CN118200950B - Method and system for inspecting telecommunication base station - Google Patents
Method and system for inspecting telecommunication base station Download PDFInfo
- Publication number
- CN118200950B CN118200950B CN202410612666.6A CN202410612666A CN118200950B CN 118200950 B CN118200950 B CN 118200950B CN 202410612666 A CN202410612666 A CN 202410612666A CN 118200950 B CN118200950 B CN 118200950B
- Authority
- CN
- China
- Prior art keywords
- data
- operation log
- abnormal
- type
- log data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 43
- 230000002159 abnormal effect Effects 0.000 claims abstract description 234
- 230000005856 abnormality Effects 0.000 claims abstract description 44
- 238000001514 detection method Methods 0.000 claims abstract description 9
- 238000012545 processing Methods 0.000 claims abstract description 5
- 238000004590 computer program Methods 0.000 claims description 5
- 238000010606 normalization Methods 0.000 claims description 5
- 230000008569 process Effects 0.000 claims description 5
- 238000012163 sequencing technique Methods 0.000 claims description 2
- 238000005516 engineering process Methods 0.000 abstract description 3
- 230000009286 beneficial effect Effects 0.000 description 6
- 230000006870 function Effects 0.000 description 5
- 238000007689 inspection Methods 0.000 description 5
- 238000010276 construction Methods 0.000 description 3
- 238000012544 monitoring process Methods 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 230000008859 change Effects 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 230000003044 adaptive effect Effects 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000005070 sampling Methods 0.000 description 1
- 238000012216 screening Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W24/00—Supervisory, monitoring or testing arrangements
- H04W24/04—Arrangements for maintaining operational condition
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/069—Management of faults, events, alarms or notifications using logs of notifications; Post-processing of notifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
- H04W88/08—Access point devices
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Debugging And Monitoring (AREA)
Abstract
The present invention relates to the field of data processing technologies, and in particular, to a method and a system for inspecting a telecommunication base station. The method comprises the following steps: acquiring each piece of operation log data of a telecommunication base station, acquiring the abnormality degree of each type of data of the whole operation log data, and further adaptively acquiring the number of updated isolated trees of each type of data of the whole operation log data to acquire a plurality of suspected abnormal data of each type of data of the whole operation log data; obtaining the abnormal expression degree of each suspected abnormal data of each type of data of the overall operation log data, and further obtaining a plurality of noise data of each type of data of the overall operation log data; the noise data is deleted to obtain each type of updated data of the whole operation log data, the abnormal condition of each type of updated data of the whole operation log data is judged by carrying out abnormal detection on the updated data, and the number of the isolated trees is obtained in a self-adaptive mode, so that the detected abnormal data is more accurate.
Description
Technical Field
The present invention relates to the field of data processing technologies, and in particular, to a method and a system for inspecting a telecommunication base station.
Background
The method is simple and direct, but has the problems of low efficiency, easy error, difficult management and the like, and in order to improve the inspection efficiency and the accuracy, an automatic inspection method is provided, the technical means such as a sensor, monitoring equipment and the like are utilized to realize the real-time monitoring and the data acquisition of the base station facilities and the equipment, and abnormal data is acquired according to the data acquired by the base station by utilizing a big data analysis technology, so that the workload and the time cost of manual inspection are greatly reduced, and the inspection accuracy and reliability are improved.
The patent document with the current authorized bulletin number of CN115964216B discloses an abnormal detection method of the data of the Internet of things equipment based on an isolated forest, wherein the equipment for reporting the data firstly judges the effectiveness of the equipment and judges the effectiveness of the equipment for reporting the data; then judging the data type, and converting the accumulated data into frequency data; then judging the rationality of the data reported by the equipment; then using an isolated algorithm in a conventional database whether the data reported by the device is isolated or not is judged, judging whether the data reported by the device are isolated or not in the knowledge database, and finally, filtering abnormal data of the operation data of the Internet of things equipment.
According to the method, when the data are isolated or not, an isolated forest algorithm is used for judging whether the data are isolated, a fixed number of isolated trees are adopted, the data set is divided into subspaces in a recursion mode until the subspaces only contain one data or a predefined stopping condition is achieved, and each complete isolated tree is finally formed, but the problem of under fitting or over fitting can be caused by using the fixed number of isolated trees, so that abnormal data in the data set cannot be accurately detected, and finally the abnormal situation judgment of a telecommunication base station is inaccurate.
Disclosure of Invention
In order to ensure that abnormal data in the operation log data of the telecommunication base station can be accurately detected, the invention provides a method and a system for inspecting the telecommunication base station.
In a first aspect, the present invention provides a method for inspecting a telecommunications base station, which adopts the following technical scheme:
a method of patrol of a telecommunications base station comprising the steps of:
collecting each piece of operation log data of a telecommunication base station; acquiring outliers of each class of data of each piece of operation log data Wherein, the method comprises the steps of, wherein,A value representing the ith and nth class data of the jth travel log data; a mean value of values representing all v-th class data of the j-th running log data; The number of v-th data representing the j-th running log data; normalizing the sum of abnormal values of each type of data of all pieces of operation data, and taking the normalized sum as the abnormal degree of each type of data of the whole operation log data;
obtaining the number of updated isolated trees of each type of data of the whole operation log data, constructing an isolated tree of each type of data of the whole operation log data, and obtaining suspected abnormal data of each type of data of the whole operation log data, wherein the number of updated isolated trees is in direct proportion to the degree of abnormality;
Obtaining the abnormal expression degree of each piece of suspected abnormal data, wherein the abnormal expression degree is inversely proportional to the concentrated distribution degree of the suspected abnormal data and is directly proportional to the abnormal score difference of the suspected abnormal data;
Based on the abnormal expression degree, acquiring noise data of each type of data of the whole operation log data, deleting the noise data, acquiring each type of updated data of the whole operation log data, performing abnormal detection, and judging whether the abnormal condition exists in the telecommunication base station.
The beneficial effects are that: the invention is innovative in that the number of the isolated trees is adaptively obtained according to the degree of abnormality of each type of data of the whole operation log data to obtain suspected abnormal data, the greater the degree of abnormality is, the more suspected abnormal data possibly exist in the data, the more isolated trees are needed, otherwise, the problem that the use of a fixed number of isolated trees possibly causes under fitting or over fitting is avoided, the obtained suspected abnormal data is more accurate, furthermore, the degree of abnormality is obtained by combining the abnormal value of each type of data of each operation log data, the more accurate is obtained, finally, the degree of abnormal expression of the suspected abnormal data is obtained, the noise data in each type of data of the whole operation log data is obtained, and the abnormal data is detected after the noise data is deleted, so that whether the abnormal condition exists in the telecommunication base station is judged, the abnormal data of the whole operation log data can be accurately detected, and the abnormal condition judgment of the telecommunication base station is more accurate.
Preferably, the obtaining the number of the updated orphan trees of each type of data of the whole operation log data, and constructing the orphan trees of each type of data of the whole operation log data includes:
The method comprises the steps of (1) upwardly rounding the product of the abnormality degree of each type of data of the whole operation log data and the number of preset isolated trees, and then using the product as the updated isolated tree number of each type of data of the whole operation log data; and constructing an isolated tree for all each type of data of all pieces of operation log data by using an isolated forest algorithm according to the number of the updated isolated trees.
The beneficial effects are that: when the value of the abnormality degree of each type of data of the overall operation log data is larger, the more suspected abnormal data in the data is indicated, the number of isolated trees needs to be updated in a self-adaptive mode, and the suspected abnormal data can be obtained more accurately.
Preferably, the acquiring suspected abnormal data of each type of data of the overall operation log data includes:
according to the isolated tree, obtaining an initial anomaly score of each type of data of the overall operation log data, and performing linear normalization processing on all initial anomaly scores to obtain an anomaly score of each type of data of the overall operation log data;
presetting an abnormality score threshold, and when the abnormality score of the ith and the v-th types of data of the overall operation log data is greater than or equal to the abnormality score threshold, marking the abnormality score as one suspected abnormality data of the v-th types of data of the overall operation log data, and acquiring all suspected abnormality data of each type of data of the overall operation log data.
The beneficial effects are that: and screening out suspected abnormal data according to the abnormal score obtained by the isolated tree, and acquiring subsequent noise data more accurately.
Preferably, the obtaining the abnormal performance degree of each suspected abnormal data includes:
And taking the product of the inverse proportion value of the concentrated distribution degree of each suspected abnormal data of each type of data of the whole operation log data and the difference of the abnormal score of each suspected abnormal data of each type of data of the whole operation log data as the abnormal expression degree of each suspected abnormal data of each type of data of the whole operation log data.
The beneficial effects are that: and combining the product of the concentrated distribution degree and the anomaly score difference to obtain the anomaly performance degree of the suspected anomaly data more accurately.
Preferably, the obtaining the difference of the anomaly score of each suspected anomaly data of each class of data of the overall operation log data includes:
obtaining the difference absolute value of the mean value of the abnormal score of each suspected abnormal data of each type of data of the whole operation log data and the abnormal score of all suspected abnormal data of each type of data of the whole operation log data, and recording the difference absolute value as the abnormal score difference of each suspected abnormal data of each type of data of the whole operation log data.
Preferably, the acquiring the centralized distribution degree of each suspected abnormal data of each class of data of the overall operation log data includes:
Acquiring a difference value between the interval time of each suspected abnormal data of each type of data of the overall operation log data and the interval time average value of all suspected abnormal data of each type of data of the overall operation log data, and recording the difference value as a time interval difference value; and acquiring the ratio of the time interval difference value to the standard deviation of the interval time of all the suspected abnormal data of each type of data of the whole operation log data as the concentrated distribution degree of each suspected abnormal data of each type of data of the whole operation log data.
Preferably, the interval time for acquiring each suspected abnormal data of each class of data of the overall operation log data includes:
Sequencing the suspected abnormal data of any type of data of the overall operation log data according to the front-back sequence of the acquisition time of the suspected abnormal data of the data of any type of the overall operation log data to obtain a suspected abnormal data sequence of the data; and recording the acquisition time interval between any one suspected abnormal data of the type of data of the overall operation log data and the previous suspected abnormal data in the suspected abnormal data sequence of the type of data as the interval time of the suspected abnormal data of the type of data of the overall operation log data.
Preferably, the acquiring the noise data of each type of data of the overall operation log data and deleting the noise data, obtaining each type of updated data of the overall operation log data, performing anomaly detection, and judging whether the telecommunications base station has an anomaly condition, includes:
Presetting an abnormal expression degree threshold, judging the suspected abnormal data of any one type of data of the overall operation log data as noise data when the abnormal expression degree of any one suspected abnormal data of any one type of data of the overall operation log data is smaller than the abnormal expression degree threshold, deleting the noise data to obtain each type of updated data of the overall operation log data, detecting the abnormal data in each type of updated data of the overall operation log data by using an abnormal algorithm, and when the abnormal data exists in any type of updated data of the overall operation log data, judging that the telecommunication base station has abnormal conditions.
The beneficial effects are that: after deleting the noise data in the overall operation log data, the abnormal data is detected more accurately, so that the detected abnormal data can be more accurate, and the abnormal condition of the telecommunication base station can be judged accurately.
In a second aspect, the present invention provides a system for inspecting a telecommunication base station, which adopts the following technical scheme:
A patrol system for a telecommunications base station, comprising: a processor and a memory storing computer program instructions which, when executed by the processor, implement a method of patrol of a telecommunications base station as described above.
By adopting the technical scheme, the computer program is generated by the inspection method of the telecommunication base station and is stored in the memory to be loaded and executed by the processor, so that the terminal equipment is manufactured according to the memory and the processor, and the use is convenient.
The invention has the following technical effects: according to the method, the number of the isolated trees is required to be obtained in a self-adaptive mode according to the abnormal degree of each type of data of the whole operation log data, the suspected abnormal data in the data are obtained to carry out subsequent analysis, the greater the abnormal degree is, the more suspected abnormal data possibly exist in the data, the more isolated trees are required, otherwise, the problem that the use of a fixed number of isolated trees possibly causes under fitting or over fitting is avoided, the obtained suspected abnormal data are more accurate, the abnormal degree is obtained by combining the abnormal value of each type of data of each operation log data, the obtaining of the abnormal degree is more accurate, the abnormal expression degree of the suspected abnormal data is finally obtained, the noise data in each type of data of the whole operation log data are further obtained, and the abnormal data detection is carried out after the noise data are deleted, so that whether the abnormal condition exists in the telecommunication base station is judged, the abnormal data of the whole operation log data can be accurately detected, and the abnormal condition judgment of the telecommunication base station is more accurate.
Drawings
The above, as well as additional purposes, features, and advantages of exemplary embodiments of the present invention will become readily apparent from the following detailed description when read in conjunction with the accompanying drawings. In the drawings, several embodiments of the invention are illustrated by way of example and not by way of limitation, and like or corresponding reference numerals refer to like or corresponding parts.
Fig. 1 is a flow chart of a method in a method for inspecting a telecommunication base station according to an embodiment of the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are some, but not all embodiments of the invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
It should be understood that when the terms "first," "second," and the like are used in the claims, the specification and the drawings of the present invention, they are used merely for distinguishing between different objects and not for describing a particular sequential order. The terms "comprises" and "comprising" when used in the specification and claims of the present invention are taken to specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
The embodiment of the invention discloses a method for inspecting a telecommunication base station, which comprises the following steps of S1 to S4 with reference to FIG. 1:
S1: each piece of operation log data of the telecommunication base station is collected.
Step S1 includes step S10, specifically as follows:
s10: each piece of operation log data of the telecommunication base station is collected.
The operation log data of the telecommunication base station refers to data collected and monitored by the telecommunication base station equipment in an operating state, such as data of a transmission rate, a transmitted signal strength, a received signal strength, and a flow rate, and the operation state of the telecommunication base station equipment is determined by installing a sensor on the telecommunication base station equipment to collect the data and analyzing the collected data.
Specifically, installing various sensors and monitoring equipment in a telecommunication base station device, acquiring one piece of operation log data every half hour, and acquiring one day; the collection mode of one piece of operation log data is as follows: every 2S is a sampling time, four types of data, namely transmission rate data, sent signal intensity data, received signal intensity data and flow data, are sequentially collected every time, the total collection time is half an hour, and all the collected data are used as one piece of operation log data. It should be noted that each piece of running log data contains four types of data.
Up to this point several pieces of running log data of the telecommunication base station are collected.
S2: and acquiring the abnormal value of each type of data of each piece of running log data, and further acquiring the abnormal degree of each type of data of the whole running log data.
Step S2 includes step S20, specifically as follows:
S20: and acquiring the abnormal value of each type of data of each piece of operation log data, and obtaining the abnormal degree of each type of data of the whole operation log data according to the abnormal value of each type of data of each piece of operation log data.
It should be noted that, the conventional isolated forest algorithm adopts a fixed number of isolated trees, each of which is formed by recursively dividing data into subspaces, until the subspaces only contain one data or reach a predefined stop condition, but the fixed number of isolated trees may cause a problem of under fitting or over fitting, so that abnormal data in the data set cannot be accurately detected, and therefore, when any type of data of the overall operation log data contains more abnormal data, namely, the data of the overall operation log data is more abnormal, the number of isolated trees needs to be more adaptive to the data.
It should be further noted that, when the fluctuation degree of any one type of data of any one piece of running log data is large, it is explained that the abnormal value of the type of data of the running log data is large, that is, the possibility of containing the abnormal data is large, so that the abnormal value of each type of data of each piece of running log data is obtained according to the fluctuation degree of any one type of data of any one piece of running log data, and then the abnormal degree of each type of data of the whole running log data is obtained according to the abnormal value of each type of data of each piece of running log data.
Specifically, an outlier of each type of data of each piece of travel log data is acquired:
；
In the method, in the process of the invention, An outlier of the v-th class data representing the j-th running log data; a value representing the ith and nth class data of the jth travel log data; a mean value of values representing all v-th class data of the j-th running log data; The number of v-th data representing the j-th running log data; the greater the value of the fluctuation degree of the v-th data representing the j-th running log data, the more severe the change of the v-th data of the j-th running log data is indicated; The greater the value of the normalized fluctuation degree, the greater the fluctuation of the v-th class data of the j-th running log data, the more likely the fluctuation is affected by noise or abnormal data, and the greater the abnormal value of the fluctuation is.
Specifically, the degree of abnormality of each type of data of the overall operation log data is acquired:
；
In the method, in the process of the invention, The degree of abnormality of the v-th type data representing the overall operation log data; An outlier of the v-th class data representing the j-th running log data; n represents the number of collected operation log data; Representing a normalization function, adopting a linear normalization function, normalizing each class of data of which the object is the whole operation log data Is a value of (2); the larger the value of (c) indicates that the v-th class of data of the overall operation log data is more likely to contain noise or abnormal data.
S3: the method comprises the steps of adaptively obtaining the number of updated orphaned trees of each type of data of the overall operation log data according to the abnormality degree of each type of data of the overall operation log data, completing construction of the orphaned trees of each type of data of the overall operation log data, obtaining all suspected abnormal data of each type of data of the overall operation log data, obtaining the abnormality expression degree of each suspected abnormal data of each type of data of the overall operation log data, and further obtaining a plurality of noise data of each type of data of the overall operation log data.
Step S3 includes step S30-step S31, specifically as follows:
S30: according to the abnormality degree of each type of data of the whole operation log data, the number of updated isolated trees of each type of data of the whole operation log data is adaptively obtained, the construction of the isolated trees of each type of data of the whole operation log data is completed, and all suspected abnormal data of each type of data of the whole operation log data are obtained.
It should be noted that, because of the characteristic of the isolated forest algorithm, if the degree of abnormality of a certain class of data is greater, it is described that the abnormal data is greater, more isolated trees are needed to identify the abnormal data more accurately at this time, whereas the degree of abnormality of a certain class of data is smaller, it is described that the abnormal data is less, and more accurate abnormal data identification is needed at this time, therefore, the initial value of the isolated tree which is defxed according to the traditional algorithm cannot adapt to each class of data of all pieces of operation log data, therefore, the number of the isolated trees of each class of data of the whole operation log data needs to be self-adapted according to the degree of abnormality of each class of data of the whole operation log data, the construction of the isolated tree of each class of data of the whole operation log data is completed, the abnormal score of each class of data of the whole operation log data is obtained, and all suspected abnormal data of each class of data of the whole operation log data is obtained.
Specifically, the number of the preset isolated trees is M, in the embodiment of the present invention, the number of the preset isolated trees is m=100, and in other embodiments, the number of the preset isolated trees can be preset by an implementation personnel according to specific implementation situations.
Obtaining the number of updated isolated trees of each type of data of the overall operation log data:
；
In the method, in the process of the invention, The number of updated isolated trees of the v-th class data representing the overall operation log data; the degree of abnormality of the v-th type data representing the overall operation log data; m represents a preset number of isolated trees; Representing an upward rounding symbol; when (when) The larger the value of the (a) is, the more likely noise or abnormal data is contained in the v-th data of the overall operation log data, so that the number of preset isolated trees is required to be increased, the number of the updated isolated trees of the v-th data of the overall operation log data is obtained, and the number of the updated isolated trees of each type of data of the overall operation log data is obtained in the same way.
According to the number of the updated isolated trees of the v-th type data of the whole operation log data, constructing an isolated tree for all v-th type data of all the operation log data by using an isolated forest algorithm, acquiring an initial abnormality score of each v-th type data of the whole operation log data, and performing linear normalization processing on the initial abnormality score of each v-th type data of the whole operation log data to acquire an abnormality score of each v-th type data of the whole operation log data.
An abnormality score threshold T1 is preset, when the abnormality score of the ith and the v-th data of the overall operation log data is greater than or equal to the abnormality score threshold T1, the ith and the v-th data of the overall operation log data are recorded as one suspected abnormality data of the v-th data of the overall operation log data, all suspected abnormality data of the v-th data of the overall operation log data are obtained, in the embodiment of the present invention, the abnormality score threshold t1=0.7 is preset, and in other embodiments, an implementer can set the abnormality score threshold according to specific implementation conditions.
S31: the abnormal expression degree of each suspected abnormal data of each type of data of the overall operation log data is obtained, and then a plurality of noise data of each type of data of the overall operation log data are obtained.
It should be noted that, all the suspected abnormal data of each type of data of the overall operation log data are acquired, and all the suspected abnormal data of each type of data of the acquired overall operation log data may contain noise data, so that it is required to distinguish the suspected abnormal data, the known abnormal data are obviously different from the abnormal scores of other data in the abnormal scores, the abnormal data are intensively present, that is, the acquisition time interval between the abnormal data is smaller, so that the abnormal expression degree of each suspected abnormal data of each type of data of the overall operation log data is acquired according to the above feature description, and then a plurality of noise data of each type of data of the overall operation log data are acquired according to the abnormal expression degree of each suspected abnormal data of each type of data of the overall operation log data.
Specifically, according to the sequence before and after the acquisition time of each suspected abnormal data of the v-th data of the overall operation log data, the suspected abnormal data of the v-th data of the overall operation log data are sequenced to obtain a suspected abnormal data sequence of the v-th data; and recording the acquisition time interval between the mth suspected abnormal data of the v-th class data of the overall operation log data and the previous suspected abnormal data in the suspected abnormal data sequence of the v-th class data as the interval time of the mth suspected abnormal data of the v-th class data of the overall operation log data.
Obtaining the abnormal expression degree of each suspected abnormal data of each type of data of the overall operation log data:
；
In the method, in the process of the invention, The abnormal expression degree of the mth suspected abnormal data representing the v-th class data of the overall operation log data; an anomaly score for the mth suspected anomaly data representing the v-th class of data of the overall log data; A mean value of the anomaly scores of all the suspected anomaly data representing the v-th class of data of the overall operation log data; interval time of the mth suspected abnormal data of the v-th class data representing the overall operation log data; the average value of the interval time of all suspected abnormal data of the v-th data of the overall operation log data is represented; Standard deviation of interval time of all suspected abnormal data of v-th class data representing overall operation log data; when the mth suspected abnormal data of the v-th data is positioned at the first of the suspected abnormal data sequences of the v-th data, setting The value of (2) is equal to 1; The larger the absolute value of the difference value of the average value of the final anomaly score of the mth suspected anomaly data and the final anomaly scores of all the suspected anomaly data, which represents the mth suspected anomaly data, the larger the difference between the final anomaly score of the mth suspected anomaly data and the final anomaly score around the mth suspected anomaly data, which indicates that the mth suspected anomaly data is more likely to be anomaly data; The smaller the value of the concentrated distribution degree of the mth suspected abnormal data representing the mth data, the smaller the interval time between the mth suspected abnormal data of the mth data and the previous data in the suspected abnormal data sequence, and the more likely the mth suspected abnormal data is abnormal data; exp () represents an exponential function based on a natural constant, and in the embodiment of the present invention, an exp (-x) model is used to represent an inverse proportion relation, x represents the input of the model, and an implementer can set the inverse proportion function according to actual situations; the absolute value symbol is represented by the absolute value; the larger the value of (c) is, the more likely that the mth suspected abnormal data of the v-th class data of the overall operation log data is abnormal data.
Presetting an abnormal expression degree threshold T2, and if the abnormal expression degree of the mth suspected abnormal data of the v-th class data of the overall operation log data is greater than or equal to the abnormal expression degree threshold, taking the mth suspected abnormal data of the v-th class data of the overall operation log data as initial abnormal data; if the abnormal performance degree of the mth suspected abnormal data of the v-th class data of the overall operation log data is smaller than the abnormal performance degree threshold, the mth suspected abnormal data of the v-th class data of the overall operation log data is judged to be noise data, and a plurality of noise data of the v-th class data of the overall operation log data are obtained.
And similarly, acquiring a plurality of noise data of each type of data of the whole operation log data.
S4: acquiring each type of update data of the whole operation log data according to a plurality of noise data of each type of data of the whole operation log data, judging the abnormal condition of each type of update data of the whole operation log data according to each type of update data of the whole operation log data, and further judging the abnormal condition of a telecommunication base station.
In order to improve the detection accuracy of the overall abnormal data, the noise data of each type of data of the overall operation log data is deleted and then the abnormal data is detected.
Specifically, deleting noise data in each type of data of the whole operation log data to obtain each type of updated data of the whole operation log data, detecting abnormal data in each type of updated data of the whole operation log data by using an LOF algorithm, and when abnormal data exists in any type of updated data of the whole operation log data, indicating that the telecommunication base station has abnormal conditions.
The beneficial effects are that: according to the method, the number of the isolated trees is adaptively acquired according to the degree of abnormality of each type of data of the whole operation log data, so that suspected abnormal data are obtained, the greater the degree of abnormality is, the more suspected abnormal data possibly exist in the data, the more isolated trees are needed, and conversely, the problem that the use of a fixed number of isolated trees possibly causes under fitting or over fitting is avoided, the obtained suspected abnormal data are more accurate, furthermore, the degree of abnormality is acquired by combining the abnormal value of each type of data of each operation log data, the acquisition of the degree of abnormality is more accurate, the degree of abnormal performance of the suspected abnormal data is finally acquired, the noise data in each type of data of the whole operation log data are obtained, abnormal data detection is carried out after the noise data are deleted, so that whether the abnormal condition exists in the telecommunication base station is judged, the abnormal data of the whole operation log data can be accurately detected, and the abnormal condition judgment of the telecommunication base station is more accurate.
The embodiment of the invention also discloses a system for inspecting the telecommunication base station, which comprises a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the method for inspecting the telecommunication base station is realized.
The above system further comprises other components well known to those skilled in the art, such as a communication bus and a communication interface, the arrangement and function of which are known in the art and therefore are not described in detail herein.
In the context of this patent, the foregoing memory may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. For example, the computer readable storage medium may be any suitable magnetic or magneto-optical storage medium, such as, for example, resistance change memory, dynamic random access memory, static random access memory, enhanced dynamic random access memory, high bandwidth memory, hybrid storage cube, etc., or any other medium that can be used to store the desired information and that can be accessed by an application, a module, or both. Any such computer storage media may be part of, or accessible by, or connectable to, the device.
While various embodiments of the present invention have been shown and described herein, it will be obvious to those skilled in the art that such embodiments are provided by way of example only. Many modifications, changes, and substitutions will now occur to those skilled in the art without departing from the spirit and scope of the invention. It should be understood that various alternatives to the embodiments of the invention described herein may be employed in practicing the invention.
The above embodiments are not intended to limit the scope of the present invention, so: all equivalent changes in structure, shape and principle of the invention should be covered in the scope of protection of the invention.
Claims (9)
1. A method of inspecting a telecommunications base station, comprising the steps of:
collecting each piece of operation log data of a telecommunication base station; acquiring outliers of each class of data of each piece of operation log data Wherein, the method comprises the steps of, wherein,A value representing the ith and nth class data of the jth travel log data; a mean value of values representing all v-th class data of the j-th running log data; The number of v-th data representing the j-th running log data; normalizing the sum of abnormal values of each type of data of all pieces of operation data, and taking the normalized sum as the abnormal degree of each type of data of the whole operation log data;
obtaining the number of updated isolated trees of each type of data of the whole operation log data, constructing an isolated tree of each type of data of the whole operation log data, and obtaining suspected abnormal data of each type of data of the whole operation log data, wherein the number of updated isolated trees is in direct proportion to the degree of abnormality;
obtaining the abnormal expression degree of each suspected abnormal data:
；
In the method, in the process of the invention, The abnormal expression degree of the mth suspected abnormal data representing the v-th class data of the overall operation log data; an anomaly score for the mth suspected anomaly data representing the v-th class of data of the overall log data; A mean value of the anomaly scores of all the suspected anomaly data representing the v-th class of data of the overall operation log data; interval time of the mth suspected abnormal data of the v-th class data representing the overall operation log data; the average value of the interval time of all suspected abnormal data of the v-th data of the overall operation log data is represented; standard deviation of interval time of all suspected abnormal data of v-th class data representing overall operation log data;
the abnormal expression degree is inversely proportional to the concentrated distribution degree of the suspected abnormal data and is directly proportional to the abnormal score difference of the suspected abnormal data;
Based on the abnormal expression degree, acquiring noise data of each type of data of the whole operation log data, deleting the noise data, acquiring each type of updated data of the whole operation log data, performing abnormal detection, and judging whether the abnormal condition exists in the telecommunication base station.
2. The method according to claim 1, wherein the steps of obtaining the updated orphan tree number of each type of data of the whole operation log data and constructing the orphan tree of each type of data of the whole operation log data include:
The method comprises the steps of (1) upwardly rounding the product of the abnormality degree of each type of data of the whole operation log data and the number of preset isolated trees, and then using the product as the updated isolated tree number of each type of data of the whole operation log data; and constructing an isolated tree for all each type of data of all pieces of operation log data by using an isolated forest algorithm according to the number of the updated isolated trees.
3. The method for inspecting a telecommunications base station according to claim 2, wherein the obtaining suspected abnormal data of each type of data of the overall operation log data comprises:
according to the isolated tree, obtaining an initial anomaly score of each type of data of the overall operation log data, and performing linear normalization processing on all initial anomaly scores to obtain an anomaly score of each type of data of the overall operation log data;
presetting an abnormality score threshold, and when the abnormality score of the ith and the v-th types of data of the overall operation log data is greater than or equal to the abnormality score threshold, marking the abnormality score as one suspected abnormality data of the v-th types of data of the overall operation log data, and acquiring all suspected abnormality data of each type of data of the overall operation log data.
4. The method for inspecting a telecommunications base station according to claim 1, wherein the obtaining the abnormal performance level of each suspected abnormal data comprises:
And taking the product of the inverse proportion value of the concentrated distribution degree of each suspected abnormal data of each type of data of the whole operation log data and the difference of the abnormal score of each suspected abnormal data of each type of data of the whole operation log data as the abnormal expression degree of each suspected abnormal data of each type of data of the whole operation log data.
5. The method according to claim 4, wherein the obtaining the difference in anomaly score of each suspected anomaly data of each class of data of the overall operation log data comprises:
obtaining the difference absolute value of the mean value of the abnormal score of each suspected abnormal data of each type of data of the whole operation log data and the abnormal score of all suspected abnormal data of each type of data of the whole operation log data, and recording the difference absolute value as the abnormal score difference of each suspected abnormal data of each type of data of the whole operation log data.
6. The method for inspecting a telecommunications base station according to claim 4, wherein the obtaining the centralized distribution degree of each suspected abnormal data of each class of data of the overall operation log data comprises:
Acquiring a difference value between the interval time of each suspected abnormal data of each type of data of the overall operation log data and the interval time average value of all suspected abnormal data of each type of data of the overall operation log data, and recording the difference value as a time interval difference value; and acquiring the ratio of the time interval difference value to the standard deviation of the interval time of all the suspected abnormal data of each type of data of the whole operation log data as the concentrated distribution degree of each suspected abnormal data of each type of data of the whole operation log data.
7. The method according to claim 6, wherein the interval for acquiring each suspected abnormal data of each class of data of the overall operation log data comprises:
Sequencing the suspected abnormal data of any type of data of the overall operation log data according to the front-back sequence of the acquisition time of the suspected abnormal data of the data of any type of the overall operation log data to obtain a suspected abnormal data sequence of the data; and recording the acquisition time interval between any one suspected abnormal data of the type of data of the overall operation log data and the previous suspected abnormal data in the suspected abnormal data sequence of the type of data as the interval time of the suspected abnormal data of the type of data of the overall operation log data.
8. The method for inspecting a telecommunication base station according to claim 1, wherein the steps of obtaining noise data of each type of data of the overall operation log data and deleting the noise data to obtain each type of updated data of the overall operation log data, performing anomaly detection, and determining whether the telecommunication base station has an anomaly condition include:
Presetting an abnormal expression degree threshold, judging the suspected abnormal data of any one type of data of the overall operation log data as noise data when the abnormal expression degree of any one suspected abnormal data of any one type of data of the overall operation log data is smaller than the abnormal expression degree threshold, deleting the noise data to obtain each type of updated data of the overall operation log data, detecting the abnormal data in each type of updated data of the overall operation log data by using an abnormal algorithm, and when the abnormal data exists in any type of updated data of the overall operation log data, judging that the telecommunication base station has abnormal conditions.
9. A patrol system for a telecommunications base station, comprising: a processor and a memory storing computer program instructions which, when executed by the processor, implement a method of patrol of a telecommunications base station according to any one of claims 1-8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410612666.6A CN118200950B (en) | 2024-05-17 | 2024-05-17 | Method and system for inspecting telecommunication base station |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410612666.6A CN118200950B (en) | 2024-05-17 | 2024-05-17 | Method and system for inspecting telecommunication base station |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN118200950A CN118200950A (en) | 2024-06-14 |
| CN118200950B true CN118200950B (en) | 2024-08-02 |
Family
ID=91405417
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202410612666.6A Active CN118200950B (en) | 2024-05-17 | 2024-05-17 | Method and system for inspecting telecommunication base station |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN118200950B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN118523963B (en) * | 2024-07-23 | 2024-10-01 | 湖北华中电力科技开发有限责任公司 | Power information network security risk assessment method and system |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115733682A (en) * | 2022-11-14 | 2023-03-03 | 国网浙江省电力有限公司宁波市奉化区供电公司 | Real-time monitoring method for unattended business hall query desk based on weblog |
| CN117312825A (en) * | 2023-09-26 | 2023-12-29 | 航天信息股份有限公司 | Target behavior detection method and device, electronic equipment and storage medium |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR101623071B1 (en) * | 2015-01-28 | 2016-05-31 | 한국인터넷진흥원 | System for detecting attack suspected anomal event |
| CN113961434A (en) * | 2021-09-29 | 2022-01-21 | 西安交通大学 | Method and system for monitoring abnormal behaviors of distributed block chain system users |
| JP2024053294A (en) * | 2022-10-03 | 2024-04-15 | トヨタ自動車株式会社 | Component management system and component management method |
| CN117585554B (en) * | 2024-01-02 | 2024-05-24 | 广东工程宝科技有限公司 | Equipment inspection method and inspection system |
-
2024
- 2024-05-17 CN CN202410612666.6A patent/CN118200950B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115733682A (en) * | 2022-11-14 | 2023-03-03 | 国网浙江省电力有限公司宁波市奉化区供电公司 | Real-time monitoring method for unattended business hall query desk based on weblog |
| CN117312825A (en) * | 2023-09-26 | 2023-12-29 | 航天信息股份有限公司 | Target behavior detection method and device, electronic equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN118200950A (en) | 2024-06-14 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN118200950B (en) | Method and system for inspecting telecommunication base station | |
| CN111796957B (en) | Transaction abnormal root cause analysis method and system based on application log | |
| CN114422379B (en) | Analysis method for multi-platform equipment wireless networking | |
| CN117572837B (en) | Intelligent power plant AI active operation and maintenance method and system | |
| CN115576738A (en) | Method and system for realizing equipment fault determination based on chip analysis | |
| CN117454283A (en) | State evaluation method for wind turbine generator operation detection data | |
| CN116306806A (en) | Fault diagnosis model determining method and device and nonvolatile storage medium | |
| CN115184674A (en) | Insulation test method and device, electronic terminal and storage medium | |
| CN117114420B (en) | Image recognition-based industrial and trade safety accident risk management and control system and method | |
| CN114138601A (en) | Service alarm method, device, equipment and storage medium | |
| CN117596133A (en) | Service portrayal and anomaly monitoring system and monitoring method based on multidimensional data | |
| CN117743120A (en) | Network card abnormality detection method based on big data technology | |
| CN108536777B (en) | Data processing method, server cluster and data processing device | |
| CN114518988B (en) | Resource capacity system, control method thereof, and computer-readable storage medium | |
| CN112732773B (en) | Method and system for checking uniqueness of relay protection defect data | |
| CN115659271A (en) | Sensor abnormality detection method, model training method, system, device, and medium | |
| CN111882135B (en) | Internet of things equipment intrusion detection method and related device | |
| CN112882854B (en) | Method and device for processing request exception | |
| CN115981911A (en) | Memory failure prediction method, electronic device and computer-readable storage medium | |
| CN112714288A (en) | Intelligent monitoring method and device and monitoring equipment | |
| CN117076184B (en) | Transaction system detection method, device and storage medium | |
| CN115334121B (en) | Automobile engine running state monitoring system based on industrial Internet of things | |
| CN117723917B (en) | Monitoring application method based on optical fiber extrinsic Fabry-Perot type ultrasonic sensor | |
| CN117688452B (en) | Food pesticide residue detection and early warning method and system based on neural network | |
| CN115854490B (en) | Analysis method and system for dehumidifier state monitoring |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |