CN114143163A

CN114143163A - Slice false alarm identification method and device based on graph attention network

Info

Publication number: CN114143163A
Application number: CN202010819466.XA
Authority: CN
Inventors: 邢彪; 郑屹峰; 陈维新; 章淑敏; 彭熙
Original assignee: China Mobile Communications Group Co Ltd; China Mobile Group Zhejiang Co Ltd
Current assignee: China Mobile Communications Group Co Ltd; China Mobile Group Zhejiang Co Ltd
Priority date: 2020-08-14
Filing date: 2020-08-14
Publication date: 2022-03-04
Anticipated expiration: 2040-08-14
Also published as: CN114143163B

Abstract

The embodiment of the invention relates to the technical field of communication, and discloses a slice false alarm identification method and a slice false alarm identification device based on a graph attention network, wherein the method comprises the following steps: acquiring feature attributes of the network slice node and the neighbor nodes at the current moment from NSMF, wherein the feature attributes comprise alarm text features and KPI operation index features; fusing a first alarm text characteristic of a network slice node and a second alarm text characteristic of a neighbor node according to a slice false alarm identification model to obtain an attribute fusion characteristic; fusing a first KPI operation index characteristic of a network slice node and a second KPI operation index characteristic of a neighbor node to obtain a KPI operation index fusion characteristic; and performing attention aggregation on the attribute fusion characteristics and the KPI operation index fusion characteristics to determine whether the alarm generated by the network slice node belongs to a false alarm. Through the mode, the method and the device can improve the accuracy of false alarm identification of the network slice and improve the efficiency of troubleshooting and alarming of operation and maintenance personnel.

Description

Slice false alarm identification method and device based on graph attention network

Technical Field

The embodiment of the invention relates to the technical field of communication, in particular to a slice false alarm identification method and device based on a graph attention network.

Background

With the rapid development of wireless communication technology, the fifth generation (5)^thGeneration, 5G) wireless communication technology has been a hot spot in the industry. The 5G will support diverse application requirements including access capability supporting higher rate experience and larger bandwidth, lower latency and highly reliable information interaction, and access and management of larger-scale and low-cost machine type communication devices, etc. The 5G network does not follow the networking mode of the traditional network any more, but adopts a network slicing technology, so that an operator can construct a plurality of special virtualized and isolated logic networks on the basis of a shared underlying physical network, and the network slicing ensures that customers with different requirements can obtain different types of end-to-end optimal network services.

At present 5G network section mistake is reported an emergency and asked for help or increased vigilance that has contained three subdomains of wireless network subfragment, transmission network subfragment, core network subfragment, and the volume of reporting an emergency and asked for help or increased vigilance is huge, the variety is various, and this precision identification who reports an emergency and asks for help or increased vigilance for the mistake provides the challenge, and network section mistake is reported an emergency and asked for help or increased vigilance and need be confirmed for the mistake through artifical investigation and report an emergency and ask for help or increased vigilance after reporting an emergency and asking for help or increased vigilance among the prior art.

Disclosure of Invention

In view of the foregoing problems, embodiments of the present invention provide a slice false alarm recognition method and apparatus based on a graph attention network, which overcome the foregoing problems or at least partially solve the foregoing problems.

According to an aspect of the embodiments of the present invention, there is provided a slice false alarm recognition method based on a graph attention network, the method including: acquiring feature attributes of a network slice node and neighbor nodes at the current moment from NSMF, wherein the feature attributes comprise alarm text features and KPI operation index features; fusing a first alarm text characteristic of the network slice node and a second alarm text characteristic of the neighbor node according to the slice false alarm identification model to obtain an attribute fusion characteristic; fusing a first KPI operation index feature of the network slicing node and a second KPI operation index feature of the neighbor node according to the slicing error alarm identification model to obtain a KPI operation index fusion feature; and performing attention aggregation on the attribute fusion characteristics and the KPI operation index fusion characteristics according to the slice false alarm identification model, and determining whether the alarm generated by the network slice node belongs to a false alarm.

In an optional manner, the obtaining the feature attributes of the network slice node and the neighboring nodes at the current time from the NSMF includes: when a network slice node is found to generate an alarm, acquiring the characteristic attributes of the network slice node and the neighbor nodes at the current moment from the NSMF; splitting the characteristic attribute of the network slice node into the first alarm text characteristic and the first KPI operation index characteristic according to different attributes; and splitting the feature attribute of the neighbor node into the second alarm text feature and the second KPI operation index feature according to different attributes.

In an optional manner, after obtaining the feature attributes of the network slice node and the neighboring nodes at the current time from the NSMF, the method includes: preprocessing the characteristic attributes of the network slice node and the neighbor nodes, which specifically comprises the following steps: encoding the first alarm text feature generated by the network slice node and the second alarm text feature generated by the neighbor node into sequence representations respectively; and respectively carrying out standardization processing on the first KPI operation index characteristics generated by the network slicing node and the second KPI operation index characteristics generated by the neighbor nodes.

In an optional manner, before the fusing the first alarm text feature of the network slice node and the second alarm text feature of the neighbor node according to the slice false alarm identification model to obtain the attribute fused feature, the method includes: collecting a characteristic attribute set of a historical network slice node from NSMF (non-subsampled finite field) as a total data set, and preprocessing the total data set, wherein the characteristic attribute set comprises historical alarm text characteristics and historical KPI (Key performance indicator) operation index characteristics of the network slice node and neighbor nodes; acquiring whether alarms generated by manually marked historical network slice nodes belong to false alarms or not, and forming a label matrix Y with the shape of N x 1, wherein N is the number of the alarms; and training the slice false alarm recognition model based on the graph attention network by using the total data set to obtain the weight parameters of the converged slice false alarm recognition model.

In an optional manner, the training the slice false alarm recognition model based on the graph attention network by using the total data set to obtain the weight parameter of the converged slice false alarm recognition model includes: training the slice false alarm recognition model according to the historical alarm text characteristics and the historical KPI operation index characteristics of the network slice nodes and the neighbor nodes in the total data set, and acquiring the predicted false alarm recognition result of each network slice node; evaluating the error between the predicted network slice node false alarm identification result and the correct network slice node false alarm identification result by using a binary cross entropy loss function as a target function; and gradient descent optimization algorithm is applied to make the slice false alarm recognition model gradient descent, and the optimal weight parameter of the slice false alarm recognition model which makes the target function minimum is obtained, wherein the optimal weight parameter is the weight parameter of the trained slice false alarm recognition model.

In an optional manner, the training the slice false alarm recognition model according to the historical alarm text features and the historical KPI operation index features of the network slice nodes and the neighboring nodes in the total data set to obtain the predicted false alarm recognition result of each network slice node includes: fusing the historical first alarm text characteristics of the network slice node and the historical second alarm text characteristics of the neighbor nodes by applying a first graph attention layer in the slice false alarm identification model to obtain historical attribute fusion characteristics; fusing the historical first KPI operation index features of the network slicing nodes and the historical second KPI operation index features of the neighbor nodes by applying a second graph attention layer in the slicing false alarm recognition model to obtain historical KPI operation index fusion features; applying a third graph attention layer of the slice false alarm identification model to perform attention aggregation on the historical attribute fusion features and the historical KPI operation index fusion features, and learning the importance of different attributes on judging whether the alarm of the network slice node is false alarm; and outputting the predicted network slice node false alarm identification result by the application output layer.

In an optional manner, before the applying a first graph attention layer in the slice false alarm recognition model to fuse a historical first alarm text feature of the network slice node and a historical second alarm text feature of the neighbor node to obtain a historical attribute fusion feature, the method includes: respectively utilizing a word embedding layer to carry out vector mapping on each word in the historical first alarm text characteristic and the historical second alarm text characteristic, converting the word into a vector with preset dimensionality, and inputting the vector into the first graph attention layer; and converting the dimensionality of the historical first KPI operation index characteristic and the dimensionality of the historical second KPI operation index characteristic into the preset dimensionality by utilizing a mapping layer respectively, and inputting the preset dimensionality into the second graph attention layer.

According to another aspect of the embodiments of the present invention, there is provided a slice false alarm recognition apparatus based on a graph attention network, the apparatus including: the data acquisition unit is used for acquiring the characteristic attributes of the network slice node and the neighbor nodes at the current moment from the NSMF, wherein the characteristic attributes comprise alarm text characteristics and KPI operation index characteristics; the attribute fusion unit is used for fusing the first alarm text characteristic of the network slice node and the second alarm text characteristic of the neighbor node according to the slice false alarm identification model to obtain an attribute fusion characteristic; the index fusion unit is used for fusing the first KPI operation index characteristics of the network slice nodes and the second KPI operation index characteristics of the neighbor nodes according to the slice false alarm identification model to obtain KPI operation index fusion characteristics; and the false alarm determining unit is used for performing attention aggregation on the attribute fusion characteristics and the KPI operation index fusion characteristics according to the slice false alarm identification model and determining whether the alarm generated by the network slice node belongs to a false alarm.

According to another aspect of embodiments of the present invention, there is provided a computing device including: the system comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete mutual communication through the communication bus;

the memory is used for storing at least one executable instruction, and the executable instruction causes the processor to execute the steps of the slice false alarm identification method based on the graph attention network.

According to yet another aspect of the embodiments of the present invention, there is provided a computer storage medium having at least one executable instruction stored therein, the executable instruction causing the processor to execute the steps of the above slice false alarm identification method based on graph attention network.

The method comprises the steps that the characteristic attributes of a network slice node and a neighbor node at the current moment are obtained from NSMF, wherein the characteristic attributes comprise alarm text characteristics and KPI operation index characteristics; fusing a first alarm text characteristic of the network slice node and a second alarm text characteristic of the neighbor node according to the slice false alarm identification model to obtain an attribute fusion characteristic; fusing a first KPI operation index feature of the network slicing node and a second KPI operation index feature of the neighbor node according to the slicing error alarm identification model to obtain a KPI operation index fusion feature; and performing attention aggregation on the attribute fusion characteristics and the KPI operation index fusion characteristics according to the slice false alarm identification model, and determining whether the alarm generated by the network slice node belongs to a false alarm, so that the accuracy of network slice false alarm identification can be improved, and the efficiency of troubleshooting and alarming by operation and maintenance personnel is improved.

The foregoing description is only an overview of technical results of the embodiments of the present invention, and the embodiments of the present invention can be implemented according to the content of the description in order to make the technical means of the embodiments of the present invention more clearly understood, and the above and other objects, features, and advantages of the embodiments of the present invention can be more clearly understood.

Drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the invention. Also, like reference numerals are used to refer to like parts throughout the drawings. In the drawings:

FIG. 1 is a flowchart illustrating a slice false alarm identification method based on a graph attention network according to an embodiment of the present invention;

FIG. 2 is a schematic diagram illustrating a slice false alarm recognition model training flow of the slice false alarm recognition method based on the graph attention network according to the embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a slice false alarm recognition model of the slice false alarm recognition method based on the graph attention network according to the embodiment of the present invention;

FIG. 4 is a schematic structural diagram illustrating a slice false alarm recognition device based on a graph attention network according to an embodiment of the present invention;

fig. 5 is a schematic structural diagram of a computing device provided by an embodiment of the present invention.

Detailed Description

Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

A Network Slice (Network Slice) is an end-to-end logical function and a physical or virtual resource set required by the end-to-end logical function, including an access Network, a transmission Network, a core Network, and the like, and the Network Slice can be regarded as a virtualized "private Network" in a 5G Network; the Network slice is constructed based on a unified infrastructure of Network Function Virtualization (NFV), and low-cost and efficient operation is achieved. Network slice techniques may enable logical isolation of a communication network, allowing network elements and functionality to be configured and reused in each network slice to meet specific industry application needs. The Slice Management architecture mainly includes a Communication Service Management Function (CSMF), a Network Slice Management Function (NSMF), and a Network Slice Subnet Management Function (NSSMF).

The CSMF completes the order and processing of the user service communication service, converts the communication service requirement of the operator/third-party client into the requirement for the network slice, sends the requirement for the network slice (such as creating, terminating, modifying the instance request of the network slice) to the NSMF through the interface between the CSMF and the NSMF, and acquires the management data (such as performance, fault data, etc.) of the network slice from the NSMF. The NSMF is responsible for receiving the network slice requirements sent by the CSMF, managing the life cycle, performance, faults and the like of the network slice examples, arranging the composition of the network slice examples, decomposing the requirements of the network slice examples into the requirements of each network slice subnet example or network function, and sending network slice subnet example management requests to each NSSMF. The NSSMF receives a network slice subnet deployment requirement issued by the NSMF, manages the network slice subnet instances, arranges the composition of the network slice subnet instances, maps SLA requirements of the network slice subnet into QoS requirements of network services, and issues a network service deployment request to an NFV orchestrator (NFV organization, NFVO) system of an European Telecommunication Standardization Institute (ETSI) NFV domain.

The identification of the network slice false alarm needs to analyze the generated alarm text and also needs to know the actual operation condition of the network element node and the operation state of the peripheral nodes. The embodiment of the invention analyzes the alarm generated in the Network slice scene by utilizing the characteristic that a Graph Attention Network (GAT) is good at distributing different weights according to the difference of the influence of neighbor nodes in the Graph Network.

The graph attention network introduces an attention mechanism into the graph network, introduces an attention (attention) mechanism into a propagation layer, assigns different weights to different adjacent nodes in an aggregation process of characteristics of a central node, generates difference on attention of adjacent nodes, focuses on network slice nodes with larger relevance, and ignores network slice nodes with smaller relevance. The original graph convolution neural network (GCN) and other graph neural networks use static and non-adaptive propagation rules, which cannot capture which neighbor node of the central node contributes more to the classification of the central node, and not all edges of the real data represent the same association strength. The graph in the embodiment of the present invention is a slice alarm topology graph, which may be represented as G ═ (V, E), where V is a set V ═ V of network slice nodes₁，V₂，V₃，…，V_NAnd E is a set of edges, each edge represents a connection relation between network slice nodes, wherein 1 represents connection, and 0 represents no connection. The characteristic of each node is the alarm content generated in unit time, the node characteristic set is represented by h, and the characteristic h of each vertex_iIs a high-dimensional vector comprising the alarm text characteristics h generated by the network slicing node i_i ¹And KPI operation index characteristic h of network slicing node i_i ². The essential purpose of the GCN is to extract spatial features of a slice topology, and the goal is to learn a mapping of signals or features on a graph G ═ V, E, where inputs include an adjacency matrix a and a feature matrix X, and a GCN model generates a node-level output or a graph-level output Z, and a slice false alarm recognition scenario according to an embodiment of the present invention is considered as a node classification (node classification) problem, and finally outputs whether an alarm generated by each network slice node belongs to a false alarm, where 1 represents a false alarm and 0 represents a non-false alarm.

Fig. 1 is a flowchart illustrating a slice false alarm identification method based on a graph attention network according to an embodiment of the present invention. The slice false alarm identification method based on the graph attention network is applied to a server side, and as shown in FIG. 1, the slice false alarm identification method based on the graph attention network comprises the following steps:

step S11: and acquiring the characteristic attributes of the network slice node and the neighbor nodes at the current moment from the NSMF, wherein the characteristic attributes comprise alarm text characteristics and KPI operation index characteristics.

Specifically, when a network slice node is found to generate an alarm, acquiring characteristic attributes of the network slice node and neighbor nodes at the current moment from the NSMF; splitting the characteristic attribute of the network slicing node into a first alarm text characteristic and a first Key Performance Indicators (KPI) operation indicator characteristic according to different attributes; and splitting the characteristic attribute of the neighbor node into a second alarm text characteristic and a second KPI operation index characteristic according to different attributes.

In the embodiment of the present invention, after step S11, the characteristic attributes of the network slice node and the neighboring nodes need to be preprocessed. Specifically, the first alarm text feature generated by the network slice node and the second alarm text feature generated by the neighbor node are encoded into sequence representations respectively. Namely, the first alarm text characteristic and the second alarm text characteristic are respectively coded into a sequence with preset length, and if no alarm is generated, the sequence is filled with zero, and the size of the dictionary is warning _ vocab _ size.

And respectively carrying out standardization processing on the first KPI operation index characteristics generated by the network slicing node and the second KPI operation index characteristics generated by the neighbor nodes. For the first KPI operation index characteristic and the second KPI operation index characteristic, carrying out linear transformation on the original data to enable the result to fall into a [0,1] interval, carrying out calculation according to a formula (X-mean)/std, respectively carrying out calculation on each dimension, subtracting the mean value of the data according to the attribute (according to columns), and dividing the data by the variance. After standardization, the convergence speed of the slice false alarm identification model is improved, and the precision of the slice false alarm identification model is improved.

Step S12: and fusing the first alarm text characteristic of the network slice node and the second alarm text characteristic of the neighbor node according to the slice false alarm identification model to obtain an attribute fusion characteristic.

The embodiment of the invention fuses the first alarm text characteristic of the network slice node and the second alarm text characteristic of the neighbor node by applying the first attention layer in the slice false alarm identification model to obtain the attribute fusion characteristic. As with all attention mechanisms, the calculation of the attention network GAT is also illustrated in two steps: an attention coefficient (attention coeffient) and a weighted sum (aggregate) are calculated. The GAT model is implemented by stacking graph attention layers (graph attention layers), and the input of each graph attention layer is a warning text feature set generated by a network slicing node:

outputting a new alarm text feature set:

to calculate the weight of each neighbor node, a shared weight matrix W of F × F' is applied to each node, and then an attention coefficient can be calculated, which can represent the importance of the neighbor node j relative to the network slice node i:

where a is an alignment model (alignment model) that scores the degree of match of the input at the neighbor node j and the output at the network slice node i. The alignment model a is a feedforward neural network and is trained together with other parts of the slice false alarm recognition model.

To make the attention coefficients easier to compute and to facilitate comparison, softmax was introduced to regularize all the neighboring nodes j of the network slice node i:

the network slice node i after passing through the graph attention layer is thus characterized as: i.e., the new feature of the GAT output for each network slice node i (with the neighborhood information fused), σ is the activation function.

Wherein N is_iThe coefficient α is the coefficient used for weighted summation at each convolution, which represents the set of neighbor nodes of the network slice node i.

In the embodiment of the present invention, before step S12, pre-training of the slice false alarm recognition model needs to be performed, so as to obtain the weight parameter of the convergence of the slice false alarm recognition model. Specifically, as shown in fig. 2, the method includes:

step S201: and collecting a characteristic attribute set of the historical network slice nodes from the NSMF as a total data set, and preprocessing the total data set, wherein the characteristic attribute set comprises historical alarm text characteristics and historical KPI (Key performance indicator) operation index characteristics of the network slice nodes and neighbor nodes.

The method of preprocessing the feature attribute set is the same as before. And respectively coding the historical alarm text feature sets generated by the network slice nodes and the neighbor nodes into sequence representations, and filling with zeros if no alarm is generated. Defining the length of a coding sequence of each alarm text feature as F, taking the longest length F in the alarm text feature set as the length of the coding sequence, filling the length of each piece of data as F, and taking the size of a dictionary as warning _ vocab _ size. The former preset length is the longest length F in the alarm text feature set here. And defining the historical alarm text features generated by the slicing nodes as historical first alarm text features, and defining the historical alarm text features generated by the neighbor nodes as historical second alarm text features. And respectively carrying out standardization processing on the historical KPI operation index characteristics of the network slice nodes and the neighbor nodes. And defining the historical KPI operation index characteristics of the network slice nodes as historical first KPI operation index characteristics, and defining the historical KPI operation index characteristics of the neighbor nodes as historical second KPI operation index characteristics.

Step S202: and acquiring whether the alarm generated by the artificially marked historical network slice node belongs to a false alarm or not, and forming a label matrix Y with the shape of N x 1, wherein N is the number of alarms.

The generated alarms of the historical network slice nodes collected from the NSMF are manually marked, wherein the alarm is marked as 1 for false alarm and is marked as 0 for non-false alarm. And acquiring the manual marking result to form a label matrix Y with the shape of N x 1. The label matrix Y is used as a correct network slice node false alarm identification result and is used for comparing the slice false alarm identification model with a predicted network slice node false alarm identification result when the slice false alarm identification model is trained.

Step S203: and training the slice false alarm recognition model based on the graph attention network by using the total data set to obtain the weight parameters of the converged slice false alarm recognition model.

The total data set is divided into training data and test data, and 80% of the whole data set is taken as the training data, and the rest 20% is taken as the test data. And training by using a training set to ensure that the closer the reconstructed data and the original data is, the better the reconstructed data is, and evaluating the verification slice false alarm recognition model by using a test set.

And when a slice false alarm recognition model is trained, the slice false alarm recognition model is trained according to the historical alarm text characteristics and the historical KPI operation index characteristics of the network slice nodes and the neighbor nodes in the total data set, and the predicted false alarm recognition result of each network slice node is obtained.

The structure of the slice false alarm recognition model is shown in fig. 3, and in the embodiment of the invention, word embedding layers (embedding) are respectively used for embedding the historical first alarm text features h_i ¹And the historical second alarm text characteristic h_ij ¹Each word in the first graph attention layer is subjected to vector mapping, converted into a vector with preset dimensionality, and input into the first graph attention layer. The preset dimensionality of input data is warping _ vocab _ size, the output is set to be space vector needing to convert words into 64 dimensionalities, and the input sequence is longThe degree is F, so the shape of the word embedding layer output data is (None, F, 64). The word embedding layer is used for carrying out vector mapping on input words and converting the index of each word into a 64-dimensional fixed shape vector.

Respectively utilizing a mapping layer to carry out the first KPI operation index characteristic h of the history_i ²And said historical second KPI operating index characteristic h_ij ²Is converted into the preset dimension and the second drawing attention layer is input. Respectively utilizing conversion matrixes of mapping layers to convert historical first KPI operation index characteristics h_i ²And the historical second KPI operation index characteristic h_ij ²Is converted to be consistent with the dimension of the alarm text characteristic attribute.

Applying a first graph attention layer in the slice false alarm recognition model to map historical first alarm text features h of the network slice nodes_i ¹And the historical second alarm text characteristic h of the neighbor node_ij ¹And performing fusion to obtain historical attribute fusion characteristics. Namely, inputting a historical first alarm text characteristic h generated by a historical network slicing node i_i ¹And historical second alarm text characteristics h generated by each neighbor node j of the historical network slice node i_ij ¹. Respectively converted into vectors through the word embedding layer and then input into the first graph attention layer, and the historical second alarm text characteristics h generated by each neighbor node j are learned through the node level attention mechanism_ij ¹And for different importance of judging whether the alarm of the historical network slice node i is a false alarm or not, outputting the historical attribute fusion characteristics of the historical network slice node i fused with the neighborhood information through the first graph attention layer. The number of convolution kernels for the first graph attention layer is 256 and the activation function is set to "relu".

Applying a second graph attention layer in the slice error alarm identification model to obtain a historical first KPI operation index characteristic h of the network slice node_i ²And the historical second KPI operation index characteristic h of the neighbor node_ij ²And fusing to obtain the fusion characteristics of the historical KPI operation indexes. Instant transfusionKPI running index characteristic h of access node i_i ²And KPI running index feature h of each neighbor node j of network slice node i_ij ²Respectively converted into vectors through the mapping layer and then input into the second graph attention layer, and the historical second KPI operation index h of each neighbor node j is learned through the node level attention mechanism_ij ²And for different importance of judging whether the alarm of the network slice node i is a false alarm or not, outputting the historical KPI operation index fusion characteristic of the network slice node i fused with the neighborhood information through the second graph attention layer. The number of convolution kernels for the second graph attention layer is 256 and the activation function is set to "relu".

And applying a third graph attention layer of the slice false alarm identification model to perform attention aggregation on the historical attribute fusion characteristics and the historical KPI operation index fusion characteristics, and learning the importance of different attributes for judging whether the node alarm is false alarm or not. The historical attribute fusion characteristics of the network slice node i and the historical KPI operation index fusion characteristics of the network slice node i obtained by the two branches are subjected to attribute level attention aggregation through a third graph attention layer, namely, the importance of different attributes for judging whether the alarm of the network slice node i is a false alarm or not is learned. The third graph notes that the number of convolution kernels for the force layer is 64 and the activation function is set to "relu".

And finally, outputting the predicted network slice node false alarm identification result by the application output layer. The output layer is composed of a full connection layer (sense), the number of the neurons is set to be 1, the activation function is set to be sigmoid, and whether the alarm generated by the network slice node i belongs to the false alarm identification result of the false alarm or not is output, wherein 1 represents the false alarm, and 0 represents the non-false alarm.

After the predicted network slice node false alarm identification result is obtained, a binary cross entropy loss function (binary _ cross _ entropy) is used as an objective function to evaluate the error between the predicted network slice node false alarm identification result and the correct network slice node false alarm identification result, and the training objective is to minimize the error:

wherein, y_iIndicating a correct network slice node false alarm identification result,

and representing the predicted network slice node false alarm identification result.

And gradient descent optimization algorithm is applied to make the slice false alarm recognition model gradient descent, and the optimal weight parameter of the slice false alarm recognition model which makes the target function minimum is obtained, wherein the optimal weight parameter is the weight parameter of the trained slice false alarm recognition model.

The training round number is set to 1000(epochs 1000), and the gradient descent optimization algorithm selects an adam optimizer for improving the learning speed of the conventional gradient descent (optimizer adam'). The optimal weight parameter which enables the target function to be minimum can be found by the gradient descent of the slice false alarm recognition model, and the weight parameter can be automatically learned by the slice false alarm recognition model through training. And training by using a training set to ensure that the smaller the target function is, the better the target function is, and evaluating a verification slice false alarm recognition model by using a test set after each round of training. And after the slice false alarm identification model is converged, deriving a weight parameter of the slice false alarm identification model.

In step S12, specifically, referring to fig. 3, a slice false alarm recognition model is configured according to the converged weight parameters, a word embedding layer in the trained slice false alarm recognition model is used to perform vector mapping on each word in the first alarm text feature and the second alarm text feature, the words are converted into vectors with preset dimensions, a first icon attention layer is input, and the first alarm text feature of the network slice node and the second alarm text feature of the neighboring node are fused by using the first icon attention layer in the trained slice false alarm recognition model to obtain an attribute fusion feature.

Step S13: and fusing the first KPI operation index characteristic of the network slice node and the second KPI operation index characteristic of the neighbor node according to the slice error alarm identification model to obtain a KPI operation index fusion characteristic.

Specifically, referring to fig. 3, the dimensionalities of the first KPI operation index feature and the second KPI operation index feature are converted into preset dimensionalities by using the mapping layer in the trained slice false alarm recognition model, the preset dimensionalities are input into the second graph attention layer, and the first KPI operation index feature and the second KPI operation index feature are fused by using the second graph attention layer in the trained slice false alarm recognition model to obtain a KPI operation index fusion feature.

Step S14: and performing attention aggregation on the attribute fusion characteristics and the KPI operation index fusion characteristics according to the slice false alarm identification model, and determining whether the alarm generated by the network slice node belongs to a false alarm.

Specifically, referring to fig. 3, the third graph attention layer of the trained slice false alarm recognition model is used to perform attention aggregation on the attribute fusion feature and the KPI operation index fusion feature, learn the importance of different attributes for judging whether the network slice node alarm is a false alarm, and then output the predicted network slice node false alarm recognition result by using the output layer, where 1 represents a false alarm and 0 represents a non-false alarm.

Fig. 4 shows a schematic structural diagram of a slice false alarm recognition device based on a graph attention network according to an embodiment of the present invention. As shown in fig. 4, the slice false alarm recognition device based on the graph attention network comprises: a data acquisition unit 401, an attribute fusion unit 402, an index fusion unit 403, a false alarm determination unit 404, and a model training unit 405. The functions implemented by the attribute fusion unit 402, the index fusion unit 403, and the false alarm determination unit 404 are all implemented in the slice false alarm recognition model. Wherein:

the data obtaining unit 401 is configured to obtain feature attributes of a network slice node and a neighbor node at a current time from the NSMF, where the feature attributes include an alarm text feature and a KPI operation index feature; the attribute fusion unit 402 is configured to fuse a first alarm text feature of the network slice node and a second alarm text feature of the neighbor node according to the slice false alarm identification model to obtain an attribute fusion feature; the index fusion unit 403 is configured to fuse a first KPI operation index feature of the network slice node and a second KPI operation index feature of the neighbor node according to the slice false alarm identification model to obtain a KPI operation index fusion feature; the false alarm determination unit 404 is configured to perform attention aggregation on the attribute fusion feature and the KPI operation index fusion feature according to the slice false alarm identification model, and determine whether an alarm generated by the network slice node belongs to a false alarm.

In an alternative manner, the data acquisition module 401 is configured to: when a network slice node is found to generate an alarm, acquiring the characteristic attributes of the network slice node and the neighbor nodes at the current moment from the NSMF; splitting the characteristic attribute of the network slice node into the first alarm text characteristic and the first KPI operation index characteristic according to different attributes; and splitting the feature attribute of the neighbor node into the second alarm text feature and the second KPI operation index feature according to different attributes.

In an optional manner, the data obtaining module 401 is further configured to: preprocessing the characteristic attributes of the network slice node and the neighbor nodes, which specifically comprises the following steps: encoding the first alarm text feature generated by the network slice node and the second alarm text feature generated by the neighbor node into sequence representations respectively; and respectively carrying out standardization processing on the first KPI operation index characteristics generated by the network slicing node and the second KPI operation index characteristics generated by the neighbor nodes.

In an alternative approach, the model training unit 405 is configured to: collecting a characteristic attribute set of a historical network slice node from NSMF (non-subsampled finite field) as a total data set, and preprocessing the total data set, wherein the characteristic attribute set comprises historical alarm text characteristics and historical KPI (Key performance indicator) operation index characteristics of the network slice node and neighbor nodes; acquiring whether alarms generated by manually marked historical network slice nodes belong to false alarms or not, and forming a label matrix Y with the shape of N x 1, wherein N is the number of the alarms; and training the slice false alarm recognition model based on the graph attention network by using the total data set to obtain the weight parameters of the converged slice false alarm recognition model.

In an alternative approach, the model training unit 405 is configured to: training the slice false alarm recognition model according to the historical alarm text characteristics and the historical KPI operation index characteristics of the network slice nodes and the neighbor nodes in the total data set, and acquiring the predicted false alarm recognition result of each network slice node; evaluating the error between the predicted network slice node false alarm identification result and the correct network slice node false alarm identification result by using a binary cross entropy loss function as a target function; and gradient descent optimization algorithm is applied to make the slice false alarm recognition model gradient descent, and the optimal weight parameter of the slice false alarm recognition model which makes the target function minimum is obtained, wherein the optimal weight parameter is the weight parameter of the trained slice false alarm recognition model.

In an alternative approach, the model training unit 405 is configured to: fusing the historical first alarm text characteristics of the network slice node and the historical second alarm text characteristics of the neighbor nodes by applying a first graph attention layer in the slice false alarm identification model to obtain historical attribute fusion characteristics; fusing the historical first KPI operation index features of the network slicing nodes and the historical second KPI operation index features of the neighbor nodes by applying a second graph attention layer in the slicing false alarm recognition model to obtain historical KPI operation index fusion features; applying a third graph attention layer of the slice false alarm identification model to perform attention aggregation on the historical attribute fusion features and the historical KPI operation index fusion features, and learning the importance of different attributes on judging whether the alarm of the network slice node is false alarm; and outputting the predicted network slice node false alarm identification result by the application output layer.

In an alternative manner, the model training unit 405 is further configured to: respectively utilizing a word embedding layer to carry out vector mapping on each word in the historical first alarm text characteristic and the historical second alarm text characteristic, converting the word into a vector with preset dimensionality, and inputting the vector into the first graph attention layer; and converting the dimensionality of the historical first KPI operation index characteristic and the dimensionality of the historical second KPI operation index characteristic into the preset dimensionality by utilizing a mapping layer respectively, and inputting the preset dimensionality into the second graph attention layer.

The embodiment of the invention provides a nonvolatile computer storage medium, wherein at least one executable instruction is stored in the computer storage medium, and the computer executable instruction can execute the slice false alarm identification method based on the graph attention network in any method embodiment.

The executable instructions may be specifically configured to cause the processor to:

acquiring feature attributes of a network slice node and neighbor nodes at the current moment from NSMF, wherein the feature attributes comprise alarm text features and KPI operation index features;

fusing a first alarm text characteristic of the network slice node and a second alarm text characteristic of the neighbor node according to the slice false alarm identification model to obtain an attribute fusion characteristic;

fusing a first KPI operation index feature of the network slicing node and a second KPI operation index feature of the neighbor node according to the slicing error alarm identification model to obtain a KPI operation index fusion feature;

and performing attention aggregation on the attribute fusion characteristics and the KPI operation index fusion characteristics according to the slice false alarm identification model, and determining whether the alarm generated by the network slice node belongs to a false alarm.

In an alternative, the executable instructions cause the processor to:

when a network slice node is found to generate an alarm, acquiring the characteristic attributes of the network slice node and the neighbor nodes at the current moment from the NSMF;

splitting the characteristic attribute of the network slice node into the first alarm text characteristic and the first KPI operation index characteristic according to different attributes;

and splitting the feature attribute of the neighbor node into the second alarm text feature and the second KPI operation index feature according to different attributes.

In an alternative, the executable instructions cause the processor to:

preprocessing the characteristic attributes of the network slice node and the neighbor nodes, which specifically comprises the following steps:

encoding the first alarm text feature generated by the network slice node and the second alarm text feature generated by the neighbor node into sequence representations respectively;

and respectively carrying out standardization processing on the first KPI operation index characteristics generated by the network slicing node and the second KPI operation index characteristics generated by the neighbor nodes.

In an alternative, the executable instructions cause the processor to:

collecting a characteristic attribute set of a historical network slice node from NSMF (non-subsampled finite field) as a total data set, and preprocessing the total data set, wherein the characteristic attribute set comprises historical alarm text characteristics and historical KPI (Key performance indicator) operation index characteristics of the network slice node and neighbor nodes;

acquiring whether alarms generated by manually marked historical network slice nodes belong to false alarms or not, and forming a label matrix Y with the shape of N x 1, wherein N is the number of the alarms;

and training the slice false alarm recognition model based on the graph attention network by using the total data set to obtain the weight parameters of the converged slice false alarm recognition model.

In an alternative, the executable instructions cause the processor to:

training the slice false alarm recognition model according to the historical alarm text characteristics and the historical KPI operation index characteristics of the network slice nodes and the neighbor nodes in the total data set, and acquiring the predicted false alarm recognition result of each network slice node;

evaluating the error between the predicted network slice node false alarm identification result and the correct network slice node false alarm identification result by using a binary cross entropy loss function as a target function;

In an alternative, the executable instructions cause the processor to:

fusing the historical first alarm text characteristics of the network slice node and the historical second alarm text characteristics of the neighbor nodes by applying a first graph attention layer in the slice false alarm identification model to obtain historical attribute fusion characteristics;

fusing the historical first KPI operation index features of the network slicing nodes and the historical second KPI operation index features of the neighbor nodes by applying a second graph attention layer in the slicing false alarm recognition model to obtain historical KPI operation index fusion features;

applying a third graph attention layer of the slice false alarm identification model to perform attention aggregation on the historical attribute fusion features and the historical KPI operation index fusion features, and learning the importance of different attributes on judging whether the alarm of the network slice node is false alarm;

and outputting the predicted network slice node false alarm identification result by the application output layer.

In an alternative, the executable instructions cause the processor to:

respectively utilizing a word embedding layer to carry out vector mapping on each word in the historical first alarm text characteristic and the historical second alarm text characteristic, converting the word into a vector with preset dimensionality, and inputting the vector into the first graph attention layer;

and converting the dimensionality of the historical first KPI operation index characteristic and the dimensionality of the historical second KPI operation index characteristic into the preset dimensionality by utilizing a mapping layer respectively, and inputting the preset dimensionality into the second graph attention layer.

An embodiment of the present invention provides a computer program product, which includes a computer program stored on a computer storage medium, where the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the slicing false alarm identification method based on a graph attention network in any of the above method embodiments.

In an alternative, the executable instructions cause the processor to:

Fig. 5 is a schematic structural diagram of a computing device according to an embodiment of the present invention, and the specific embodiment of the present invention does not limit the specific implementation of the device.

As shown in fig. 5, the computing device may include: a processor (processor)502, a Communications Interface 504, a memory 506, and a communication bus 508.

Wherein: the processor 502, communication interface 504, and memory 506 communicate with one another via a communication bus 508. A communication interface 504 for communicating with network elements of other devices, such as clients or other servers. The processor 502 is configured to execute the program 510, and may specifically execute the relevant steps in the above embodiment of the slice false alarm identification method based on the graph attention network.

In particular, program 510 may include program code that includes computer operating instructions.

The processor 502 may be a central processing unit CPU or an application Specific Integrated circuit asic or an Integrated circuit or Integrated circuits configured to implement embodiments of the present invention. The one or each processor included in the device may be the same type of processor, such as one or each CPU; or may be different types of processors such as one or each CPU and one or each ASIC.

And a memory 506 for storing a program 510. The memory 506 may comprise high-speed RAM memory, and may also include non-volatile memory (non-volatile memory), such as at least one disk memory.

The program 510 may specifically be used to cause the processor 502 to perform the following operations:

In an alternative, the program 510 causes the processor to:

The algorithms or displays presented herein are not inherently related to any particular computer, virtual system, or other apparatus. Various general purpose systems may also be used with the teachings herein. The required structure for constructing such a system will be apparent from the description above. In addition, embodiments of the present invention are not directed to any particular programming language. It is appreciated that a variety of programming languages may be used to implement the teachings of the present invention as described herein, and any descriptions of specific languages are provided above to disclose the best mode of the invention.

In the description provided herein, numerous specific details are set forth. It is understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, various features of the embodiments of the invention are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the invention and aiding in the understanding of one or more of the various inventive aspects. However, the disclosed method should not be interpreted as reflecting an intention that: that the invention as claimed requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art will appreciate that the modules in the device in an embodiment may be adaptively changed and disposed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and furthermore they may be divided into a plurality of sub-modules or sub-units or sub-components. All of the features disclosed in this specification (including any accompanying claims, abstract and drawings), and all of the processes or elements of any method or apparatus so disclosed, may be combined in any combination, except combinations where at least some of such features and/or processes or elements are mutually exclusive. Each feature disclosed in this specification (including any accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will appreciate that while some embodiments herein include some features included in other embodiments, rather than other features, combinations of features of different embodiments are meant to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by one and the same item of hardware. The usage of the words first, second and third, etcetera do not indicate any ordering. These words may be interpreted as names. The steps in the above embodiments should not be construed as limiting the order of execution unless specified otherwise.

Claims

1. A slice false alarm identification method based on a graph attention network is characterized by comprising the following steps:

2. The method according to claim 1, wherein the obtaining the feature attributes of the network slice node and the neighboring nodes at the current time from the NSMF includes:

3. The method according to claim 1, wherein the obtaining the feature attributes of the network slice node and the neighbor nodes at the current time from the NSMF comprises: preprocessing the characteristic attributes of the network slice node and the neighbor nodes, which specifically comprises the following steps:

4. The method according to claim 1, wherein before fusing the first alarm text feature of the network slice node and the second alarm text feature of the neighbor node according to the slice false alarm identification model to obtain the attribute fused feature, the method comprises:

5. The method according to claim 4, wherein the applying the total data set to train the slice false alarm recognition model based on the graph attention network to obtain the weight parameters of the converged slice false alarm recognition model comprises:

6. The method according to claim 5, wherein the training the slice false alarm recognition model according to the historical alarm text features and the historical KPI operation index features of the network slice nodes and the neighboring nodes in the total data set to obtain the predicted false alarm recognition result of each network slice node comprises:

7. The method according to claim 6, wherein before applying the first graph attention layer in the slice false alarm recognition model to fuse the historical first alarm text features of the network slice node with the historical second alarm text features of the neighbor nodes to obtain the historical attribute fusion feature, the method comprises:

8. A slice false alarm recognition device based on a graph attention network, the device comprising:

the data acquisition unit is used for acquiring the characteristic attributes of the network slice node and the neighbor nodes at the current moment from the NSMF, wherein the characteristic attributes comprise alarm text characteristics and KPI operation index characteristics;

the attribute fusion unit is used for fusing the first alarm text characteristic of the network slice node and the second alarm text characteristic of the neighbor node according to the slice false alarm identification model to obtain an attribute fusion characteristic;

the index fusion unit is used for fusing the first KPI operation index characteristics of the network slice nodes and the second KPI operation index characteristics of the neighbor nodes according to the slice false alarm identification model to obtain KPI operation index fusion characteristics;

and the false alarm determining unit is used for performing attention aggregation on the attribute fusion characteristics and the KPI operation index fusion characteristics according to the slice false alarm identification model and determining whether the alarm generated by the network slice node belongs to a false alarm.

9. A computing device, comprising: the system comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete mutual communication through the communication bus;

the memory is configured to store at least one executable instruction that causes the processor to perform the steps of the graph attention network based slicing false alarm identification method according to any one of claims 1-7.

10. A computer storage medium having stored therein at least one executable instruction for causing a processor to perform the steps of the graph attention network based slicing false alarm identification method according to any one of claims 1-7.