WO2021244415A1 - 检测网络故障的方法和装置 - Google Patents

检测网络故障的方法和装置 Download PDF

Info

Publication number
WO2021244415A1
WO2021244415A1 PCT/CN2021/096678 CN2021096678W WO2021244415A1 WO 2021244415 A1 WO2021244415 A1 WO 2021244415A1 CN 2021096678 W CN2021096678 W CN 2021096678W WO 2021244415 A1 WO2021244415 A1 WO 2021244415A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
data stream
data
abnormality
degree
Prior art date
Application number
PCT/CN2021/096678
Other languages
English (en)
French (fr)
Inventor
段艳杰
谭小兵
吴霜
叶强
庞宏超
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021244415A1 publication Critical patent/WO2021244415A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0823—Errors, e.g. transmission errors
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0823—Errors, e.g. transmission errors
    • H04L43/0829—Packet loss

Definitions

  • This application relates to the field of artificial intelligence, and in particular to a method and device for detecting network failures.
  • Network transmission refers to the process of using electric current or electromagnetic waves to transmit information.
  • faults such as low network speed and network stalls may occur.
  • a method for detecting network failures is to capture multiple data packets from a data stream transmitted on the network, and determine whether there is an abnormal condition in the data stream by analyzing the characteristics of the multiple data packets. Because different networks have different judgment standards for abnormal characteristics, and data transmission protocols usually have a certain degree of fault tolerance, it is necessary for experienced engineers to manually analyze the characteristics of data packets to find out the data streams with abnormal conditions. This method of detecting network failures is highly dependent on manually set rules and thresholds, and it is difficult to quickly determine the cause of the failure. This is a problem that needs to be resolved at present.
  • the present application provides a method and device for detecting network faults, which can improve the efficiency of detecting network faults.
  • a method for detecting a network failure including: acquiring target characteristic data, where the target characteristic data is data related to the target characteristic of the first data stream; and determining according to the target probability model and the target characteristic data The target abnormality degree, wherein the target probability model is used to indicate the probability distribution of normal characteristic data, the normal characteristic data is data related to the target characteristic of the normal data stream, and the target abnormality degree is the first data stream
  • the degree of abnormality of the target feature; the failure of the network transmitting the first data stream is determined according to the degree of target abnormality.
  • the target probability model is, for example, the target of the normal data stream
  • the target probability model is, for example, the target of the normal data stream
  • the target probability model does not rely on manually set rules and thresholds. Therefore, the target probability model can quickly determine the cause of the failure and improve the efficiency of network failure detection.
  • the target probability model can be acquired by the processor to learn the target characteristics of normal data streams of different networks without manual intervention. Therefore, the above method can also adapt to different network environments and has good adaptability.
  • the determining the degree of target abnormality according to the target probability model and the target characteristic data includes: inputting the target characteristic data into the target probability model to determine the target probability, and the target probability is used to indicate the target abnormality degree.
  • the target characteristic data includes data of multiple dimensions
  • the target probability model includes a probability model corresponding to the multiple dimensions
  • the target probability includes a probability corresponding to the multiple dimensions
  • Detecting target features through multiple dimensions can comprehensively detect the abnormal length of the target feature, thereby providing more accurate detection results.
  • the multiple dimensions include a statistical dimension
  • the target feature data includes a statistical value of the target feature of the first data stream
  • the target probability model includes a statistical Gaussian distribution
  • the target probability includes the The cumulative distribution probability of the statistical value of the target feature of the first data stream on the statistical Gaussian distribution, wherein the statistical value of the Gaussian distribution is a Gaussian distribution subject to the statistical value of the target feature of the normal data stream.
  • the multiple dimensions include data flow morphological dimensions
  • the target feature data includes target reconstruction error
  • the target probability model includes a reconstruction error Gaussian distribution
  • the target probability includes the target reconstruction error
  • the cumulative distribution probability of the reconstruction error Gaussian distribution wherein the target reconstruction error is the reconstruction error of the data stream form of the target feature of the first data stream, and the reconstruction error Gaussian distribution is the The reconstruction error of the data stream morphology of the target feature of the normal data stream obeys the Gaussian distribution.
  • the multiple dimensions include a correlation dimension
  • the target feature data includes a target correlation coefficient
  • the target probability model includes a correlation Gaussian distribution
  • the target probability includes the target correlation coefficient in the The cumulative distribution probability of the correlation Gaussian distribution, wherein the target correlation coefficient is the correlation coefficient between the target feature of the first data stream and other features of the first data stream, and the correlation Gaussian
  • the distribution is a Gaussian distribution in which correlation coefficients between the target feature of the normal data stream and other features of the normal data stream obey.
  • the determining the target abnormality degree according to the target probability includes: determining the abnormality degree of the target feature of the first data stream in the multiple dimensions according to the probabilities corresponding to the multiple dimensions; The target abnormality degree is determined according to the abnormality degree of the target feature of the first data stream in the multiple dimensions.
  • the target abnormality degree is the one with the largest value among the plurality of abnormality degrees.
  • the determining the failure of the network transmitting the first data stream according to the target abnormality degree includes: determining the abnormality degree of a plurality of characteristics of the first data stream, the plurality of characteristics including the target characteristic Determine the final degree of abnormality of the first data stream according to the degree of abnormality of the multiple characteristics; determine the failure of the network transmitting the first data stream according to the final degree of abnormality of the first data stream.
  • the above solution provides a method for determining network failures.
  • the final degree of abnormality is the one with the largest value among the abnormal degrees of the multiple features.
  • the determining the failure of the network transmitting the first data stream according to the final abnormality degree of the first data stream includes: determining the final abnormality degree of multiple data streams, the multiple data streams including all The first data stream, and the multiple data streams are all transmitted by the network that transmits the first data stream; the failure of the network that transmits the first data stream is determined according to the final degree of abnormality of the multiple data streams .
  • the above scheme gives a method of how to determine the network failure.
  • the present application provides a device for detecting a network failure, including a unit for executing the method described in the first aspect.
  • the device can be a terminal device or a server, or a chip in the terminal device or the server.
  • the device may include an input unit and a processing unit.
  • the processing unit may be a processor, and the input unit may be a transceiver; the terminal device may also include a storage unit, and the storage unit may be a memory; the storage unit is used to store instructions, The processing unit executes the instructions stored in the storage unit, so that the terminal device executes the method described in the first aspect.
  • the processing unit may be a processing unit inside the chip, and the input unit may be an input/output interface, a pin or a circuit, etc.; the processing unit executes instructions stored in the storage unit , So that the chip executes the method described in the first aspect, the storage unit can be a storage unit (for example, a register, a cache, etc.) in the chip, or a storage unit (for example, a read-only memory) located outside the chip. , Random Access Memory, etc.).
  • the present application provides a computer-readable storage medium in which a computer program is stored.
  • the processor executes the method described in the first aspect.
  • the present application provides a computer program product, the computer program product comprising: computer program code, when the computer program code is executed by a processor, the processor executes the method described in the first aspect.
  • Figure 1 is a schematic diagram of a network suitable for this application.
  • Fig. 2 is a schematic diagram of a method for detecting network failures provided by the present application.
  • Fig. 3 is a schematic diagram of a device for detecting network failures provided by the present application.
  • Fig. 4 is a schematic diagram of a device for detecting network failures provided by the present application.
  • Figure 1 shows a network suitable for this application.
  • the sending end 110 After the sending end 110 obtains the information to be sent, it packs the information to be sent into a data packet, which is modulated and sent out in the form of electromagnetic waves or electric current; the network device 130 transmits the data packet to the receiving end 120; the receiving end 120 receives the data After the packet is processed, the information carried in the data packet is obtained after processing such as demodulation.
  • the sending end 110 may be a mobile phone
  • the receiving end 120 may be a server
  • the network device 120 may be a base station and a core network.
  • the mobile phone sends the data packet
  • the data packet is transmitted through the base station and the core network, and finally reaches the server.
  • the base station, the core network, the optical fiber or cable between the base station and the core network, and the optical fiber or cable between the core network and the server together form a network for transmitting data packets.
  • the sending end 110 needs to carry the information to be sent through multiple data packets, and the multiple data packets are transmitted to the receiving end 120 through the network in order, then the multiple data packets can be called a data stream ( Or "stream").
  • the multiple data packets can be called a data stream ( Or "stream").
  • the network can transmit data packets according to the transmission control protocol (TCP), or can transmit data packets according to other methods, and this application does not limit the specific method of network transmission of data packets.
  • TCP transmission control protocol
  • the network will inevitably fail in the working process.
  • the user's most direct experience is that the network speed is stuck or the network is disconnected.
  • the engineer needs to determine the cause of the failure to facilitate targeted troubleshooting. Since the fault will be reflected by the characteristics of the data stream (for example, packet loss), the fault can be detected by analyzing the characteristics of the data stream.
  • the method for detecting network faults provided by this application is introduced below.
  • the data stream suitable for this application can be a TCP stream or a data stream based on other transmission protocols.
  • the following uses TCP stream as an example to introduce the technical solution of this application .
  • the device for detecting network failures can obtain TCP packets from the network through the packet capture module, where the location where the packet capture module performs packet capture can be any location in the network. After the above-mentioned device obtains the TCP packet, it can parse one or more TCP streams from the obtained TCP packet through the packet analysis module.
  • the speed test can be performed on the mobile phone through speedtest, and each speed measurement constitutes a transaction; the TCP packets captured in a speed measurement process are samples; subsequently, the device for detecting network failures can be based on preset rules from the captured TCP packets.
  • the article analyzes multiple characteristics of TCP flow and TCP flow, and the characteristics can also be called items or indicators.
  • the proportion of normal rate samples can be kept much larger than the proportion of abnormal rate samples. For example, if the number of abnormal samples in the currently collected samples is large, some abnormal samples can be discarded, so that the model can learn the normal data flow Features, so that abnormal data flow can be identified in the model application stage.
  • Table 1 shows some characteristics of the data stream provided by this application.
  • the left side is the name of each feature
  • the message parsing module can parse each feature from the TCP stream according to the description on the right side.
  • Each of the above features can include the feature of the upstream TCP flow and the feature of the downstream TCP flow.
  • the device for detecting the network failure may preprocess each TCP stream, and only keep the TCP streams whose static load ratio is greater than the minimum static load ratio constraint (e.g., one-thousandth). Detect network faults based on the preprocessed TCP stream.
  • the device for detecting network failures After analyzing the characteristics from the TCP stream, the device for detecting network failures can perform failure detection according to the method 200 shown in FIG. 2.
  • the method 200 includes:
  • S210 Acquire target feature data, where the target feature data is data related to the target feature of the first data stream.
  • the first data stream is a TCP stream to be tested, and the target characteristic is a characteristic of the first data stream.
  • the target characteristic is, for example, packet loss.
  • the target characteristic data can be data related to the target characteristic obtained directly from the first data stream, such as the packet loss rate; the target characteristic data can also be the first data stream that has been processed multiple times.
  • the obtained data related to the target feature for example, the reconstruction error of the time series formed by the number of lost packets of the first data stream.
  • S220 Determine the degree of target abnormality according to the target probability model and the target feature data, where the target probability model is used to indicate the probability distribution of normal feature data, and the normal feature data is data related to the target feature of the normal data stream ,
  • the target abnormality degree is the abnormality degree of the target feature of the first data stream.
  • the target probability model is a probability model of the related data of the target feature determined according to the normal data flow. It is used to indicate the probability distribution of the normal feature data.
  • the target feature data can be input into the target probability model to determine the target probability, and the first probability is determined according to the target probability.
  • the degree of abnormality of the target feature of the data stream, wherein the target probability is used to indicate the degree to which the target feature data deviates from the normal feature data.
  • the normal data flow can be determined based on the user's experience, for example, a data flow without a freeze in the user experience is a normal data flow.
  • This application does not limit the method for determining the normal data flow.
  • the target feature can be detected from multiple dimensions. That is, the target feature data includes data corresponding to the above-mentioned multiple dimensions, the target probability model includes the probability model corresponding to the multiple dimensions, and the target probability includes the probability corresponding to the multiple dimensions.
  • the above-mentioned multiple dimensions may include at least one of statistical dimensions, data flow form dimensions, and correlation dimensions. This application does not limit the specific content of the multiple dimensions. Here are a few examples of how to determine the degree of abnormality of target features from different dimensions. Example.
  • the target feature data includes the statistical value of the target feature of the first data stream.
  • the target probability model can be a statistical Gaussian distribution, and the target probability can be the statistical value of the target feature of the first data stream on the statistical Gaussian distribution.
  • the cumulative distribution probability wherein the Gaussian distribution of the statistical value is a Gaussian distribution subject to the statistical value of the target feature of the normal data stream.
  • the target feature is packet loss
  • the statistical value of the target feature can be the packet loss rate
  • the target probability model is the Gaussian distribution that the packet loss rate of the normal data stream obeys, that is, the statistical value Gaussian distribution; divide the packet loss of the first data stream Enter the Gaussian distribution of the statistical value to obtain the cumulative distribution probability of the packet loss rate of the first data stream.
  • the cumulative distribution probability is used to indicate the degree to which the packet loss rate of the first data stream deviates from the packet loss rate of the normal data stream, so as to determine The degree of abnormality in the statistical dimension of the target feature (ie, packet loss) of the first data stream.
  • the Gaussian distribution of the statistical value can be obtained by learning the packet loss rate of the normal data stream.
  • the value range of the cumulative distribution probability is 0 to 1.
  • Packet rate the larger the value, the greater the degree of abnormality. Therefore, we only consider the case where the cumulative distribution probability is close to 1.
  • the cumulative distribution probability of the packet loss rate of the first data stream is closer to 1, indicating the first data stream The greater the degree of abnormality in the statistical dimension of the packet loss characteristics of.
  • the target feature data can be the target reconstruction error
  • the target probability model can be the reconstruction error Gaussian distribution
  • the target probability can be the cumulative distribution probability of the target reconstruction error on the reconstruction error Gaussian distribution.
  • the target reconstruction error is a reconstruction error of the data stream morphology of the target feature of the first data stream
  • the reconstruction error Gaussian distribution is a Gaussian distribution that the reconstruction error of the data stream morphology of the target feature of the normal data stream obeys.
  • the target feature is packet loss
  • the target feature data can be the reconstruction error of the data stream morphology of the number of packets lost in the first data stream, that is, the target reconstruction error
  • the target probability model is the data of the number of packets lost in the normal data stream.
  • the reconstruction error of the flow morphology obeys the Gaussian distribution, that is, the reconstruction error Gaussian distribution
  • the target reconstruction error is input into the reconstruction error Gaussian distribution, and the cumulative probability distribution of the target reconstruction error is obtained.
  • the cumulative distribution probability is used to indicate the first
  • Statistics can be performed at intervals of 200 milliseconds to determine the data stream form of each feature of the first data stream, and each feature forms a data sequence sorted by time, that is, a time sequence.
  • the target feature as packet loss as an example
  • the time series is processed to a preset length by first expansion and then sampling, and then the processed time series are numerically normalized.
  • the numerically normalized time series no longer have numerical information. In this way, the neural network can focus more on learning the information of the time series in the morphological dimension of the data stream.
  • Variational auto-encoders for different characteristics can be constructed.
  • the target characteristic as packet loss as an example
  • the packet loss VAE encodes and reconstructs the time series, and trains the packet loss VAE by minimizing the reconstruction error; after the training is completed, the reconstruction error of the time series determining the number of packets lost in the normal data stream obeys The Gaussian distribution, that is, the Gaussian distribution of reconstruction error.
  • the normalized time series is input to the packet loss VAE to obtain the packet loss reconstruction error
  • the packet loss reconstruction error is input to the reconstruction error Gaussian distribution to obtain the cumulative distribution probability.
  • the value range of the cumulative distribution probability is 0 to 1.
  • the larger the value the greater the degree of abnormality. Therefore, we only consider the case where the cumulative distribution probability approaches 1, and the cumulative distribution probability of the packet loss reconstruction error is closer In 1, it indicates that the packet loss characteristics of the first data stream are more abnormal in the data stream morphological dimension.
  • the target feature data includes target correlation coefficients
  • the target probability model includes the correlation Gaussian distribution
  • the target probability includes the cumulative distribution probability of the target correlation coefficient on the correlation Gaussian distribution
  • the target correlation coefficient I is the correlation coefficient (such as Pearson correlation coefficient) between the target feature of the first data stream and other features of the first data stream
  • the correlation Gaussian distribution is the target feature of the normal data stream and other features of the normal data stream The correlation coefficient between them obeys the Gaussian distribution.
  • the target feature is packet loss
  • the target feature data can be the correlation coefficient between the number of packets lost in the first data stream and the number of out-of-sequence packets in the first data stream
  • the target probability model is the number of packets lost in the normal data stream and normal
  • the correlation coefficient of the number of out-of-order data packets of the data stream obeys the Gaussian distribution; input the correlation coefficient of the packet loss and out-of-order of the first data stream into the Gaussian distribution that the correlation coefficient of out-of-order packets obeys to obtain the first The cumulative probability distribution of the correlation coefficient between packet loss and disorder of the data stream.
  • the cumulative distribution probability is used to indicate that the correlation coefficient of the packet loss and disorder of the first data stream deviates from the correlation between the packet loss and disorder of the normal data stream.
  • the degree of the correlation coefficient; the cumulative distribution probability of the correlation coefficient is close to 0 or 1, which means that the distribution of the correlation coefficient is greatly deviated from the Gaussian distribution. Therefore, when calculating the cumulative distribution probability of the correlation coefficient, two need to be considered Deviation direction (the cumulative distribution probability is close to 0 or 1), you can subtract 0.5 from the cumulative distribution probability of the correlation coefficient and take the absolute value, then multiply it by the normalization coefficient 2, and the result can be used as the packet loss of the first data stream.
  • the degree of abnormality of the correlation coefficient with disorder When there are 3 or more features in the first data stream, the abnormal degree of the correlation coefficient between the packet loss and any other feature can be calculated, the average value of multiple abnormal degree values can be calculated, and the average The value is the degree of abnormality in the correlation dimension of packet loss.
  • the value range of the cumulative distribution probability is 0 to 1.
  • the correlation coefficient of packet loss in some cases, the larger the value, the greater the degree of abnormality, in other cases, the smaller the value, the greater the degree of abnormality. Therefore, we need to consider the cumulative distribution probability When it approaches 1 or 0, the closer the cumulative distribution probability of the correlation coefficient of packet loss is to 0 or 1, it indicates that the packet loss characteristics of the first data stream are more abnormal in the correlation dimension.
  • the cumulative distribution probability of the target feature in three dimensions can be obtained, thereby determining the degree of abnormality of the target feature in the three dimensions; the maximum pooling method can be used for reasoning, selecting The one with the largest degree of abnormality in the three dimensions is the final degree of abnormality of the target feature, that is, the target degree of abnormality.
  • the device that detects network failures can perform the following steps.
  • S230 Determine a failure of the network transmitting the first data stream according to the target abnormality degree.
  • the device for detecting network failure can be a data packet belonging to a data stream (ie, the first data stream), and the data stream has only one feature (ie, target feature), then the device for detecting network failure can
  • the target abnormality degree is taken as the final abnormality degree of the first data stream, and the network fault is determined according to the final abnormality degree.
  • the network is detected
  • the malfunctioning device can determine the degree of abnormality of multiple features, and determine the final degree of abnormality of the first data stream based on the degree of abnormality of the multiple features.
  • the final degree of abnormality of the first data stream may be the largest value among the abnormal degrees of the multiple features. Then, the network fault is determined according to the final degree of abnormality and corresponding characteristics.
  • the device for detecting network failure can determine the final degree of abnormality of multiple data streams, and determine the network failure based on the final degree of abnormality of multiple data streams.
  • the device for detecting network failures can sort the abnormality of multiple data streams, and present the data stream with the highest abnormality and corresponding characteristics.
  • the data packets captured by the current speed test belong to three data streams.
  • the three data streams are the first data stream, the second data stream, and the third data stream.
  • Each data stream can be parsed to obtain the characteristics shown in Table 1. ;
  • the abnormal degree of packet loss among the multiple characteristics of the first data stream is the largest, and the abnormal degree is 0.8, then the final degree of abnormality of the first data stream is 0.8, and the abnormal characteristic is packet loss;
  • the multiple characteristics of the second data stream Among the features, the degree of abnormality of retransmission is the largest.
  • the degree of abnormality is 0.5, the final degree of abnormality of the second data stream is 0.5, and the abnormal characteristic is retransmission; among the multiple characteristics of the third data stream, the degree of abnormality of packet loss is the largest, abnormal If the degree is 0.6, the final degree of abnormality of the third data stream is 0.6, and the abnormal characteristic is packet loss; the abnormal characteristic of the transaction (that is, the speed measurement) can be determined based on the voting decision, due to the abnormal characteristics of the two data streams in the three data streams If both are packet loss, it can be determined that the abnormal feature of the transaction is packet loss, that is, the failure of the network transmitting the first data stream is packet loss.
  • the method 200 first obtains the target characteristic data of the data stream to be tested, and then measures the degree of deviation of the target characteristic data from the normal characteristic data through the target probability model.
  • the target probability model does not rely on manually set rules and thresholds. Compared with manually setting rules and thresholds to detect network failures, the method 200 can quickly determine the cause of the failure and improve the efficiency of network failure detection.
  • the target probability model can be acquired by the processor learning the target features of normal data streams of different networks without manual intervention. Therefore, the method 200 also has good adaptability.
  • the corresponding device includes a hardware structure and/or software module corresponding to each function.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered as going beyond the scope of this application.
  • the present application may divide the device into functional units according to the foregoing method examples.
  • each function may be divided into each functional unit, or two or more functions may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit. It should be noted that the division of units in this application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.
  • Fig. 3 shows a schematic structural diagram of a device for detecting network failures provided by the present application.
  • the device 300 includes a processing unit 310.
  • the processing unit 310 is configured to: obtain target feature data, where the target feature data is data related to the target feature of the first data stream; determine the degree of target abnormality according to the target probability model and the target feature data, wherein the target probability
  • the model is used to indicate the probability distribution of normal feature data, where the normal feature data is data related to the target feature of the normal data stream, and the target abnormality degree is the abnormality degree of the target feature of the first data stream; according to the The degree of target abnormality determines the failure of the network transmitting the first data stream.
  • the processing unit 310 is specifically configured to: input the target feature data into the target probability model to determine a target probability, where the target probability is used to indicate the degree of abnormality of the target.
  • the target feature data includes data of multiple dimensions
  • the target probability model includes a probability model corresponding to the multiple dimensions
  • the target probability includes a probability corresponding to the multiple dimensions
  • the multiple dimensions include a statistical dimension
  • the target feature data includes a statistical value of the target feature of the first data stream
  • the target probability model includes a statistical Gaussian distribution
  • the target probability includes the The cumulative distribution probability of the statistical value of the target feature of the first data stream on the statistical Gaussian distribution, wherein the statistical value of the Gaussian distribution is a Gaussian distribution subject to the statistical value of the target feature of the normal data stream.
  • the multiple dimensions include data flow morphological dimensions
  • the target feature data includes target reconstruction error
  • the target probability model includes a reconstruction error Gaussian distribution
  • the target probability includes the target reconstruction error
  • the cumulative distribution probability of the reconstruction error Gaussian distribution wherein the target reconstruction error is the reconstruction error of the data stream form of the target feature of the first data stream, and the reconstruction error Gaussian distribution is the The reconstruction error of the data stream morphology of the target feature of the normal data stream obeys the Gaussian distribution.
  • the multiple dimensions include a correlation dimension
  • the target feature data includes a target correlation coefficient
  • the target probability model includes a correlation Gaussian distribution
  • the target probability includes the target correlation coefficient in the The cumulative distribution probability of the correlation Gaussian distribution, wherein the target correlation coefficient is the correlation coefficient between the target feature of the first data stream and other features of the first data stream, and the correlation Gaussian
  • the distribution is a Gaussian distribution in which correlation coefficients between the target feature of the normal data stream and other features of the normal data stream obey.
  • the processing unit 310 is specifically configured to: determine the degree of abnormality of the target feature of the first data stream in the multiple dimensions according to the probabilities corresponding to the multiple dimensions; according to the target of the first data stream The degree of abnormality of the feature in the multiple dimensions determines the degree of abnormality of the target.
  • the target abnormality degree is the one with the largest value among the plurality of abnormality degrees.
  • the processing unit 310 is specifically configured to: determine the degree of abnormality of multiple features of the first data stream, where the multiple features include the target feature; determine the first data according to the degree of abnormality of the multiple features The final degree of abnormality of the stream; the failure of the network transmitting the first data stream is determined according to the final degree of abnormality of the first data stream.
  • the final degree of abnormality is the one with the largest value among the abnormal degrees of the multiple features.
  • the processing unit 310 is specifically configured to determine the final degree of abnormality of multiple data streams, the multiple data streams including the first data stream, and the multiple data streams are all transmitted by the first data stream.
  • Network transmission of the data stream determining the failure of the network transmitting the first data stream according to the final degree of abnormality of the multiple data streams.
  • Figure 4 shows a schematic structural diagram of a device for detecting network failures provided by the present application.
  • the dotted line in Figure 4 indicates that the unit or the module is optional.
  • the device 400 may be used to implement the methods described in the foregoing method embodiments.
  • the device 400 may be a terminal device or a server or a chip.
  • the device 400 includes one or more processors 401, and the one or more processors 401 can support the device 400 to implement the method in the method embodiment.
  • the processor 401 may be a general-purpose processor or a special-purpose processor.
  • the processor 401 may be a central processing unit (CPU).
  • the CPU can be used to control the device 400, execute a software program, and process data of the software program.
  • the device 400 may also include a communication unit 405 to implement input (reception) and/or output (transmission) of a signal (such as the first data stream).
  • the device 400 may be a chip, and the communication unit 405 may be an input and/or output circuit of the chip, or the communication unit 405 may be a communication interface of the chip, and the chip may be used as a terminal device or a network device or other electronic device. component.
  • the device 400 may be a terminal device or a server
  • the communication unit 405 may be a transceiver of the terminal device or the server, or the communication unit 405 may be a transceiver circuit of the terminal device or the server.
  • the device 400 may include one or more memories 402, on which a program 404 is stored.
  • the program 404 can be run by the processor 401 to generate an instruction 403, so that the processor 401 executes the method described in the foregoing method embodiment according to the instruction 403.
  • data (such as target feature data) may also be stored in the memory 402.
  • the processor 401 may also read data stored in the memory 402. The data may be stored at the same storage address as the program 404, or the data may be stored at a different storage address from the program 404.
  • the processor 401 and the memory 402 may be provided separately or integrated together, for example, integrated on a system-on-chip (SOC) of the terminal device.
  • SOC system-on-chip
  • the processor 401 may be a CPU, a digital signal processor (digital signal processor, DSP), an application specific integrated circuit (ASIC), a field programmable gate array (field programmable gate array, FPGA) or other programmable logic devices , For example, discrete gates, transistor logic devices, or discrete hardware components.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • This application also provides a computer program product, which, when executed by the processor 401, implements the method described in any method embodiment in this application.
  • the computer program product may be stored in the memory 402, for example, a program 404.
  • the program 404 is finally converted into an executable object file that can be executed by the processor 401 after preprocessing, compilation, assembly, and linking.
  • the present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a computer, the method described in any method embodiment in the present application is implemented.
  • the computer program can be a high-level language program or an executable target program.
  • the computer-readable storage medium is, for example, the memory 402.
  • the memory 402 may be a volatile memory or a non-volatile memory, or the memory 402 may include both a volatile memory and a non-volatile memory.
  • the non-volatile memory can be read-only memory (ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), and electrically available Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be random access memory (RAM), which is used as an external cache.
  • RAM random access memory
  • static random access memory static random access memory
  • dynamic RAM dynamic RAM
  • DRAM dynamic random access memory
  • synchronous dynamic random access memory synchronous DRAM, SDRAM
  • double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • synchronous connection dynamic random access memory serial DRAM, SLDRAM
  • direct rambus RAM direct rambus RAM, DR RAM
  • the disclosed system, device, and method may be implemented in other ways. For example, some features of the method embodiments described above may be ignored or not implemented.
  • the device embodiments described above are merely illustrative.
  • the division of units is only a logical function division. In actual implementation, there may be other division methods, and multiple units or components may be combined or integrated into another system.
  • the coupling between the various units or the coupling between the various components may be direct coupling or indirect coupling, and the foregoing coupling includes electrical, mechanical, or other forms of connection.
  • the size of the sequence number of each process does not mean the order of execution.
  • the execution order of each process should be determined by its function and internal logic, and should not correspond to the embodiments of the present application.
  • the implementation process constitutes any limitation.

Abstract

本申请涉及人工智能领域，提供了一种检测网络故障的方法，包括：获取目标特征数据，所述目标特征数据为与第一数据流的目标特征相关的数据；根据目标概率模型和所述目标特征数据确定目标异常程度，其中，所述目标概率模型用于指示正常特征数据的概率分布，所述正常特征数据为与正常数据流的目标特征相关的数据，所述目标异常程度为所述第一数据流的目标特征的异常程度；根据所述目标异常程度确定传输所述第一数据流的网络的故障。相比于人工设定规则和阈值检测网络故障，上述方法不依赖人工设定的规则和阈值，能够提高网络故障的检测效率，并且具有良好的自适应性。

Description

检测网络故障的方法和装置
本申请要求于2020年6月3日提交中国专利局、申请号为202010495686.1、申请名称为“检测网络故障的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及人工智能领域，具体涉及一种检测网络故障的方法和装置。
背景技术
网络传输是指利用电流或者电磁波传输信息的过程。在网络传输中，可能出现网速低、网络卡顿等故障，此时需要检测网络故障，即，确定故障的原因，以便于针对性地排除故障。
一种检测网络故障的方法是从网络传输的数据流中抓取多个数据包，通过分析该多个数据包的特征确定该数据流是否存在异常情况。由于不同的网络中对异常特征的判断标准不同，并且，数据传输协议通常具有一定的容错性，需要经验丰富的工程师人工分析数据包的特征，找出存在异常情况的数据流。这种检测网络故障的方式对人工设定的规则和阈值的依赖性较强，难以快速确定故障原因，这是当前需要解决的问题。
发明内容
本申请提供了一种检测网络故障的方法和装置，能够提高网络故障的检测效率。
第一方面，提供了一种检测网络故障的方法，包括：获取目标特征数据，所述目标特征数据为与第一数据流的目标特征相关的数据；根据目标概率模型和所述目标特征数据确定目标异常程度，其中，所述目标概率模型用于指示正常特征数据的概率分布，所述正常特征数据为与正常数据流的目标特征相关的数据，所述目标异常程度为所述第一数据流的目标特征的异常程度；根据所述目标异常程度确定传输所述第一数据流的网络的故障。
在本申请提供的检测网络的方法中，首先获取待测数据流的目标特征数据，然后通过目标概率模型衡量目标特征数据偏离正常特征数据的程度，其中，目标概率模型例如是正常数据流的目标特征的统计值服从的高斯分布，目标概率模型不依赖人工设定的规则和阈值，因此，基于目标概率模型能够快速确定故障原因，提高网络故障的检测效率。此外，目标概率模型可以通过处理器学习不同网络的正常数据流的目标特征获取，无需人工干预，因此，上述方法还能够适应不同的网络环境，具有良好的自适应性。
可选地，所述根据目标概率模型和所述目标特征数据确定目标异常程度，包括：将所述目标特征数据输入所述目标概率模型确定目标概率，所述目标概率用于表示所述目标异常程度。
可选地，所述目标特征数据包括多个维度的数据，所述目标概率模型包括所述多个维 度对应的概率模型，所述目标概率包括所述多个维度对应的概率。
通过多个维度对目标特征进行检测，能够全面检测目标特征的异常长度，从而提供更加准确的检测结果。
可选地，所述多个维度包括统计维度，所述目标特征数据包括所述第一数据流的目标特征的统计值，所述目标概率模型包括统计值高斯分布，所述目标概率包括所述第一数据流的目标特征的统计值在所述统计高斯分布上的累积分布概率，其中，所述统计值高斯分布为所述正常数据流的目标特征的统计值服从的高斯分布。
可选地，所述多个维度包括数据流形态维度，所述目标特征数据包括目标重构误差，所述目标概率模型包括重构误差高斯分布，所述目标概率包括所述目标重构误差在所述重构误差高斯分布上的累积分布概率，其中，所述目标重构误差为所述第一数据流的目标特征的数据流形态的重构误差，所述重构误差高斯分布为所述正常数据流的目标特征的数据流形态的重构误差服从的高斯分布。
可选地，所述多个维度包括相关性维度，所述目标特征数据包括目标相关性系数，所述目标概率模型包括相关性高斯分布，所述目标概率包括所述目标相关性系数在所述相关性高斯分布上的累积分布概率，其中，所述目标相关性系数为所述第一数据流的目标特征与所述第一数据流的其它特征之间的相关性系数，所述相关性高斯分布为所述正常数据流的目标特征与所述正常数据流的其它特征之间的相关性系数服从的高斯分布。
可选地，所述根据所述目标概率确定所述目标异常程度，包括：根据所述多个维度对应的概率确定所述第一数据流的目标特征在所述多个维度上的异常程度；根据所述第一数据流的目标特征在所述多个维度上的异常程度确定所述目标异常程度。
可选地，所述目标异常程度为所述多个异常程度中数值最大的一个。
可选地，所述根据所述目标异常程度确定传输所述第一数据流的网络的故障，包括：确定第一数据流的多个特征的异常程度，所述多个特征包括所述目标特征；根据所述多个特征的异常程度确定所述第一数据流的最终异常程度；根据所述第一数据流的最终异常程度确定传输所述第一数据流的网络的故障。
当第一数据流包含多个特征时，上述方案给出了如何确定网络故障的方法。
可选地，所述最终异常程度为所述多个特征的异常程度中数值最大的一个。
可选地，所述根据所述第一数据流的最终异常程度确定传输所述第一数据流的网络的故障，包括：确定多个数据流的最终异常程度，所述多个数据流包括所述第一数据流，并且，所述多个数据流均由传输所述第一数据流的网络传输；根据所述多个数据流的最终异常程度确定传输所述第一数据流的网络的故障。
当网络传输多个数据流时，上述方案给出了如何确定网络故障的方法。
第二方面，本申请提供了一种检测网络故障的装置，包括用于执行第一方面所述的方法的单元。该装置可以是终端设备或服务器，也可以是终端设备或服务器内的芯片。该装置可以包括输入单元和处理单元。
当该装置是终端设备或服务器时，该处理单元可以是处理器，该输入单元可以是收发器；该终端设备还可以包括存储单元，该存储单元可以是存储器；该存储单元用于存储指令，该处理单元执行该存储单元所存储的指令，以使该终端设备执行第一方面所述的方法。
当该装置是终端设备或服务器内的芯片时，该处理单元可以是芯片内部的处理单元， 该输入单元可以是输入/输出接口、管脚或电路等；该处理单元执行存储单元所存储的指令，以使该芯片执行第一方面所述的方法，该存储单元可以是该芯片内的存储单元(例如，寄存器、缓存等)，也可以是位于该芯片外部的存储单元(例如，只读存储器、随机存取存储器等)。
第三方面，本申请提供了一种计算机可读存储介质，该计算机可读存储介质中存储了计算机程序，该计算机程序被处理器执行时，使得处理器执行第一方面所述的方法。
第四方面，本申请提供了一种计算机程序产品，该计算机程序产品包括：计算机程序代码，当该计算机程序代码被处理器运行时，使得处理器执行第一方面所述的方法。
附图说明
图1是一种适用于本申请的网络的示意图。
图2是本申请提供的一种检测网络故障的方法的示意图。
图3是本申请提供的一种检测网络故障的装置的示意图。
图4是本申请提供的一种检测网络故障的设备的示意图。
具体实施方式
下面将结合附图，对本申请的技术方案进行描述。
图1示出了适用于本申请的一种网络。
发送端110获取待发送信息后，将待发送信息打包生成数据包，数据包经过调制后以电磁波或者电流的形式发送出去；网络设备130将数据包传输至接收端120；接收端120接收到数据包后，经过解调等处理后获取数据包中承载的信息。
发送端110可以是手机，接收端120可以是服务器，网络设备120可以是基站和核心网。手机将数据包发送出去后，数据包经过基站和核心网的传输，最终到达服务器。在该传输过程中，基站、核心网、基站与核心网之间的光纤或电缆、以及核心网和服务器之间的光纤或电缆共同构成了传输数据包的网络。
当待发送信息较多时，发送端110需要通过多个数据包承载待发送信息，该多个数据包按照顺序通过网络传输至接收端120，则该多个数据包可以被称为一个数据流(或“流”)。网络中可以存在多个数据流，这取决于多个数据包的逻辑划分方式。此外，网络可以依据传输控制协议(transmission control protocol，TCP)传输数据包，也可以依据其它方法传输数据包，本申请对网络传输数据包的具体方式不作限定。
网络在工作过程中不可避免地会出现故障，当网络出现故障时，用户最直接的体验是网速卡顿或断网，此时，工程师需要确定故障的原因，以便于针对性地排除故障。由于故障会通过数据流的特征(如，丢包)反映出来，可以通过分析数据流的特征来检测故障，下面介绍本申请提供的检测网络故障的方法。
在检测网络故障之前，首先需要获取待检测的数据流，适用于本申请的数据流可以是TCP流，也可以是基于其它传输协议的数据流，下面以TCP流为例介绍本申请的技术方案。检测网络故障的装置可以通过抓包模块从网络中获取TCP报文，其中，抓包模块进行抓包的位置可以是网络中的任意位置。上述装置获取TCP报文后，可以通过报文解析模块从获取的TCP报文中解析出一条或多条TCP流。
例如，可以通过speedtest在手机端进行测速，每次测速构成一个事务；在一次测速过程中抓取的TCP报文即样本；随后，检测网络故障的装置可以根据预设规则从抓取的TCP报文中解析出TCP流和TCP流的多个特征，特征也可以称为项目或指标。
在模型训练阶段，可以保持正常速率样本的比例远大于异常速率样本的比例，例如，当前采集的样本中异常样本的数量较多，可以丢弃一些异常样本，这样，模型可以学习到正常数据流的特征，从而能够在模型应用阶段识别出异常数据流。
表1是本申请提供的数据流的一些特征。
表1
Figure PCTCN2021096678-appb-000001
表1中，左侧为各个特征的名称，报文解析模块可以按照右侧的描述从TCP流中解析中各个特征，上述各个特征可以包括上行TCP流的特征和下行TCP流的特征。可选地，在检测网络故障前，检测网络故障的装置可以对各条TCP流进行预处理，只保留静荷占比大于最小静荷占比约束(如，千分之一)的TCP流，基于预处理后的TCP流检测网络故障。
从TCP流中解析出特征后，检测网络故障的装置可以按照图2所示的方法200进行故障检测。
如图2所示，方法200包括：
S210，获取目标特征数据，所述目标特征数据为与第一数据流的目标特征相关的数据。
第一数据流是一个待测的TCP流，目标特征是第一数据流的一个特征。目标特征例如是丢包，目标特征数据可以是直接从第一数据流中获得的与目标特征相关的数据，如，丢包率；目标特征数据也可以是对第一数据流进行多次处理后获得的与目标特征相关的数据，如，第一数据流的丢包数量所构成的时间序列的重构误差。
S220，根据目标概率模型和所述目标特征数据确定目标异常程度，其中，所述目标概率模型用于指示正常特征数据的概率分布，所述正常特征数据为与正常数据流的目标特征相关的数据，所述目标异常程度为所述第一数据流的目标特征的异常程度。
目标概率模型是根据正常数据流确定的目标特征的相关数据的概率模型，用于指示正常特征数据的概率分布，可以将目标特征数据输入目标概率模型确定目标概率，根据目标概率确定所述第一数据流的目标特征的异常程度，其中，所述目标概率用于指示目标特征数据偏离正常特征数据的程度。
上述步骤中，正常数据流可以基于用户的体验确定，例如，用户体验没有卡顿的数据流即正常数据流。本申请对确定正常数据流的方法不做限定。
为了全面检测目标特征的异常程度，可以从多个维度对目标特征进行检测。即，目标特征数据包括上述多个维度对应的数据，目标概率模型包括所述多个维度对应的概率模型，目标概率包括所述多个维度对应的概率。
上述多个维度可以包括统计维度、数据流形态维度和相关性维度中的至少一个，本申请对该多个维度的具体内容不作限定，下面给出几个从不同维度确定目标特征的异常程度的示例。
1、统计维度。
在统计维度，目标特征数据包括第一数据流的目标特征的统计值，目标概率模型可以是统计值高斯分布，目标概率可以是第一数据流的目标特征的统计值在统计值高斯分布上的累积分布概率，其中，所述统计值高斯分布为正常数据流的目标特征的统计值服从的高斯分布。
例如，目标特征为丢包，目标特征的统计值可以是丢包率，目标概率模型为正常数据流的丢包率服从的高斯分布，即，统计值高斯分布；将第一数据流的丢包率输入统计值高斯分布，得到第一数据流的丢包率的累积分布概率，该累积分布概率用于指示第一数据流的丢包率偏离正常数据流的丢包率的程度，从而可以确定第一数据流的目标特征(即，丢包)在统计维度的异常程度。
上述示例中，统计值高斯分布可以通过学习正常数据流的丢包率得到。累积分布概率的取值范围是0到1，第一数据流的目标特征的统计值偏离正常数据流的目标特征的统计值的程度越大，累积分布概率越趋近于0或1；对于丢包率，其数值越大说明异常程度越大，因此，我们只考虑累积分布概率趋近于1的情况，第一数据流的丢包率的累积分布概率越接近于1，说明第一数据流的丢包特征在统计维度上的异常程度越大。
2、数据流形态维度。
在数据流形态维度，目标特征数据可以是目标重构误差，目标概率模型可以是重构误差高斯分布，目标概率可以是目标重构误差在重构误差高斯分布上的累积分布概率，其中，所述目标重构误差为第一数据流的目标特征的数据流形态的重构误差，所述重构误差高斯分布为正常数据流的目标特征的数据流形态的重构误差服从的高斯分布。
例如，目标特征为丢包，目标特征数据可以是第一数据流的丢包数量的数据流形态的重构误差，即，目标重构误差；目标概率模型为正常数据流的丢包数量的数据流形态的重构误差服从的高斯分布，即，重构误差高斯分布；将目标重构误差输入重构误差高斯分布，得到目标重构误差的累积概率分布，该累积分布概率用于指示第一数据流的丢包数量的数据流形态的重构误差偏离正常数据流的丢包数量的数据流形态的重构误差的程度，从而可以确定第一数据流的目标特征(即，丢包)在数据流形态维度的异常程度。
可以以200毫秒为间隔进行统计，确定第一数据流的各个特征的数据流形态，每个特征均形成一条按照时间排序的数据序列，即，时间序列。以目标特征为丢包为例，获取丢包数量的时间序列后，采用先扩充后采样的方式将该时间序列处理为预设的长度，然后对处理后的时间序列进行数值归一化，经过数值归一化的时间序列不再具有数值方面的信息，这样，神经网络可以更加专注于学习时间序列在数据流形态维度的信息。
例如，第一数据流的传输时长是2秒，以200毫秒为间隔进行统计，则特征(以丢包为例)的时间序列有10个数据点，即，a＝[0,2,0,3,0,0,0,3,0,0]，为表述方便，将时间序列a中的每个点记为a i，i＝1,2,...,10，其中，a 1＝0表示第一个间隔内不存在丢包，a 2＝2表示第二个间隔内存在两个丢包，等等。
假设时间序列的预设长度为6，先扩充后采样可以是如下方案：先将a中的每个数据点扩充6倍，得到扩充后的时间序列b，b＝[a 1,a 1,a 1,a 1,a 1,a 1,a 2,a 2,a 2,a 2,a 2,a 2,...,a 10,a 10,a 10,a 10,a 10,a 10]，为表述方便，将b中的每个点记为b j,j＝1,2,...,60；再对b进行采样得到长度为6的时间序列c，为表述方便，将c中的每个点记为c k，k＝1,2,...,6；其中，可以将b中每10个点分为一组求平均值，得到的结果为c中一个点。例如，
c 1＝(b 1+b 2+...+b 10)/10
＝(a 1+a 1+a 1+a 1+a 1+a 1+a 2+a 2+a 2+a 2)/10
＝(0+0+0+0+0+0+2+2+2+2)/10
＝0.8
以上完成了神经网络学习所需的准备工作，接下来进行模型构建和训练。可以构建针对不同特征的变分自编码器(variational auto-encoder，VAE)，以目标特征为丢包为例，构建丢包VAE后，将多个正常数据流的丢包数量的时间序列输入该丢包VAE，丢包VAE对该时间序列进行编码和重构，通过最小化重构误差对丢包VAE进行训练；训练完成后，确定正常数据流的丢包数量的时间序列的重构误差服从的高斯分布，即，重构误差高斯分布。
对于第一数据流的丢包数量的时间序列，将其处理成与丢包VAE的输入数据的长度(如6)相等的时间序列，然后对处理后的时间序列进行数值归一化，将数值归一化后的时间序列输入丢包VAE得到丢包重构误差，将该丢包重构误差输入重构误差高斯分布得到累积分布概率。
上述示例中，累积分布概率的取值范围是0到1，目标重构误差偏离正常重构误差(正常数据流的目标特征的数据流形态的重构误差)的程度越大，累积分布概率越趋近于0或1；对于丢包重构误差，其数值越大说明异常程度越大，因此，我们只考虑累积分布概率趋近于1的情况，丢包重构误差的累积分布概率越接近于1，说明第一数据流的丢包特征在数据流形态维度上的异常程度越大。
3、相关性维度。
在相关性维度中，目标特征数据包括目标相关性系数，目标概率模型包括相关性高斯分布，目标概率包括目标相关性系数在相关性高斯分布上的累积分布概率，其中，所述目标相关性系数为第一数据流的目标特征与第一数据流的其它特征之间的相关性系数(如皮尔逊相关系数)，所述相关性高斯分布为正常数据流的目标特征与正常数据流的其它特征之间的相关性系数服从的高斯分布。
例如，目标特征为丢包，目标特征数据可以是第一数据流的丢包数量与第一数据流的乱序数据包数量的相关性系数；目标概率模型为正常数据流的丢包数量与正常数据流的乱序数据包数量的相关性系数服从的高斯分布；将第一数据流的丢包与乱序的相关性系数输入丢包与乱序的相关性系数服从的高斯分布，得到第一数据流的丢包与乱序的相关性系数 的累积概率分布，该累积分布概率用于指示第一数据流的丢包与乱序的相关性系数偏离正常数据流的丢包与乱序的相关性系数的程度；相关性系数的累积分布概率接近0或1均表示该相关性系数的分布与高斯分布存在较大的偏离，因此，在计算相关性系数的累积分布概率时，需要考虑两个偏离方向(累积分布概率接近0或1)，可以将相关性系数的累积分布概率减去0.5后取绝对值，再乘以归一化系数2，得到的结果可以作为第一数据流的丢包与乱序的相关性系数的异常程度。当第一数据流存在3个或3个以上的特征时，可以计算丢包与其它任意一个特征之间的相关性系数的异常程度，计算多个异常程度的取值的平均值，将该平均值作为丢包的相关性维度异常程度。
上述示例中，累积分布概率的取值范围是0到1，目标相关性系数偏离正常相关性系数(正常数据流的目标特征的相关性系数)的程度越大，累积分布概率越趋近于0或1；对于丢包的相关性系数，在一些情况下，其数值越大说明异常程度越大，在另一些情况下，其数值越小说明异常程度越大，因此，我们需要考虑累积分布概率趋近于1或0的情况，丢包的相关性系数的累积分布概率越接近于0或1，说明第一数据流的丢包特征在相关性维度上的异常程度越大。
通过上文所述的方法，可以得到目标特征在三个维度上的累积分布概率，从而确定了目标特征在三个维度上的异常程度；可以采用最大池化(max pooling)方法进行推理，选择该三个维度上的异常程度中异常程度最大的一个作为目标特征的最终异常程度，即，目标异常程度。
确定目标异常程度后，检测网络故障的装置可以执行下列步骤。
S230，根据所述目标异常程度确定传输所述第一数据流的网络的故障。
若检测网络故障的装置抓取的数据包是属于一条数据流(即，第一数据流)的数据包，并且，该数据流只有一个特征(即，目标特征)，则检测网络故障的装置可以将目标异常程度作为第一数据流的最终异常程度，并根据最终异常程度确定网络故障。
若检测网络故障的装置抓取的数据包是属于一条数据流(即，第一数据流)的数据包，并且，该数据流包括多个特征(该多个特征包括目标特征)，则检测网络故障的装置可以确定多个特征的异常程度，基于该多个特征的异常程度确定第一数据流的最终异常程度，第一数据流的最终异常程度可以是该多个特征的异常程度中数值最大的一个；随后，根据最终异常程度和相应的特征确定网络故障。
若检测网络故障的装置抓取的数据包是属于多条数据流的数据包，其中，该多条数据流包括第一数据流，并且该多个数据流均由传输第一数据流的网络传输，则检测网络故障的装置可以确定多条数据流的最终异常程度，并基于多条数据流的最终异常程度确定网络故障。可选地，检测网络故障的装置可以对多个数据流的异常程度进行排序，将最终异常程度最高的数据流以及相应的特征呈现出来。
例如，当前测速抓取的数据包属于三条数据流，该三条数据流分别为第一数据流、第二数据流和第三数据流，每条数据流都能解析出如表1所示的特征；其中，第一数据流的多个特征中丢包的异常程度最大，异常程度为0.8，则第一数据流的最终异常程度为0.8，且异常特征为丢包；第二数据流的多个特征中重传的异常程度最大，异常程度为0.5，则第二数据流的最终异常程度为0.5，且异常特征为重传；第三数据流的多个特征中丢包的异常程度最大，异常程度为0.6，则第三数据流的最终异常程度为0.6，且异常特征为丢包； 可以基于投票决策确定事务(即，测速)的异常特征，由于三条数据流中两条数据流的异常特征均为丢包，则可以确定事务的异常特征为丢包，即，传输第一数据流的网络的故障为丢包。
综上所述，方法200首先获取待测数据流的目标特征数据，然后通过目标概率模型衡量目标特征数据偏离正常特征数据的程度，其中，目标概率模型不依赖人工设定的规则和阈值，相比于人工设定规则和阈值检测网络故障，方法200能够快速确定故障原因，提高网络故障的检测效率。此外，目标概率模型可以通过处理器学习不同网络的正常数据流的目标特征获取，无需人工干预，因此，方法200还具有良好的自适应性。
上文详细介绍了本申请提供的检测网络故障的方法的示例。可以理解的是，相应的装置为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请可以根据上述方法示例对装置进行功能单元的划分，例如，可以将各个功能划分为各个功能单元，也可以将两个或两个以上的功能集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。需要说明的是，本申请中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
图3示出了本申请提供的一种检测网络故障的装置的结构示意图。装置300包括处理单元310。
处理单元310用于：获取目标特征数据，所述目标特征数据为与第一数据流的目标特征相关的数据；根据目标概率模型和所述目标特征数据确定目标异常程度，其中，所述目标概率模型用于指示正常特征数据的概率分布，所述正常特征数据为与正常数据流的目标特征相关的数据，所述目标异常程度为所述第一数据流的目标特征的异常程度；根据所述目标异常程度确定传输所述第一数据流的网络的故障。
可选地，处理单元310具体用于：将所述目标特征数据输入所述目标概率模型确定目标概率，所述目标概率用于表示所述目标异常程度。
可选地，所述目标特征数据包括多个维度的数据，所述目标概率模型包括所述多个维度对应的概率模型，所述目标概率包括所述多个维度对应的概率。
可选地，所述多个维度包括统计维度，所述目标特征数据包括所述第一数据流的目标特征的统计值，所述目标概率模型包括统计值高斯分布，所述目标概率包括所述第一数据流的目标特征的统计值在所述统计高斯分布上的累积分布概率，其中，所述统计值高斯分布为所述正常数据流的目标特征的统计值服从的高斯分布。
可选地，所述多个维度包括数据流形态维度，所述目标特征数据包括目标重构误差，所述目标概率模型包括重构误差高斯分布，所述目标概率包括所述目标重构误差在所述重构误差高斯分布上的累积分布概率，其中，所述目标重构误差为所述第一数据流的目标特征的数据流形态的重构误差，所述重构误差高斯分布为所述正常数据流的目标特征的数据 流形态的重构误差服从的高斯分布。
可选地，所述多个维度包括相关性维度，所述目标特征数据包括目标相关性系数，所述目标概率模型包括相关性高斯分布，所述目标概率包括所述目标相关性系数在所述相关性高斯分布上的累积分布概率，其中，所述目标相关性系数为所述第一数据流的目标特征与所述第一数据流的其它特征之间的相关性系数，所述相关性高斯分布为所述正常数据流的目标特征与所述正常数据流的其它特征之间的相关性系数服从的高斯分布。
可选地，处理单元310具体用于：根据所述多个维度对应的概率确定所述第一数据流的目标特征在所述多个维度上的异常程度；根据所述第一数据流的目标特征在所述多个维度上的异常程度确定所述目标异常程度。
可选地，所述目标异常程度为所述多个异常程度中数值最大的一个。
可选地，处理单元310具体用于：确定第一数据流的多个特征的异常程度，所述多个特征包括所述目标特征；根据所述多个特征的异常程度确定所述第一数据流的最终异常程度；根据所述第一数据流的最终异常程度确定传输所述第一数据流的网络的故障。
可选地，所述最终异常程度为所述多个特征的异常程度中数值最大的一个。
可选地，处理单元310具体用于：确定多个数据流的最终异常程度，所述多个数据流包括所述第一数据流，并且，所述多个数据流均由传输所述第一数据流的网络传输；根据所述多个数据流的最终异常程度确定传输所述第一数据流的网络的故障。
装置300执行检测网络故障的方法的具体方式以及产生的有益效果可以参见方法实施例中的相关描述。
图4示出了本申请提供的一种检测网络故障的设备的结构示意图。图4中的虚线表示该单元或该模块为可选的。设备400可用于实现上述方法实施例中描述的方法。设备400可以是终端设备或服务器或芯片。
设备400包括一个或多个处理器401，该一个或多个处理器401可支持设备400实现方法实施例中的方法。处理器401可以是通用处理器或者专用处理器。例如，处理器401可以是中央处理器(central processing unit，CPU)。CPU可以用于对设备400进行控制，执行软件程序，处理软件程序的数据。设备400还可以包括通信单元405，用以实现信号(如第一数据流)的输入(接收)和/或输出(发送)。
例如，设备400可以是芯片，通信单元405可以是该芯片的输入和/或输出电路，或者，通信单元405可以是该芯片的通信接口，该芯片可以作为终端设备或网络设备或其它电子设备的组成部分。
又例如，设备400可以是终端设备或服务器，通信单元405可以是该终端设备或该服务器的收发器，或者，通信单元405可以是该终端设备或该服务器的收发电路。
设备400中可以包括一个或多个存储器402，其上存有程序404，程序404可被处理器401运行，生成指令403，使得处理器401根据指令403执行上述方法实施例中描述的方法。可选地，存储器402中还可以存储有数据(如目标特征数据)。可选地，处理器401还可以读取存储器402中存储的数据，该数据可以与程序404存储在相同的存储地址，该数据也可以与程序404存储在不同的存储地址。
处理器401和存储器402可以单独设置，也可以集成在一起，例如，集成在终端设备的系统级芯片(system on chip，SOC)上。
处理器401执行方法实施例的具体方式可以参见方法实施例中的相关描述。
应理解，上述方法实施例的各步骤可以通过处理器401中的硬件形式的逻辑电路或者软件形式的指令完成。处理器401可以是CPU、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现场可编程门阵列(field programmable gate array，FPGA)或者其它可编程逻辑器件，例如，分立门、晶体管逻辑器件或分立硬件组件。
本申请还提供了一种计算机程序产品，该计算机程序产品被处理器401执行时实现本申请中任一方法实施例所述的方法。
该计算机程序产品可以存储在存储器402中，例如是程序404，程序404经过预处理、编译、汇编和链接等处理过程最终被转换为能够被处理器401执行的可执行目标文件。
本申请还提供了一种计算机可读存储介质，其上存储有计算机程序，该计算机程序被计算机执行时实现本申请中任一方法实施例所述的方法。该计算机程序可以是高级语言程序，也可以是可执行目标程序。
该计算机可读存储介质例如是存储器402。存储器402可以是易失性存储器或非易失性存储器，或者，存储器402可以同时包括易失性存储器和非易失性存储器。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
本领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的装置和设备的具体工作过程以及产生的技术效果，可以参考前述方法实施例中对应的过程和技术效果，在此不再赘述。
在本申请所提供的几个实施例中，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的方法实施例的一些特征可以忽略，或不执行。以上所描述的装置实施例仅仅是示意性的，单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，多个单元或组件可以结合或者可以集成到另一个系统。另外，各单元之间的耦合或各个组件之间的耦合可以是直接耦合，也可以是间接耦合，上述耦合包括电的、机械的或其它形式的连接。
应理解，在本申请的各种实施例中，各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请的实施例的实施过程构成任何限定。
另外，本文中的术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B 这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
总之，以上所述仅为本申请技术方案的较佳实施例而已，并非用于限定本申请的保护范围。凡在本申请的原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (25)

  1. 一种检测网络故障的方法，其特征在于，包括：
    获取目标特征数据，所述目标特征数据为与第一数据流的目标特征相关的数据；
    根据目标概率模型和所述目标特征数据确定目标异常程度，其中，所述目标概率模型用于指示正常特征数据的概率分布，所述正常特征数据为与正常数据流的目标特征相关的数据，所述目标异常程度为所述第一数据流的目标特征的异常程度；
    根据所述目标异常程度确定传输所述第一数据流的网络的故障。
  2. 根据权利要求1所述的方法，其特征在于，所述根据目标概率模型和所述目标特征数据确定目标异常程度，包括：
    将所述目标特征数据输入所述目标概率模型确定目标概率，所述目标概率用于表示所述目标异常程度。
  3. 根据权利要求2所述的方法，其特征在于，所述目标特征数据包括多个维度的数据，所述目标概率模型包括所述多个维度对应的概率模型，所述目标概率包括所述多个维度对应的概率。
  4. 根据权利要求3所述的方法，其特征在于，所述多个维度包括统计维度，所述目标特征数据包括所述第一数据流的目标特征的统计值，所述目标概率模型包括统计值高斯分布，所述目标概率包括所述第一数据流的目标特征的统计值在所述统计高斯分布上的累积分布概率，其中，所述统计值高斯分布为所述正常数据流的目标特征的统计值服从的高斯分布。
  5. 根据权利要求3或4所述的方法，其特征在于，所述多个维度包括数据流形态维度，所述目标特征数据包括目标重构误差，所述目标概率模型包括重构误差高斯分布，所述目标概率包括所述目标重构误差在所述重构误差高斯分布上的累积分布概率，其中，所述目标重构误差为所述第一数据流的目标特征的数据流形态的重构误差，所述重构误差高斯分布为所述正常数据流的目标特征的数据流形态的重构误差服从的高斯分布。
  6. 根据权利要求3至5中任一项所述的方法，其特征在于，所述多个维度包括相关性维度，所述目标特征数据包括目标相关性系数，所述目标概率模型包括相关性高斯分布，所述目标概率包括所述目标相关性系数在所述相关性高斯分布上的累积分布概率，其中，所述目标相关性系数为所述第一数据流的目标特征与所述第一数据流的其它特征之间的相关性系数，所述相关性高斯分布为所述正常数据流的目标特征与所述正常数据流的其它特征之间的相关性系数服从的高斯分布。
  7. 根据权利要求3至6中任一项所述的方法，其特征在于，所述根据所述目标概率确定所述目标异常程度，包括：
    根据所述多个维度对应的概率确定所述第一数据流的目标特征在所述多个维度上的异常程度；
    根据所述第一数据流的目标特征在所述多个维度上的异常程度确定所述目标异常程度。
  8. 根据权利要求7所述的方法，其特征在于，所述目标异常程度为所述多个异常程度中数值最大的一个。
  9. 根据权利要求7或8所述的方法，其特征在于，所述根据所述目标异常程度确定传输所述第一数据流的网络的故障，包括：
    确定第一数据流的多个特征的异常程度，所述多个特征包括所述目标特征；
    根据所述多个特征的异常程度确定所述第一数据流的最终异常程度；
    根据所述第一数据流的最终异常程度确定传输所述第一数据流的网络的故障。
  10. 根据权利要求9所述的方法，其特征在于，所述最终异常程度为所述多个特征的异常程度中数值最大的一个。
  11. 根据权利要求9或10所述的方法，其特征在于，所述根据所述第一数据流的最终异常程度确定传输所述第一数据流的网络的故障，包括：
    确定多个数据流的最终异常程度，所述多个数据流包括所述第一数据流，并且，所述多个数据流均由传输所述第一数据流的网络传输；
    根据所述多个数据流的最终异常程度确定传输所述第一数据流的网络的故障。
  12. 一种检测网络故障的装置，其特征在于，包括处理单元，用于：
    获取目标特征数据，所述目标特征数据为与第一数据流的目标特征相关的数据；
    根据目标概率模型和所述目标特征数据确定目标异常程度，其中，所述目标概率模型用于指示正常特征数据的概率分布，所述正常特征数据为与正常数据流的目标特征相关的数据，所述目标异常程度为所述第一数据流的目标特征的异常程度；
    根据所述目标异常程度确定传输所述第一数据流的网络的故障。
  13. 根据权利要求12所述的装置，其特征在于，所述处理单元具体用于：
    将所述目标特征数据输入所述目标概率模型确定目标概率，所述目标概率用于表示所述目标异常程度。
  14. 根据权利要求13所述的装置，其特征在于，所述目标特征数据包括多个维度的数据，所述目标概率模型包括所述多个维度对应的概率模型，所述目标概率包括所述多个维度对应的概率。
  15. 根据权利要求14所述的装置，其特征在于，所述多个维度包括统计维度，所述目标特征数据包括所述第一数据流的目标特征的统计值，所述目标概率模型包括统计值高斯分布，所述目标概率包括所述第一数据流的目标特征的统计值在所述统计高斯分布上的累积分布概率，其中，所述统计值高斯分布为所述正常数据流的目标特征的统计值服从的高斯分布。
  16. 根据权利要求14或15所述的装置，其特征在于，所述多个维度包括数据流形态维度，所述目标特征数据包括目标重构误差，所述目标概率模型包括重构误差高斯分布，所述目标概率包括所述目标重构误差在所述重构误差高斯分布上的累积分布概率，其中，所述目标重构误差为所述第一数据流的目标特征的数据流形态的重构误差，所述重构误差高斯分布为所述正常数据流的目标特征的数据流形态的重构误差服从的高斯分布。
  17. 根据权利要求14至16中任一项所述的装置，其特征在于，所述多个维度包括相关性维度，所述目标特征数据包括目标相关性系数，所述目标概率模型包括相关性高斯分布，所述目标概率包括所述目标相关性系数在所述相关性高斯分布上的累积分布概率，其中，所述目标相关性系数为所述第一数据流的目标特征与所述第一数据流的其它特征之间的相关性系数，所述相关性高斯分布为所述正常数据流的目标特征与所述正常数据流的其 它特征之间的相关性系数服从的高斯分布。
  18. 根据权利要求14至17中任一项所述的装置，其特征在于，所述处理单元具体用于：
    根据所述多个维度对应的概率确定所述第一数据流的目标特征在所述多个维度上的异常程度；
    根据所述第一数据流的目标特征在所述多个维度上的异常程度确定所述目标异常程度。
  19. 根据权利要求18所述的装置，其特征在于，所述目标异常程度为所述多个异常程度中数值最大的一个。
  20. 根据权利要求18或19所述的装置，其特征在于，所述处理单元具体用于：
    确定第一数据流的多个特征的异常程度，所述多个特征包括所述目标特征；
    根据所述多个特征的异常程度确定所述第一数据流的最终异常程度；
    根据所述第一数据流的最终异常程度确定传输所述第一数据流的网络的故障。
  21. 根据权利要求20所述的装置，其特征在于，所述最终异常程度为所述多个特征的异常程度中数值最大的一个。
  22. 根据权利要求20或21所述的装置，其特征在于，所述处理单元具体用于：
    确定多个数据流的最终异常程度，所述多个数据流包括所述第一数据流，并且，所述多个数据流均由传输所述第一数据流的网络传输；
    根据所述多个数据流的最终异常程度确定传输所述第一数据流的网络的故障。
  23. 一种检测网络故障的设备，其特征在于，所述设备包括处理器和存储器，所述存储器用于存储计算机程序，所述处理器用于从所述存储器中调用并运行所述计算机程序，使得所述设备执行权利要求1至11中任一项所述的方法。
  24. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储了计算机程序，当所述计算机程序被处理器执行时，使得处理器执行权利要求1至11中任一项所述的方法。
  25. 一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行如权利要求1至11中任意一项所述的方法。
PCT/CN2021/096678 2020-06-03 2021-05-28 检测网络故障的方法和装置 WO2021244415A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010495686.1 2020-06-03
CN202010495686.1A CN111817875B (zh) 2020-06-03 2020-06-03 检测网络故障的方法和装置

Publications (1)

Publication Number Publication Date
WO2021244415A1 true WO2021244415A1 (zh) 2021-12-09

Family

ID=72847936

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/096678 WO2021244415A1 (zh) 2020-06-03 2021-05-28 检测网络故障的方法和装置

Country Status (2)

Country Link
CN (1) CN111817875B (zh)
WO (1) WO2021244415A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114172796A (zh) * 2021-12-24 2022-03-11 中国工商银行股份有限公司 通信网络的故障定位方法及相关装置
CN114363212A (zh) * 2021-12-27 2022-04-15 绿盟科技集团股份有限公司 一种设备检测方法、装置、设备和存储介质
CN114760190A (zh) * 2022-04-11 2022-07-15 北京邮电大学 一种面向服务的融合网络性能异常检测方法
CN115022908A (zh) * 2022-05-11 2022-09-06 中电信数智科技有限公司 一种核心网与基站传输网络异常预测及定位的方法
CN115913898A (zh) * 2023-01-09 2023-04-04 浙江数思信息技术有限公司 一种基于机器学习算法的物联网终端故障诊断方法与介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111817875B (zh) * 2020-06-03 2022-06-28 华为技术有限公司 检测网络故障的方法和装置
CN116723059B (zh) * 2023-08-10 2023-10-20 湖南润科通信科技有限公司 一种针对网络信息的安全分析系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190182103A1 (en) * 2017-12-07 2019-06-13 Cisco Technology, Inc. In-situ oam (ioam) network risk flow-based "topo-gram" for predictive flow positioning
CN110086649A (zh) * 2019-03-19 2019-08-02 深圳壹账通智能科技有限公司 异常流量的检测方法、装置、计算机设备及存储介质
CN110149343A (zh) * 2019-05-31 2019-08-20 国家计算机网络与信息安全管理中心 一种基于流的异常通联行为检测方法和系统
CN110519290A (zh) * 2019-09-03 2019-11-29 南京中孚信息技术有限公司 异常流量检测方法、装置及电子设备
CN111817875A (zh) * 2020-06-03 2020-10-23 华为技术有限公司 检测网络故障的方法和装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105704103B (zh) * 2014-11-26 2017-05-10 中国科学院沈阳自动化研究所 基于OCSVM双轮廓模型的Modbus TCP通信行为异常检测方法
CN105119734B (zh) * 2015-07-15 2018-04-17 中国人民解放军防空兵学院 基于健壮多元概率校准模型的全网络异常检测定位方法
CN106453392B (zh) * 2016-11-14 2019-04-09 中国人民解放军防空兵学院 基于流量特征分布的全网络异常流识别方法
CN109951462B (zh) * 2019-03-07 2020-08-25 中国科学院信息工程研究所 一种基于全息建模的应用软件流量异常检测系统及方法
CN110808972B (zh) * 2019-10-30 2021-12-24 杭州迪普科技股份有限公司 数据流识别方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190182103A1 (en) * 2017-12-07 2019-06-13 Cisco Technology, Inc. In-situ oam (ioam) network risk flow-based "topo-gram" for predictive flow positioning
CN110086649A (zh) * 2019-03-19 2019-08-02 深圳壹账通智能科技有限公司 异常流量的检测方法、装置、计算机设备及存储介质
CN110149343A (zh) * 2019-05-31 2019-08-20 国家计算机网络与信息安全管理中心 一种基于流的异常通联行为检测方法和系统
CN110519290A (zh) * 2019-09-03 2019-11-29 南京中孚信息技术有限公司 异常流量检测方法、装置及电子设备
CN111817875A (zh) * 2020-06-03 2020-10-23 华为技术有限公司 检测网络故障的方法和装置

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114172796A (zh) * 2021-12-24 2022-03-11 中国工商银行股份有限公司 通信网络的故障定位方法及相关装置
CN114172796B (zh) * 2021-12-24 2024-01-30 中国工商银行股份有限公司 通信网络的故障定位方法及相关装置
CN114363212A (zh) * 2021-12-27 2022-04-15 绿盟科技集团股份有限公司 一种设备检测方法、装置、设备和存储介质
CN114363212B (zh) * 2021-12-27 2023-12-26 绿盟科技集团股份有限公司 一种设备检测方法、装置、设备和存储介质
CN114760190A (zh) * 2022-04-11 2022-07-15 北京邮电大学 一种面向服务的融合网络性能异常检测方法
CN115022908A (zh) * 2022-05-11 2022-09-06 中电信数智科技有限公司 一种核心网与基站传输网络异常预测及定位的方法
CN115022908B (zh) * 2022-05-11 2023-05-12 中电信数智科技有限公司 一种核心网与基站传输网络异常预测及定位的方法
CN115913898A (zh) * 2023-01-09 2023-04-04 浙江数思信息技术有限公司 一种基于机器学习算法的物联网终端故障诊断方法与介质

Also Published As

Publication number Publication date
CN111817875A (zh) 2020-10-23
CN111817875B (zh) 2022-06-28

Similar Documents

Publication Publication Date Title
WO2021244415A1 (zh) 检测网络故障的方法和装置
JP7116103B2 (ja) 光モジュールの故障を予測するための方法、装置、およびデバイス
WO2019184557A1 (zh) 定位根因告警的方法、装置和计算机可读存储介质
WO2018103453A1 (zh) 检测网络的方法和装置
CN104506376B (zh) 一种具有帧起始敏感同步触发功能的多通道冗余式can总线测试系统
CN111475370A (zh) 基于数据中心的运维监控方法、装置、设备及存储介质
CN104584483A (zh) 用于自动确定服务质量降级的原因的方法和设备
US10635520B2 (en) Monitoring method and monitoring device of deep learning processor
CN114785666B (zh) 一种网络故障排查方法与系统
CN112087334B (zh) 告警根因分析方法、电子设备和存储介质
JP2018148350A (ja) 閾値決定装置、閾値決定方法及びプログラム
US11501106B2 (en) Anomaly factor estimation device, anomaly factor estimation method, and storage medium
WO2022048652A1 (zh) 故障定位的方法、电子设备及存储介质
CN109618361A (zh) 一种4g基站隐性故障排查方法及装置
CN112817785A (zh) 一种微服务系统的异常检测方法及装置
CN113568900A (zh) 基于人工智能的大数据清洗方法及云服务器
CN110502432B (zh) 智能测试方法、装置、设备及可读存储介质
CN113934536A (zh) 面向边缘计算的数据采集方法
US11153193B2 (en) Method of and system for testing a computer network
CN114936614B (zh) 一种基于神经网络的作业风险识别方法及系统
CN111740998A (zh) 一种基于堆叠自编码器的网络入侵检测方法
CN116450137A (zh) 一种系统异常的检测方法、装置、存储介质及电子设备
CN114157486B (zh) 通信流量数据异常检测方法、装置、电子设备及存储介质
CN115834195A (zh) 一种日志异常检测方法、装置、系统及介质
Park et al. Classification of application traffic using tensorflow machine learning

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21818000

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21818000

Country of ref document: EP

Kind code of ref document: A1