CN115859188A - Service abnormity prediction method and device, storage medium and electronic device - Google Patents
Service abnormity prediction method and device, storage medium and electronic device Download PDFInfo
- Publication number
- CN115859188A CN115859188A CN202111124591.XA CN202111124591A CN115859188A CN 115859188 A CN115859188 A CN 115859188A CN 202111124591 A CN202111124591 A CN 202111124591A CN 115859188 A CN115859188 A CN 115859188A
- Authority
- CN
- China
- Prior art keywords
- data
- time
- service data
- real
- historical
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 40
- 238000003860 storage Methods 0.000 title claims abstract description 10
- 230000002776 aggregation Effects 0.000 claims abstract description 48
- 238000004220 aggregation Methods 0.000 claims abstract description 48
- 238000003062 neural network model Methods 0.000 claims abstract description 32
- 238000007637 random forest analysis Methods 0.000 claims abstract description 31
- 238000012545 processing Methods 0.000 claims abstract description 17
- 230000002159 abnormal effect Effects 0.000 claims abstract description 16
- 238000001514 detection method Methods 0.000 claims abstract description 14
- 238000012549 training Methods 0.000 claims description 20
- 238000004590 computer program Methods 0.000 claims description 16
- 239000011159 matrix material Substances 0.000 claims description 15
- 230000006399 behavior Effects 0.000 claims description 12
- 238000010606 normalization Methods 0.000 claims description 5
- 208000018910 keratinopathic ichthyosis Diseases 0.000 claims 2
- 238000012423 maintenance Methods 0.000 abstract description 17
- 230000005856 abnormality Effects 0.000 abstract description 11
- 238000005516 engineering process Methods 0.000 abstract description 5
- 238000004140 cleaning Methods 0.000 description 10
- 238000010586 diagram Methods 0.000 description 10
- 238000000605 extraction Methods 0.000 description 7
- 230000006870 function Effects 0.000 description 7
- 239000000523 sample Substances 0.000 description 7
- 230000005540 biological transmission Effects 0.000 description 6
- 230000011664 signaling Effects 0.000 description 6
- 238000004891 communication Methods 0.000 description 4
- 238000002372 labelling Methods 0.000 description 4
- 230000006855 networking Effects 0.000 description 4
- 238000006243 chemical reaction Methods 0.000 description 2
- 238000010295 mobile communication Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 241000760358 Enodes Species 0.000 description 1
- 206010033799 Paralysis Diseases 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 238000013528 artificial neural network Methods 0.000 description 1
- 238000004422 calculation algorithm Methods 0.000 description 1
- 230000015556 catabolic process Effects 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 238000006731 degradation reaction Methods 0.000 description 1
- 238000003745 diagnosis Methods 0.000 description 1
- 238000013399 early diagnosis Methods 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 239000000284 extract Substances 0.000 description 1
- GVVPGTZRZFNKDS-JXMROGBWSA-N geranyl diphosphate Chemical compound CC(C)=CCC\C(C)=C\CO[P@](O)(=O)OP(O)(O)=O GVVPGTZRZFNKDS-JXMROGBWSA-N 0.000 description 1
- PCHJSUWPFVWCPO-UHFFFAOYSA-N gold Chemical compound [Au] PCHJSUWPFVWCPO-UHFFFAOYSA-N 0.000 description 1
- 239000010931 gold Substances 0.000 description 1
- 229910052737 gold Inorganic materials 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000007689 inspection Methods 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 238000013507 mapping Methods 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 230000000737 periodic effect Effects 0.000 description 1
- 230000000306 recurrent effect Effects 0.000 description 1
- 238000013519 translation Methods 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
- 238000013024 troubleshooting Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/243—Classification techniques relating to the number of classes
- G06F18/2431—Multiple classes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/04—Forecasting or optimisation specially adapted for administrative or management purposes, e.g. linear programming or "cutting stock problem"
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0639—Performance analysis of employees; Performance analysis of enterprise or organisation operations
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
- G06Q50/40—Business processes related to the transportation industry
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Human Resources & Organizations (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Strategic Management (AREA)
- Economics (AREA)
- General Physics & Mathematics (AREA)
- Entrepreneurship & Innovation (AREA)
- Marketing (AREA)
- Data Mining & Analysis (AREA)
- General Business, Economics & Management (AREA)
- Tourism & Hospitality (AREA)
- Development Economics (AREA)
- Life Sciences & Earth Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Operations Research (AREA)
- Game Theory and Decision Science (AREA)
- Educational Administration (AREA)
- Artificial Intelligence (AREA)
- Quality & Reliability (AREA)
- Health & Medical Sciences (AREA)
- General Engineering & Computer Science (AREA)
- Evolutionary Computation (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Bioinformatics & Computational Biology (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- Evolutionary Biology (AREA)
- Molecular Biology (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Primary Health Care (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The embodiment of the application provides a service abnormity prediction method, a device, a storage medium and an electronic device, wherein the method comprises the following steps: collecting real-time service data of the current time; performing multi-dimensional index aggregation on the real-time service data to obtain multi-dimensional real-time data indexes; inputting the multidimensional real-time data index into a target neural network model to obtain a prediction result of a service within a preset time period after the current time output by the target neural network model; the prediction result is input into the target random forest model to obtain the abnormal detection result of the business within the preset time output by the target random forest model, so that the problem that abnormal processing is not timely caused by the fact that operation and maintenance personnel start to diagnose the abnormality after the abnormality occurs in the related technology can be solved, the possible future abnormality of the network can be predicted, the operation and maintenance personnel can intervene and deal in advance, and the complaint risk is reduced.
Description
Technical Field
The embodiment of the application relates to the field of communication, in particular to a business abnormity prediction method, a business abnormity prediction device, a storage medium and an electronic device.
Background
In the field of operation and maintenance of mobile operators, thousands of dimension index data are stored in a big data analysis system. Network operation and maintenance personnel usually perform periodic inspection on core indexes according to manual experience, and can start the next fault handling work after finding that the indexes are abnormal. However, due to the complexity of the mobile networking and the diversity of indexes, the troubleshooting of the fault root is difficult, the time consumption is long, and the network paralysis can be caused even directly due to serious problems, so that the normal use of the user is influenced.
Currently, mobile operators have started monitoring Key Performance Indicators (KPIs) in networks and using thresholds to determine index anomalies. And the intervention in advance in the network operation and maintenance does not have breakthrough application practice.
In the related art, no solution is provided for the problem that operation and maintenance personnel start to diagnose the abnormality after the abnormality occurs, so that the abnormality is not processed in time.
Disclosure of Invention
The embodiment of the application provides a service abnormity prediction method, a service abnormity prediction device, a storage medium and an electronic device, and at least solves the problem that in the related technology, operation and maintenance personnel start to diagnose abnormity after abnormity occurs, so that abnormity processing is not timely.
According to an embodiment of the present application, there is provided a method for predicting a traffic anomaly, including:
collecting real-time service data of the current time;
performing multi-dimensional index aggregation on the real-time service data to obtain multi-dimensional real-time data indexes;
inputting the multi-dimensional real-time data index into a target neural network model trained based on historical service data in advance to obtain a service prediction result within a preset time period after the current time output by the target neural network model;
and inputting the prediction result into a target random forest model trained in advance based on the historical service data to obtain an abnormal detection result of the service within the preset time output by the target random forest model.
In an exemplary embodiment, before performing multidimensional index aggregation on the real-time service data to obtain a multidimensional real-time data index, the method further includes:
stripping invalid data in the real-time service data to obtain effective real-time service data;
and carrying out standardization processing on non-standardized data in the effective real-time service data to obtain cleaned real-time service data.
In an exemplary embodiment, the method further comprises:
extracting the historical service data;
performing multi-dimensional index aggregation on the historical service data to obtain multi-dimensional historical data indexes;
and training the constructed initial neural network model according to the multi-dimensional historical data indexes to obtain the trained target neural network model.
In an exemplary embodiment, before performing multidimensional index aggregation on the historical service data to obtain multidimensional historical data indexes, the method further includes:
stripping invalid data in the historical service data to obtain valid historical service data;
and carrying out normalization processing on the non-normalized data in the effective historical service data to obtain the cleaned historical service data.
In an exemplary embodiment, the method further comprises:
extracting data aggregation indexes with a time window of N and a time window of M from the multi-dimensional historical data indexes respectively, wherein N is not equal to M, and N, M are integers greater than 1;
determining characteristic parameters according to the data aggregation indexes;
converting the characteristic parameters into a characteristic matrix;
and training the constructed initial random forest model according to the characteristic matrix to obtain the trained target random forest model.
In an exemplary embodiment, determining the characteristic parameter from the data aggregation indicator comprises:
respectively obtaining the following parameters from the data aggregation indexes: mean, standard deviation, minimum, maximum, quarter locus, median, three quarter locus, standard deviation mean, variance mean, chebyshev statistical characteristics, total variation, coefficient of variation;
and composing the acquired parameters into the characteristic parameters.
In an exemplary embodiment, the real-time service data includes at least: time information, behavior information, location information and KPIs;
the historical traffic data includes at least: time information, behavior information, location information, and KPIs.
According to another embodiment of the present application, there is also provided a traffic anomaly prediction apparatus, including:
the acquisition module is used for acquiring real-time service data of the current time;
the first aggregation module is used for carrying out multi-dimensional index aggregation on the real-time service data to obtain multi-dimensional real-time data indexes;
the input module is used for inputting the multidimensional real-time data index into a target neural network model trained on historical service data in advance to obtain a service prediction result within a preset time period after the current time output by the target neural network model;
and the anomaly detection module is used for inputting the prediction result into a target random forest model which is trained on the basis of the historical service data in advance to obtain an anomaly detection result of the service within the preset time output by the target random forest model.
In an exemplary embodiment, the apparatus further comprises:
the first stripping module is used for stripping invalid data in the real-time service data to obtain valid real-time service data;
and the first cleaning module is used for carrying out normalized processing on non-normalized data in the effective real-time service data to obtain cleaned real-time service data.
In an exemplary embodiment, the apparatus further comprises:
the first extraction module is used for extracting the historical service data;
the second focusing module is used for carrying out multi-dimensional index aggregation on the historical service data to obtain multi-dimensional historical data indexes;
and the first training module is used for training the constructed initial neural network model according to the multi-dimensional historical data indexes to obtain the trained target neural network model.
In an exemplary embodiment, the apparatus further comprises:
the second stripping module is used for stripping invalid data in the historical service data to obtain valid historical service data;
and the second cleaning module is used for carrying out normalization processing on the non-normalized data in the effective historical service data to obtain cleaned historical service data.
In an exemplary embodiment, the apparatus further comprises:
the second extraction module is used for extracting data aggregation indexes with a time window of N and a time window of M from the multi-dimensional historical data indexes respectively, wherein N is not equal to M, and N, M are integers larger than 1;
the determining module is used for determining characteristic parameters according to the data aggregation indexes;
the conversion module is used for converting the characteristic parameters into a characteristic matrix;
and the second training module is used for training the constructed initial random forest model according to the characteristic matrix to obtain the trained target random forest model.
In an exemplary embodiment, the determining module is further configured to
Respectively obtaining the following parameters from the data aggregation indexes: mean, standard deviation, minimum, maximum, quarter locus, median, three quarter locus, standard deviation mean, variance mean, chebyshev statistical characteristics, total variation, coefficient of variation;
and composing the acquired parameters into the characteristic parameters.
In an exemplary embodiment, the real-time service data includes at least: time information, behavior information, location information and KPIs;
the historical traffic data includes at least: time information, behavior information, location information, and KPIs.
According to a further embodiment of the present application, there is also provided a computer-readable storage medium having a computer program stored thereon, wherein the computer program is arranged to perform the steps of any of the above method embodiments when executed.
According to yet another embodiment of the present application, there is also provided an electronic device, comprising a memory having a computer program stored therein and a processor configured to run the computer program to perform the steps of any of the method embodiments described above.
The method comprises the steps of acquiring real-time service data of the current time; performing multi-dimensional index aggregation on the real-time service data to obtain multi-dimensional real-time data indexes; inputting the multi-dimensional real-time data index into a target neural network model trained based on historical service data in advance to obtain a service prediction result within a preset time period after the current time output by the target neural network model; and inputting the prediction result into a target random forest model which is trained in advance based on the historical service data to obtain an abnormal detection result of the service within the preset time output by the target random forest model, so that the problem that abnormal processing is not timely caused by the fact that operation and maintenance personnel start to diagnose the abnormality after the abnormality occurs in the related technology can be solved, the possible future abnormality of the network can be predicted, the operation and maintenance personnel can intervene and deal in advance, the complaint risk is reduced, and the user experience is improved.
Drawings
Fig. 1 is a block diagram of a hardware structure of a mobile terminal of a service anomaly prediction method according to an embodiment of the present application;
fig. 2 is a flowchart of a traffic anomaly prediction method according to an embodiment of the present application;
FIG. 3 is a flow diagram of a method of traffic anomaly prediction according to an alternative embodiment of the present application;
fig. 4 is a flow chart of KPI network intelligent warning according to an embodiment of the application;
FIG. 5 is a schematic diagram of a neural network model according to an embodiment of the present application;
fig. 6 is a networking diagram of a VoLTE probe acquisition deployment according to an embodiment of the application;
fig. 7 is a block diagram of a traffic anomaly prediction apparatus according to an embodiment of the present application.
Detailed Description
Embodiments of the present application will be described in detail below with reference to the accompanying drawings in conjunction with embodiments.
It should be noted that the terms "first," "second," and the like in the description and claims of this application and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order.
The method embodiments provided in the embodiments of the present application may be executed in a mobile terminal, a computer terminal, or a similar computing device. Taking a mobile terminal as an example, fig. 1 is a block diagram of a hardware structure of the mobile terminal of the traffic anomaly prediction method according to the embodiment of the present invention, and as shown in fig. 1, the mobile terminal may include one or more processors 102 (only one is shown in fig. 1) (the processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA, etc.), and a memory 104 for storing data, where the mobile terminal may further include a transmission device 106 for a communication function, and an input/output device 108. It will be understood by those skilled in the art that the structure shown in fig. 1 is only an illustration, and does not limit the structure of the mobile terminal. For example, the mobile terminal may also include more or fewer components than shown in FIG. 1, or have a different configuration than shown in FIG. 1.
The memory 104 may be used to store a computer program, for example, a software program and a module of application software, such as a computer program corresponding to the service anomaly prediction method in the embodiment of the present application, and the processor 102 executes various functional applications and service chain address pool slicing processing by running the computer program stored in the memory 104, so as to implement the method described above. The memory 104 may include high speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include memory located remotely from the processor 102, which may be connected to the mobile terminal over a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
The transmission device 106 is used to receive or transmit data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a Network adapter (NIC), which can be connected to other Network devices through a base station so as to communicate with the internet. In one example, the transmission device 106 may be a Radio Frequency (RF) module, which is used for communicating with the internet in a wireless manner.
In this embodiment, a method for predicting a service anomaly, which operates on the mobile terminal or the network architecture, is provided, and fig. 2 is a flowchart of the method for predicting a service anomaly according to the embodiment of the present application, as shown in fig. 2, the flowchart includes the following steps:
step S202, collecting real-time service data of the current time;
in this embodiment, the real-time service data at least includes: time information, behavior information, location information, and KPIs.
Step S204, carrying out multi-dimensional index aggregation on the real-time service data to obtain multi-dimensional real-time data indexes;
step S206, inputting the multi-dimensional real-time data index into a target neural network model trained based on historical service data in advance to obtain a service prediction result within a preset time period after the current time output by the target neural network model;
and S208, inputting the prediction result into a target random forest model trained on the historical service data in advance to obtain an abnormal detection result of the service within the preset time output by the target random forest model.
Through the steps S202 to S208, the problem that the abnormity processing is not timely caused because the operation and maintenance personnel start to diagnose the abnormity after the abnormity occurs in the related technology can be solved, the possible abnormity of the network in the future is predicted, the operation and maintenance personnel can intervene and deal in advance, the complaint risk is reduced, and the user experience is improved.
In order to remove invalid real-time service data, before the step S204, the real-time service data is cleaned to obtain cleaned real-time service data, and further, invalid data in the real-time service data is stripped to obtain valid real-time service data; and carrying out standardization processing on the non-standardized data in the effective real-time service data to obtain cleaned real-time service data.
Fig. 3 is a flowchart of a traffic anomaly prediction method according to an alternative embodiment of the present application, as shown in fig. 3, including:
step S302, extracting historical service data;
in this embodiment, the historical service data at least includes: the time information, the behavior information, the position information and the KPI can specifically collect specific data from different positions.
Step S304, carrying out multi-dimensional index aggregation on the historical service data to obtain multi-dimensional historical data indexes;
and S306, training the constructed initial neural network model according to the multi-dimensional historical data indexes to obtain the trained target neural network model.
In order to remove invalid historical service data, before the step S304, the historical service data is cleaned to obtain cleaned historical service data, and further, invalid data in the historical service data is stripped to obtain valid historical service data; and carrying out normalization processing on the non-normalized data in the effective historical service data to obtain the cleaned historical service data.
The embodiment extracts historical service data, and performs hour and day granularity index aggregation on the historical service data of each dimension respectively; extracting the time sequence characteristics of the collected historical data based on the multi-dimensional historical service data; constructing an initial neural network model, and using the historical service data after the characteristics are extracted for training the initial neural network model; the initial neural network model is commonly used for natural language translation, and is used for predicting time sequences after being modified, and actual results show that the prediction accuracy is superior to that of common time sequence prediction algorithms. The trained target neural network model can be used for predicting a prediction result in a future period of time.
In an exemplary embodiment, data aggregation indexes with a time window of N and a time window of M are respectively extracted from the multidimensional historical data indexes, where N is not equal to M, and N, M are integers greater than 1, for example, N is 7 days, and M is 60 days, when historical data is collected, the data aggregation indexes with the time window of 7 days are extracted from the multidimensional historical data indexes from the current time, and the data aggregation indexes with the time window of 60 days are extracted from the multidimensional historical data indexes; determining characteristic parameters according to the data aggregation indexes; converting the characteristic parameters into a characteristic matrix; and training the constructed initial random forest model according to the characteristic matrix to obtain the trained target random forest model.
The embodiment respectively carries out hour and day granularity index aggregation on historical service data of each dimension; extracting the collected historical statistical characteristic parameters based on the multi-dimensional historical service data, and performing model training on the random forest network; conventional anomaly detection requires a large number of manually marked samples, and sample marking based on hundreds of millions of data per hour is almost impossible to realize in the field of operation and maintenance. The embodiment of the application adopts a semi-automatic labeling mode combining statistics and manual labeling, so that the sample is edited, the manual labeling cost can be greatly reduced, and the labeling efficiency is improved. And the target random forest model obtained after training is used for carrying out index abnormality detection and classification (normal indexes and abnormal indexes) and giving out index prediction conclusions which possibly have abnormality.
Further, the determining the characteristic parameter according to the data aggregation indicator may specifically include: respectively obtaining the following parameters from the data aggregation indexes: mean, standard deviation, minimum, maximum, quarter locus, median, three quarter locus, standard deviation mean, variance mean, chebyshev statistical characteristics, total variation, coefficient of variation; and composing the acquired parameters into the characteristic parameters.
Compared with a mode in which the operation and maintenance personnel start fault diagnosis after the fault is triggered in the related technology, the embodiment provides a feasible implementation scheme for the operation and maintenance ideas of early identification, early diagnosis and early treatment through technical capability evolution. Predicting the KPI future trend by adopting a multi-dimensional KPI historical feature learning mode; in the process of identifying the abnormity, the embodiment is compared with historical data of dimension-KPI, and abnormity is divided without a Lai Menxian threshold value, so that false alarm and false alarm can be effectively avoided, and obvious KPI abnormity and abnormity with a degradation trend can be detected; in a fault early warning interface, a gold service index-operation and maintenance KPI and multi-dimensional layered early warning system is constructed according to abnormal scenes by combining with operation and maintenance working depth, so that false alarms caused by accidental index fluctuation are filtered, the alarm range is greatly reduced, and the optimization efficiency of operation and maintenance colleagues is improved.
Fig. 4 is a flowchart of KPI network intelligent warning according to an embodiment of the present application, as shown in fig. 4, including:
after the probe acquires data, basic data cleaning is carried out on the data, and basic index aggregation and abnormal data processing are completed in the cleaning stage.
And performing feature extraction on the aggregated data through feature engineering, wherein the features comprise statistical features of single time granularity of the global data and time sequence features (namely time sequence prediction features) of the dimension data.
The extracted features are used as input of an AI model, and a prediction result of the specified dimension is obtained after the time sequence is input into the prediction model. Inputting an abnormal recognition model after splicing the predicted historical data and the prediction result, and judging abnormal recognition, wherein the abnormal recognition model is a random forest abnormal recognition model and can be obtained through historical service data training, and the historical service data at least comprises: the KPI comprises time information, behavior information, position information and KPIs, wherein the KPIs specifically comprise statistical labels and manual analysis labels.
And finally obtaining a summary result of dimensions with possible abnormal dimensions in the future.
Fig. 5 is a schematic diagram of a Neural Network model according to an embodiment of the present application, and as shown in fig. 5, the model mainly includes an Encoder, a Decoder, and an Attention model Attention, and a coding/decoding Network uses an RNN (Recurrent Neural Network) model. And the time sequence KPI is used as the input of an Encoder model, the characteristics are coded and converted into characteristic tensors through the Encoder, and the characteristic tensors are used as the input of the Decoder. And (4) combining SelfAttention, giving different weights according to the influence degree, splicing the characteristic matrix and the Encoder result to be used as the input of the full-connection network, and finally outputting a prediction result.
Fig. 6 is a networking diagram of the collection and deployment of the VoLTE probe according to the embodiment of the present application, and as shown in fig. 6, the networking diagram includes an IMS (IP Multimedia Subsystem IP), an EPC (Evolved Packet Core, all-IP Packet Core), an E-UTRAN (Evolved UMTS Terrestrial Radio Access Network), a GERAN (GSM EDGE Radio Access Network/EDGE, wireless communication Network), an eMSC/GMSC (Evolved Mobile Switching Center/Gateway Mobile Switching Center), a DNS/ENUM (Domain Name System/Telephone Number Mapping service group), and a service Subscriber Home Server (IMS), where: BGCF (Breakout Gateway Control Function), MGCF (Media Gateway Control Function), AS (Application Server), I/S-CSCF (interworking/Serving Call Session Control Function, query/service CSCF), IBCF (interconnection border Control Function), P-CSCF/SBC (Proxy Call Session Control Function/Session border controller), and PCRF (Policy and Charging Rules Function), the EPC includes: SEA-GW (Serving Gateway), MME (Mobility Management Entity), E-UTRAN includes eNB (eNode B, base station). The network elements related to this embodiment at least include an I/S-CSCF, a P-CSCF/SBC, an SEA-GW, an MME, an eNB, and an eMSC/GMSC, and a third generation partnership Project (The 3rd generation partnership Project, abbreviated as 3 GPP) protocol standard acquisition interface, that is, a data acquisition probe deployment location, is on a connection line of each network element.
The embodiment is based on the video service abnormity prediction of the VoLTE (Voice over Long Term Evolution) mobile communication network, and comprises the processes of network index acquisition, original data cleaning, multi-dimensional index aggregation, KPI historical feature extraction, KPI index prediction and index abnormity identification.
Acquiring network indexes, as shown in FIG. 6, a hard probe is deployed at an Mw port between an I/S-CSCF and a P-CSCF/SBC to acquire registration, call and drop signaling; the Rx ports deployed on the P/SBC and the PCRF collect call drop signaling; an Sv port deployed between an MME and an eMSC network element collects an ESRVCC (Evolved Single Radio Voice Call Continuity) switching signaling; an s1-u port deployed between a cell and a Signaling Gateway (SGW) network element collects voice and video user plane signaling.
Cleaning original data, wherein the collected signaling contains time information, user information, behavior information, position information and KPI, and key KPI model indexes at least comprise: the method comprises the following steps of initial registration success rate, re-registration success rate, voLTE network call completing rate, V2V call establishing duration, voLTE call drop rate, ESRVCC switching success rate, ESRVCC switching average time delay, MOS 3.0 (Mean Opinion Score, call quality subjective evaluation Mean) ratio and uplink packet loss rate. And cleaning valid information in the information by using the original data cleaning, namely stripping invalid data and standardizing unplanned data.
And (4) multi-dimensional index aggregation, namely performing index aggregation of cell dimensions and network element dimensions on the cleaned data respectively, and performing hour granularity aggregation statistics. The aggregated indicator matrix is as follows:
and (3) KPI historical characteristic extraction, namely respectively taking dimension-KPI aggregation indexes with a window of N and a window of M, acquiring a mean value, a standard deviation, a minimum value, a maximum value, a quarter site, a median value, a quarter site, a standard deviation mean value, a variance mean value, chebyshev statistical characteristics, total variation and a variation coefficient as characteristic parameters, and converting data into a characteristic matrix with the same structure as the indexes.
And (4) index prediction, namely converting the index matrix into a time sequence format, and performing model training by taking historical data as seq2seq + attention prediction model input. And the real-time data is used as prediction data to predict future indexes to obtain a prediction result.
And (4) index abnormity identification, wherein the feature matrix is used as random forest model input for model training. And inputting the prediction result into the random forest model to perform anomaly detection on the predicted time sequence.
According to another embodiment of the present application, there is also provided a traffic anomaly prediction apparatus, and fig. 7 is a block diagram of the traffic anomaly prediction apparatus according to the embodiment of the present application, and as shown in fig. 7, the apparatus includes:
the acquisition module 72 is used for acquiring real-time service data of the current time;
a first aggregation module 74, configured to perform multi-dimensional index aggregation on the real-time service data to obtain a multi-dimensional real-time data index;
an input module 76, configured to input the multidimensional real-time data index into a target neural network model trained in advance based on historical service data, so as to obtain a prediction result of a service within a preset time period after the current time output by the target neural network model;
and the anomaly detection module 78 is configured to input the prediction result into a target random forest model trained in advance based on the historical service data, so as to obtain an anomaly detection result of the service within the preset time output by the target random forest model.
In an exemplary embodiment, the apparatus further comprises:
the first stripping module is used for stripping invalid data in the real-time service data to obtain valid real-time service data;
and the first cleaning module is used for carrying out normalized processing on non-normalized data in the effective real-time service data to obtain cleaned real-time service data.
In an exemplary embodiment, the apparatus further comprises:
the first extraction module is used for extracting the historical service data;
the second focusing module is used for carrying out multi-dimensional index aggregation on the historical service data to obtain multi-dimensional historical data indexes;
and the first training module is used for training the constructed initial neural network model according to the multi-dimensional historical data indexes to obtain the trained target neural network model.
In an exemplary embodiment, the apparatus further comprises:
the second stripping module is used for stripping invalid data in the historical service data to obtain valid historical service data;
and the second cleaning module is used for carrying out normalization processing on the non-normalized data in the effective historical service data to obtain cleaned historical service data.
In an exemplary embodiment, the apparatus further comprises:
the second extraction module is used for respectively extracting data aggregation indexes with a time window of N and a time window of M from the multi-dimensional historical data indexes, wherein N is not equal to M, and N, M are integers more than 1;
the determining module is used for determining characteristic parameters according to the data aggregation indexes;
the conversion module is used for converting the characteristic parameters into a characteristic matrix;
and the second training module is used for training the constructed initial random forest model according to the characteristic matrix to obtain the trained target random forest model.
In an exemplary embodiment, the determining module is further configured to
Respectively obtaining the following parameters from the data aggregation indexes: mean, standard deviation, minimum, maximum, quarter locus, median, three quarter locus, standard deviation mean, variance mean, chebyshev statistical characteristics, total variation, coefficient of variation;
and composing the acquired parameters into the characteristic parameters.
In an exemplary embodiment, the real-time service data includes at least: time information, behavior information, location information and KPIs;
the historical traffic data includes at least: time information, behavior information, location information, and KPIs.
Embodiments of the present application further provide a computer-readable storage medium having a computer program stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.
In an exemplary embodiment, the computer readable storage medium may include, but is not limited to: various media capable of storing computer programs, such as a usb disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk.
Embodiments of the present application further provide an electronic device, comprising a memory in which a computer program is stored and a processor configured to execute the computer program to perform the steps in any of the method embodiments described above.
In an exemplary embodiment, the electronic apparatus may further include a transmission device and an input/output device, wherein the transmission device is connected to the processor, and the input/output device is connected to the processor.
For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary embodiments, and details of this embodiment are not repeated herein.
It will be apparent to those skilled in the art that the various modules or steps of the present application described above may be implemented using a general purpose computing device, they may be centralized on a single computing device or distributed across a network of multiple computing devices, and they may be implemented using program code executable by the computing devices, such that they may be stored in a memory device and executed by the computing devices, and in some cases, the steps shown or described may be performed in an order different than that described herein, or they may be separately fabricated into separate integrated circuit modules, or multiple ones of them may be fabricated into a single integrated circuit module. Thus, the present application is not limited to any specific combination of hardware and software.
The above description is only a preferred embodiment of the present application and is not intended to limit the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the principle of the present application shall be included in the protection scope of the present application.
Claims (10)
1. A method for predicting traffic anomaly, comprising:
collecting real-time service data of the current time;
performing multi-dimensional index aggregation on the real-time service data to obtain multi-dimensional real-time data indexes;
inputting the multi-dimensional real-time data index into a target neural network model trained based on historical service data in advance to obtain a service prediction result within a preset time period after the current time output by the target neural network model;
and inputting the prediction result into a target random forest model trained in advance based on the historical service data to obtain an abnormal detection result of the service within the preset time output by the target random forest model.
2. The method of claim 1, wherein before performing multidimensional index aggregation on the real-time service data to obtain a multidimensional real-time data index, the method further comprises:
stripping invalid data in the real-time service data to obtain valid real-time service data;
and carrying out standardization processing on the non-standardized data in the effective real-time service data to obtain cleaned real-time service data.
3. The method of claim 1, further comprising:
extracting the historical service data;
performing multi-dimensional index aggregation on the historical service data to obtain multi-dimensional historical data indexes;
and training the constructed initial neural network model according to the multi-dimensional historical data indexes to obtain the trained target neural network model.
4. The method of claim 3, wherein before performing multidimensional index aggregation on the historical business data to obtain multidimensional historical data indexes, the method further comprises:
stripping invalid data in the historical service data to obtain valid historical service data;
and carrying out normalization processing on the non-normalized data in the effective historical service data to obtain the cleaned historical service data.
5. The method of claim 3, further comprising:
extracting data aggregation indexes with a time window of N and a time window of M from the multi-dimensional historical data indexes respectively, wherein N is not equal to M, and N, M are integers greater than 1;
determining characteristic parameters according to the data aggregation indexes;
converting the characteristic parameters into a characteristic matrix;
and training the constructed initial random forest model according to the characteristic matrix to obtain the trained target random forest model.
6. The method of claim 5, wherein determining a characteristic parameter from the data aggregation indicator comprises:
respectively obtaining the following parameters from the data aggregation indexes: mean, standard deviation, minimum, maximum, quarter locus, median, three quarter locus, standard deviation mean, variance mean, chebyshev statistical characteristics, total variation, coefficient of variation;
and composing the acquired parameters into the characteristic parameters.
7. The method according to any one of claims 1 to 6,
the real-time service data at least comprises: time information, behavior information, location information, and KPIs;
the historical traffic data includes at least: time information, behavior information, location information, and KPIs.
8. A traffic anomaly prediction apparatus, comprising:
the acquisition module is used for acquiring real-time service data of the current time;
the first aggregation module is used for carrying out multi-dimensional index aggregation on the real-time service data to obtain multi-dimensional real-time data indexes;
the input module is used for inputting the multidimensional real-time data index into a target neural network model trained on historical service data in advance to obtain a service prediction result within a preset time period after the current time output by the target neural network model;
and the anomaly detection module is used for inputting the prediction result into a target random forest model which is trained on the basis of the historical service data in advance to obtain an anomaly detection result of the service within the preset time output by the target random forest model.
9. A computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to carry out the method of any one of claims 1 to 7 when executed.
10. An electronic device comprising a memory and a processor, wherein the memory has stored therein a computer program, and wherein the processor is arranged to execute the computer program to perform the method of any of claims 1 to 7.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111124591.XA CN115859188A (en) | 2021-09-24 | 2021-09-24 | Service abnormity prediction method and device, storage medium and electronic device |
| PCT/CN2022/119099 WO2023045829A1 (en) | 2021-09-24 | 2022-09-15 | Service abnormality prediction method and device, storage medium, and electronic device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111124591.XA CN115859188A (en) | 2021-09-24 | 2021-09-24 | Service abnormity prediction method and device, storage medium and electronic device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115859188A true CN115859188A (en) | 2023-03-28 |
Family
ID=85653212
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111124591.XA Pending CN115859188A (en) | 2021-09-24 | 2021-09-24 | Service abnormity prediction method and device, storage medium and electronic device |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN115859188A (en) |
| WO (1) | WO2023045829A1 (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116381511A (en) * | 2023-05-30 | 2023-07-04 | 中国华能集团清洁能源技术研究院有限公司 | Battery state detection method and device, electronic equipment and storage medium |
| CN116528274A (en) * | 2023-07-05 | 2023-08-01 | 腾讯科技（深圳）有限公司 | Network quality regulation and control method and related equipment |
| CN118612754A (en) * | 2024-08-08 | 2024-09-06 | 宁波市鄞州华数广电网络有限公司 | Three-in-one terminal control system and method capable of intelligent networking |
Families Citing this family (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116304913B (en) * | 2023-04-07 | 2024-08-20 | 中国长江三峡集团有限公司 | Water quality state monitoring method and device based on Bayesian model and electronic equipment |
| CN116628428B (en) * | 2023-07-24 | 2023-10-31 | 华能信息技术有限公司 | Data processing method and system |
| CN116701127B (en) * | 2023-08-09 | 2023-12-19 | 睿至科技集团有限公司 | Big data-based application performance monitoring method and platform |
| CN116827971B (en) * | 2023-08-29 | 2023-11-24 | 北京国网信通埃森哲信息技术有限公司 | Block chain-based carbon emission data storage and transmission method, device and equipment |
| CN117314305A (en) * | 2023-09-11 | 2023-12-29 | 国网物资有限公司 | Electric power material warning method and device for intelligent digital cockpit based on visualization |
| CN117041121B (en) * | 2023-10-07 | 2023-12-19 | 成都无声讯通科技有限责任公司 | Internet of Things anomaly monitoring method and system based on data mining |
| CN117389179B (en) * | 2023-10-17 | 2024-05-03 | 北京思木企业管理咨询中心(有限合伙) | Remote intelligent centralized control method and system for inspection equipment |
| CN117520410B (en) * | 2023-11-03 | 2024-08-16 | 华青融天(北京)软件股份有限公司 | Service data processing method, device, electronic equipment and computer readable medium |
| CN117196322B (en) * | 2023-11-06 | 2024-03-26 | 深圳市明心数智科技有限公司 | Intelligent wind control method, intelligent wind control device, computer equipment and storage medium |
| CN117726257B (en) * | 2023-12-20 | 2024-07-05 | 重庆环问问科技有限公司 | Industrial park hazardous waste treatment method based on artificial intelligence big data model |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20200380335A1 (en) * | 2019-05-30 | 2020-12-03 | AVAST Software s.r.o. | Anomaly detection in business intelligence time series |
| CN111062464B (en) * | 2019-10-24 | 2022-07-01 | 中国电力科学研究院有限公司 | Power communication network reliability prediction and guarantee method and system based on deep learning |
| CN111914873B (en) * | 2020-06-05 | 2024-07-19 | 华南理工大学 | Two-stage cloud server unsupervised anomaly prediction method |
| CN112115024B (en) * | 2020-09-03 | 2023-07-18 | 上海上讯信息技术股份有限公司 | Training method and device for fault prediction neural network model |
-
2021
- 2021-09-24 CN CN202111124591.XA patent/CN115859188A/en active Pending
-
2022
- 2022-09-15 WO PCT/CN2022/119099 patent/WO2023045829A1/en active Application Filing
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116381511A (en) * | 2023-05-30 | 2023-07-04 | 中国华能集团清洁能源技术研究院有限公司 | Battery state detection method and device, electronic equipment and storage medium |
| CN116381511B (en) * | 2023-05-30 | 2023-08-29 | 中国华能集团清洁能源技术研究院有限公司 | Battery state detection method and device, electronic equipment and storage medium |
| CN116528274A (en) * | 2023-07-05 | 2023-08-01 | 腾讯科技（深圳）有限公司 | Network quality regulation and control method and related equipment |
| CN116528274B (en) * | 2023-07-05 | 2023-09-22 | 腾讯科技（深圳）有限公司 | Network quality regulation and control method and related equipment |
| CN118612754A (en) * | 2024-08-08 | 2024-09-06 | 宁波市鄞州华数广电网络有限公司 | Three-in-one terminal control system and method capable of intelligent networking |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2023045829A1 (en) | 2023-03-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN115859188A (en) | Service abnormity prediction method and device, storage medium and electronic device | |
| CN107426059B (en) | DPI equipment feature library automatic updating method and system, DPI equipment and cloud server | |
| CN107332715B (en) | Network application system with active performance test and passive shunt control and implementation method thereof | |
| EP3286878A1 (en) | Fault diagnosis in networks | |
| CN110460454B (en) | Intelligent network equipment port fault prediction method based on deep learning | |
| CN112968816B (en) | Method and system for screening abnormality of Internet of things equipment through flow abnormality detection | |
| WO2022028120A1 (en) | Indicator detection model acquisition method and apparatus, fault locating method and apparatus, and device and storage medium | |
| CN105306246B (en) | A kind of method, apparatus and server of the complaint of automatic-answering back device network class | |
| CN115774855A (en) | Fault root cause determination method and device, storage medium and electronic device | |
| CN110808856A (en) | Big data operation and maintenance method and system based on data center | |
| CN112884159A (en) | Model updating system, model updating method and related equipment | |
| CN112235154A (en) | Data processing method, system, device and medium based on Internet of things | |
| Rizwan et al. | A zero-touch network service management approach using AI-enabled CDR analysis | |
| CN104539556A (en) | Method for providing satisfaction service quality for users under heterogeneous network environment | |
| CN114138771A (en) | Abnormal data processing method and device and electronic equipment | |
| CN107292519B (en) | Browsing service perception index prediction method based on multi-label learning | |
| CN113780398A (en) | Wireless network link quality prediction method and system | |
| US10742485B2 (en) | Method for determining a sequence of events, a determination device for determining a sequence of events, and a providing device | |
| EP4199449A1 (en) | Automatic classification of correlated anomalies from a network through interpretable clustering | |
| Babaria et al. | Flowformers: Transformer-based models for real-time network flow classification | |
| CN114785617B (en) | 5G network application layer anomaly detection method and system | |
| CN116466166A (en) | Fault detection method, system and device for large-screen equipment | |
| CN116016288A (en) | Flow monitoring method, device, equipment and storage medium of industrial equipment | |
| KR100835647B1 (en) | Statistical data managing system and methods of mirrored packets for realtime monitoring and performance trend analysis by separating realtime statistical data and transition analysis data | |
| Tauriainen | Can you hear me now? A call detail record based end-to-end diagnostics system for mobile networks |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |