WO2021057382A1 - 一种异常检测方法、装置、终端及存储介质 - Google Patents

一种异常检测方法、装置、终端及存储介质 Download PDF

Info

Publication number
WO2021057382A1
WO2021057382A1 PCT/CN2020/112150 CN2020112150W WO2021057382A1 WO 2021057382 A1 WO2021057382 A1 WO 2021057382A1 CN 2020112150 W CN2020112150 W CN 2020112150W WO 2021057382 A1 WO2021057382 A1 WO 2021057382A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
performance index
cluster set
objects
abnormal
Prior art date
Application number
PCT/CN2020/112150
Other languages
English (en)
French (fr)
Inventor
郭天
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US17/278,483 priority Critical patent/US12063528B2/en
Priority to EP20864266.0A priority patent/EP3843445A4/en
Publication of WO2021057382A1 publication Critical patent/WO2021057382A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/02—Arrangements for optimising operational condition
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/23—Clustering techniques
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0806—Configuration setting for initial configuration or provisioning, e.g. plug-and-play
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0813—Configuration setting characterised by the conditions triggering a change of settings
    • H04L41/0816—Configuration setting characterised by the conditions triggering a change of settings the condition being an adaptation, e.g. in response to network events
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0893—Assignment of logical groups to network elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0895—Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/142—Network analysis or design using statistical or mathematical methods
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/40—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using virtualisation of network functions or resources, e.g. SDN or NFV entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/20—Arrangements for monitoring or testing data switching networks the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/04—Arrangements for maintaining operational condition
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/147—Network analysis or design for predicting network behaviour
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/149—Network analysis or design for prediction of maintenance
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/16—Threshold monitoring

Definitions

  • the embodiment of the present application relates to a wireless communication network, and specifically relates to an abnormality detection method, device, terminal, and storage medium.
  • an embodiment of the present application provides an anomaly detection method, including: generating at least one cluster set of the object according to the configuration data and performance index data of the object; according to a preset anomaly detection algorithm and the corresponding object in the cluster set
  • the performance index data determines the algorithm configuration parameters corresponding to each cluster set; the abnormal performance index data of the objects in the corresponding cluster set are determined according to the algorithm configuration parameters, and the abnormal objects are determined according to the abnormal performance index data.
  • An embodiment of the application provides an abnormality detection device, including: a cluster set generation module, configured to generate at least one cluster set of an object based on the configuration data and performance index data of the object; a parameter determination module, configured to generate at least one cluster set of an object based on preset abnormalities Detection algorithm and performance index data corresponding to the objects in the clustering set to determine the algorithm configuration parameters corresponding to each clustering set; anomaly detection module for determining the abnormal performance indicators of the objects in the corresponding clustering set according to the algorithm configuration parameters Data, the abnormal object is determined according to the abnormal performance index data.
  • An embodiment of the present application provides a terminal, including: a memory and one or more processors; wherein the memory is configured to store one or more programs; when the one or more programs are used by the one or more Execution by two processors, so that the one or more processors implement any one of the methods in the embodiments of the present application.
  • the embodiment of the present application provides a storage medium storing a computer program, where the computer program implements any one of the methods in the embodiments of the present application when the computer program is executed by a processor.
  • FIG. 1 is a schematic diagram of the basic structure of an existing wireless communication network system
  • FIG. 3 is a flowchart of processing configuration data in an anomaly detection method provided by an embodiment of the application.
  • FIG. 4 is a flowchart of processing for determining a cluster set in an anomaly detection method provided by an embodiment of the application
  • FIG. 5 is a flowchart of another abnormality detection method provided by an embodiment of the application.
  • FIG. 6 is a schematic diagram of a logical dependency relationship between objects provided by an embodiment of this application.
  • FIG. 7 is a schematic diagram of attribution reduction of an abnormal object provided by an embodiment of the application.
  • FIG. 8 is a schematic block diagram of the structure of an abnormality detection device provided by an embodiment of the application.
  • FIG. 9 is a schematic diagram of the processing flow of another anomaly detection device provided by an embodiment of the application.
  • FIG. 10 is an example diagram of a wireless communication network system provided by an embodiment of this application.
  • FIG. 11 is a schematic structural diagram of a terminal provided by an embodiment of the application.
  • FIG. 1 is a schematic diagram of the basic structure of an existing wireless communication network system.
  • the wireless communication network system mainly includes a core network 140, a base station 130, a cell 120, a terminal 110, and a transmission link 150.
  • the object includes functional modules for constructing a wireless communication network system.
  • the objects are not limited to the above-listed ones, and may also be baseband processing modules, radio frequency processing modules, etc., which are not specifically limited in the embodiment of the present application.
  • the terminal 110 is a general term for network access devices used by users.
  • the terminal may be a mobile phone.
  • the terminal and the base station perform wireless data interaction through their respective antennas, and then access the network to perform upload services (such as voice calls or access to the Internet, etc.).
  • the base station 130 is a core device for constructing a wireless communication network system. It interacts with the terminal through a wireless communication protocol on the upper side, and interacts with the core network through a transmission link on the lower side, and is responsible for opening a data channel between the terminal and the core network. Most wireless communication protocols are implemented in the base station.
  • the cell 120 is a virtual management object.
  • planners In order to achieve the best balance of coverage, interference, access capacity and other factors for wireless signals in the service area of the system, planners generally divide the entire service area into many cells, and set a different cell for each cell. Parameters to achieve the goal. In most cases, the terminal will generally access the network through a geographically close cell.
  • the core network 140 is responsible for terminal user authentication, billing, and processing of all service data. After the base station opens the data channel from the terminal to the core network, the service data (such as voice data and Internet data) initiated by the terminal must be processed or forwarded through the core network.
  • the service data such as voice data and Internet data
  • the transmission link 150 generally refers to a wired transmission link connecting the base station and the core network. Since all terminal service data must eventually be aggregated to the core network through the base station, there are generally high requirements on the bandwidth, reliability and delay of the transmission link.
  • FIG. 1 is only a schematic diagram of the architecture of a wireless communication network system, and the network architecture of an actual wireless communication network system is more complicated.
  • the network architecture shown in FIG. 1 is conceptually correct, and can help understand the basic structure of the wireless communication network system and the technical problems to be solved by the embodiments of the present application.
  • the 3GPP standards organization has formulated a batch of basic performance index PI and key performance index KPI in multiple standard documents, and gave The meaning of the indicators, collection content, collection conditions and related calculation formulas are presented. All communication equipment manufacturers must comply with the requirements of the standard, implement and report these PIs in the network equipment, and at the same time summarize the PI in the network management system (hereinafter referred to as the network management system), and calculate the KPI according to the formula.
  • equipment vendors and operators generally also design and implement a batch of PIs or KPIs outside the standard according to their own specific needs to monitor key system operating conditions.
  • Network management generally implements some auxiliary functions to help operation and maintenance personnel observe and analyze these data.
  • the network manager provides a visual kanban system that allows users to observe and understand data in the form of charts.
  • the network manager provides descending sorting and filtering, allowing users to focus on the indicators with the largest changes.
  • the network management system provides an alarm system. Users can set up alarm thresholds or rules for specified indicators, and report an alarm when the indicator value exceeds the threshold or triggers the rule, so that the user is aware of system abnormalities.
  • the network management system can reduce the burden of some manual analysis indicators, there are still some shortcomings. For example, analysis coverage is low. Even with the aid of tools such as the Kanban system, TopN or screening, the number of indicators that can be observed and analyzed by humans at the same time is still very limited (generally no more than 10), which is mainly determined by the inherent limitations of people. For another example, it is difficult to specify appropriate alarm thresholds or triggering rules.
  • the communication system is complex and changeable. Different times, different spaces, different business scenarios, and different configurations will have different effects on the performance of the same index. It is difficult to operate in such a changeable scenario based on human experience and knowledge alone. For related indicators, accurately define what is abnormal and what is normal.
  • the empirical knowledge base can be in the form of marked historical performance index data (that is, abnormal performance index data has been marked), or a set of pattern recognition rules set.
  • the former is generally used to assist statistical training procedures to obtain the detection threshold, while the latter is directly used to detect abnormal performance index data.
  • the first type of solution continues the problem-solving method of the expert system, and its effect is similar: the more complete the expert rules in the system, the more accurate the result, and the problem to be solved will not change significantly, then the effect of the expert system operation would be better.
  • the actual situation is generally not so ideal, and it usually has the following limitations: the cost of manually collecting and summarizing expert rules is very high; due to the limitations of people, the completeness and accuracy of expert rules are difficult to guarantee; there are many in reality The problems to be solved are not static.
  • the current mainstream algorithms for anomaly detection basically use historical performance index data as the only input, that is, predict the future based on the history of performance index data only, which affects the accuracy of the detection results.
  • the embodiment of the present application provides an abnormality detection method to solve the above technical problem.
  • FIG. 2 is a method flowchart of an abnormality detection method provided by an embodiment of the application, and the method may be executed by an abnormality detection apparatus.
  • the device can be implemented by software and/or hardware, and can generally be integrated in a network management system, or exist independently of the network management system.
  • the method provided by the embodiment of the present application includes:
  • Step 210 Generate at least one cluster set of the object according to the configuration data and performance index data of the object.
  • the object includes functional modules for constructing a wireless communication network system.
  • the objects may be core networks, base stations, cells, terminals, and transmission links. It can be understood that the object is related to the composition of the wireless communication network system, and when the composition of the wireless communication network system changes, the object also changes.
  • the configuration data may be attribute information of the object in terms of configuration.
  • configuration data may include configuration data related to spatial information.
  • the configuration data may also include configuration data related to performance indicators.
  • the type of configuration data can be determined according to the type of performance index data to be subjected to anomaly detection, and then the corresponding type of configuration data can be selected for further processing. It is understandable that when there are multiple types of performance index data to be subjected to anomaly detection, or the performance index data to be subjected to anomaly detection includes multiple indicators, multiple types of configuration data need to be selected. It should be noted that when the wireless communication network system is constructed and started to operate, the configuration data is usually fixed and unchanged. Therefore, when the configuration data changes, the configuration data of the object in the wireless communication network system needs to be re-acquired from the network manager.
  • the performance index data may be data related to the performance index.
  • Performance indicators are evaluation criteria for monitoring network quality and performance. Performance indicators include PIs or KPIs specified by 3GPP, and can also include PIs or KPIs outside the standards set by equipment vendors and operators themselves. It should be noted that the performance index data is related to the operation of the wireless communication network system, and the wireless communication network system needs to periodically obtain the performance index data.
  • the acquisition period of the performance indicator data is usually aligned with the report update period of the performance indicator data reported by the network device. For example, the acquisition cycle is the same as the reporting update cycle. Or, there is an integer multiple relationship between the acquisition period and the reporting update period.
  • the clustering set is a set obtained by clustering comprehensively considering the characteristics of the configuration data and performance index data corresponding to the object. Since the performance index data is acquired periodically, at least one cluster set generated based on the performance index data of the current acquisition period contains objects that have similar performance index characteristics and fluctuation patterns in the current acquisition period. For example, objects can be clustered based on the characteristics of configuration data and performance index data, respectively, to obtain a sub-cluster set based on configuration data and a sub-cluster set based on performance index data. Comprehensively consider the characteristics of the data in the two sub-cluster sets, and perform logical operations on the two sub-cluster sets to obtain at least one cluster set of objects. The performance index data of the objects in the same cluster set have similar performance index characteristics and fluctuations mode.
  • the performance index data is obtained periodically, and accordingly, the generation of the cluster set is also periodic, and the period of generating the cluster set is related to the period of obtaining the performance index data.
  • Step 220 Determine the algorithm configuration parameters corresponding to each clustering set according to the preset anomaly detection algorithm and the performance index data corresponding to the objects in the clustering set.
  • anomaly detection algorithm is an algorithm for detecting anomalous objects based on the object's performance index data.
  • anomaly detection algorithms may include: low-pass filter type algorithms, density-based detection algorithms, cluster detection algorithms, and support vector machine algorithms.
  • low-pass filter type algorithms include moving average or Kalman filter and its variants.
  • Density-based detection algorithms include k-nearest neighbor or local anomaly factor algorithm and its variants.
  • the clustering detection algorithm includes k-means clustering and its variants.
  • Support vector machine algorithms include single-type support vector machine algorithms and their variants.
  • the algorithm configuration parameter is the parameter required for running the anomaly detection algorithm to perform anomaly detection.
  • the threshold value of abnormality detection can be determined based on the algorithm configuration parameters. Because the algorithm configuration parameters correspond to each clustering set, it is realized as objects with different characteristics, and different algorithm configuration parameters are generated in different time intervals, which reduces the workload of manual analysis and parameter adjustment in the field of performance indicator detection, and improves Adaptability of detection methods.
  • the method of determining the algorithm configuration parameters may be: performing the preset anomaly detection based on the performance index data of the objects in each clustering set.
  • the algorithm is trained to obtain the algorithm configuration parameters corresponding to each clustering set. For example, based on a preset acquisition period, performance index data is acquired. After cleaning and regularizing the currently acquired performance index data, sample data for training the preset anomaly detection algorithm is obtained. The sample data has a corresponding relationship with the object. Traverse the cluster set, and use the sample data corresponding to the object in each cluster set to train the preset anomaly detection algorithm, and obtain the algorithm configuration parameters suitable for each cluster aggregation.
  • the preset anomaly detection algorithm is trained according to the performance index parameters corresponding to the objects in the cluster set. Get the algorithm configuration parameters applicable to the first clustering set.
  • the preset anomaly detection algorithm is trained according to the performance index parameters corresponding to the objects in the cluster set, and the algorithm configuration parameters suitable for the second cluster set are obtained.
  • the preset anomaly detection algorithm is trained according to the performance index parameters corresponding to the objects in the cluster set, and the algorithm configuration parameters suitable for the sixth cluster set are obtained.
  • Step 230 Determine the abnormal performance index data of the objects in the corresponding cluster set according to the algorithm configuration parameters, and determine the abnormal object according to the abnormal performance index data.
  • abnormal performance index data is abnormal performance index data.
  • the preset anomaly detection algorithm can be used to detect whether the performance index data is abnormal. Since the performance index data corresponds to the object, after the abnormal performance index data is detected, the object corresponding to the abnormal performance index data can be determined based on the abnormal performance index data, that is, the abnormal object.
  • the target performance index data corresponding to the objects in the cluster set to be detected is obtained. Determine the target algorithm configuration parameters corresponding to the cluster set to be detected. Perform anomaly detection on the target performance index data according to the preset anomaly detection algorithm and target algorithm configuration parameters, determine the abnormal performance index data in the target performance index data according to the abnormality detection result, and determine the object corresponding to the abnormal performance index data as the abnormal object.
  • Each cluster set may include at least one object.
  • a wireless network communication system includes 10 cells. After clustering the cells based on configuration data and performance index data, 6 cluster sets are obtained, and each cluster set contains 2 cells.
  • a clustering set of the object is arbitrarily obtained as the clustering set to be detected.
  • the preset anomaly detection algorithm is used to perform anomaly detection on the target performance index data, and the abnormal performance index data in the target performance index data is determined according to the abnormality detection result. Perform the above operations on the remaining cluster sets until all objects in the cluster sets have been detected abnormally on the performance index data. Determine all objects corresponding to abnormal performance index data in each cluster set as abnormal objects.
  • the performance index data is obtained periodically, and accordingly, the operation of determining abnormal objects in the cluster set is also periodic, and the period of determining abnormal objects is related to the period of obtaining performance indicator data.
  • the embodiment of the present application provides an anomaly detection method.
  • the object is clustered through the configuration data and performance index data of the object to obtain at least one cluster set; the performance index data corresponding to each cluster set is used to train the preset anomaly
  • the detection algorithm obtains the algorithm configuration parameters corresponding to each cluster set; determines the abnormal performance index data of the objects in the corresponding cluster set based on the preset anomaly detection algorithm and algorithm configuration parameters, and determines the abnormal objects according to the abnormal performance index data.
  • generating at least one cluster set of the object according to the configuration data and performance index data of the object can be optimized to generate at least one cluster set of the object according to the configuration data, performance index data, and running state data of the object .
  • the operating status data includes service quality data, measurement reports, call tracking data, signaling tracking data, user complaint data, or other data associated with the operating status of the object.
  • the running status data may be one or a combination of several of the above-listed data, which is not specifically limited in the embodiment of the present application.
  • the object's operating status data can reflect the object's operating status, and based on the object's configuration data, performance index data, and operating status data, a cluster set is generated, which can more accurately grasp the operating status and attributes of different objects in the wireless communication network system Features, realize automatic adjustment of algorithm configuration parameters for different systems, different objects, different time intervals and other factors.
  • generating at least one cluster set of the object according to the configuration data, performance index data, and running state data of the object further includes:
  • Logical operations are performed on the first cluster set, the second cluster set, and the third cluster set based on a preset rule to obtain at least one cluster set of the object.
  • the configuration data is basically solidified. Therefore, in the subsequent abnormal detection process, if the configuration data does not change, the configuration data of the object is obtained, and the configuration data is obtained according to the configuration.
  • the data performs clustering processing on the objects, and the operation of generating the first cluster set of the objects is performed only once. If the configuration data changes, the configuration data needs to be reacquired, and the objects are clustered based on the newly acquired configuration data to generate a new first cluster set.
  • FIG. 3 is a flowchart of processing configuration data in an anomaly detection method provided by an embodiment of the application. As shown in FIG. 3, acquiring configuration data of an object, performing clustering processing on the object according to the configuration data, and generating a first cluster set of the object includes:
  • Step 310 The network manager obtains the configuration data of the wireless network management system, and performs cleaning and regularization processing on the obtained configuration data.
  • the configuration data is cleaned to remove duplicate data, erroneous data, and so on. Regularize the configuration data to realize data cleaning, conversion, merging and reshaping.
  • Step 320 Determine the logical dependency relationship of the objects in the wireless communication network system according to the configuration data.
  • the logical dependency is the logical connection between different objects.
  • a base station can correspond to multiple cells.
  • the logical transmission link is a sub-object of the physical transmission link.
  • the logical dependence of objects in a wireless network communication system presents a tree-like structure.
  • Step 330 Perform clustering processing on the objects according to the configuration data related to the spatial information to obtain a spatial clustering set of the objects clustered according to the spatial information.
  • configuration data related to spatial information refers to data that carries an attribute of spatial information in the configuration data.
  • the spatial information may be geographic location and so on.
  • Step 340 Perform clustering processing on the objects according to the configuration data of the set type to obtain a configuration cluster set of objects clustered according to the configuration data of the set type.
  • the selection of the type of configuration data for clustering depends on the KPI or PI index for anomaly detection. For example, if the indicators related to the radio frequency are to be detected for anomaly, the configuration parameters related to the radio frequency are selected for clustering. Or, if the anomaly detection is call-related indicators, then call-related configuration parameters are selected for clustering. In some embodiments, there may be multiple configuration cluster sets obtained by clustering based on different types of configuration data at the same time.
  • the obtained first cluster set includes: the spatial cluster set in step 330 and the configuration cluster set in step 340.
  • step 320 there is no execution order requirement for step 320, step 330, and step 340, and can be executed in the order described in the above example, or executed in reverse order, or can be executed synchronously.
  • FIG. 4 is a flowchart of processing for determining a cluster set in an anomaly detection method provided by an embodiment of the application.
  • the performance index data of the object is acquired, the object is clustered according to the performance index data, and a second cluster set of the object is generated;
  • Clustering processing to generate a third cluster set of the object; logical operations are performed on the first cluster set, the second cluster set, and the third cluster set based on preset rules to obtain at least one cluster of the object
  • the collection process includes:
  • Step 410 Periodically obtain the performance index data and the running status data of the object, and perform cleaning and regularization processing on the performance index data and the running status data, respectively.
  • the acquisition period of the performance index data and the operating state data is determined according to the reporting period of the above-mentioned data. For example, assuming that the reporting period of performance index data or operating status data in the wireless network communication system is x minutes, the acquisition period of acquiring the performance indicator data and operating status data of the object in the embodiment of the present application may also be x minutes. In some implementation manners, according to actual usage scenarios, the acquisition period may also be an integer multiple of the reporting period, which is not specifically limited in the embodiment of the present application.
  • the operating status data includes data such as user call bills, complaint sheets, measurement reports MR, or call tracking CDT.
  • the performance index data includes the index data related to the business volume.
  • the index data related to the business volume may be data corresponding to the index such as the business data volume or the number of handovers.
  • Step 420 Perform clustering processing on the objects in the wireless communication network system according to the indicator data related to the business volume to obtain a business volume cluster set clustered according to the indicator data related to the business volume.
  • the business volume belongs to a performance index
  • clustering is performed based on the related index data of the business volume
  • the obtained business volume clustering set belongs to the second clustering set obtained by clustering the performance index data.
  • Step 430 Perform clustering processing on the objects in the wireless communication network system according to the operating state data to obtain an operating state cluster set clustered according to the operating state data.
  • running state cluster set belongs to the third cluster set.
  • Step 440 Perform logical operations on the spatial clustering set, the configuration clustering set, the business volume clustering set, and the running state clustering set based on preset rules to obtain at least one clustering set of the object.
  • the preset rule is limited information that limits the logical operator or operation sequence of a logical operation. Logical operations are performed on the spatial clustering set, the configuration clustering set, the business volume clustering set, and the running state clustering set based on different preset rules, and the calculation results are different.
  • the preset rule to be selected can be determined according to the target of anomaly detection. For example, the preset rule may be to configure a cluster set AND a business volume cluster set AND a running state cluster set XOR spatial cluster set. Among them, AND is a logical operator that represents an AND operation, and XOR is a logical operator that represents an exclusive OR operation.
  • the preset rule may be to configure a cluster set AND a spatial cluster set AND a running state cluster set XOR a business volume cluster set.
  • the preset rule may be to configure a cluster set AND a business volume cluster set AND a running state cluster set AND a spatial cluster set.
  • the same objects are included in a cluster set.
  • Fig. 5 is a flowchart of another abnormality detection method provided by an embodiment of the application. As shown in Figure 5, the anomaly detection method includes:
  • Step 501 Periodically obtain the performance index data and running status data of the object, and perform cleaning and regularization processing on the performance index data and running status data, respectively.
  • Step 502 Perform clustering processing on the objects in the wireless communication network system according to the operating state data to obtain an operating state cluster set clustered according to the operating state data.
  • Step 503 Perform clustering processing on the objects in the wireless communication network system according to the index data related to the business volume to obtain a business volume cluster set clustered according to the index data related to the business volume.
  • Step 504 Obtain the spatial cluster set of the object and configure the cluster set.
  • Step 505 Perform logical operations on the spatial clustering set, the configuration clustering set, the business volume clustering set, and the running state clustering set based on the preset rules to obtain at least one clustering set of the object.
  • At least one cluster set of objects may be stored in the form of a list, and further, a list storing at least one cluster set is referred to as a cluster set list.
  • Step 506 Obtain each cluster set in the cluster set list, and determine the algorithm configuration parameters corresponding to each cluster set according to the preset anomaly detection algorithm and the performance index data corresponding to the objects in the cluster set.
  • the algorithm configuration parameters include the configuration parameters or threshold values required by the anomaly detection algorithm. It should be noted that which algorithm is selected as the preset anomaly detection algorithm is determined according to actual application scenarios, and the embodiment of the present application does not specifically limit it. In some implementations, the purpose of classifying objects in different states is achieved through the above-mentioned logical operations, thereby simplifying the application scenario. Simpler anomaly detection such as Vector Auto Regression (VAR) can be selected. algorithm.
  • VAR Vector Auto Regression
  • Step 507 Determine the abnormal performance index data of the objects in the corresponding cluster set according to the algorithm configuration parameters, and determine the abnormal object according to the abnormal performance index data.
  • a preset anomaly detection algorithm is used to perform anomaly detection on the performance index data of the objects in each cluster set to obtain abnormal performance index data. According to the corresponding relationship between the performance index data and the object, the abnormal object corresponding to the abnormal performance index data is determined.
  • Step 508 Generate a set of abnormal objects to be determined according to the abnormal objects.
  • Step 509 Obtain the logical dependency relationship of the objects in the wireless communication network system.
  • Step 510 Determine the logical causality of the abnormal object in the set of abnormal objects to be determined based on the logical dependency relationship between the objects.
  • FIG. 6 is a schematic diagram of a logical dependency relationship between objects provided by an embodiment of the application.
  • object 0 has a logical dependency relationship with three other types of objects (ie, object 0-0, object 0-1, and object 0-2); object 0-0 is related to object 0-0-0 and object respectively 0-0-1 has a logical dependency relationship; object 0-1 has a logical dependency relationship with object 0-1-0 and object 0-1-1; object 0-2 has a logical dependency relationship with object 0-2-0 and object 0- respectively 2-1 has a logical dependency.
  • Step 511 Adjust the set of abnormal objects to be determined according to the logical causality to obtain a set of abnormal objects.
  • the logical dependency relationship between the objects traverse down from the topmost child node to obtain an abnormal object and an object that has a logical dependency relationship with the abnormal object (the object at the parent node), and judge Whether the abnormal object and the object at the parent node have similar performance indicator abnormalities. If yes, delete the abnormal object as a child node from the set of abnormal objects to be determined; otherwise, no operation is performed. In the case that there is still an abnormal object that has not been traversed in the cluster set, a new abnormal object is obtained, and the above process is repeated. If the abnormal objects of all cluster sets in the cluster set list have been traversed, the adjusted abnormal object set to be determined is taken as the final abnormal object set.
  • FIG. 7 is a schematic diagram of attribution reduction of an abnormal object provided by an embodiment of the application.
  • object 0-0, object 0-0-0, and object 0-0-1 have similar performance anomalies
  • object 0-0 is the object at the parent node
  • object 0-0-0 and object 0-0-1 are all objects at the child node.
  • the exception of the object at the child node is likely to be caused by the object at the parent node. Therefore, the objects 0-0-0 and 0-0-0 can be deleted from the set of abnormal objects to be determined.
  • Object 0-0-1 has similar performance anomalies
  • object 0-0 is the object at the parent node
  • object 0-0-0 and object 0-0-1 are all objects at the child node.
  • the exception of the object at the child node is likely to be caused by the object at the parent node. Therefore, the objects 0-0-0 and 0-0-0 can be deleted from the set of abnormal objects to be determined.
  • Object 0-0-1 is a schematic diagram of attribution reduction of an abnormal object provided by an embodiment of the application.
  • the abnormality of the object at the child node is attributed to the object at the parent node, thereby achieving
  • the attribution reduction of abnormal objects reduces the redundant data contained in the abnormal object set and improves the accuracy of abnormal object detection.
  • FIG. 8 is a schematic block diagram of the structure of an abnormality detection device provided by an embodiment of the application.
  • the device can be configured in the network management, or it can exist independently of the network management.
  • the device implements the anomaly detection method provided in the embodiments of the present application to accurately detect domestic abnormal objects in the wireless communication network system.
  • the abnormality detection device in the embodiment of the present application includes:
  • the cluster set generating module 810 is configured to generate at least one cluster set of the object according to the configuration data and performance index data of the object;
  • the parameter determination module 820 is configured to determine the algorithm configuration parameters corresponding to each clustering set according to the preset anomaly detection algorithm and the performance index data corresponding to the objects in the clustering set;
  • the anomaly detection module 830 is configured to determine the abnormal performance index data of the objects in the corresponding cluster set according to the algorithm configuration parameters, and determine the abnormal object according to the abnormal performance index data.
  • the anomaly detection device provided by the embodiment of the present application is configured to implement the anomaly detection method of the embodiment shown in FIG. 2, and the implementation principle and technical effect of the anomaly detection device are similar to the anomaly detection method, and will not be repeated here.
  • the object includes a functional module for constructing a wireless communication network system.
  • the cluster set generating module 810 is used to:
  • At least one cluster set of the object is generated.
  • the operating status data includes one or a combination of service quality data, measurement reports, call tracking data, signaling tracking data, and user complaint data.
  • the cluster set generating module 810 is specifically configured to:
  • the operating status data of the object perform clustering processing on the object according to the operating status data, and generate a third cluster set of the object, wherein the operating status data includes service quality data, measurement reports, and call tracking Data, signaling tracking data or user complaint data;
  • Logical operations are performed on the first cluster set, the second cluster set, and the third cluster set based on a preset rule to obtain at least one cluster set of the object.
  • the parameter determination module 820 is specifically configured to:
  • the preset anomaly detection algorithm is trained based on the performance index data of the objects in each cluster set, and the algorithm configuration parameters corresponding to each cluster set are obtained.
  • the abnormality detection module 830 is specifically configured to:
  • the abnormality detection device further includes:
  • the set adjustment module is configured to generate a set of abnormal objects to be determined according to the abnormal objects after the abnormal objects are determined according to the abnormal performance index data; obtain the dependency relationship of the objects in the wireless communication network system, wherein the dependency relationship is based on the The configuration data is determined; based on the dependencies between the objects, determine the logical causality of abnormal objects in the set of abnormal objects to be determined; adjust the set of abnormal objects to be determined according to the logical causality to obtain the set of abnormal objects .
  • FIG. 9 is a schematic diagram of the processing flow of another anomaly detection device provided by an embodiment of the application.
  • the abnormality detection device may include a performance index data preprocessing (loading, cleaning, and regularization) module 901, an abnormality detection algorithm module 902, and configuration data preprocessing (loading, cleaning, and regularization) shown in FIG. 9.
  • Module 903 operating state data preprocessing (loading, cleaning and regularization) module 904, object dependency generation module 905, configuration cluster set generation module 906, operating state cluster set generation module 907, business volume cluster set generation module 908, a cluster set generation module 909, an algorithm configuration parameter generation module 910, and an abnormal object attribution reduction module 911.
  • the performance index data preprocessing module 901 is used to read the performance index data, clean and normalize it, and send the cleaned and normalized data to the anomaly detection algorithm module 902 and the business volume clustering set generation respectively. Module 908.
  • the configuration data preprocessing module 903 is used to read the configuration data of the wireless communication network system, clean and normalize it, and send the cleaned and normalized data to the object dependency generation module 905 and the configuration cluster set respectively Generate module 906.
  • the running state data preprocessing module 904 is used to read the running state data of the objects in the wireless communication network system, clean and regularize them, and send the cleaned and regularized data to the running state cluster set generation module 907.
  • the object dependency generating module 905 is configured to generate a logical dependency of the object based on the configuration data, and send the logical dependency to the abnormal object attribution reduction module 911.
  • the configuration cluster set generation module 906 is used to cluster the objects according to the configuration data to obtain the configuration cluster set and the spatial cluster set of the objects, and send the configuration cluster set and the spatial cluster set to the cluster set generation module 909.
  • the running state cluster set generating module 907 is configured to cluster the objects according to the running state data to obtain the running state cluster set of the objects, and send the running state cluster set to the cluster set generating module 909.
  • the business volume clustering set generating module 908 is configured to cluster the objects according to the business volume to obtain the business volume clustering set of the objects, and send the business volume clustering set to the clustering set generating module 909.
  • the cluster set generating module 909 is configured to perform logical operations on the spatial cluster set, the configuration cluster set, the business volume cluster set, and the running state cluster set according to preset rules to obtain at least one cluster set of the object.
  • at least one cluster set of the object may be stored in the form of a cluster set list.
  • the cluster set generating module 909 sends the cluster set list to the algorithm configuration parameter generating module 910.
  • the algorithm configuration parameter generation module 910 is configured to generate algorithm configuration parameters for each cluster set according to the preset anomaly detection algorithm and the performance index data corresponding to the objects in the cluster set list, and send them to the anomaly detection algorithm module 902.
  • the anomaly detection algorithm module 902 is used to perform anomaly detection on the performance index data in the corresponding cluster set according to the algorithm configuration parameters corresponding to each cluster set, generate a set of abnormal objects to be determined, and send it to the abnormal object attribution Cut down the module 911.
  • the abnormal object attribution reduction module 911 is used to determine the logical causality of abnormal objects in the set of abnormal objects to be determined according to the logical dependence of the objects, and determine the target abnormal objects in the set of abnormal objects to be determined that meet the set rules according to the logical causality , Delete the target abnormal object to obtain the abnormal object set, and output the abnormal object set.
  • FIG. 10 is an example diagram of a wireless communication network system provided by an embodiment of this application.
  • the wireless communication network system includes:
  • a core network numbered: CN_0;
  • Each base station manages 2 cells (10 cells in total), the cell number is: C_0_0 ⁇ C_4_1, the second digit is the base station number (0 ⁇ 4) to which the cell belongs, and the third digit is the cell number (0 ⁇ 1);
  • the configuration data preprocessing module first obtains the configuration data, cleans and regularizes it, and generates an object dependency graph. At this time, the anomaly detection device has learned which objects are contained in the wireless network communication system and the parent-child dependency relationship between the objects, and saves the dependency relationship data for future use. The processed configuration data is then sent to the configuration cluster generation module.
  • the configuration cluster generation module calculates the configuration data related to the spatial information based on the DBSCAN clustering algorithm, and then obtains a cell cluster set clustered according to geographic location and a cell cluster set clustered according to wireless parameter configuration.
  • the cells in the above-mentioned wireless communication network system are clustered by geographic location, and two spatial clustering sets are obtained:
  • LOC_2 [C_2_0,C_2_1,C_3_0,C_3_1,C_4_0,C_4_1]
  • the cells in the above wireless communication network system are clustered according to the wireless configuration, and two configuration cluster sets are obtained:
  • the performance index data preprocessing module reads the performance index data reported by the system, cleans and normalizes it, and sends it to the business volume clustering set generation module, and at the same time caches the data and waits for the anomaly detection algorithm module to be ready to provide data .
  • the running state data preprocessing module reads the running state data reported by the system (in this scenario, the user call ticket), cleans and regularizes it, and sends it to the running state cluster set generation module.
  • the business volume clustering set generation module calculates the received performance index data based on the DBSCAN clustering algorithm to obtain the cell clustering set clustered according to the traffic volume.
  • the running state clustering set generation module calculates the received running state data based on the DBSCAN clustering algorithm, and then the cell clustering set clustered according to the running state data can be obtained.
  • the cells in the above-mentioned wireless communication network system are clustered according to business volume, and two business volume clustering sets are obtained:
  • the cells in the above wireless communication network system are clustered according to the operating state data to obtain an operating state cluster set, which includes all cells. Keep these data for future use.
  • the cluster set generation module can obtain a cluster set list through set operations based on the cluster data obtained in steps 3 and 8.
  • the specific approach is: wireless configuration clustering set AND operating state clustering set AND traffic clustering set XOR spatial clustering set, so that all the cells with similar wireless configuration, operating state and traffic volume but different geographical locations can be obtained The cluster set.
  • the final cluster set list of the cell is:
  • the algorithm configuration parameter generation module uses the cell performance index data in each cluster set as a set according to the obtained cluster set list, and uses the vector autoregressive method for training to obtain the algorithm configuration parameters suitable for the set. After the algorithm configuration calculation is completed for all cluster sets in the cluster set list, the algorithm configuration parameters of each cluster set are passed to the anomaly detection algorithm module.
  • the anomaly detection algorithm module obtains performance indicator data from the performance indicator data preprocessing module, and obtains the cluster set list from the algorithm configuration parameter generation module, as well as the algorithm configuration parameters applicable to each cluster set, and then uses each cluster set
  • the cell in is the unit, and the vector autoregressive algorithm is used for anomaly detection. After all cluster sets are detected, the set of abnormal objects to be confirmed is output to the abnormal object attribution reduction module.
  • the abnormal object attribution reduction module uses the object dependency graph obtained in step 1 to perform attribution reduction on the set of abnormal objects to be confirmed. For example, referring to FIG. 10, the anomaly detection algorithm considers that LL_1_1, LL_3_0, LL_3_1, and PL_3 have similar abnormalities in the indicator of packet loss rate.
  • the abnormal object attribution reduction module is determined according to the dependency relationship between the objects: the objects at the adjacent node of LL_1_1 and the object at the parent node are not abnormal. Therefore, the abnormality is only limited to LL_1_1 itself and does not need to be reduced; and PL_3 is regarded as abnormal The object at the parent node and the objects at all its child nodes have similar exceptions.
  • FIG. 11 is a schematic structural diagram of a terminal provided by an embodiment of the application.
  • the terminal includes a memory 1110 and one or more processors 1120; wherein, the memory 1110 is configured to store one or more programs; when the one or more programs are used by the one or more Is executed by one processor 1120, so that the one or more processors 1120 implement the abnormality detection method described in the embodiment of the present application.
  • the terminal provided above can be configured to execute the abnormality detection method provided in any of the above embodiments, and has corresponding functions and beneficial effects.
  • the embodiment of the present application also provides a storage medium for executable instructions.
  • the computer executable instructions When executed by a computer processor, they are set to perform an abnormality detection method.
  • the method includes: according to the configuration data and performance index data of the object, Generate at least one cluster set of objects;
  • the various embodiments of the present application can be implemented in hardware or dedicated circuits, software, logic or any combination thereof.
  • some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software that may be executed by a controller, microprocessor, or other computing device, although the present application is not limited thereto.
  • the block diagram of any logic flow in the drawings of the present application may represent program steps, or may represent interconnected logic circuits, modules, and functions, or may represent a combination of program steps and logic circuits, modules, and functions.
  • the computer program can be stored on the memory.
  • the memory can be of any type suitable for the local technical environment and can be implemented using any suitable data storage technology, such as but not limited to read only memory (ROM), random access memory (RAM), optical storage devices and systems (digital multi-function optical discs) DVD or CD disc) etc.
  • Computer-readable media may include non-transitory storage media.
  • the data processor can be any type suitable for the local technical environment, such as but not limited to general-purpose computers, special-purpose computers, microprocessors, digital signal processors (DSP), application-specific integrated circuits (ASIC), programmable logic devices (FGPA) And processors based on multi-core processor architecture.
  • DSP digital signal processors
  • ASIC application-specific integrated circuits
  • FGPA programmable logic devices

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Probability & Statistics with Applications (AREA)
  • Algebra (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Mathematical Physics (AREA)
  • Pure & Applied Mathematics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • General Engineering & Computer Science (AREA)
  • Evolutionary Computation (AREA)
  • Evolutionary Biology (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Artificial Intelligence (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Testing And Monitoring For Control Systems (AREA)

Abstract

一种异常检测方法、装置、终端及存储介质，该方法包括：根据对象的配置数据和性能指标数据，生成对象的至少一个聚类集合(210)；根据预设异常检测算法和聚类集合中对象对应的性能指标数据，确定每个聚类集合对应的算法配置参数(220)；根据所述算法配置参数确定对应的聚类集合中对象的异常性能指标数据，根据所述异常性能指标数据确定异常对象(230)。

Description

一种异常检测方法、装置、终端及存储介质
相关申请的交叉引用
本申请基于申请号为201910901446.4、申请日为2019年09月23日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请实施例涉及无线通信网络，具体涉及一种异常检测方法、装置、终端及存储介质。
背景技术
在当前的无线网络系统中，基于基本的性能指标(Performance Indicator，PI)和关键性能指标(Key Performance Indicator，KPI)实现无线通信系统的运维，以及网络质量和性能的评估等。由于无线通信网络系统在运行时产生的PI和KPI的数据量(即性能指标数据)是非常巨大的，面对如此规模的性能指标数据，若通过人工分析的方式检测其中的异常性能指标数据，在准确度及自适应性等方面存在局限性。
发明内容
有鉴于此，本申请实施例提供一种异常检测方法，包括：根据对象的配置数据和性能指标数据，生成对象的至少一个聚类集合；根据预设异常检测算法和聚类集合中对象对应的性能指标数据，确定每个聚类集合对应的算法配置参数；根据所述算法配置参数确定对应的聚类集合中对象的异常性能指标数据，根据所述异常性能指标数据确定异常对象。
本申请实施例提供一种异常检测装置，包括：聚类集合生成模块，用于根据对象的配置数据和性能指标数据，生成对象的至少一个聚类集合；参数确定模块，用于根据预设异常检测算法和聚类集合中对象对应的性能指标数据，确定每个聚类集合对应的算法配置参数；异常检测模块，用于根据所述算法配置参数确定对应的聚类集合中对象的异常性能指标数据，根据所述异常性能指标数据确定异常对象。
本申请实施例提供一种终端，包括：存储器，以及一个或多个处理器；其中，所述存储器，设置为存储一个或多个程序；当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现本申请实施例中的任意一种方法。
本申请实施例提供了一种存储介质，存储有计算机程序，其中，所述计算机程序被处理器执行时实现本申请实施例中的任意一种方法。
关于本申请的以上实施例和其他方面以及其实现方式，在附图说明、具体实施方式和权利要求中提供更多说明。
附图说明
图1为现有的一种无线通信网络系统的基本架构示意图；
图2为本申请实施例提供的一种异常检测方法的方法流程图；
图3为本申请实施例提供的一种异常检测方法中配置数据的处理流程图；
图4为本申请实施例提供的一种异常检测方法中确定聚类集合的处理流程图；
图5为本申请实施例提供的另一种异常检测方法的流程图；
图6为本申请实施例提供的一种对象之间的逻辑依赖关系示意图；
图7为本申请实施例提供的一种异常对象的归因裁减示意图；
图8为本申请实施例提供的一种异常检测装置的结构示意框图；
图9为本申请实施例提供的另一种异常检测装置的处理流程示意图；
图10为本申请实施例提供的一种无线通信网络系统的示例图；
图11为本申请实施例提供的一种终端的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚明白，下文中将结合附图对本申请的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
为了便于理解，首先对无线通信网络系统的基本架构进行简要介绍。图1为现有的一种无线通信网络系统的基本架构示意图。如图1所示，无线通信网络系统主要包括核心网140、基站130、小区120、终端110以及传输链路150这些对象组成。需要说明的是，对象包括构建无线通信网络系统的功能模块。对象并不限于上述列举的几种，还可以是基带处理模块、射频处理模块等，本申请实施例不作具体限定。
终端110是用户使用的网络接入设备的统称。例如，终端可以是手机。终端与基站之间通过各自的天线进行无线数据交互，进而接入网络，进行上传业务(例如语音通话或访问互联网等)。
基站130是构建无线通信网络系统的核心设备，其对上通过无线通信协议与终端交互，对下通过传输链路与核心网交互，负责打通终端到核心网之间的数据通道。大部分无线通信协议都在基站中实现。
小区120是一个虚拟的管理对象。为了让系统服务区域内的无线信号在覆盖度、干扰度、接入容量等因素上达到一个最佳的平衡，规划人员一般会将整个服务区域划分为许多个小区，通过为每个小区设置不同的参数来达到目标。在大多数情况下，终端一般会通过地理位置接近的小区接入网络。
核心网140负责终端用户的鉴权、计费以及所有业务数据的处理。当基站打通了终端到核心网的数据通道后，终端发起的业务数据(比如语音数据和互联网数据)要通过核心网来处理或转发。
传输链路150一般指连接基站与核心网的有线传输链路。由于所有的终端业务数据最终都要通过基站汇聚到核心网，对传输链路的带宽、可靠性和延迟一般都有很高的要求。
需要说明的是，图1只是一种无线通信网络系统的架构简图，实际的无线通信网络系统的网络架构要更加复杂。但图1所展示的网络架构在概念上是正确的，能够帮助理解无线通信网络系统的基本结构以及本申请实施例所要解决的技术问题。
为了便于无线通信网络系统的运维，同时为网络质量和性能设定一个统一的评估标准，3GPP标准组织在多个标准文件中制订了一批基本的性能指标PI和关键性能指标KPI，并给出了指标的含义、采集内容、采集条件和相关的运算公式。所有的通信设备制造商都要遵从标准的要求，在网络设备中实现并上报这些PI，同时在网络管理系统(下文简称为网管)中汇总PI，并根据公式计算出KPI。此外，设备商和运营商一般也会根据自身的特定需求，设计并实现一批标准外的PI或KPI，以监控关键的系统运行状况。
在大多数情况下，无线通信网络系统在运行时产生的KPI和PI数据量是非常惊人的。面对如此规模的数据，试图通过人工来分析数据并发现其中的异常点是很困难的。网管一般都会实现一些辅助功能来帮助运维人员观察和分析这些数据。例如，网管提供可视化看板系统，让用户能够以图表的方式观察和理解数据。又如，网管提供降序排列与筛选，让用户能重点观察变化量最大的指标。又如，网管提供告警系统，用户可以为指定的指标设立告警门限或规则，当指标值突破门限或触发规则时上报告警，让用户知晓系统异常。
网管提供的上述功能虽然可以减轻一部分人工分析指标的负担，但仍然存在一些不足。例如，分析覆盖度低。即使有看板系统、TopN或筛选等工具辅助，人工能同时观察和分析到的指标数量仍然十分有限(一般不会超过10个)，这主要是由于人的固有局限性决定的。又如，难以指定合适的告警门限或触发规则。通信系统复杂而多变，不同的时间、不同的空间、不同的业务场景、不同的配置对相同指标的表现都会有不同的影响，仅凭人的经验和知识很难在这样多变的场景下为相关指标精确地界定何为异常何为正常。
为了弥补传统网管辅助分析功能的不足，提出了一些改进方案。这些改进方案主要包括两类：
第一、人工维护一个检测异常的经验知识库，该经验知识库的形式可以是做了标注的历史性能指标数据(即异常性能指标数据已被标记出来)，也可以是一套模式识别规则的集合。前者一般用于辅助统计训练规程得到检测门限，而后者则直接用于异常性能指标数据的检测。
第二、采用统计分析方法对历史性能指标数据进行分析，计算得出区分异常性能指标数据或正常性能指标数据的门限，并将该门限应用到当前的性能指标数据的检测中。
第一类方案延续了专家系统解决问题的方法，其效果也类似：系统内具备的专家规则越全，结果越准确，且待解决的问题本身不会发生较大变化，那么专家系统运行的效果就会比较好。然而，实际情况一般都不会如此理想，通常具有下述局限性：人工收集并总结专家规则的成本非常高；由于人本身的局限性，专家规则的完整性和准确性难以保证；现实中很多待解决的问题都不是静态不变的。
采用第二类方案对性能指标数据进行异常检测，虽然降低了对专家经验和规则的需求，减少了人工干预或指导的成本，但其仍然存在一些局限性，例如：
第一、绝大多数异常检测算法依然需要用户设定算法配置参数。虽然设定参数的工作量和难度要远小于直接指定检测规则，但用户提供的参数质量仍然直接影响到了算法输出结果的准确性。对于无线通信网络系统这种极端复杂庞大的系统而言，针对不同时间、不 同空间、不同对象给出合适的算法配制参数，对用户来说是非常困难的。
第二、大多数异常检测算法对于异常点的特性模式都有某种假定(比如对于k近邻算法，其假定异常点一定离所有的密集邻域都较远)。但在实际情况中，同一个对象在不同的时间范围内异常模式可能会不同；或者说两个同类对象在相同的时间范围内异常模式会有所不同。在这样的前提下，参数配置基本固定的算法很难为不同条件下的对象做出精确的异常检测。
第三、目前用于异常检测的主流算法，基本都是将历史性能指标数据作为唯一的输入，也就是只根据性能指标数据的历史来预测其未来，影响检测结果的精确性。
有鉴于此，本申请实施例提供了一种异常检测方法以解决上述技术问题。
图2为本申请实施例提供的一种异常检测方法的方法流程图，该方法可以由异常检测装置执行。其中，该装置可由软件和/或硬件实现，一般可集成在网络管理系统中，或者独立与网络管理系统而存在。
如图2所示，本申请实施例提供的方法包括：
步骤210、根据对象的配置数据和性能指标数据，生成对象的至少一个聚类集合。
需要说明的是，对象包括构建无线通信网络系统的功能模块。以图1中的无线通信网络系统为例，对象可以是核心网、基站、小区、终端以及传输链路。可以理解的是，对象与无线通信网络系统的组成相关联，在无线通信网络系统的组成发生变化时，对象也随之变化。
本申请实施例中，配置数据可以是对象的在配置方面的属性信息。配置数据的种类有很多，本申请实施例并不作具体限定。例如，配置数据可以包括空间信息相关的配置数据。或者，配置数据还可以包括性能指标相关的配置数据。可以根据要进行异常检测的性能指标数据的类型，确定配置数据的类型，进而，选取相应类型的配置数据作进一步处理。可以理解的是，当有多种性能指标数据要进行异常检测，或者要进行异常检测的性能指标数据包含多个指标时，需要选取多种类型的配置数据。需要说明的是，在无线通信网络系统构建完毕并开始运行时，配置数据通常就已经固化不变了。因此，在配置数据发生变化的情况下，需要从网管重新获取无线通信网络系统中对象的配置数据。
本申请实施例中，性能指标数据可以是性能指标相关的数据。性能指标是监控网络质量和性能的评估标准。性能指标包括3GPP指定的PI或KPI，也可以包括设备商和运营商自行制定的标准外的PI或KPI。需要说明的是，性能指标数据与无线通信网络系统的运行相关，需要周期性的由无线通信网络系统获取性能指标数据。在一些实施方式中，性能指标数据的获取周期通常与网络设备上报性能指标数据的上报更新周期对齐。例如，获取周期与上报更新周期相同。或者，获取周期与上报更新周期存在整数倍数的关系。
需要说明的是，聚类集合是综合考虑对象对应的配置数据和性能指标数据的特性，聚类得到的集合。由于性能指标数据是周期性获取的，基于当前获取周期的性能指标数据生成的至少一个聚类集合，其包含的对象在当前获取周期下具有相似的性能指标特征和波动模式。例如，可以分别基于配置数据和性能指标数据的特性对对象进行聚类，得到基于配 置数据的子聚类集合和基于性能指标数据的子聚类集合。综合考虑两个子聚类集合中数据的特性，对两个子聚类集合进行逻辑运算，得到对象的至少一个聚类集合，同一聚类集合中的对象的性能指标数据具有相似的性能指标特征和波动模式。
需要说明的是，性能指标数据是周期性获取的，相应的，聚类集合的生成也是周期性的，且生成聚类集合的周期与性能指标数据的获取周期相关。
步骤220、根据预设异常检测算法和聚类集合中对象对应的性能指标数据，确定每个聚类集合对应的算法配置参数。
需要说明的是，预设异常检测算法是基于对象的性能指标数据检测异常对象的算法。异常检测算法可以有很多种，本申请实施例并不作具体限定。例如，异常检测算法可以包括：低通滤波器类型的算法、基于密度的检测算法、聚类检测算法和支撑向量机算法等。其中，低通滤波器类型的算法包括移动平均线或卡尔曼滤波器及其变种等。基于密度的检测算法包括k近邻或局部异常因子算法及其变种等。聚类检测算法包括k均值聚类及其变种。支撑向量机算法包括单类支撑向量机算法及其变种等。
本申请实施例中，算法配置参数是运行异常检测算法进行异常检测所需的参数。例如，可以基于算法配置参数确定异常检测的门限值等。由于算法配置参数与每个聚类集合相对应，实现为具有不同特性的对象、在不同时间区间内生成不同的算法配置参数，减轻了性能指标检测领域人工分析和调参的工作负担，提高了检测方法的自适应性。
在某些实施例中，根据预设异常检测算法和聚类集合中对象的性能指标数据，确定算法配置参数的方式可以是：基于每个聚类集合中对象的性能指标数据对预设异常检测算法进行训练，得到每个聚类集合对应的算法配置参数。例如，基于预设的获取周期，获取性能指标数据。对当前获取的性能指标数据进行清洗并规整化处理后，得到用于训练预设异常检测算法的样本数据。样本数据与对象具有对应关系。遍历聚类集合，采用每个聚类集合中对象对应的样本数据对预设异常检测算法进行训练，得到适用于各个聚类聚合的算法配置参数。例如，假设根据对象的配置数据和性能指标数据，生成了6个聚类集合，那么，针对第一个聚类集合，根据该聚类集合中对象对应的性能指标参数训练预设异常检测算法，得到适用于第一个聚类集合的算法配置参数。同样的，针对第二个聚类集合，根据该聚类集合中对象对应的性能指标参数训练预设异常检测算法，得到适用于第二个聚类集合的算法配置参数。以此类推，针对第六个聚类集合，根据该聚类集合中对象对应的性能指标参数训练预设异常检测算法，得到适用于第六个聚类集合的算法配置参数。
需要说明的是，不同预设异常检测算法的训练方式也不同，本申请实施例对具体的训练过程并不作具体限定。
需要说明的是，由于聚类集合的生成是周期性的，相应的，确定每个聚类集合对应的算法配置参数也是周期性的，且算法配置参数的确定周期与聚类集合的生成周期相关联。
步骤230、根据所述算法配置参数确定对应的聚类集合中对象的异常性能指标数据，根据所述异常性能指标数据确定异常对象。
需要说明的是，异常性能指标数据是存在异常的性能指标数据。可以采用预设异常检 测算法检测性能指标数据是否存在异常。由于性能指标数据与对象相对应，在检测出异常性能指标数据后，可以基于异常性能指标数据确定与其对应的对象，即为异常对象。
在某些实施例中，获取待检测的聚类集合中对象对应的目标性能指标数据。确定该待检测的聚类集合对应的目标算法配置参数。根据预设异常检测算法和目标算法配置参数对目标性能指标数据进行异常检测，根据异常检测结果确定目标性能指标数据中的异常性能指标数据，将异常性能指标数据对应的对象确定为异常对象。
需要说明的是，在无线网络通信系统中，同一类型的对象可能有多个，而多个对象可能具有不同的数据特性，得到多个聚类集合。每个聚类集合中可能包括至少一个对象。例如，无线网络通信系统包括10个小区，基于配置数据和性能指标数据对小区进行聚类后，得到6个聚类集合，每个聚类集合中包含2个小区。
在确定了每个聚类集合对应的算法配置参数之后，任意获取对象的一个聚类集合，作为待检测的聚类集合。确定待检测的聚类集合中的对象，并获取该对象对应的性能指标数据，作为目标性能指标数据。获取待检测的聚类集合对应的算法配置参数，作为目标算法配置参数。根据目标算法配置参数，采用预设异常检测算法对目标性能指标数据进行异常检测，根据异常检测结果确定目标性能指标数据中的异常性能指标数据。对剩余聚类集合执行上述操作，直至所有聚类集合中的对象均被进行过关于性能指标数据的异常检测。将每个聚类集合中异常性能指标数据对应的所有对象确定为异常对象。
需要说明的是，性能指标数据是周期性获取的，相应的，确定聚类集合中的异常对象的操作也是周期性的，且异常对象的确定周期与性能指标数据的获取周期相关联。
本申请实施例提供了一种异常检测方法，通过对象的配置数据和性能指标数据对对象进行聚类处理，得到至少一个聚类集合；采用每个聚类集合对应的性能指标数据训练预设异常检测算法，得到每个聚类集合对应的算法配置参数；基于预设异常检测算法和算法配置参数确定对应的聚类集合中对象的异常性能指标数据，根据异常性能指标数据确定异常对象。上述技术方案充分利用除了性能指标数据之外的配置数据，从而能更精确地掌握系统不同组成部分的属性，实现自动化调整算法配置参数，提高了检测的准确度和检测方法的自适应性。
在一个实施方式中，根据对象的配置数据和性能指标数据，生成对象的至少一个聚类集合，可以优化为根据对象的配置数据、性能指标数据和运行状态数据，生成对象的至少一个聚类集合。其中，运行状态数据包括业务质量数据、测量报告、呼叫跟踪数据、信令跟踪数据、用户投诉数据或其它与对象的运行状态相关联的数据。可以理解的是，运行状态数据可以是上述列举的数据中的一种或几种的组合，本申请实施例并不作具体限定。由于对象的运行状态数据能够体现对象的运行状况，而基于对象的配置数据、性能指标数据和运行状态数据，生成聚类集合，能够更精确地掌握无线通信网络系统中不同对象的运行状况和属性特征，实现针对不同系统、不同对象、不同时间区间等因素自动调整算法配置参数。
在某些实施例中，根据对象的配置数据、性能指标数据和运行状态数据，生成对象的 至少一个聚类集合，进一步包括：
获取对象的配置数据，根据所述配置数据对所述对象进行聚类处理，生成所述对象的第一聚类集合；
获取对象的性能指标数据，根据所述性能指标数据对所述对象进行聚类处理，生成所述对象的第二聚类集合；
根据所述运行状态数据对所述对象进行聚类处理，生成所述对象的第三聚类集合；
基于预设规则对所述第一聚类集合、第二聚类集合和第三聚类集合进行逻辑运算，得到对象的至少一个聚类集合。
需要说明的是，当无线网络通信系统构建完毕且开始运行时，配置数据基本已固化，因此，在后续的异常检测过程中，如果配置数据未发生变化，则获取对象的配置数据，并根据配置数据对对象进行聚类处理，生成对象的第一聚类集合的操作仅执行一次。如果配置数据发生变化，则需要重新获取配置数据，并基于新获取的配置数据对对象进行聚类处理，生成新的第一聚类集合。
图3为本申请实施例提供的一种异常检测方法中配置数据的处理流程图。如图3所示，获取对象的配置数据，根据所述配置数据对所述对象进行聚类处理，生成所述对象的第一聚类集合的处理流程包括：
步骤310、由网管获取无线网络管理系统的配置数据，对所获取的配置数据进行清洗和规整化处理。
需要说明的是，对配置数据进行清洗处理，实现去除重复数据、错误数据等。对配置数据进行规整化处理，实现数据的清理、转换、合并和重塑。
步骤320、根据所述配置数据确定无线通信网络系统中对象的逻辑依赖关系。
需要说明的是，逻辑依赖关系是只不同对象之间在逻辑上的联系。例如，一个基站可以对应多个小区，此时，小区与基站存在逻辑依赖关系，可以认为，基站是小区的父对象，小区是基站的子对象。或者，每个小区和其所属的基站之间存在一条逻辑传输链路，每个基站和核心网之间存在一条物理传输链路，基于同一基站的物理传输链路是逻辑传输链路的父对象，而逻辑传输链路是物理传输链路的子对象。
通常情况下，无线网络通信系统中的对象的逻辑依赖关系呈现树状图的结构。
步骤330、根据与空间信息相关的配置数据，对对象进行聚类处理，得到按空间信息进行聚类的对象的空间聚类集合。
本申请实施例中，空间信息相关的配置数据是指配置数据中携带空间信息之一属性的数据。例如，空间信息可以是地理位置等。
步骤340、根据设定类型的配置数据，对对象进行聚类处理，得到按设定类型的配置数据进行聚类的对象的配置聚类集合。
需要说明的是，选取何种类型的配置数据进行聚类，取决于进行异常检测的KPI或PI指标。比如，要进行异常检测的是无线射频相关的指标，则选取与无线射频相关的配置参数来进行聚类。或者，要进行异常检测的是通话相关的指标，则选取与通话相关的配置参 数来进行聚类。在一些实施方式中，可以同时存在基于不同类型的配置数据进行聚类，得到的多个配置聚类集合。
需要说明的是，按照配置数据进行聚类，得到的第一聚类集合包括：步骤330中的空间聚类集合以及步骤340中的配置聚类集合。
需要说明的是，步骤320、步骤330和步骤340没有执行顺序要求，可以按照上述示例中记载的顺序执行，也可以颠倒顺序执行，或者可以同步进行。
图4为本申请实施例提供的一种异常检测方法中确定聚类集合的处理流程图。如图4所示，获取对象的性能指标数据，根据所述性能指标数据对所述对象进行聚类处理，生成所述对象的第二聚类集合；根据所述运行状态数据对所述对象进行聚类处理，生成所述对象的第三聚类集合；基于预设规则对所述第一聚类集合、第二聚类集合和第三聚类集合进行逻辑运算，得到对象的至少一个聚类集合的处理流程包括：
步骤410、周期性的获取对象的性能指标数据和运行状态数据，并分别对性能指标数据和运行状态数据进行清洗和规整化处理。
本申请实施例中，根据上述数据的上报周期确定性能指标数据和运行状态数据的获取周期。例如，假设无线网络通信系统中性能指标数据或运行状态数据的上报周期是x分钟，则本申请实施例中获取对象的性能指标数据和运行状态数据的获取周期也可以是x分钟。在一些实施方式中，根据实际使用场景的需要，获取周期还可以是上报周期的整数倍，本申请实施例并不作具体限定。
本申请实施例中，运行状态数据包括用户话单、投诉单、测量报告MR或呼叫跟踪CDT等数据。性能指标数据包括业务量相关的指标数据。其中，业务量相关的指标数据可以是业务数据量或者切换数量等指标对应的数据。
步骤420、根据业务量相关的指标数据，对无线通信网络系统中的对象进行聚类处理，得到按业务量相关的指标数据聚类的业务量聚类集合。
需要说明的是，由于业务量属于性能指标，基于业务量的相关指标数据进行聚类处理，得到的业务量聚类集合，属于按照性能指标数据聚类得到的第二聚类集合。
步骤430、根据运行状态数据对无线通信网络系统中的对象进行聚类处理，得到按照运行状态数据聚类的运行状态聚类集合。
需要说明的是，运行状态聚类集合属于第三聚类集合。
步骤440、基于预设规则对空间聚类集合、配置聚类集合、业务量聚类集合和运行状态聚类集合进行逻辑运算，得到对象的至少一个聚类集合。
本申请实施例中，预设规则是对逻辑运算的逻辑运算符或运算顺序进行限定的限定信息。基于不同预设规则对空间聚类集合、配置聚类集合、业务量聚类集合和运行状态聚类集合进行逻辑运算，得到运算结果也不同。可以根据异常检测的目标确定所要选择的预设规则。例如，预设规则可以是配置聚类集合AND业务量聚类集合AND运行状态聚类集合XOR空间聚类集合。其中，AND是表示与运算的逻辑运算符，XOR是表示异或运算的逻辑运算符。采用上述预设规则对空间聚类集合、配置聚类集合、业务量聚类集合和运行状 态聚类集合进行逻辑运算，得到的运算结果是将配置类似、业务量类似、运行状态类似但空间位置不同的对象纳入一个聚类集合中。又如，预设规则可以是配置聚类集合AND空间聚类集合AND运行状态聚类集合XOR业务量聚类集合。采用上述预设规则对空间聚类集合、配置聚类集合、业务量聚类集合和运行状态聚类集合进行逻辑运算，得到的运算结果是将配置类似、运行状态类似、空间位置类似但业务量不同的对象纳入一个聚类集合中。又如，预设规则可以是配置聚类集合AND业务量聚类集合AND运行状态聚类集合AND空间聚类集合。采用上述预设规则对空间聚类集合、配置聚类集合、业务量聚类集合和运行状态聚类集合进行逻辑运算，得到的运算结果是将配置类似、业务量类似、运行状态类似且空间位置相同的对象纳入一个聚类集合中。
图5为本申请实施例提供的另一种异常检测方法的流程图。如图5所示，该异常检测方法包括：
步骤501、周期性的获取对象的性能指标数据和运行状态数据，并分别对性能指标数据和运行状态数据进行清洗和规整化处理。
步骤502、根据运行状态数据对无线通信网络系统中的对象进行聚类处理，得到按照运行状态数据聚类的运行状态聚类集合。
步骤503、根据业务量相关的指标数据，对无线通信网络系统中的对象进行聚类处理，得到按业务量相关的指标数据聚类的业务量聚类集合。
步骤504、获取对象的空间聚类集合和配置聚类集合。
步骤505、基于预设规则对空间聚类集合、配置聚类集合、业务量聚类集合和运行状态聚类集合进行逻辑运算，得到对象的至少一个聚类集合。
在一些实施方式中，可以采用列表的形式存储对象的至少一个聚类集合，进而，将存储至少一个聚类集合的列表称为聚类集合列表。
步骤506、分别获取聚类集合列表中的每个聚类集合，根据预设异常检测算法和聚类集合中对象对应的性能指标数据，确定每个聚类集合对应的算法配置参数。
本申请实施例中，算法配置参数包括异常检测算法所需的配置参数或门限值。需要说明的是，选择何种算法作为预设异常检测算法是根据实际应用场景确定的，本申请实施例并不作具体限定。在一些实施方式中，通过上述逻辑运算实现对不同状态的对象进行分类的目的，从而简化了应用场景，可以选用较为诸如向量自回归算法(Vector Auto Regression，VAR)之类的比较简单的异常检测算法。
步骤507、根据所述算法配置参数确定对应的聚类集合中对象的异常性能指标数据，根据所述异常性能指标数据确定异常对象。
在某些实施例中，根据上述步骤所确定的各个聚类集合对应的算法配置参数，采用预设异常检测算法对各个聚类集合中对象的性能指标数据进行异常检测，得到异常性能指标数据。根据性能指标数据与对象的对应关系，确定异常性能指标数据对应的异常对象。
步骤508、根据异常对象生成待确定异常对象集合。
步骤509、获取无线通信网络系统中对象的逻辑依赖关系。
步骤510、基于所述对象之间的逻辑依赖关系，确定所述待确定异常对象集合中异常对象的逻辑因果关系。
图6为本申请实施例提供的一种对象之间的逻辑依赖关系示意图。如图6所示，对象0与三个其它类对象(即对象0-0，对象0-1和对象0-2)具有逻辑依赖关系；对象0-0分别与对象0-0-0和对象0-0-1具有逻辑依赖关系；对象0-1分别与对象0-1-0和对象0-1-1具有逻辑依赖关系；对象0-2分别与对象0-2-0和对象0-2-1具有逻辑依赖关系。
步骤511、根据所述逻辑因果关系调整所述待确定异常对象集合，得到异常对象集合。
在某些实施例中，根据对象之间的逻辑依赖关系，从最顶层的子节点向下遍历，获取一个异常对象以及与该异常对象存在逻辑依赖关系的对象(父节点处的对象)，判断异常对象与该父节点处的对象是否具有相类似的性能指标异常。若是，则由待确定异常对象集合中删除作为子节点的异常对象；否则，不进行任何操作。在聚类集合中还存在未被遍历到的异常对象的情况下，获取新的异常对象，重复上述过程。若聚类集合列表中所有聚类集合的异常对象均被遍历过，则将调整后的待确定异常对象集合作为最终的异常对象集合。
图7为本申请实施例提供的一种异常对象的归因裁减示意图。如图7所示，对象0-0、对象0-0-0和对象0-0-1具有相似的性能异常，且对象0-0是父节点处的对象，对象0-0-0和对象0-0-1均是子节点处的对象，子节点处的对象的异常很可能是由父节点处的对象引发的，因此，可以由待确定异常对象集合中删除对象0-0-0和对象0-0-1。
采用上述方案，基于对象之间的逻辑依赖关系，在子节点处的对象与父节点处的对象具有相似的异常时，将子节点处的对象的异常归因与父节点处的对象，从而实现异常对象的归因裁减，减少了异常对象集合包含的冗余数据，提高了异常对象检测的精确度。
图8为本申请实施例提供的一种异常检测装置的结构示意框图。该装置可以配置于网管中，也可以独立于网管之外存在。该装置通过执行本申请实施例提供的异常检测方法，实现精确检测无线通信网络系统中国内的异常对象。如图8所示，本申请实施例中的异常检测装置包括：
聚类集合生成模块810，用于根据对象的配置数据和性能指标数据，生成对象的至少一个聚类集合；
参数确定模块820，用于根据预设异常检测算法和聚类集合中对象对应的性能指标数据，确定每个聚类集合对应的算法配置参数；
异常检测模块830，用于根据所述算法配置参数确定对应的聚类集合中对象的异常性能指标数据，根据所述异常性能指标数据确定异常对象。
本申请实施例提供的异常检测装置设置为实现图2所示实施例的异常检测方法，该异常检测装置的实现原理与技术效果与异常检测方法类似，此处不再赘述。
在一个实例中，所述对象包括构建无线通信网络系统的功能模块。
在一个实例中，所述聚类集合生成模块810用于：
根据对象的配置数据、性能指标数据和运行状态数据，生成对象的至少一个聚类集合。
在一个实例中，所述运行状态数据包括业务质量数据、测量报告、呼叫跟踪数据、信 令跟踪数据、用户投诉数据中的一种或几种的组合。
在一个实例中，所述聚类集合生成模块810具体用于：
获取对象的配置数据，根据所述配置数据对所述对象进行聚类处理，生成所述对象的第一聚类集合；
获取对象的性能指标数据，根据所述性能指标数据对所述对象进行聚类处理，生成所述对象的第二聚类集合；
获取对象的运行状态数据，根据所述运行状态数据对所述对象进行聚类处理，生成所述对象的第三聚类集合，其中，所述运行状态数据包括业务质量数据、测量报告、呼叫跟踪数据、信令跟踪数据或用户投诉数据；
基于预设规则对所述第一聚类集合、第二聚类集合和第三聚类集合进行逻辑运算，得到对象的至少一个聚类集合。
在一个实例中，所述参数确定模块820具体用于：
基于每个聚类集合中对象的性能指标数据对预设异常检测算法进行训练，得到每个聚类集合对应的算法配置参数。
在一个实例中，所述异常检测模块830具体用于：
获取待检测的聚类集合中对象对应的目标性能指标数据；
确定所述待检测的聚类集合对应的目标算法配置参数；
根据所述预设异常检测算法和所述目标算法配置参数对所述目标性能指标数据进行异常检测，根据异常检测结果确定所述目标性能指标数据中的异常性能指标数据。
在一个实例性，该异常检测装置还包括：
集合调整模块，用于在所述根据所述异常性能指标数据确定异常对象之后，根据异常对象生成待确定异常对象集合；获取无线通信网络系统中对象的依赖关系，其中，所述依赖关系根据所述配置数据确定；基于所述对象之间的依赖关系，确定所述待确定异常对象集合中异常对象的逻辑因果关系；根据所述逻辑因果关系调整所述待确定异常对象集合，得到异常对象集合。
图9为本申请实施例提供的另一种异常检测装置的处理流程示意图。在一个实施方式中，异常检测装置可以包括图9所示的性能指标数据预处理(加载、清洗和规整化)模块901、异常检测算法模块902、配置数据预处理(加载、清洗和规整化)模块903、运行状态数据预处理(加载、清洗和规整化)模块904、对象依赖关系生成模块905、配置聚类集合生成模块906、运行状态聚类集合生成模块907、业务量聚类集合生成模块908、聚类集合生成模块909、算法配置参数生成模块910和异常对象归因裁减模块911。
其中，性能指标数据预处理模块901，用于读取性能指标数据，对其进行清洗和规整化，并将清洗和规整化后的数据分别发送给异常检测算法模块902和业务量聚类集合生成模块908。
配置数据预处理模块903，用于读取无线通信网络系统的配置数据，对其进行清洗和规整化，并将清洗和规整化后的数据分别发送给对象依赖关系生成模块905和配置聚类集 合生成模块906。
运行状态数据预处理模块904，用于读取无线通信网络系统中对象的运行状态数据，并对其进行清洗和规整化，并将清洗和规整化后的数据发送给运行状态聚类集合生成模块907。
对象依赖关系生成模块905，用于基于配置数据生成对象的逻辑依赖关系，并将该逻辑依赖关系发送给异常对象归因裁减模块911。
配置聚类集合生成模块906，用于根据配置数据对对象进行聚类，得到对象的配置聚类集合和空间聚类集合，并将配置聚类集合和空间聚类集合发送给聚类集合生成模块909。
运行状态聚类集合生成模块907，用于根据运行状态数据对对象进行聚类，得到对象的运行状态聚类集合，并将运行状态聚类集合发送给聚类集合生成模块909。
业务量聚类集合生成模块908，用于根据业务量对对象进行聚类，得到对象的业务量聚类集合，并将业务量聚类集合发送给聚类集合生成模块909。
聚类集合生成模块909，用于根据基于预设规则对空间聚类集合、配置聚类集合、业务量聚类集合和运行状态聚类集合进行逻辑运算，得到对象的至少一个聚类集合。在一些实施方式中，可以采用聚类集合列表的方式存储对象的至少一个聚类集合。聚类集合生成模块909将聚类集合列表发送给算法配置参数生成模块910。
算法配置参数生成模块910，用于根据预设异常检测算法和聚类集合列表中对象对应的性能指标数据，为每个聚类集合生成算法配置参数，并将其发送给异常检测算法模块902。
异常检测算法模块902，用于根据每个聚类集合对应的算法配置参数，对相应聚类集合中的性能指标数据进行异常检测，生成待确定异常对象集合，并将其发送至异常对象归因裁减模块911。
异常对象归因裁减模块911，用于根据对象的逻辑依赖关系，确定待确定异常对象集合中异常对象的逻辑因果关系，根据逻辑因果关系确定待确定异常对象集合中符合设定规律的目标异常对象，删除目标异常对象得到异常对象集合，输出该异常对象集合。
为了便于理解，采用下述具体示例说明本申请实施例的异常检测方法的处理流程。图10为本申请实施例提供的一种无线通信网络系统的示例图。假设存在一个简化后的无线通信网络系统，如图10所示，该无线通信网络系统包括：
1)一个核心网，编号为：CN_0；
2)5个基站，编号为：B_0～B_4；
3)每个基站管辖2个小区(共10个小区)，小区编号为：C_0_0～C_4_1，其中第二位数字为小区所属的基站编号(0～4)，第三位数字为小区编号(0～1)；
4)每个小区和基站之间存在一条逻辑传输链路，编号为：LL_0_0～LL_4_1；
5)每个基站和CN之间存在一条物理传输链路，编号为：PL_0～PL_4；
6)假设这10个小区主要覆盖2处地理位置：LOC_0～LOC_1，其中B_0、B_1管辖的4个小区覆盖LOC_0，B_2、B_3、B_4管辖的6个小区覆盖LOC_1；
7)假设这些小区共存在2套不同的无线参数配置，附图中用包含水平线的圆和包含 垂直线的圆来代表；
8)假设部分小区当前处于高业务量状态，附图中用灰色底色代表；部分小区处于低业务量状态，附图中用白底色代表；
9)假设当前的运行转态数据只有用户话单数据，且所有小区的用户话单数据基本相同。
基于上述假设说明本申请实施例中的异常检测方法的具体实现过程。
1.配置数据预处理模块首先获取配置数据，进行清洗和规整化，并生成对象依赖关系图。此时异常检测装置已了解无线网络通信系统中包含哪些对象以及对象之间的父子依赖关系，并将此依赖关系数据留存备用。随后将处理后的配置数据发送给配置聚类生成模块。
2.配置聚类生成模块基于DBSCAN聚类算法对空间信息相关的配置数据进行运算，即可得到根据地理位置聚类的小区聚类集合，以及根据无线参数配置聚类的小区聚类集合。
3.上述无线通信网络系统中的小区按地理位置聚类，得到两个空间聚类集合：
LOC_1：[C_0_0,C_0_1,C_1_0,C_1_1]
LOC_2：[C_2_0,C_2_1,C_3_0,C_3_1,C_4_0,C_4_1]
上述无线通信网络系统中的小区按无线配置聚类，得到两个配置聚类集合：
a.[C_0_0,C_0_1,C_2_0,C_2_1,C_4_1]
b.[C_1_0,C_1_1,C_3_0,C_3_1,C_4_0]
将这些数据留存备用。
4.性能指标数据预处理模块读取系统上报的性能指标数据，进行清洗和规整化后先发送给业务量聚类集合生成模块，并同时缓存数据等待异常检测算法模块准备就绪后为其提供数据。
5.运行状态数据预处理模块读取系统上报的运行状态数据(此场景下为用户话单)，进行清洗和规整化后发送给运行状态聚类集合生成模块。
6.业务量聚类集合生成模块基于DBSCAN聚类算法对收到的性能指标数据进行运算，即可得到根据业务量聚类的小区聚类集合。
7.运行状态聚类集合生成模块基于DBSCAN聚类算法对收到的运行状态数据进行运算，即可得到根据运行状态数据聚类的小区聚类集合。
8.上述无线通信网络系统中的小区按业务量聚类，得到两个业务量聚类集合：
高业务量：[C_0_1,C_1_0,C_3_0,C_3_1,C_4_1]
低业务量：[C_0_0,C_1_1,C_2_0,C_2_1,C_4_0]
上述无线通信网络系统中的小区按运行状态数据聚类，得到一个运行状态聚类集合，该集合包含所有小区。将这些数据留存备用。
9.聚类集合生成模块可根据第3步和第8步得到的聚类数据，通过集合运算得到聚类集合列表。具体的做法是：无线配置聚类集合AND运行状态聚类集合AND业务量聚类集合XOR空间聚类集合，这样可以得到所有在无线配置、运行状态和业务量上类似、 但地理位置不同的小区的聚类集合。
10.最终得到的小区的聚类集合列表为：
a.[C_0_0,C_2_0]
b.[C_0_0,C_2_1]
c.[C_0_1,C_4_1]
d.[C_1_0,C_3_0]
e.[C_1_0,C_3_1]
f.[C_1_1,C_4_0]
将此数据发送给算法配置参数生成模块。
11.算法配置参数生成模块根据得到的聚类集合列表，以每一个聚类集合中的小区性能指标数据为一组，使用向量自回归方法进行训练，得到适用于该组的算法配置参数。待针对聚类集合列表中所有的聚类集合均完成算法配置计算后，将每个聚类集合的算法配置参数传递给异常检测算法模块。
12.异常检测算法模块从性能指标数据预处理模块获取性能指标数据，从算法配置参数生成模块获得聚类集合列表，以及适用于每个聚类集合的算法配置参数，随后以每个聚类集合中的小区为单位，使用向量自回归算法进行异常检测。待所有聚类集合都检测完毕后，输出待确认异常对象集合给异常对象归因裁减模块。
13.异常对象归因裁减模块通过步骤1得到的对象依赖关系图，对待确认异常对象集合进行归因裁减。举例来说，参考图10，异常检测算法认为LL_1_1、LL_3_0、LL_3_1以及PL_3在丢包率这个指标上有类似异常。异常对象归因裁减模块根据对象间的依赖关系确定：LL_1_1的相邻节点处的对象和父节点处的对象均无异常，因此，异常仅限定于LL_1_1自身，无须裁减；而PL_3作为有异常的父节点处的对象、其所有子节点处的对象均有类似异常，那么，子节点处的对象的异常很有可能是由于父节点处的对象引发的，因此，决定裁剪掉所有子节点处的对象，只留下PL_3的异常对象，至此，归因裁减完毕，得到异常对象集合。
14.输出异常对象集合。
本申请实施例提供了一种终端。图11为本申请实施例提供的一种终端的结构示意图。如图11所示，终端包括存储器1110，以及一个或多个处理器1120；其中，所述存储器1110，设置为存储一个或多个程序；当所述一个或多个程序被所述一个或多个处理器1120执行，使得所述一个或多个处理器1120实现本申请实施例所述的异常检测方法。
上述提供的终端可设置为执行上述任意实施例提供的异常检测方法，具备相应的功能和有益效果。
本申请实施例还提供了一种可执行指令的存储介质，计算机可执行指令在由计算机处理器执行时设置为执行一种异常检测方法，该方法包括：根据对象的配置数据和性能指标数据，生成对象的至少一个聚类集合；
根据预设异常检测算法和聚类集合中对象对应的性能指标数据，确定每个聚类集合对 应的算法配置参数；
根据所述算法配置参数确定对应的聚类集合中对象的异常性能指标数据，根据所述异常性能指标数据确定异常对象。
以上，仅为本申请的若干实施例而已，并非用于限定本申请的保护范围。
一般来说，本申请的多种实施例可以在硬件或专用电路、软件、逻辑或其任何组合中实现。例如，一些方面可以被实现在硬件中，而其它方面可以被实现在可以被控制器、微处理器或其它计算装置执行的固件或软件中，尽管本申请不限于此。
本申请附图中的任何逻辑流程的框图可以表示程序步骤，或者可以表示相互连接的逻辑电路、模块和功能，或者可以表示程序步骤与逻辑电路、模块和功能的组合。计算机程序可以存储在存储器上。存储器可以具有任何适合于本地技术环境的类型并且可以使用任何适合的数据存储技术实现，例如但不限于只读存储器(ROM)、随机访问存储器(RAM)、光存储器装置和系统(数码多功能光碟DVD或CD光盘)等。计算机可读介质可以包括非瞬时性存储介质。数据处理器可以是任何适合于本地技术环境的类型，例如但不限于通用计算机、专用计算机、微处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、可编程逻辑器件(FGPA)以及基于多核处理器架构的处理器。

Claims (11)

  1. 一种异常检测方法，包括：
    根据对象的配置数据和性能指标数据，生成对象的至少一个聚类集合；
    根据预设异常检测算法和聚类集合中对象对应的性能指标数据，确定每个聚类集合对应的算法配置参数；
    根据所述算法配置参数确定对应的聚类集合中对象的异常性能指标数据，根据所述异常性能指标数据确定异常对象。
  2. 根据权利要求1所述的方法，其中，所述对象包括构建无线通信网络系统的功能模块。
  3. 根据权利要求1所述的方法，其中，所述根据对象的配置数据和性能指标数据，生成对象的至少一个聚类集合，包括：
    根据对象的配置数据、性能指标数据和运行状态数据，生成对象的至少一个聚类集合。
  4. 根据权利要求3所述的方法，其中，所述运行状态数据包括业务质量数据、测量报告、呼叫跟踪数据、信令跟踪数据、用户投诉数据中的一种或几种的组合。
  5. 根据权利要求3所述的方法，其中，所述根据对象的配置数据、性能指标数据和运行状态数据，生成对象的至少一个聚类集合，包括：
    获取对象的配置数据，根据所述配置数据对所述对象进行聚类处理，生成所述对象的第一聚类集合；
    获取对象的性能指标数据，根据所述性能指标数据对所述对象进行聚类处理，生成所述对象的第二聚类集合；
    获取对象的运行状态数据，根据所述运行状态数据对所述对象进行聚类处理，生成所述对象的第三聚类集合；
    基于预设规则对所述第一聚类集合、第二聚类集合和第三聚类集合进行逻辑运算，得到对象的至少一个聚类集合。
  6. 根据权利要求1所述的方法，其中，所述根据预设异常检测算法和聚类集合中对象对应的性能指标数据，确定每个聚类集合对应的算法配置参数，包括：
    基于每个聚类集合中对象的性能指标数据对预设异常检测算法进行训练，得到每个聚类集合对应的算法配置参数。
  7. 根据权利要求1所述的方法，其中，所述根据所述算法配置参数确定对应的聚类集合中对象的异常性能指标数据，包括：
    获取待检测的聚类集合中对象对应的目标性能指标数据；
    确定所述待检测的聚类集合对应的目标算法配置参数；
    根据所述预设异常检测算法和所述目标算法配置参数对所述目标性能指标数据进行异常检测，根据异常检测结果确定所述目标性能指标数据中的异常性能指标数据。
  8. 根据权利要求1至7中任一项所述的方法，在所述根据所述异常性能指标数据确定异常对象之后，还包括：
    根据异常对象生成待确定异常对象集合；
    获取无线通信网络系统中对象的逻辑依赖关系，其中，所述逻辑依赖关系根据所述配置数据确定；
    基于所述对象之间的逻辑依赖关系，确定所述待确定异常对象集合中异常对象的逻辑因果关系；
    根据所述逻辑因果关系调整所述待确定异常对象集合，得到异常对象集合。
  9. 一种异常检测装置，包括：
    聚类集合生成模块，用于根据对象的配置数据和性能指标数据，生成对象的至少一个聚类集合；
    参数确定模块，用于根据预设异常检测算法和聚类集合中对象对应的性能指标数据，确定每个聚类集合对应的算法配置参数；
    异常检测模块，用于根据所述算法配置参数确定对应的聚类集合中对象的异常性能指标数据，根据所述异常性能指标数据确定异常对象。
  10. 一种终端，包括：存储器，以及一个或多个处理器；其中，
    所述存储器，设置为存储一个或多个程序；
    当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现权利要求1-8任一所述的异常检测方法。
  11. 一种存储介质，存储有计算机程序，其中，所述计算机程序被处理器执行时实现权利要求1-8任一项所述的异常检测方法。
PCT/CN2020/112150 2019-09-23 2020-08-28 一种异常检测方法、装置、终端及存储介质 WO2021057382A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US17/278,483 US12063528B2 (en) 2019-09-23 2020-08-28 Anomaly detection method and device, terminal and storage medium
EP20864266.0A EP3843445A4 (en) 2019-09-23 2020-08-28 METHOD AND DEVICE FOR DETECTION OF ANOMALIES, TERMINAL DEVICE AND STORAGE MEDIUM

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910901446.4 2019-09-23
CN201910901446.4A CN112543465B (zh) 2019-09-23 2019-09-23 一种异常检测方法、装置、终端及存储介质

Publications (1)

Publication Number Publication Date
WO2021057382A1 true WO2021057382A1 (zh) 2021-04-01

Family

ID=75013220

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/112150 WO2021057382A1 (zh) 2019-09-23 2020-08-28 一种异常检测方法、装置、终端及存储介质

Country Status (4)

Country Link
US (1) US12063528B2 (zh)
EP (1) EP3843445A4 (zh)
CN (1) CN112543465B (zh)
WO (1) WO2021057382A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113568812A (zh) * 2021-07-29 2021-10-29 北京奇艺世纪科技有限公司 一种智能机器人的状态检测方法和装置
CN113965497A (zh) * 2021-10-20 2022-01-21 平安医疗健康管理股份有限公司 服务器异常识别方法、装置、计算机设备及可读存储介质
CN114630365A (zh) * 2022-04-14 2022-06-14 北京邮电大学 小区健康状态检测的方法及装置
CN116419008A (zh) * 2023-03-15 2023-07-11 苏州匠数科技有限公司 运营播放视频的实时检测方法、系统和电子设备
CN116599778A (zh) * 2023-07-18 2023-08-15 山东溯源安全科技有限公司 用于确定恶意设备的数据处理方法
CN117093942A (zh) * 2023-08-24 2023-11-21 唐人通信技术服务股份有限公司 家庭宽带中异常数据分析方法及装置

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115884416A (zh) * 2021-09-23 2023-03-31 中兴通讯股份有限公司 一种干扰信号的规避方法、装置、基站和存储介质
WO2024085881A1 (en) * 2022-10-21 2024-04-25 Rakuten Mobile, Inc. Method of analyzing voice over internet protocol communication and system for implementing the same
CN117421684B (zh) * 2023-12-14 2024-03-12 易知谷科技集团有限公司 基于数据挖掘和神经网络的异常数据监测与分析方法
CN117633697B (zh) * 2024-01-26 2024-05-03 西安艺琳农业发展有限公司 基于物联网的生猪智能监测方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160124966A1 (en) * 2014-10-30 2016-05-05 The Johns Hopkins University Apparatus and Method for Efficient Identification of Code Similarity
CN107231649A (zh) * 2016-03-25 2017-10-03 中国移动通信有限公司研究院 一种室内弱覆盖的确定方法及装置
CN109843653A (zh) * 2017-07-26 2019-06-04 松下电器（美国）知识产权公司 异常检测装置以及异常检测方法
CN110061854A (zh) * 2018-01-18 2019-07-26 华东明 一种无边界网络智能运维管理方法与系统
CN110062410A (zh) * 2019-03-28 2019-07-26 东南大学 一种基于自适应谐振理论的小区中断检测定位方法
CN111199252A (zh) * 2019-12-30 2020-05-26 广东电网有限责任公司 一种电力通信网络智能运维系统的故障诊断方法

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10505825B1 (en) * 2014-10-09 2019-12-10 Splunk Inc. Automatic creation of related event groups for IT service monitoring
US20170034720A1 (en) * 2015-07-28 2017-02-02 Futurewei Technologies, Inc. Predicting Network Performance
US9961571B2 (en) * 2015-09-24 2018-05-01 Futurewei Technologies, Inc. System and method for a multi view learning approach to anomaly detection and root cause analysis
US10546241B2 (en) * 2016-01-08 2020-01-28 Futurewei Technologies, Inc. System and method for analyzing a root cause of anomalous behavior using hypothesis testing
CN105873105B (zh) * 2016-04-22 2018-07-03 中国科学技术大学 一种基于网络体验质量的移动通信网异常检测和定位方法
US20170364819A1 (en) * 2016-06-17 2017-12-21 Futurewei Technologies, Inc. Root cause analysis in a communication network via probabilistic network structure
US10178566B2 (en) * 2017-01-27 2019-01-08 Telefonaktiebolaget Lm Ericsson (Publ) Radio access network (RAN) cell site diagnostic test tool system and method
US10897389B2 (en) * 2018-09-14 2021-01-19 Cisco Technology, Inc. Threshold selection for KPI candidacy in root cause analysis of network issues

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160124966A1 (en) * 2014-10-30 2016-05-05 The Johns Hopkins University Apparatus and Method for Efficient Identification of Code Similarity
CN107231649A (zh) * 2016-03-25 2017-10-03 中国移动通信有限公司研究院 一种室内弱覆盖的确定方法及装置
CN109843653A (zh) * 2017-07-26 2019-06-04 松下电器（美国）知识产权公司 异常检测装置以及异常检测方法
CN110061854A (zh) * 2018-01-18 2019-07-26 华东明 一种无边界网络智能运维管理方法与系统
CN110062410A (zh) * 2019-03-28 2019-07-26 东南大学 一种基于自适应谐振理论的小区中断检测定位方法
CN111199252A (zh) * 2019-12-30 2020-05-26 广东电网有限责任公司 一种电力通信网络智能运维系统的故障诊断方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3843445A4 *

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113568812A (zh) * 2021-07-29 2021-10-29 北京奇艺世纪科技有限公司 一种智能机器人的状态检测方法和装置
CN113568812B (zh) * 2021-07-29 2024-06-07 北京奇艺世纪科技有限公司 一种智能机器人的状态检测方法和装置
CN113965497A (zh) * 2021-10-20 2022-01-21 平安医疗健康管理股份有限公司 服务器异常识别方法、装置、计算机设备及可读存储介质
CN114630365A (zh) * 2022-04-14 2022-06-14 北京邮电大学 小区健康状态检测的方法及装置
CN114630365B (zh) * 2022-04-14 2024-02-06 北京邮电大学 小区健康状态检测的方法及装置
CN116419008A (zh) * 2023-03-15 2023-07-11 苏州匠数科技有限公司 运营播放视频的实时检测方法、系统和电子设备
CN116419008B (zh) * 2023-03-15 2024-05-10 苏州匠数科技有限公司 运营播放视频的实时检测方法、系统和电子设备
CN116599778A (zh) * 2023-07-18 2023-08-15 山东溯源安全科技有限公司 用于确定恶意设备的数据处理方法
CN116599778B (zh) * 2023-07-18 2023-09-26 山东溯源安全科技有限公司 用于确定恶意设备的数据处理方法
CN117093942A (zh) * 2023-08-24 2023-11-21 唐人通信技术服务股份有限公司 家庭宽带中异常数据分析方法及装置

Also Published As

Publication number Publication date
CN112543465A (zh) 2021-03-23
US12063528B2 (en) 2024-08-13
US20220124517A1 (en) 2022-04-21
CN112543465B (zh) 2022-04-29
EP3843445A1 (en) 2021-06-30
EP3843445A4 (en) 2021-12-22
US20230140836A9 (en) 2023-05-04

Similar Documents

Publication Publication Date Title
WO2021057382A1 (zh) 一种异常检测方法、装置、终端及存储介质
US9716633B2 (en) Alarm prediction in a telecommunication network
CN107040415B (zh) 一种终端及数据上报方法、服务器及数据接收方法
EP2997756B1 (en) Method and network device for cell anomaly detection
EP3138235B1 (en) Verification in self-organizing networks
US9015312B2 (en) Network management system and method for identifying and accessing quality of service issues within a communications network
CN114128226A (zh) 使用机器学习的根本原因分析和自动化
CN107204894B (zh) 网络业务质量的监控方法及装置
US20200134421A1 (en) Assurance of policy based alerting
CN110891283A (zh) 一种基于边缘计算模型的小基站监控装置及方法
US10680919B2 (en) Eliminating bad rankers and dynamically recruiting rankers in a network assurance system
TWI684139B (zh) 基於自動學習的基地台異常之預測的系統與方法
WO2024066331A1 (zh) 网络异常检测方法、装置、电子设备及存储介质
CN109286526A (zh) 一种wifi系统运行策略动态调整方法及装置
US11246046B2 (en) Proactive wireless traffic capture for network assurance
KR20180130295A (ko) 통신망의 장애를 예측하는 장치 및 방법
CN110647086B (zh) 一种基于运行大数据分析的智能运维监控系统
Khatib et al. LTE performance data reduction for knowledge acquisition
Khatib et al. Knowledge acquisition for fault management in LTE networks
Muñoz et al. A method for identifying faulty cells using a classification tree-based UE diagnosis in LTE
CN113556773B (zh) 基于ai模型检测睡眠小区的方法
US20180357560A1 (en) Automatic detection of information field reliability for a new data source
WO2022121513A1 (zh) 性能指标至差值的生成方法、装置、电子设备及存储介质
Frenzel et al. Operational troubleshooting-enabled coordination in self-organizing networks
WO2024061254A1 (zh) 数据获取方法、装置、系统和设备

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 20864266.0

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2020864266

Country of ref document: EP

Effective date: 20210323

NENP Non-entry into the national phase

Ref country code: DE