TWI763177B - Management system and method for a plurality of network devices and computer readable medium - Google Patents

Abstract

The present invention discloses a management system and method for a plurality of network devices. First, event lists regarding multiple network devices, and operating data and network data of multiple network devices are recorded; next, data compensation or prediction, dimensional value collection, contribution filtering, dimensional grouping, and root cause analysis with respect to event lists, operating data, and network data are performed in order to obtain a root cause of network anomaly, such that an autonomous decision-making performance management of multiple network devices can be carried out based on the root cause of the network anomaly. The present invention further provides a computer readable medium for executing the management method for multiple network devices of the present invention.

Description

Management system, method and computer readable medium for multiple network devices

The present invention relates to a technology for wireless communication network equipment, and more specifically, to a management system, method and computer readable medium for wireless communication network equipment.

With the ever-increasing amount of mobile data and supporting various new services and application scenarios, the 5th Generation Wireless System (5G) or future mobile communication systems are expected to have huge mobile data and device connections. For example, in order to provide proper network services, a network splitting (Network Splitting) architecture that separates a traditional base station into several units, such as a central unit (CU), a distributed unit (DU), and a radio unit ( Radio Unit, RU).

In addition, with the popularization of emerging information technology applications such as mobile devices, the Internet of Things and cloud services, the Internet and the physical world have gradually merged. Although emerging information and communication technologies have brought convenience to human life, they are not conducive to the continuous evolution of enterprise information architecture. During the process, maintenance and operation are faced with greater challenges. The equipment boundaries and data scale to be maintained continue to grow, and fault location becomes difficult. The maintenance and operation management that relies on a large number of human decision-making can no longer cope with the huge, complex, fast, and evolving supply and installation requirements. Challenges of network systems.

Therefore, how to effectively maintain 5G and other wireless network equipment is an urgent issue to be solved in the industry.

To solve the above problems and other problems, the present invention discloses a management system, method and computer readable medium for multiple network devices.

The management system for multiple network devices of the present invention includes: an event list module for recording event lists related to multiple network devices; a system log module for recording the operation of the multiple network devices data; a network log module for recording the network data of the plurality of network devices; and a root cause analysis module for sequentially performing data compensation on the event ticket, the operation data, and the network data Or prediction, dimension value aggregation, contribution filtering, dimension grouping, and root cause analysis to obtain the root cause of network anomalies.

The management system for multiple network devices of the present invention further includes a performance management module, wherein the root cause analysis module transmits the root cause of the network abnormality to the performance management module for the performance management module to use. The group performs autonomous decision performance management on the plurality of network devices according to the root cause of the network abnormality.

The management system for a plurality of network devices of the present invention further includes a probe module, wherein the probe module actively and periodically inquires or passively receives the plurality of Monitoring indicator data of network equipment, so that when the monitoring indicator data is abnormal, the event ticket module is notified to generate the event ticket.

The management method for a plurality of network devices of the present invention includes: recording an event list about a plurality of network devices, operation data and network data of the plurality of network devices; Execute data compensation or prediction, dimension value aggregation, contribution filtering, dimension grouping, and root cause analysis in sequence on the operation data and the network data, so as to obtain the root cause of network anomalies.

In one embodiment, the operational data includes equipment, equipment, system, and routing fault or exception data, and the network data includes network traffic or packet data.

In one embodiment, performing the data compensation or prediction includes performing the data compensation or prediction according to historical data; performing the contribution filtering includes calculating the contribution according to the severity and normal predicted values; performing the dimension grouping includes making the Group members are selected from the group consisting of systems, events, networks, and devices; performing this root cause analysis includes performing root cause analysis within and between groups.

The present invention further provides a computer-readable medium, which is applied to a computing device or a computer and stores instructions for executing the above-mentioned management method for a plurality of network devices.

Therefore, the management system, method and computer-readable medium for multiple network devices of the present invention provide rapid identification of abnormal causes and dynamic adjustment using automated tools, which can effectively improve device service stability and reduce information system maintenance costs.

10: Management System

11: Infrastructure Mods

12: System log module

13: Network log module

14: Probe module

15: Event single module

16: Root cause analysis module

17: Performance Management Module

S201~S207: Steps

FIG. 1 is a schematic block diagram of a management system for multiple network devices according to the present invention.

FIG. 2 is a schematic flowchart of a management method for a plurality of network devices according to the present invention.

The following specific examples illustrate the implementation of the present application, and those skilled in the art can easily understand other advantages and effects of the present application from the content disclosed herein. The structures, proportions, sizes, etc. shown in the drawings attached in this specification are only used to cooperate with the contents disclosed in the specification for familiarity. The understanding and reading of those skilled in the art are not used to limit the conditions for the implementation of this case. Therefore, any modification, change or adjustment should still fall within the scope of this case without affecting the effect and the purpose that can be achieved in this case. The technical content disclosed in this case can be covered within the scope.

Please refer to FIG. 1 , the management system 10 for multiple network devices of the present invention includes the following modules, wherein each module of the management system 10 in FIG. 1 can be software, hardware or firmware; Hardware can be a processing unit, processor, computer or server with data processing and computing capabilities; in the case of software or firmware, it can include instructions executable by the processing unit, processor, computer or server.

The infrastructure module 11, usually in the resource management layer, can record the device information of the network device including the mobile network and/or the physical network and the connection relationship between the devices, for example, the network of pre-transmission, mid-transmission and post-transmission The physical link of the road device and the network routing table information. In addition, the network environment of the fronthaul refers to the connection between the Radio Unit (RU) and the Distributed Unit (DU); the network environment of the midhaul refers to the connection between the DU and the Central Unit (CU). The post-transmission network environment refers to the connection between the CU and the core network (Core).

The system log module 12, usually in the resource management layer, can record operation data of multiple network devices, such as failure or abnormal data of devices, equipment, systems, and routes. In addition, the main function of the system log module 12 is to collect monitoring data of various dimensions, including real-time indicator data and log data of devices, systems, application services, databases and networks.

The network log module 13, usually in the network management layer, can record network data of the plurality of network devices, such as network traffic or packet data. In addition, the main functions of the network log module 13 are bandwidth management, deep packet inspection, and network routing management for forward, intermediate, and post-transmission.

The probe module 14, usually in the network management layer, actively and regularly inquires or passively receives monitoring indicator data of multiple network devices according to the network environment of pre-transmission, mid-transmission and post-transmission, so as to monitor indicators When the data is abnormal, the notification event ticket module 15 generates an event ticket. In addition, these monitoring indicator data include key performance indicators of equipment, such as the status of wireless network equipment, and the connection status of uplink and downlink network equipment. When the indicator is abnormal, it means that the network equipment is faulty, which may be caused by the abnormality of its basic components. Abnormal components can be reflected by one or more key performance indicators (see Table 1) abnormally. For example, when the Sync-E BITS status of the network device becomes abnormal, the passive probe will send the detected change information to the event. In the single module 15, the active probe will check the network device status in a fixed period. If it is different from the set normal value, it will also transmit the abnormal information and the severity level of the event ticket to the event ticket module 15.

The ticket module 15, usually at the network management layer, can record tickets for multiple network devices. In addition, the main function of the event ticket module 15 is to record all abnormal values and alarm management, which can effectively reduce the error rate and improve the overall network performance. When the probe module 14 detects a problem, the event ticket module 15 can generate a time-stamped event ticket (such as Table 2). An event ticket contains many attributes, such as the ticket number, category, and event severity. ...etc, each property has a different property value. For example, the severity attribute of the event ticket is defined according to the severity level of the probe module 14, and there are at least three levels of severity, namely low, medium, and high, and the at least three levels of severity represent different weights in the root cause analysis module 16, respectively. It can speed up finding the root cause.

The root cause analysis module 16 , usually in the network management layer, executes data compensation in sequence on the event ticket of the event ticket module 15 , the operation data of the system log module 12 , and the network data of the network log module 13 . Or prediction, dimension value aggregation, contribution filtering, dimension grouping, and root cause analysis to obtain the root cause of network anomalies. In addition, performing the data compensation or prediction includes performing the data compensation or prediction based on historical data, such as converting missing values therein, and then predicting normal values at abnormal time points according to the processed data, thereby comparing the predicted values The difference from the actual value, to determine whether Abnormal; performing the dimension value aggregation includes summarizing the time value and the predicted value, and summarizing various dimension information according to the dimension order; performing the contribution filtering includes calculating the contribution based on the severity and the normal predicted value; performing the dimension grouping includes making the Group members are selected from the group consisting of systems, events, networks, and devices; performing this root cause analysis includes performing root cause analysis within and between groups, thereby reducing search complexity and accelerating root cause differentiation.

The performance management module 17, usually in the network management layer, the root cause analysis module 16 transmits the root cause of the network abnormality to the performance management module 17 for the performance management module 17 to analyze the root cause of the network abnormality Perform autonomous decision performance management on the plurality of network devices. In addition, the main function of the performance management module 17 is to integrate and manage various key performance indicators of the overall fronthaul, midhaul, and backhaul transmission networks and radio access networks.

Please refer to FIG. 2 , the management method for multiple network devices of the present invention includes the following steps:

In step S201, data is recorded. Specifically, all operating data of network devices (system logs shown in Table 3), all network packets and traffic data of network devices (network logs shown in Table 4), monitored indicator data ( The event list shown in Table 2) shall be recorded.

Table 2. Examples of event tickets.

Table 3. System log example.

Table 4. Examples of network logs.

In step S202, data compensation or prediction is performed. Specifically, convert the data with incomplete data in the event list (such as Table 2), system log (such as Table 3), and network log (such as Table 4), and then enter the data prediction stage. There will be two situations, the first situation is to fill in the missing data; the second situation is to judge the correct value of the outlier, both of which use artificial intelligence methods (such as LSTM, not limited to this algorithm) to predict the anomaly normal value of time, by predicting a positive A constant value pinpoints the root cause of an anomalous point in time. For example, when the data is partially missing, such as No. 21 in Table 4, due to an abnormality in the network log process, the record is missing, and the device information (such as the flow of device 601 and device 602) will be supplemented first, and then the The data prediction stage fills up its value (such as No. 1 in Table 6). For example, when abnormal traffic occurs, such as No. 5 in Table 4, normal network traffic will be predicted based on past data in the data prediction stage (for example, No. 5 in Table 6, the normal traffic is predicted to be 10G). In addition, taking Table 3 as an example, No. 7 is the network abnormality of the device, and other devices should be affected by it and generate an alarm in the future, but the system log is missing due to system abnormality or network problem. At this time, based on past data, event sheets and network logs, artificial intelligence algorithms can be used to predict that after an abnormality occurs in the device network, there will be events such as network port failure and abnormal circuit, and the results predicted by artificial intelligence ( Such as No. 8, 9) fill it back to the log table (see Table 5).

Table 5. Examples of system log compensation and prediction tables.

Table 6. Examples of Network Log Compensation and Prediction Tables.

In step S203, dimension value aggregation is performed. Specifically, after compensating event tickets, network logs and system logs, they are compiled into a table according to the defined format, which contains data of various monitoring dimensions and forecast data, as shown in Table 7.

Table 7. Example of multi-dimensional monitoring indicator table.

In step S204, filtering the contribution degree is performed, which includes calculating the contribution degree first and then filtering the contribution degree. Specifically, the contribution degree is calculated according to its severity and normal predicted value (such as Table 8), and irrelevant data is deleted to reduce the amount of calculation (such as Table 9, which is reserved when the contribution degree exceeds 6), as shown in the number of Table 8 1 and No. 2 have nothing to do with this network abnormality, so the data is filtered out.

Table 8. Examples of calculating contributions from the multi-dimensional monitoring indicator table.

Table 9. Example of filtering multi-dimensional monitoring index table.

In step S205, dimension grouping is performed. That is, according to the dimension, it is divided into system (such as table 10), event ticket (such as table 11), network (such as table 12) and equipment (such as table 13) and other dimensions, forming a dimension grouping table (such as table 13). fourteen).

Table 10. Examples of system dimension groups.

Table 11. Examples of single-dimensional groups of events.

Table 12. Examples of network dimension groups.

Table 13. Examples of equipment dimension groups.

Table 14. Dimension grouping table.

In step S206, root cause analysis is performed. Specifically, the root cause analysis within the group is calculated according to the dimension grouping table (Table 14). For example, there is no root cause in Table 15, but the number 6 can be judged in Table 16. "00103 Loop network abnormality" is the root cause of the network abnormality, followed by number 3. Because the system is abnormal, it will affect the network status. In addition, according to Table 17, the main reason may be the network abnormality of No. 4, followed by the abnormal network of No. 5, and so on to obtain the top three root causes in the group respectively. Then, calculate the root cause analysis between groups, and find out the possible causes of errors according to the comparison between groups. Finally, it can be concluded that the root cause of the abnormality in the network is 2020-02-20 07:56 "Nokia 001 Network Anomaly".

Table 15. Examples of system and event groups.

Table 16. Examples of systems and network groups.

Table 17. Examples of systems, events, and netgroups.

In step S207, performance management is performed. Specifically, automatic configuration adjustment is performed according to the designed rules to achieve the self-regulation capability of network devices.

In addition, the present invention also discloses a computer-readable medium, which is applied to a computing device or computer having a processor (eg, CPU, GPU, etc.) and/or memory, and stores instructions, and can utilize the computing device or computer. The computer executes the computer-readable medium through a processor and/or a memory, so as to execute the above-mentioned methods and steps when executing the computer-readable medium.

To sum up, the management system, method and computer readable medium for multiple network devices of the present invention are designed with various data collection mechanisms, which can greatly grasp the control ability of network devices, and use active/passive probes Technology to manage and support different data access technologies, provide monitoring functions of diversified equipment service information, and use various dimension data to intelligently determine the root cause of the problem and choose the best repair decision plan. Therefore, the present invention can effectively and greatly reduce the investment of excessive manpower to maintain 5G wireless network equipment, and the maintenance and repair time can be shortened from hours to minutes, or even seconds.

The above-mentioned embodiments are only used to illustrate the effect of the present case, but not to limit the present case. Anyone skilled in the art can modify and change the above-mentioned embodiments without departing from the spirit and scope of the present case. Therefore, the scope of protection of the rights in this case should be listed in the scope of the patent application described later.

S201~S207: Steps

Claims (10)

A management system for multiple network devices, comprising: an event list module for recording event lists related to multiple network devices; a system log module for recording operation data of the multiple network devices ; a network log module for recording the network data of the plurality of network devices; and a root cause analysis module for sequentially performing data compensation or Prediction, dimension value aggregation, contribution filtering, dimension grouping, and root cause analysis to obtain the root cause of network anomalies, wherein performing the data compensation or prediction includes performing the data compensation or prediction based on historical data. The management system according to claim 1, further comprising a performance management module, wherein the root cause analysis module transmits the root cause of the network abnormality to the performance management module for the performance management module to use according to the The root cause of network anomalies performs autonomous decision-making performance management for the plurality of network devices. The management system according to claim 1, further comprising a probe module, wherein the probe module actively and periodically inquires or passively receives the plurality of network devices according to the network environment of pre-transmission, mid-transmission and post-transmission The monitoring indicator data, so that when the monitoring indicator data is abnormal, the event ticket module is notified to generate the event ticket. The management system according to claim 1, wherein performing the contribution degree filtering comprises calculating the contribution degree according to the severity and the normal predicted value, and performing the dimension grouping comprises selecting the group members from systems, events, networks, and A group of devices, and performing the root cause analysis includes performing a within-group and between-group root cause analysis. A management method for multiple network devices, comprising: Recording event tickets, operation data and network data of multiple network devices; and sequentially performing data compensation or prediction, dimension values for the event tickets, the operation data, and the network data Aggregation, contribution filtering, dimension grouping, and root cause analysis to obtain the root cause of network anomalies, wherein performing the data compensation or prediction includes performing the data compensation or prediction based on historical data. The management method according to claim 5, further comprising performing autonomous decision-making performance management on the plurality of network devices according to the root cause of the network abnormality. The management method as described in claim 5, further comprises actively periodically inquiring or passively receiving monitoring indicator data of the plurality of network devices according to the network environment of pre-transmission, mid-transmission and post-transmission, so that when the monitoring indicator data is abnormal, Generate the event ticket. The management method according to claim 5, wherein performing the contribution degree filtering comprises calculating the contribution degree according to the severity and the normal predicted value, and performing the dimension grouping comprises selecting the group members from the system, the event, the network, and the system after the grouping. A group of devices, and performing the root cause analysis includes performing a within-group and between-group root cause analysis. The management method of claim 5, wherein the operation data includes equipment, equipment, system, and routing failure or abnormal data, and the network data includes network traffic or packet data. A computer-readable medium, applied in a computing device or a computer, stores instructions for executing the management method for a plurality of network devices as described in any one of claim 5 to 9.

Images