the following method. The method has the advantages of high detection efficiency and dynamic threshold value.
Calculating a second maximum value MAX, a second minimum value MIN, a first quartile Q1, a median MID and a third quartile Q3 of the performance index data; when the first quartile Q1, the median MID and the third quartile Q3 have values smaller than a second minimum value MIN or larger than a second maximum value MAX, a first abnormal detection result is expressed as abnormal performance index data; when the first quartile Q1, the median MID and the third quartile Q3 are all values which are greater than or equal to the second minimum MIN and less than or equal to the second maximum MAX, the first abnormal detection result indicates that the performance index data are normal.
Of course, in other embodiments, other methods commonly used for non-fluctuating index anomaly detection may be used, such as boxplot. Finally, one of the methods with the optimal detection effect of the non-fluctuating index is adopted.
Step S222, when the index attribute of the performance index data is an aperiodic index, performing abnormal index analysis by the following method.
Clustering the performance index data according to a preset class number; judging the abnormality of the cluster obtained class; when at least one type of abnormal in the clustered classes is obtained, a first abnormal detection result is expressed as abnormal performance index data; and when the clustered class has no abnormal class, the first abnormal detection result shows that the performance index data is normal.
Of course, in other embodiments, other methods commonly used for aperiodic index anomaly detection, such as isolated forest algorithm, may be used. And finally, adopting one of the multiple methods with the optimal aperiodic index detection effect.
In step S223, when the index attribute of the performance index data is a periodic index, the following method is used to analyze the abnormal index.
Performing numerical prediction on the performance index data according to a periodic rule to obtain a first predicted value; comparing the first predicted value with the corresponding first real value to obtain a first error between the first predicted value and the first real value; when the first error is smaller than a first error threshold value, the first abnormal detection result is represented as abnormal performance index data; when the first error is greater than or equal to the first error threshold, the first abnormal detection result indicates that the performance index data is normal.
For example, the first n seconds of data in the performance index data are subjected to numerical prediction according to the period rule to obtain a first predicted value of the (n + 1) th second, and the corresponding first true value is the value of the (n + 1) th second in the performance index data.
Wherein the first error threshold is set based on historical data.
Of course, in other embodiments, other methods commonly used for aperiodic index anomaly detection, such as decision tree algorithm, may be used. And finally, one of the methods with the optimal periodic index detection effect is adopted.
In step S224, when the index attribute of the performance index data is a trend index, the following method is used to analyze the abnormal index.
Performing local regression fitting on the performance index data to obtain a second predicted value; comparing the second predicted value with a corresponding second real value to obtain a second error between the second predicted value and the second real value; when the second error is smaller than a second error threshold value, the first abnormal detection result is represented as abnormal performance index data; when the second error is greater than or equal to the second error threshold, the first abnormal detection result indicates that the performance index data is normal.
For example, local regression fitting is performed on the previous n seconds of data in the performance index data to obtain a second predicted value of the (n + 1) th second, and then the corresponding second true value is the value of the (n + 1) th second in the performance index data.
Wherein the second error threshold is set based on historical data.
Of course, in other embodiments, other methods commonly used for trend index anomaly detection may be used. And finally, one of the methods with the optimal periodic index detection effect is adopted.
It should be noted that, the multiple anomaly detection models in step S200 are subjected to offline training, and each anomaly detection model is subjected to offline training until convergence by using the historical KPI time-series data, so that the trained models are stored persistently, and are convenient to call during online reasoning. Secondly, performing online reasoning on real-time KPI time sequence data by utilizing a plurality of trained abnormal detection models, and analyzing abnormal indexes; the time consumption of model reasoning is reduced so as to meet the application of a large-scale network.
In step S200, the method further includes the steps of:
when the first abnormal detection result shows that the performance index data is abnormal, determining a second abnormal degree value corresponding to the performance index data
The second abnormal degree value is used forIndicating the degree of abnormality of the performance index data.
For the second degree of abnormality value
For example, the index attribute of the performance index data is a trend index, when abnormal index analysis is performed, a second error is obtained, when the second error is smaller than a second error threshold value, and the first abnormal detection result indicates that the performance index data is abnormal, a ratio of the second error to a real value is calculated, and the abnormal degree of the performance index data is reflected by the ratio of the second error to the real value, so that a second abnormal degree value is obtained
In addition, the first abnormality detection result obtained in step S200 may be stored in a library to obtain an index abnormality detection table as shown in table 1.
TABLE 1 index abnormality detection table
| time | enodeb_id | cell_id | kpi_name | kpi_value | check_result |
| 2021/5/19 3:00 | 11579393 | 111 | dl_rlc_sdu_avg_delay | 4.997 | 0 |
| 2021/5/19 3:00 | 11579393 | 111 | ul_rlc_sdu_avg_delay | 2.5 | 0 |
| 2021/5/19 3:00 | 11579393 | 111 | ul_pdcp_sdu_loss_rate | 0.002 | 0 |
| 2021/5/19 3:00 | 11579393 | 111 | sn_avg_delay | 93 | 1 |
| 2021/5/19 3:00 | 11579393 | 111 | sn_abnormal_release_rate | 0 | 0 |
| 2021/5/19 3:00 | 11579393 | 111 | wireless_drop_rate | 0 | 0 |
| 2021/5/19 3:00 | 11579393 | 111 | dl_prb_usage | 0 | -1 |
In table 1, the time field indicates the start time node of the current hour granularity data. The enodeb _ ID is a base station ID, the cell _ ID is a cell ID, and the enodeb _ ID and the cell _ ID jointly form a unique identifier of the cell. KPI _ name is the KPI time series name. KPI _ value is the actual value of the cell current time granularity KPI time series. check _ result is a first anomaly detection result of the KPI time sequence, wherein 0 represents normal, -1 represents lower limit anomaly, 1 represents upper limit anomaly, and 2 represents null anomaly.
It should be noted that the data in table 1 are only used as specific examples for reference.
Step S300, classifying the performance index data to obtain a plurality of data categories.
For step S300, specifically, the performance index data is divided into a plurality of data categories from the service level, the data categories include a first data category SC1 related to coverage, a second data category SC2 related to handover, a third data category SC3 related to retention, a fourth data category SC4 related to capacity, a fifth data category SC5 related to interference, and a sixth data category SC6 related to integrity.
Step S400, determining a first anomaly degree value corresponding to each data category according to the first anomaly detection result.
For step S400, for each data category, calculating a total number of performance index data, an abnormal number, and an abnormal proportion, where the abnormal number is the number of abnormal performance index data, and the abnormal proportion is a ratio of the abnormal number to the total number; and obtaining a first abnormal degree value according to the abnormal proportion and the second abnormal degree value.
The first abnormal degree value is specifically calculated by the following equation:
in the formula, λ 4 A weight coefficient being a ratio of abnormality indexes, n being the number of abnormalities of performance index data in the data class, m being the total number of performance index data in the data class,
to an abnormal ratio, λ i For each second anomaly value
Corresponding proportionality coefficient, λ i Setting is performed according to the historical data.
And step S500, obtaining a second abnormal detection result of the cell according to the plurality of first abnormal degree values.
For step S500, comparing the first abnormal degree value with a preset abnormal threshold value for each data category to obtain a third abnormal detection result indicating whether the data category is abnormal; when the third abnormal detection result corresponding to at least one data type is abnormal, the second abnormal detection result of the cell is abnormal; and when the third abnormal detection result corresponding to each data type is normal, the second abnormal detection result of the cell is normal.
Wherein, the abnormal threshold is set according to the actual service condition.
In addition, summing the first abnormal degree values of all the data types to obtain the total abnormal degree of the cell; and sorting the total abnormal degrees of the plurality of cells according to a descending order, selecting the cell corresponding to the total abnormal degree with the ranking before the preset selection quantity value as a target abnormal cell, or sorting the total abnormal degrees of the plurality of cells according to a descending order, and selecting the cell corresponding to the total abnormal degree with the ranking after the preset selection quantity value as a target abnormal cell. For example, the first 10 with the largest total abnormality degree are selected as the target abnormal cells. By the method, the target abnormal cell can be determined quickly and accurately.
In addition, the target abnormal cell and the related data detected in step S500 may be stored in a library to obtain a target abnormal cell condition table as shown in table 2.
Table 2 target abnormal cell situation table
| time | enodeb_id | cell_id | anomaly_score |
| 2021/5/19 3:00 | 11581671 | 112 | 4.22 |
| 2021/5/19 3:00 | 11580178 | 413 | 4.19 |
| 2021/5/19 3:00 | 11580178 | 412 | 4.08 |
| 2021/5/19 3:00 | 11580054 | 213 | 3.97 |
| 2021/5/19 3:00 | 11580053 | 211 | 3.86 |
| 2021/5/19 3:00 | 11582170 | 113 | 3.85 |
| 2021/5/19 3:00 | 11579551 | 112 | 3.82 |
| 2021/5/19 3:00 | 11579631 | 212 | 3.77 |
| 2021/5/19 3:00 | 11582166 | 112 | 3.73 |
| 2021/5/19 3:00 | 11582161 | 112 | 3.68 |
In Table 2, the time field represents the start time node for the current hour granularity data. The enodeb _ ID is a base station ID, the cell _ ID is a cell ID, and the enodeb _ ID and the cell _ ID jointly form a unique identifier of the cell. and the anomaly _ score is the first anomaly degree value.
It should be noted that the data in table 2 are only used as specific examples for reference.
Finally, the first anomaly detection result obtained in step S200 and the second anomaly detection result of the cell obtained in step S500 are encapsulated, and a Representational State Transfer (REST) interface is provided for external invocation. A push module is deployed on a server with an internal and external network environment, an REST interface is called through an internal network, data are obtained, and then the data are pushed to external equipment such as a mobile phone, a personal computer or a tablet personal computer through an external network, so that a user can conveniently check the data.
The cell network anomaly detection method adopts an index classification method and a multi-model anomaly detection method, so that anomaly detection is more targeted, the accuracy of anomaly detection can be improved, and the cell network anomaly detection method has the advantages of automation, intellectualization and instantaneity.
Referring to fig. 3, an embodiment of the present invention further provides a cell network abnormality detection apparatus, which includes a data acquisition unit 100, a first abnormality detection unit 200, a data classification unit 300, an abnormality degree calculation unit 400, and a second abnormality detection unit 500.
The data acquiring unit 100 is configured to acquire performance index data of a cell; the first anomaly detection unit 200 is configured to determine an index attribute of the performance index data, perform anomaly index analysis on the performance index data through an anomaly detection model corresponding to the index attribute, and determine a first anomaly detection result corresponding to the performance index data; the data classifying unit 300 is configured to classify the performance index data to obtain a plurality of data categories; the abnormality degree calculation unit 400 is configured to determine a first abnormality degree value corresponding to each data category according to the first abnormality detection result; the second anomaly detection unit 500 is configured to obtain a second anomaly detection result of the cell according to the plurality of first anomaly degree values.
Referring to fig. 4, the first anomaly detection unit 200 includes an offline training unit 210 and an online inference unit 220, where the offline training unit 210 performs offline training on each anomaly detection model by using historical KPI time-series data until convergence, and persistently stores the trained model, so as to facilitate calling of the online inference unit 220 during online inference. The online reasoning unit 220 performs online reasoning on the real-time KPI time series data by using a plurality of anomaly detection models trained and completed by the offline training unit 210, and performs anomaly index analysis; and the time consumption of model reasoning is reduced so as to meet the application of a large-scale network.
In addition, the cell network anomaly detection device further comprises a pushing unit 600, wherein the pushing unit is used for calling an REST interface through an internal network, obtaining a first encapsulated anomaly detection result and a second encapsulated anomaly detection result, and then pushing the first encapsulated anomaly detection result and the second encapsulated anomaly detection result to external equipment such as a mobile phone, a personal computer or a tablet personal computer through an external network, so that a user can conveniently check data.
It should be noted that, in this embodiment, each unit of the multi-user device pairing apparatus corresponds to each step of the multi-user device pairing method one to one, and the same technical means is adopted, so that the same technical effect is achieved, and detailed description is omitted here.
It will be appreciated by those skilled in the art that the functions performed by each unit of the apparatus for pairing multiple user devices may be understood by reference to the foregoing description of the method for pairing multiple user devices. The functions of the units in the multi-user device pairing apparatus can be realized by a program running on a processor, and can also be realized by specific logic circuits, such as a programmable logic array (FPGA).
Referring to fig. 5, another embodiment of the present invention further provides a cell network abnormality detection apparatus, including: a memory 20, a processor 10 and a computer program stored on the memory 20 and executable on the processor 10, the processor 10 when executing the computer program implementing the cell network anomaly detection method as described above.
The processor 10 and memory 20 may be connected by a bus 30 or otherwise.
The memory 20, which is a non-transitory computer readable storage medium, may be used to store non-transitory software programs as well as non-transitory computer executable programs. Further, the memory 20 may include high speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid state storage device. In some embodiments, the memory 20 optionally includes memory 20 located remotely from the processor, which may be connected to the processor 10 via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
The non-transitory software programs and instructions required to implement the cell network anomaly detection method of the above-described embodiment are stored in the memory 20, and when executed by the processor 10, perform the cell network anomaly detection method of the above-described embodiment, for example, perform the above-described steps S100 to S500.
The above described node embodiments are merely illustrative, wherein the units illustrated as separate components may or may not be physically separate, i.e. may be located in one place, or may also be distributed over a plurality of network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
Furthermore, an embodiment of the present invention also provides a computer-readable storage medium, which stores computer-executable instructions, which are executed by a processor or a controller, for example, by a processor, and can cause the processor to execute the cell network anomaly detection method in the above embodiment, for example, execute the above-described steps S100 to S500.
One of ordinary skill in the art will appreciate that all or some of the steps, systems, and methods disclosed above may be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on computer readable media, which may include computer readable storage media (or non-transitory media) and communication media (or transitory media). The term computer readable storage medium includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data, as is known to one of ordinary skill in the art. Computer-readable storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital Versatile Disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer. In addition, communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media as known to those skilled in the art.
While the preferred embodiments of the present invention have been described, the present invention is not limited to the above embodiments, and those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention, and such equivalent modifications or substitutions are to be included within the scope of the present invention defined by the appended claims.
Claims (16)
1. A method of cell network anomaly detection, the method comprising:
acquiring performance index data of a cell;
determining an index attribute of the performance index data, and performing abnormal index analysis on the performance index data through an abnormal detection model corresponding to the index attribute to determine a first abnormal detection result corresponding to the performance index data;
classifying the performance index data to obtain a plurality of data categories;
determining a first abnormal degree value corresponding to each data type according to the first abnormal detection result;
and obtaining a second abnormal detection result of the cell according to the plurality of first abnormal degree values.
2. The method of detecting cell network anomaly according to claim 1, wherein said determining an indicator property of said performance indicator data comprises:
and performing mobility analysis on the performance index data to determine an index attribute corresponding to the performance index data as a non-volatility index or a volatility index.
3. The method of detecting cell network anomaly according to claim 2, wherein said determining an indicator property of said performance indicator data further comprises:
and periodically analyzing the performance index data with the index attribute as a volatility index so as to change the index attribute corresponding to the performance index data into a periodic index or an aperiodic index.
4. The method of claim 3, wherein the determining an indicator attribute of the performance indicator data further comprises:
and performing trend analysis on the performance index data of which the index attribute is a periodic index so as to change the index attribute corresponding to the performance index data into a non-trend index or a trend index.
5. The method according to claim 2, wherein the performing mobility analysis on the performance index data to determine an index attribute corresponding to the performance index data as a non-mobility index or a mobility index includes:
calculating a first mean and a first variance of the performance indicator data;
and performing mobility analysis on the performance index data according to the first mean value and the first variance so as to determine an index attribute corresponding to the performance index data as a non-volatility index or a volatility index.
6. The method according to claim 3, wherein the periodically analyzing the performance index data with the index attribute being a volatility index to change the index attribute corresponding to the performance index data to a periodic index or an aperiodic index comprises:
when the index attribute of the performance index data is a volatility index, calculating a periodicity analysis parameter of the performance index data, wherein the periodicity analysis parameter comprises an autocorrelation coefficient, a magnitude spectrum maximum value, a second mean value, a second variance and a maximum wave peak value of a magnitude spectrum main wave peak;
when the volatility index data meets a first discriminant constructed based on the periodicity analysis parameters, changing the index attribute into a periodicity index;
and when the fluctuation index data does not meet the first discriminant, the autocorrelation coefficient is smaller than a first discriminant threshold value or the amplitude spectrum has no peak, changing the index attribute into an aperiodic index.
7. The method according to claim 4, wherein the performing trend analysis on the performance index data with the index attribute being a periodic index to change the index attribute corresponding to the performance index data to a non-trend index or a trend index includes:
when the index attribute of the performance index data is a periodic index, calculating the period of the performance index data, and averaging the performance index data in each period to obtain a first analysis time sequence;
for the first analysis time sequence, calculating the difference of numerical values corresponding to two adjacent points to obtain a second analysis time sequence;
calculating trend analysis parameters of the second analysis time series, wherein the trend analysis parameters comprise a first maximum value, a first minimum value, a third mean value and a third variance;
when the second analysis time series meets a second judgment formula constructed based on the trend analysis parameters, the index attribute of the performance index data corresponding to the second analysis time series is changed into a trend index;
and when the second analysis time series does not meet a second judgment formula constructed based on the trend analysis parameters, the index attribute of the performance index data corresponding to the second analysis time series is changed into a non-trend index.
8. The method for detecting the cell network abnormality according to claim 2 or 5, wherein the determining a first abnormality detection result corresponding to the performance index data by performing abnormality index analysis on the performance index data by using an abnormality detection model corresponding to the index attribute includes:
when the index attribute of the performance index data is a non-volatility index, calculating a second maximum value, a second minimum value, a first quartile, a median and a third quartile of the performance index data;
when a numerical value smaller than the second minimum value or larger than the second maximum value exists in the first quartile, the median and the third quartile, the first abnormality detection result is represented as the performance index data abnormality;
and when the first quartile, the median and the third quartile are all values which are greater than or equal to the second minimum value and less than or equal to the second maximum value, the first abnormal detection result indicates that the performance index data are normal.
9. The method according to claim 3 or 6, wherein the determining a first abnormal detection result corresponding to the performance index data by performing abnormal index analysis on the performance index data through an abnormal detection model corresponding to the index attribute comprises:
when the index attribute of the performance index data is an aperiodic index, clustering the performance index data according to a preset class number;
judging the abnormality of the cluster obtained class;
when at least one type of abnormal in the clustered classes is obtained, the first abnormal detection result is expressed as the abnormal performance index data;
and when no abnormal class exists in the clustered classes, the first abnormal detection result indicates that the performance index data is normal.
10. The method according to claim 3 or 6, wherein the determining a first abnormal detection result corresponding to the performance index data by performing abnormal index analysis on the performance index data through an abnormal detection model corresponding to the index attribute comprises:
when the index attribute of the performance index data is a periodic index, performing numerical prediction on the performance index data according to a periodic rule to obtain a first predicted value;
comparing the first predicted value with a corresponding first real value to obtain a first error between the first predicted value and the first real value;
when the first error is smaller than a first error threshold value, the first abnormal detection result represents that the performance index data is abnormal;
when the first error is greater than or equal to a first error threshold, the first abnormal detection result indicates that the performance index data is normal.
11. The method according to claim 4 or 7, wherein the determining a first abnormal detection result corresponding to the performance index data by performing abnormal index analysis on the performance index data through an abnormal detection model corresponding to the index attribute comprises:
when the index attribute of the performance index data is a trend index, performing local regression fitting on the performance index data to obtain a second predicted value;
comparing the second predicted value with a corresponding second real value to obtain a second error between the second predicted value and the second real value;
when the second error is smaller than a second error threshold, the first abnormal detection result is represented as the abnormal performance index data;
and when the second error is greater than or equal to a second error threshold, the first abnormal detection result indicates that the performance index data is normal.
12. The method of claim 1, wherein the performing an anomaly detection model corresponding to the indicator attribute on the performance indicator data to determine a first anomaly detection result corresponding to the performance indicator data further comprises: when the first abnormality detection result shows that the performance index data is abnormal, determining a second abnormality degree value corresponding to the performance index data, wherein the second abnormality degree value is used for showing the abnormality degree of the performance index data;
the determining a first anomaly degree value corresponding to each data category according to the first anomaly detection result includes: for each of the data categories, calculating a total number of the performance indicator data, an anomaly number and an anomaly proportion, wherein the anomaly number is the number of the abnormal performance indicator data, and the anomaly proportion is the ratio of the anomaly number to the total number; and obtaining the first abnormal degree value according to the abnormal proportion and the second abnormal degree value.
13. The method of claim 1, wherein the obtaining the second anomaly detection result of the cell according to the plurality of first anomaly degree values comprises:
for each data category, comparing the first abnormal degree value with a preset abnormal threshold value to obtain a third abnormal detection result for indicating whether the data category is abnormal or not;
when the third abnormal detection result corresponding to at least one data type is abnormal, the second abnormal detection result of the cell is abnormal;
and when the third abnormal detection result corresponding to each data type is normal, the second abnormal detection result of the cell is normal.
14. The method of claim 1, further comprising, after the step of obtaining a second anomaly detection result for the cell according to the plurality of first anomaly degree values:
summing the first anomaly degree values of all the data types to obtain the total anomaly degree of the cell;
sorting the total abnormal degrees of the cells according to a descending order, selecting the cell corresponding to the total abnormal degree with the ranking before a preset selection quantity value as a target abnormal cell, or sorting the total abnormal degrees of the cells according to a descending order, and selecting the cell corresponding to the total abnormal degree with the ranking after the preset selection quantity value as a target abnormal cell.
15. A cell network anomaly detection apparatus, comprising: memory, processor and computer program stored on the memory and executable on the processor, characterized in that the processor implements the cell network anomaly detection method according to any one of claims 1 to 14 when executing the computer program.
16. A computer readable storage medium having stored therein executable instructions which, when executed by a processor, implement a cell network anomaly detection method according to any one of claims 1 to 14.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110919607.XA CN115705282A (en) | 2021-08-11 | 2021-08-11 | Cell network anomaly detection method and device and computer readable storage medium |
| PCT/CN2022/110684 WO2023016380A1 (en) | 2021-08-11 | 2022-08-05 | Cell network anomaly detection method and apparatus, and computer-readable storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110919607.XA CN115705282A (en) | 2021-08-11 | 2021-08-11 | Cell network anomaly detection method and device and computer readable storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115705282A true CN115705282A (en) | 2023-02-17 |
Family
ID=85180090
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110919607.XA Pending CN115705282A (en) | 2021-08-11 | 2021-08-11 | Cell network anomaly detection method and device and computer readable storage medium |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN115705282A (en) |
| WO (1) | WO2023016380A1 (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116074876B (en) * | 2023-03-07 | 2023-06-20 | 南京邮电大学 | Communication base station abnormality detection method based on wavelet transformation |
| CN116578911A (en) * | 2023-07-13 | 2023-08-11 | 亚信科技（中国）有限公司 | Data processing method, device, electronic equipment and computer storage medium |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105471663A (en) * | 2014-08-18 | 2016-04-06 | 中兴通讯股份有限公司 | Abnormal network detection method, abnormal network detection device, communication network detection device and communication network detection system |
| US20190272470A1 (en) * | 2018-03-05 | 2019-09-05 | Microsoft Technology Licensing, Llc | Rule-Based Classification for Detected Anomalies |
| JP6977650B2 (en) * | 2018-03-30 | 2021-12-08 | 富士通株式会社 | Anomaly detection method, anomaly detection program, and anomaly detection device |
| CN112183758A (en) * | 2019-07-04 | 2021-01-05 | 华为技术有限公司 | Method and device for realizing model training and computer storage medium |
| CN112994960B (en) * | 2019-12-02 | 2022-09-16 | 中国移动通信集团浙江有限公司 | Method and device for detecting business data abnormity and computing equipment |
-
2021
- 2021-08-11 CN CN202110919607.XA patent/CN115705282A/en active Pending
-
2022
- 2022-08-05 WO PCT/CN2022/110684 patent/WO2023016380A1/en unknown
Also Published As
| Publication number | Publication date |
|---|---|
| WO2023016380A1 (en) | 2023-02-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US20090125916A1 (en) | Event-processing operators | |
| CN111867049B (en) | Positioning method, positioning device and storage medium | |
| CN109842513A (en) | Network exception event analytical equipment, method and its computer storage medium | |
| CN115705282A (en) | Cell network anomaly detection method and device and computer readable storage medium | |
| CN111796957B (en) | Transaction abnormal root cause analysis method and system based on application log | |
| CN110457175B (en) | Service data processing method and device, electronic equipment and medium | |
| EP4120653A1 (en) | Communication network performance and fault analysis using learning models with model interpretation | |
| CN113837596B (en) | Fault determination method and device, electronic equipment and storage medium | |
| Barreto et al. | Condition monitoring of 3G cellular networks through competitive neural models | |
| CN111314113B (en) | Internet of things node fault detection method and device, storage medium and computer equipment | |
| CN113918433A (en) | Adaptive intelligent network equipment performance index abnormity detection device and method | |
| CN104821854B (en) | A kind of many primary user's multidimensional frequency spectrum sensing methods based on random set | |
| CN116862081B (en) | Operation and maintenance method and system for pollution treatment equipment | |
| US10917836B2 (en) | Small cell identification using machine learning | |
| CN116739742A (en) | Monitoring method, device, equipment and storage medium of credit wind control model | |
| CN116319255A (en) | Root cause positioning method, device, equipment and storage medium based on KPI | |
| CN113936157A (en) | Abnormal information processing method and device, storage medium and electronic device | |
| CN109993556B (en) | User behavior analysis method and device, computing equipment and storage medium | |
| CN105188080B (en) | Cell outage detection method in mobile communications network based on direct-push confidence machine and hypothesis testing | |
| CN112884167B (en) | Multi-index anomaly detection method based on machine learning and application system thereof | |
| CN116541252B (en) | Computer room fault log data processing method and device | |
| CN112153685B (en) | RRC fault detection method and device | |
| CN116860562B (en) | Method and system for monitoring data quality of data center | |
| CN111507639B (en) | Financing risk analysis method and device | |
| CN115483992A (en) | Interference identification method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination |