CN116112341A - Network equipment detection method and device, electronic equipment and storage medium - Google Patents
Network equipment detection method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN116112341A CN116112341A CN202211735181.3A CN202211735181A CN116112341A CN 116112341 A CN116112341 A CN 116112341A CN 202211735181 A CN202211735181 A CN 202211735181A CN 116112341 A CN116112341 A CN 116112341A
- Authority
- CN
- China
- Prior art keywords
- user
- alarm
- data
- flow
- time
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000001514 detection method Methods 0.000 title claims description 21
- 238000000034 method Methods 0.000 claims abstract description 61
- 238000013145 classification model Methods 0.000 claims abstract description 45
- 230000006399 behavior Effects 0.000 claims description 89
- 238000012549 training Methods 0.000 claims description 41
- 230000006870 function Effects 0.000 claims description 25
- 238000011084 recovery Methods 0.000 claims description 21
- 238000004140 cleaning Methods 0.000 claims description 20
- 238000004891 communication Methods 0.000 claims description 12
- 230000009471 action Effects 0.000 claims description 11
- 230000002159 abnormal effect Effects 0.000 claims description 9
- 238000012360 testing method Methods 0.000 claims description 8
- 238000004364 calculation method Methods 0.000 claims description 5
- 238000004590 computer program Methods 0.000 claims description 5
- 238000012163 sequencing technique Methods 0.000 claims description 5
- 230000008569 process Effects 0.000 description 17
- 238000012545 processing Methods 0.000 description 13
- 230000003287 optical effect Effects 0.000 description 11
- 230000005856 abnormality Effects 0.000 description 7
- 238000004422 calculation algorithm Methods 0.000 description 6
- 230000002093 peripheral effect Effects 0.000 description 5
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000010586 diagram Methods 0.000 description 3
- 239000000835 fiber Substances 0.000 description 3
- 238000004458 analytical method Methods 0.000 description 2
- 238000006243 chemical reaction Methods 0.000 description 2
- 238000013461 design Methods 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 238000007689 inspection Methods 0.000 description 2
- 239000004973 liquid crystal related substance Substances 0.000 description 2
- YHXISWVBGDMDLQ-UHFFFAOYSA-N moclobemide Chemical compound C1=CC(Cl)=CC=C1C(=O)NCCN1CCOCC1 YHXISWVBGDMDLQ-UHFFFAOYSA-N 0.000 description 2
- 239000013307 optical fiber Substances 0.000 description 2
- 238000012935 Averaging Methods 0.000 description 1
- 241000124033 Salix Species 0.000 description 1
- 230000001133 acceleration Effects 0.000 description 1
- 238000009825 accumulation Methods 0.000 description 1
- 230000032683 aging Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000005484 gravity Effects 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 238000004806 packaging method and process Methods 0.000 description 1
- 238000007781 pre-processing Methods 0.000 description 1
- 230000005236 sound signal Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000010897 surface acoustic wave method Methods 0.000 description 1
- 238000012795 verification Methods 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/147—Network analysis or design for predicting network behaviour
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The embodiment of the invention provides a method and a device for detecting network equipment, electronic equipment and a storage medium, wherein the method comprises the following steps: responding to the alarm of the network equipment, acquiring target work order data and target alarm data corresponding to the network equipment, and a classification model and a time sequence prediction model, wherein the target work order data and the target alarm data are both associated with a user identifier; inputting the target work order data and the target alarm data into a classification model to predict the user behavior, and obtaining a prediction result corresponding to the alarm; if the prediction result represents that the alarm is caused by the user power-off behavior, acquiring user flow use information corresponding to the user identifier, and inputting the user flow use information into a time sequence prediction model to acquire a flow value corresponding to the user identifier; if the flow value is smaller than the preset flow threshold value corresponding to the user flow use information, the alarm is judged to be caused by the user power-off behavior.
Description
Technical Field
The present invention relates to the field of network device processing technologies, and in particular, to a method for detecting a network device, a device for detecting a network device, an electronic device, and a computer readable storage medium.
Background
At present, the reason for generating fault alarms for peripheral network equipment is mainly represented by the following points: user individual power-off, equipment damage, network optical fiber damage, large-area power failure and other reasons. The method for judging the reason mainly comprises a traditional mode, an expert experience system and artificial intelligent network judgment.
The terminal network equipment manufacturer also provides a mode of judging reasons for equipment disconnection, and a plurality of chip manufacturers design a marking Gasp (power-off alarm) performance module when designing chips, and send 'temporary introduction' to the upper-level equipment through a protocol before equipment disconnection to inform information such as fault reasons.
Unfortunately, not all vendors support the protocol for all device models, and even if the device supports the protocol, it may not function properly for various reasons in actual use. For example, when an FTTH (Fiber) To The Home) terminal uses a power adapter lower than The DC 12V, the terminal fails To send a swing Gasp message after powering down, informing The OLT (Optical LineTerminal ) that The terminal is powered down, resulting in The OLT generating an optical signal loss alarm prompt. The RRU (Remote Radio Unit, radio frequency pull-up unit) of the base station is the same, and even if the support of the Dying Gasp is carried out, the problem of insufficient field voltage or component aging causes the Dying Gasp to be invalid. Therefore, the reason positioning cannot be completed by completely relying on the Dying Gasp protocol.
In the traditional method, for alarming of reasons of peripheral network equipment, the local side needs to send a person to go to the gate for special checking and processing, and for alarming of personal power-off behavior and power failure reasons of users, the local side does not need to process. In practical situations, the personal power-off behavior of the user has the largest proportion, the judgment difficulty is high, and for equipment alarming caused by the reasons, the local side is required to contact the user to confirm the power-off behavior, so that the workload is increased, and the use experience of the user is influenced.
Disclosure of Invention
The embodiment of the invention provides a method and a device for detecting network equipment, electronic equipment and a computer readable storage medium, which are used for solving or partially solving the problem that the network equipment cannot timely and rapidly process the abnormality when the abnormality occurs.
The embodiment of the invention discloses a detection method of network equipment, which comprises the following steps:
responding to the alarm of network equipment, acquiring target work order data and target alarm data corresponding to the network equipment, and a classification model for identifying user behaviors and a time sequence prediction model for predicting the flow condition of a user at the current moment, wherein the target work order data and the target alarm data are both associated with a user identifier;
Inputting the target work order data and the target alarm data into the classification model to predict user behaviors, and obtaining a prediction result corresponding to the alarm;
if the prediction result represents that the alarm is caused by the user power-off behavior, acquiring user flow use information corresponding to the user identifier, and inputting the user flow use information into the time sequence prediction model to acquire a flow value corresponding to the user identifier;
and if the flow value is smaller than a preset flow threshold corresponding to the user flow use information, judging that the alarm is caused by user power-off behavior.
Optionally, the method further comprises:
and if the flow value is greater than or equal to a preset flow threshold corresponding to the user flow use information, judging that the alarm is not caused by the user power-off behavior.
Optionally, the user traffic usage information includes an average user traffic of an account corresponding to the user identifier in a preset time period, and if the traffic value is smaller than a preset traffic threshold corresponding to the user traffic usage information, determining that the alarm is caused by a user power-off behavior includes:
threshold calculation is carried out by adopting the average flow of the user and a preset percentage, so as to obtain a preset flow threshold used for identifying the flow condition;
And if the flow value is smaller than the preset flow threshold value, judging that the alarm is caused by the power-off action of the user.
Optionally, the method further comprises:
acquiring historical worksheet data and historical alarm data of the network equipment in a historical time period;
performing data cleaning on the historical worksheet data and the historical alarm data to obtain training samples;
and training the original classification model according to the training sample until the loss function meets the condition, so as to obtain the classification model.
Optionally, the historical worksheet data at least includes a user identifier, a fault area, a fault occurrence time, a fault recovery time and a fault reason, the historical alarm data at least includes an alarm identifier, a plurality of pieces of alarm data, an alarm generation time and an alarm ending time, and the data cleaning is performed on the historical worksheet data and the historical alarm data to obtain a training sample, including:
adopting the fault occurrence time and the alarm generation time to combine with the public holiday in the current year to obtain holiday characteristics;
the fault occurrence time and the alarm generation time are combined with the calendar of the current year to obtain a double holiday characteristic;
Taking the user identifier as a unique identifier, taking the average value of the fault occurrence time as the off-duty time corresponding to the user identifier, and taking the average value of the fault recovery time as the on-duty time corresponding to the user identifier;
combining the alarm data, correlating the alarm data with the alarm mark, generating a corresponding work order, and acquiring the work order backtracking times of the alarm data in the work order;
calculating historical average online time and historical average interrupt time corresponding to the user identifier by adopting the fault occurrence time and the fault recovery time;
converting the fault area into a corresponding first numerical value according to the grade of the ground city;
acquiring a second numerical value corresponding to the fault cause;
and forming training samples by the holiday features, the double holiday features, the working hours, the work order backtracking times, the historical average online time, the historical average interrupt time, the first numerical value and the second numerical value.
Optionally, the method further comprises:
acquiring traffic usage information of the user equipment in one year;
cleaning the flow use information, and sequencing according to time sequence to obtain daily flow use information of the user equipment in one year;
And training an original time sequence prediction model according to the daily flow use information until a loss function meets the condition to obtain the time sequence prediction model by taking the daily flow use information of 5 days after each month as test data.
Optionally, the method further comprises:
and if the preset result indicates that the alarm is not caused by the power-off behavior of the user, generating abnormal prompt information aiming at the network equipment.
The embodiment of the invention also discloses a detection device of the network equipment, which comprises:
the system comprises a data acquisition module, a classification module, a time sequence prediction module and a control module, wherein the data acquisition module is used for responding to the occurrence of an alarm of network equipment, acquiring target work order data and target alarm data corresponding to the network equipment, and a classification model for identifying user behaviors and a time sequence prediction model for predicting the flow condition of a user at the current moment, and the target work order data and the target alarm data are both associated with a user identifier;
the prediction result generation module is used for inputting the target work order data and the target alarm data into the classification model to predict the user behavior and obtain a prediction result corresponding to the alarm;
the flow value determining module is used for acquiring user flow use information corresponding to the user identifier if the prediction result represents that the alarm is caused by user power-off behavior, inputting the user flow use information into the time sequence prediction model and acquiring a flow value corresponding to the user identifier;
And the behavior detection module is used for judging that the alarm is caused by the user power-off behavior if the flow value is smaller than a preset flow threshold corresponding to the user flow use information.
Optionally, the method further comprises:
and the flow judgment module is used for judging that the alarm is not caused by the user power-off behavior if the flow value is larger than or equal to a preset flow threshold corresponding to the user flow use information.
Optionally, the user flow usage information includes an average user flow of an account corresponding to the user identifier in a preset time period, and the behavior detection module is specifically configured to:
threshold calculation is carried out by adopting the average flow of the user and a preset percentage, so as to obtain a preset flow threshold used for identifying the flow condition;
and if the flow value is smaller than the preset flow threshold value, judging that the alarm is caused by the power-off action of the user.
Optionally, the method further comprises:
the historical data acquisition module is used for acquiring historical worksheet data and historical alarm data of the network equipment in a historical time period;
the sample generation module is used for carrying out data cleaning on the historical worksheet data and the historical alarm data to obtain training samples;
And the classification model training module is used for training the original classification model according to the training sample until the loss function meets the condition to obtain the classification model.
Optionally, the historical worksheet data at least includes a user identifier, a fault area, a fault occurrence time, a fault recovery time and a fault reason, the historical alarm data at least includes an alarm identifier, a plurality of pieces of alarm data, an alarm generation time and an alarm ending time, and the sample generation module is specifically configured to:
adopting the fault occurrence time and the alarm generation time to combine with the public holiday in the current year to obtain holiday characteristics;
the fault occurrence time and the alarm generation time are combined with the calendar of the current year to obtain a double holiday characteristic;
taking the user identifier as a unique identifier, taking the average value of the fault occurrence time as the off-duty time corresponding to the user identifier, and taking the average value of the fault recovery time as the on-duty time corresponding to the user identifier;
combining the alarm data, correlating the alarm data with the alarm mark, generating a corresponding work order, and acquiring the work order backtracking times of the alarm data in the work order;
Calculating historical average online time and historical average interrupt time corresponding to the user identifier by adopting the fault occurrence time and the fault recovery time;
converting the fault area into a corresponding first numerical value according to the grade of the ground city;
acquiring a second numerical value corresponding to the fault cause;
and forming training samples by the holiday features, the double holiday features, the working hours, the work order backtracking times, the historical average online time, the historical average interrupt time, the first numerical value and the second numerical value.
Optionally, the method further comprises:
the flow information acquisition module is used for acquiring the flow use information of the user equipment in one year;
the data cleaning module is used for cleaning the flow use information and sequencing the flow use information according to the time sequence to obtain daily flow use information of the user equipment in one year;
the model training module is used for training the original time sequence prediction model by taking the daily flow use information of 5 days after each month as test data according to the daily flow use information until the loss function meets the condition, and obtaining the time sequence prediction model.
Optionally, the method further comprises:
and the abnormal prompt information generation module is used for generating abnormal prompt information aiming at the network equipment if the preset result represents that the alarm is not caused by the power-off behavior of the user.
The embodiment of the invention also discloses electronic equipment, which comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory are communicated with each other through the communication bus;
the memory is used for storing a computer program;
the processor is configured to implement the method according to the embodiment of the present invention when executing the program stored in the memory.
Embodiments of the present invention also disclose a computer-readable storage medium having instructions stored thereon, which when executed by one or more processors, cause the processors to perform a method according to an embodiment of the present invention.
The embodiment of the invention has the following advantages:
in the embodiment of the invention, for the detection of network equipment, when the network equipment alarms, the flow value corresponding to the user identification can be obtained by acquiring a classification model and target alarm data corresponding to the network equipment, and a time sequence prediction model for carrying out user behavior recognition and predicting the flow condition of a user at the current moment, wherein the target work order data and the target alarm data are both associated with a user identification, then the target work order data and the target alarm data are input into the classification model for carrying out user behavior prediction, a prediction result corresponding to the alarm is obtained, if the prediction result characterizes the alarm as a result of user power-off behavior, the user flow utilization information corresponding to the user identification is obtained, and the flow value is further input into the time sequence prediction model, if the flow value is smaller than a preset flow threshold corresponding to the user flow utilization information, the alarm is judged as a result of user power-off behavior, so that under the condition that the network equipment generates the alarm, the corresponding work order data and the alarm data are firstly carried out user behavior prediction through the classification model, and whether the alarm is associated with the user behavior is judged, under the condition that the suspected association is carried out, if the suspected association is further, the flow value is not associated with the alarm behavior of the network equipment, the network equipment can be judged under the condition that the network equipment is required to be processed by the network equipment, and the network equipment is not associated with the alarm behavior, and the network equipment can be judged under the condition that the network equipment is required to be judged, the method not only can ensure the running stability of the network equipment, but also can process in time under the condition that the alarm cause is not caused by a user, and improves the alarm processing efficiency.
Drawings
Fig. 1 is a flowchart of steps of a method for detecting a network device according to an embodiment of the present invention;
fig. 2 is a block diagram of a detection apparatus of a network device according to an embodiment of the present invention;
fig. 3 is a block diagram of an electronic device provided in an embodiment of the invention.
Detailed Description
In order that the above-recited objects, features and advantages of the present invention will become more readily apparent, a more particular description of the invention will be rendered by reference to the appended drawings and appended detailed description.
As an example, for alarms for reasons of peripheral network devices, the local side needs to be dispatched to a gate to check specially, while for alarms for user personal power-off behavior and power failure reasons, the local side does not need to deal with. In practical situations, the personal power-off behavior of the user has the largest proportion, the judgment difficulty is high, and for equipment alarming caused by the reasons, the local side is required to contact the user to confirm the power-off behavior, so that the workload is increased, and the use experience of the user is influenced.
In view of this, one of the core invention points is that for the detection of network equipment, when the network equipment gives an alarm, the target work order data and the target alarm data corresponding to the network equipment can be obtained, and the classification model for identifying the user behavior and the time sequence prediction model for predicting the flow condition of the user at the current moment can be obtained, the target work order data and the target alarm data are both associated with the user identification, then the target work order data and the target alarm data are input into the classification model for predicting the user behavior, the prediction result corresponding to the alarm is obtained, if the prediction result characterizes the alarm to be the result of the user power-off behavior, the user flow utilization information corresponding to the user identification is obtained, and the user flow utilization information can be further input into the time sequence prediction model, and the flow value corresponding to the user identification can be obtained, if the flow value is smaller than the preset flow threshold corresponding to the user flow utilization information, the alarm is determined to be the result of the user power-off behavior, so that under the condition that the network equipment generates the alarm, the alarm is generated by obtaining the corresponding work order data and the alarm data, then the user behavior is predicted through the classification model, and whether the time sequence prediction is associated with the user behavior is determined, under the condition that the network equipment generates the alarm, under the condition that the alarm is generated, under the condition that the alarm is not associated with the network, the user behavior is further, the network equipment can be processed through the corresponding to the prediction model, the user behavior is determined to the user behavior under the condition, the method not only can ensure the running stability of the network equipment, but also can process in time under the condition that the alarm cause is not caused by a user, and improves the alarm processing efficiency.
Referring to fig. 1, a step flowchart of a method for detecting a network device according to an embodiment of the present invention may specifically include the following steps:
for the network device, it may include a peripheral network device, for example, a base station device RRU (remote radio Unit), an IPRAN U (IP Radio Access Network, radio access network IP) device, an OTN (Optical Transport Network, optical transmission network) client device CPE (Customer Premise Equipment), a PON (Passive Optical Network ) client device, or the like, when the network device generates an alarm, target work order data and target alarm data corresponding to the network device may be acquired, and a classification model for performing user behavior recognition and a timing prediction model for predicting a traffic situation of a user at a current moment, where the target work order data and the target alarm data are both associated with a user identifier. The target work order data may be data related to user behavior, and the target alarm data may be data related to an alarm generated by the network device.
In an alternative embodiment, for the classification model, the classification model may be obtained by acquiring historical worksheet data and historical alarm data of the network device in a historical time period, then performing data cleaning on the historical worksheet data and the historical alarm data to obtain a training sample, and then training the original classification model according to the training sample until a loss function meets a condition.
In a specific implementation, the historical worksheet data at least may include a user identifier, a fault area, a fault occurrence time, a fault recovery time and a fault reason, and the historical alarm data at least may include an alarm identifier, a plurality of pieces of alarm data, an alarm generation time and an alarm ending time, and then for a data cleaning process, the method may include: the holiday characteristics are obtained by combining the fault occurrence time and the alarm generation time with the public holidays in the current year; the double holiday characteristics are obtained by combining the fault occurrence time and the alarm generation time with the calendar of the current year; taking the user identifier as a unique identifier, taking the average value of the fault occurrence time as the working time corresponding to the user identifier, and taking the average value of the fault recovery time as the working time corresponding to the user identifier; combining a plurality of pieces of alarm data, correlating the pieces of alarm data with the alarm identifiers, generating corresponding worksheets, and acquiring worksheet backtracking times of the alarm data in the worksheets; calculating historical average online time and historical average interrupt time corresponding to the user identifier by adopting the fault occurrence time and the fault recovery time; converting the fault area into a corresponding first numerical value according to the grade of the ground city; and acquiring a second numerical value corresponding to the fault cause, and after the data cleaning is finished, forming a training sample from the holiday feature, the double holiday feature, the off-duty time, the on-duty time, the work order backtracking times, the historical average on-line time, the historical average interruption time, the first numerical value and the second numerical value.
Optionally, for data sources that train the classification model: the data of the model is obtained from the work order data of the supporting system and the alarm data of the alarm system, and the work order details and the alarm details of the terminal network equipment in the last year are derived, wherein the total number of the work order data is about 10 ten thousand and the total number of the alarm data is about 32 ten thousand. The worksheet data selects the following fields as the characteristics of the model: user IP (Internet Protocol ), failure zone, alarm ID (identity), failure occurrence time, failure recovery time, failure cause. The alarm data selects the following fields as the characteristics of the model: network element name, alarm ID, alarm generation time, alarm end time. The fault occurrence time, the fault recovery time, the alarm generation time and the alarm ending time are numerical data, and the rest are character data, so that the model training can be performed only by further processing. Wherein, for preprocessing of data: for the above raw data, further data cleaning and conversion may be performed, and specific processes may include:
determining whether the holiday is a holiday, and determining the value of the characteristic by combining the fault occurrence time and the alarm generation time with the public holiday condition of the current year, wherein the holiday value is 1, and the non-holiday value is 0;
Determining the value of the feature by combining the fault occurrence time and the alarm generation time with the calendar of the current year, wherein the value of the feature is 1, the value of Tuesday is 2, the value of Tuesday is 3, the value of Tuesday is 4, the value of Tuesday is 5, the value of Saturday is 6, the value of Sunday is 7 and the like;
the personal working hours, the part of the historical work order belonging to the user power-off behavior is screened out, the user IP is taken as a unique mark, the average value of fault occurrence time (removing the year, month and day part, reserving the time-division and second part, and the same as the time-division) is taken as the working hours of the user, the average value of fault recovery time (removing the year, month and day part, reserving the time-division and second part, and the same as the time-division) is taken as the working hours of the user, and the result is taken as the unit of hours, and two decimal points are reserved, and the shape is as follows: the working time is 7.89 hours, and the working time is 18.10 hours.
The number of backtracking of the work order is compared and analyzed by the work order data and the alarm data, and the comparison and analysis show that when the equipment has the condition of instant disconnection, a plurality of pieces of alarm data can be generated in a short time, and at the moment, the work order system can combine the plurality of pieces of alarm data into one work order to be dispatched. The work order data and the alarm data are associated through the alarm IP, and the work order backtracking times are the number of alarms under one work order;
The user is in the region, the characteristic is Chinese description, the Chinese description needs to be converted into a numerical form, and the Chinese description is converted according to the ordering of the ground level market, and the form is as follows: nanning: 1. willow state: 2, etc.;
the historical average online time length of the user takes the user IP as a unique identifier, the fault occurrence time minus the last fault recovery time is taken as the online time length of the user in the period, and the historical average online time length of the user is obtained by accumulation and averaging.
The historical average interrupt duration of the user takes the user IP as a unique identifier, the fault recovery time minus the last fault occurrence time is taken as the interrupt duration of the user in the period, and the accumulated average is taken as the historical average interrupt duration of the user.
The fault cause is described in Chinese and needs to be converted into a digital form, and the fault cause comprises the following values of customer power-off/power-off ',power-off/under-voltage', 'customer equipment', 'ODF (Optical Distribution Frame ) fault', 'version upgrade', 'self-recovery during inspection', 'power equipment', 'cutting-over task notification', 'engineering cutting-over', 'optical fiber box fault', 'optical cross fault', 'optical cable fault', 'interconnection', 'platform fault', 'equipment network withdrawal', 'data configuration', 'extra equipment', 'network management error', 'network management system', 'network element equipment', 'tail fiber fault', 'temperature and humidity', 'fiber core interrupt', 'performance fault', 'inspection test', 'unused' of service ',' hardware board card ',' hardware port ',' and the other value is 0, wherein the value of the customer power-off/the word is 1.
After the data is cleaned and converted, the minmax algorithm can be used for data normalization for part of characteristics, such as the average online time length of the user history and the average interrupt time length of the user history.
After the data conversion and cleaning, balancing positive and negative samples according to the fault type, controlling the proportion of the positive and negative samples to be 1:1 in a downsampling mode, selecting 80% as a training set, 20% as a test set, taking a historical work order receipt as marking data, training by using a LightGBM (LightGradient Boosting Machine) classifier, and evaluating the accuracy of a model through cross verification.
In addition, for the time sequence prediction model, the daily flow use information of the user equipment in one year can be obtained by obtaining the flow use information of the user equipment in one year, then cleaning the flow use information, and sequencing the flow use information according to the time sequence, then training the original time sequence prediction model according to the daily flow use information by taking the daily flow use information of 5 days after each month as test data until a loss function meets the condition, and the time sequence prediction model is obtained.
In a specific implementation, for a time sequence prediction model, flow data of user equipment in one year can be obtained by collecting flow use information of the user equipment in one year and taking a user identifier as a unique identifier, the flow data of the user equipment in one year can be obtained according to daily collection, then data cleaning can be carried out on the flow data, null value data and abnormal data are removed, user records without flow for more than half a year are removed, the data are converted into a time sequence format required by model training, then whether the data are stable or not can be observed through drawing, if not, difference is carried out, an ARIMA (Autoregressive Integrated Moving Average Model, autoregressive moving average model) algorithm is used for fitting the model, and the accuracy of the model is evaluated by taking 5 days after each month as test data.
It should be noted that, for the classification model and the time sequence prediction model, the corresponding training process can perform model training based on the gradient descent mode, and the model training is ended until the corresponding loss function is smaller than or equal to the preset condition by continuously optimizing the model, so as to obtain the model after training is completed.
102, inputting the target work order data and the target alarm data into the classification model to predict user behaviors, and obtaining a prediction result corresponding to the alarm;
after the corresponding data and the model are obtained, the target worksheet data and the target alarm data can be input into the classification model to predict the user behavior, and whether the current alarm of the network equipment is associated with the user behavior is judged to generate a corresponding prediction result. The prediction result may be a result of association between the network device and the user behavior, that is, the user behavior belongs to the user power-off behavior, or may be a result of independence between the network device and the user behavior, for the former, further analysis may be performed through a time sequence prediction model, for the latter, if the prediction result is irrelevant to the user behavior, the network device belongs to own abnormality, and a corresponding staff needs to be notified to process the abnormality, if the preset result characterizes that the alarm is not caused by the user power-off behavior, abnormality prompt information for the network device is generated.
in a specific implementation, if the prediction result of the classification model is characterized in that the current alarm of the network device is caused by the user power-off behavior, user traffic usage information corresponding to the user identifier can be further obtained, then the user traffic usage information is input into the time sequence prediction model for prediction, the traffic usage condition (i.e., the traffic value) of the user device corresponding to the user identifier is obtained, and then the traffic value can be obtained. Optionally, the network service condition corresponding to the user equipment can be effectively identified through the flow value, so that whether the alarm of the network equipment is associated with the user behavior can be judged.
And 104, if the flow value is smaller than a preset flow threshold corresponding to the user flow use information, judging that the alarm is caused by user power-off behavior.
In a specific implementation, the user flow using information includes user average flow of an account corresponding to a user identifier in a preset time period, a preset flow threshold for identifying a flow condition can be obtained by adopting the user average flow and a preset percentage to perform threshold calculation, and if the flow value is smaller than the preset flow threshold, an alarm is judged to be caused by user power-off behavior; if the flow value is greater than or equal to the preset flow threshold corresponding to the user flow usage information, the alarm is judged not to be caused by the user power-off action, so that under the condition that the network equipment generates the alarm, the corresponding work order data and the alarm data are obtained, then the user action prediction is carried out on the work order data through the classification model, whether the alarm is related to the user action or not is judged, under the condition that the alarm is suspected to be related, the alarm data are further processed through the time sequence prediction model, the corresponding flow value is obtained, whether the network equipment is related to the user action or not can be judged based on the flow value, further, under the condition that the alarm of the network equipment is judged to be related to the user action, the network equipment can be processed without being processed, under the condition that the alarm of the network equipment is not related to the user action, the alarm of the network equipment is judged to be processed, and the alarm reason of the network equipment is recognized, so that the running stability of the network equipment can be ensured, and under the condition that the alarm reason is not caused by the user, the alarm processing efficiency can be timely processed.
The preset percentage may be a percentage set according to actual situations, for example, 20%, and when the flow value output by the time sequence prediction model is less than 20% of the average flow of the user, it may be determined that the alarm of the network device is caused by the user power-off behavior; correspondingly, if the flow value is greater than or equal to 20%, that is, the user equipment is in a network active state, the alarm of the network equipment is irrelevant to the user behavior, corresponding abnormal prompt information can be generated so as to inform corresponding staff to timely process the abnormality of the network equipment, so that the abnormality detection of the network equipment is realized through two model algorithms, one model is a time sequence prediction model, the classification model judges whether the alarm is the user power-off behavior, the time sequence prediction model predicts the flow condition of the user at the current moment, and a discriminating flow of disconnection of the peripheral network equipment due to the user reason is constructed based on the combination of the two models, and is used for compressing the alarm work order quantity and realizing the intelligent treatment of the fault reason.
It should be noted that the embodiments of the present invention include, but are not limited to, the foregoing examples, and it will be understood that those skilled in the art may also set the embodiments according to actual requirements under the guidance of the concepts of the embodiments of the present invention, which are not limited thereto.
In the embodiment of the invention, for the detection of network equipment, when the network equipment alarms, the flow value corresponding to the user identification can be obtained by acquiring a classification model and target alarm data corresponding to the network equipment, and a time sequence prediction model for carrying out user behavior recognition and predicting the flow condition of a user at the current moment, wherein the target work order data and the target alarm data are both associated with a user identification, then the target work order data and the target alarm data are input into the classification model for carrying out user behavior prediction, a prediction result corresponding to the alarm is obtained, if the prediction result characterizes the alarm as a result of user power-off behavior, the user flow utilization information corresponding to the user identification is obtained, and the flow value is further input into the time sequence prediction model, if the flow value is smaller than a preset flow threshold corresponding to the user flow utilization information, the alarm is judged as a result of user power-off behavior, so that under the condition that the network equipment generates the alarm, the corresponding work order data and the alarm data are firstly carried out user behavior prediction through the classification model, and whether the alarm is associated with the user behavior is judged, under the condition that the suspected association is carried out, if the suspected association is further, the flow value is not associated with the alarm behavior of the network equipment, the network equipment can be judged under the condition that the network equipment is required to be processed by the network equipment, and the network equipment is not associated with the alarm behavior, and the network equipment can be judged under the condition that the network equipment is required to be judged, the method not only can ensure the running stability of the network equipment, but also can process in time under the condition that the alarm cause is not caused by a user, and improves the alarm processing efficiency.
In order to enable those skilled in the art to better understand the technical solutions according to the embodiments of the present invention, the following description is given by way of example:
step 1, acquiring work order data and alarm data, taking fault reasons replied by maintenance engineers as data labels, wherein the user behavior is powered off and labeled 1, and other reasons are labeled 0;
step 2, selecting holidays, double holidays, personal work time, work time backtracking times, user area, user historical average online time length, user historical average interrupt time length and fault reason as characteristics, vectorizing the fault reason and the user area, and normalizing the user historical average online time length and the user historical average interrupt time length; carrying out data cleaning and abnormal value processing on the flow data;
step 3, performing classification model training by using an lgbm algorithm; training a time sequence model by using an ARIMA algorithm;
step 4, verifying the accuracy of the model on the new data set;
step 5, judging that the accuracy of the model is more than 80%; if yes, saving the current model parameters, saving the model, and executing the step 6; otherwise, adjusting the model parameters, and executing the step 3;
step 6, packaging the two models into API (Application Programming Interface ) capability;
Step 7, calling the API capability of the classification model, inputting data, outputting whether the failure cause is the user power-off behavior, if so, judging that the failure cause is the suspected user power-off behavior, and executing step 8; if not, judging other reasons, and ending the step;
step 8, calling a time sequence prediction model, inputting data, outputting a predicted flow value, and judging that the user is powered off if the flow value is smaller than the average flow of the user by 20%; otherwise, judging other reasons, checking the dispatch, and ending the step.
It should be noted that, for simplicity of description, the method embodiments are shown as a series of acts, but it should be understood by those skilled in the art that the embodiments are not limited by the order of acts, as some steps may occur in other orders or concurrently in accordance with the embodiments. Further, those skilled in the art will appreciate that the embodiments described in the specification are presently preferred embodiments, and that the acts are not necessarily required by the embodiments of the invention.
Referring to fig. 2, a block diagram of a detection apparatus for a network device provided in an embodiment of the present invention may specifically include the following modules:
The data acquisition module 201 is configured to respond to an alarm generated by a network device, and acquire target work order data and target alarm data corresponding to the network device, and a classification model for performing user behavior recognition and a time sequence prediction model for predicting a flow condition of a user at a current moment, where the target work order data and the target alarm data are both associated with a user identifier;
the prediction result generating module 202 is configured to input the target work order data and the target alarm data into the classification model to perform user behavior prediction, so as to obtain a prediction result corresponding to the alarm;
the flow value determining module 203 is configured to obtain user flow usage information corresponding to the user identifier if the prediction result indicates that the alarm is caused by a user power-off behavior, and input the user flow usage information into the time sequence prediction model to obtain a flow value corresponding to the user identifier;
the behavior detection module 204 is configured to determine that the alarm is caused by the user power-off behavior if the flow value is smaller than a preset flow threshold corresponding to the user flow usage information.
In an alternative embodiment, further comprising:
And the flow judgment module is used for judging that the alarm is not caused by the user power-off behavior if the flow value is larger than or equal to a preset flow threshold corresponding to the user flow use information.
In an optional embodiment, the user traffic usage information includes an average user traffic of an account corresponding to the user identifier in a preset time period, and the behavior detection module 204 is specifically configured to:
threshold calculation is carried out by adopting the average flow of the user and a preset percentage, so as to obtain a preset flow threshold used for identifying the flow condition;
and if the flow value is smaller than the preset flow threshold value, judging that the alarm is caused by the power-off action of the user.
In an alternative embodiment, further comprising:
a historical data acquisition module 201, configured to acquire historical worksheet data and historical alarm data of the network device in a historical time period;
the sample generation module is used for carrying out data cleaning on the historical worksheet data and the historical alarm data to obtain training samples;
and the classification model training module is used for training the original classification model according to the training sample until the loss function meets the condition to obtain the classification model.
In an optional embodiment, the historical worksheet data at least includes a user identifier, a fault area, a fault occurrence time, a fault recovery time and a fault reason, the historical alarm data at least includes an alarm identifier, a plurality of pieces of alarm data, an alarm generation time and an alarm ending time, and the sample generation module is specifically configured to:
adopting the fault occurrence time and the alarm generation time to combine with the public holiday in the current year to obtain holiday characteristics;
the fault occurrence time and the alarm generation time are combined with the calendar of the current year to obtain a double holiday characteristic;
taking the user identifier as a unique identifier, taking the average value of the fault occurrence time as the off-duty time corresponding to the user identifier, and taking the average value of the fault recovery time as the on-duty time corresponding to the user identifier;
combining the alarm data, correlating the alarm data with the alarm mark, generating a corresponding work order, and acquiring the work order backtracking times of the alarm data in the work order;
calculating historical average online time and historical average interrupt time corresponding to the user identifier by adopting the fault occurrence time and the fault recovery time;
Converting the fault area into a corresponding first numerical value according to the grade of the ground city;
acquiring a second numerical value corresponding to the fault cause;
and forming training samples by the holiday features, the double holiday features, the working hours, the work order backtracking times, the historical average online time, the historical average interrupt time, the first numerical value and the second numerical value.
In an alternative embodiment, further comprising:
the flow information acquisition module is used for acquiring the flow use information of the user equipment in one year;
the data cleaning module is used for cleaning the flow use information and sequencing the flow use information according to the time sequence to obtain daily flow use information of the user equipment in one year;
the model training module is used for training the original time sequence prediction model by taking the daily flow use information of 5 days after each month as test data according to the daily flow use information until the loss function meets the condition, and obtaining the time sequence prediction model.
In an alternative embodiment, further comprising:
and the abnormal prompt information generation module is used for generating abnormal prompt information aiming at the network equipment if the preset result represents that the alarm is not caused by the power-off behavior of the user.
For the device embodiments, since they are substantially similar to the method embodiments, the description is relatively simple, and reference is made to the description of the method embodiments for relevant points.
In addition, the embodiment of the invention also provides electronic equipment, which comprises: the processor, the memory, the computer program stored in the memory and capable of running on the processor, the computer program realizes each process of the above-mentioned network device detection method embodiment when being executed by the processor, and can achieve the same technical effect, and for avoiding repetition, the description is omitted here.
The embodiment of the invention also provides a computer readable storage medium, on which a computer program is stored, which when executed by a processor, realizes the processes of the above-mentioned network device detection method embodiment, and can achieve the same technical effects, and in order to avoid repetition, the description is omitted here. Wherein the computer readable storage medium is selected from Read-Only Memory (ROM), random access Memory (Random AccessMemory, RAM), magnetic disk or optical disk.
Fig. 3 is a schematic hardware structure of an electronic device implementing various embodiments of the present invention.
The electronic device 300 includes, but is not limited to: radio frequency unit 301, network module 302, audio output unit 303, input unit 304, sensor 305, display unit 306, user input unit 307, interface unit 308, memory 309, processor 310, and power supply 311. It will be appreciated by those skilled in the art that the structure of the electronic device according to the embodiments of the present invention is not limited to the electronic device, and the electronic device may include more or less components than those illustrated, or may combine some components, or may have different arrangements of components. In the embodiment of the invention, the electronic equipment comprises, but is not limited to, a mobile phone, a tablet computer, a notebook computer, a palm computer, a vehicle-mounted terminal, a wearable device, a pedometer and the like.
It should be understood that, in the embodiment of the present invention, the radio frequency unit 301 may be used to receive and send information or signals during a call, specifically, receive downlink data from a base station, and then process the downlink data with the processor 310; and, the uplink data is transmitted to the base station. Typically, the radio frequency unit 301 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, and the like. In addition, the radio frequency unit 301 may also communicate with networks and other devices through a wireless communication system.
The electronic device provides wireless broadband internet access to the user through the network module 302, such as helping the user to send and receive e-mail, browse web pages, and access streaming media, etc.
The audio output unit 303 may convert audio data received by the radio frequency unit 301 or the network module 302 or stored in the memory 309 into an audio signal and output as sound. Also, the audio output unit 303 may also provide audio output (e.g., a call signal reception sound, a message reception sound, etc.) related to a specific function performed by the electronic device 300. The audio output unit 303 includes a speaker, a buzzer, a receiver, and the like.
The input unit 304 is used to receive an audio or video signal. The input unit 304 may include a graphics processor (Graphics Processing Unit, GPU) 3041 and a microphone 3042, the graphics processor 3041 processing image data of still pictures or video obtained by an image capturing device (such as a camera) in a video capturing mode or an image capturing mode. The processed image frames may be displayed on the display unit 306. The image frames processed by the graphics processor 3041 may be stored in the memory 309 (or other storage medium) or transmitted via the radio frequency unit 301 or the network module 302. The microphone 3042 may receive sound, and may be capable of processing such sound into audio data. The processed audio data may be converted into a format output that can be transmitted to the mobile communication base station via the radio frequency unit 301 in the case of a telephone call mode.
The electronic device 300 further comprises at least one sensor 305, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor that can adjust the brightness of the display panel 3061 according to the brightness of ambient light, and a proximity sensor that can turn off the display panel 3061 and/or the backlight when the electronic device 300 is moved to the ear. As one of the motion sensors, the accelerometer sensor can detect the acceleration in all directions (generally three axes), and can detect the gravity and direction when stationary, and can be used for recognizing the gesture of the electronic equipment (such as horizontal and vertical screen switching, related games, magnetometer gesture calibration), vibration recognition related functions (such as pedometer and knocking), and the like; the sensor 305 may further include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which are not described herein.
The display unit 306 is used to display information input by a user or information provided to the user. The display unit 306 may include a display panel 3061, and the display panel 3061 may be configured in the form of a liquid crystal display (Liquid Crystal Display, LCD), an Organic Light-Emitting Diode (OLED), or the like.
The user input unit 307 may be used to receive input numeric or character information and to generate key signal inputs related to user settings and function control of the electronic device. Specifically, the user input unit 307 includes a touch panel 3071 and other input devices 3072. The touch panel 3071, also referred to as a touch screen, may collect touch operations thereon or thereabout by a user (e.g., operations of the user on the touch panel 3071 or thereabout the touch panel 3071 using any suitable object or accessory such as a finger, stylus, or the like). The touch panel 3071 may include two parts, a touch detection device and a touch controller. The touch detection device detects the touch azimuth of a user, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts the touch information into touch point coordinates, sends the touch point coordinates to the processor 310, and receives and executes commands sent by the processor 310. In addition, the touch panel 3071 may be implemented in various types such as resistive, capacitive, infrared, and surface acoustic wave. The user input unit 307 may include other input devices 3072 in addition to the touch panel 3071. Specifically, other input devices 3072 may include, but are not limited to, a physical keyboard, function keys (e.g., volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which are not described in detail herein.
Further, the touch panel 3071 may be overlaid on the display panel 3061, and when the touch panel 3071 detects a touch operation thereon or thereabout, the touch operation is transmitted to the processor 310 to determine a type of touch event, and then the processor 310 provides a corresponding visual output on the display panel 3061 according to the type of touch event. It will be appreciated that in one embodiment, the touch panel 3071 and the display panel 3061 are implemented as two separate components for the input and output functions of the electronic device, but in some embodiments, the touch panel 3071 and the display panel 3061 may be integrated to implement the input and output functions of the electronic device, which is not limited herein.
The interface unit 308 is an interface to which an external device is connected to the electronic apparatus 300. For example, the external devices may include a wired or wireless headset port, an external power (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device having an identification module, an audio input/output (I/O) port, a video I/O port, an earphone port, and the like. The interface unit 308 may be used to receive input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the electronic apparatus 300 or may be used to transmit data between the electronic apparatus 300 and an external device.
The processor 310 is a control center of the electronic device, connects various parts of the entire electronic device using various interfaces and lines, and performs various functions of the electronic device and processes data by running or executing software programs and/or modules stored in the memory 309, and calling data stored in the memory 309, thereby performing overall monitoring of the electronic device. Processor 310 may include one or more processing units; preferably, the processor 310 may integrate an application processor that primarily handles operating systems, user interfaces, applications, etc., with a modem processor that primarily handles wireless communications. It will be appreciated that the modem processor described above may not be integrated into the processor 310.
The electronic device 300 may also include a power supply 311 (e.g., a battery) for powering the various components, and preferably the power supply 311 may be logically coupled to the processor 310 via a power management system that performs functions such as managing charge, discharge, and power consumption.
In addition, the electronic device 300 includes some functional modules, which are not shown, and will not be described herein.
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.
From the above description of the embodiments, it will be clear to those skilled in the art that the above-described embodiment method may be implemented by means of software plus a necessary general hardware platform, but of course may also be implemented by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (e.g. ROM/RAM, magnetic disk, optical disk) comprising instructions for causing a terminal (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to perform the method according to the embodiments of the present invention.
The embodiments of the present invention have been described above with reference to the accompanying drawings, but the present invention is not limited to the above-described embodiments, which are merely illustrative and not restrictive, and many forms may be made by those having ordinary skill in the art without departing from the spirit of the present invention and the scope of the claims, which are to be protected by the present invention.
Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described systems, apparatuses and units may refer to corresponding procedures in the foregoing method embodiments, and are not repeated herein.
In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the units is merely a logical function division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.
The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
In addition, each functional unit in the embodiments of the present invention may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit.
The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution, in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a usb disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk, etc.
The foregoing is merely illustrative of the present invention, and the present invention is not limited thereto, and any person skilled in the art will readily recognize that variations or substitutions are within the scope of the present invention. Therefore, the protection scope of the invention is subject to the protection scope of the claims.
Claims (10)
1. A method for detecting a network device, comprising:
responding to the alarm of network equipment, acquiring target work order data and target alarm data corresponding to the network equipment, and a classification model for identifying user behaviors and a time sequence prediction model for predicting the flow condition of a user at the current moment, wherein the target work order data and the target alarm data are both associated with a user identifier;
inputting the target work order data and the target alarm data into the classification model to predict user behaviors, and obtaining a prediction result corresponding to the alarm;
if the prediction result represents that the alarm is caused by the user power-off behavior, acquiring user flow use information corresponding to the user identifier, and inputting the user flow use information into the time sequence prediction model to acquire a flow value corresponding to the user identifier;
and if the flow value is smaller than a preset flow threshold corresponding to the user flow use information, judging that the alarm is caused by user power-off behavior.
2. The method as recited in claim 1, further comprising:
and if the flow value is greater than or equal to a preset flow threshold corresponding to the user flow use information, judging that the alarm is not caused by the user power-off behavior.
3. The method according to claim 1 or 2, wherein the user traffic usage information includes an average user traffic of an account corresponding to the user identifier over a preset period of time, and the determining that the alarm is caused by a user power-off action if the traffic value is smaller than a preset traffic threshold corresponding to the user traffic usage information includes:
threshold calculation is carried out by adopting the average flow of the user and a preset percentage, so as to obtain a preset flow threshold used for identifying the flow condition;
and if the flow value is smaller than the preset flow threshold value, judging that the alarm is caused by the power-off action of the user.
4. The method as recited in claim 1, further comprising:
acquiring historical worksheet data and historical alarm data of the network equipment in a historical time period;
performing data cleaning on the historical worksheet data and the historical alarm data to obtain training samples;
and training the original classification model according to the training sample until the loss function meets the condition, so as to obtain the classification model.
5. The method according to claim 4, wherein the historical worksheet data includes at least a user identifier, a fault area, a fault occurrence time, a fault recovery time, and a fault cause, the historical alarm data includes at least an alarm identifier, a plurality of pieces of alarm data, an alarm generation time, and an alarm end time, and the performing data cleaning on the historical worksheet data and the historical alarm data to obtain training samples includes:
Adopting the fault occurrence time and the alarm generation time to combine with the public holiday in the current year to obtain holiday characteristics;
the fault occurrence time and the alarm generation time are combined with the calendar of the current year to obtain a double holiday characteristic;
taking the user identifier as a unique identifier, taking the average value of the fault occurrence time as the off-duty time corresponding to the user identifier, and taking the average value of the fault recovery time as the on-duty time corresponding to the user identifier;
combining the alarm data, correlating the alarm data with the alarm mark, generating a corresponding work order, and acquiring the work order backtracking times of the alarm data in the work order;
calculating historical average online time and historical average interrupt time corresponding to the user identifier by adopting the fault occurrence time and the fault recovery time;
converting the fault area into a corresponding first numerical value according to the grade of the ground city;
acquiring a second numerical value corresponding to the fault cause;
and forming training samples by the holiday features, the double holiday features, the working hours, the work order backtracking times, the historical average online time, the historical average interrupt time, the first numerical value and the second numerical value.
6. The method as recited in claim 1, further comprising:
acquiring traffic usage information of the user equipment in one year;
cleaning the flow use information, and sequencing according to time sequence to obtain daily flow use information of the user equipment in one year;
and training an original time sequence prediction model according to the daily flow use information until a loss function meets the condition to obtain the time sequence prediction model by taking the daily flow use information of 5 days after each month as test data.
7. The method as recited in claim 1, further comprising:
and if the preset result indicates that the alarm is not caused by the power-off behavior of the user, generating abnormal prompt information aiming at the network equipment.
8. A detection apparatus for a network device, comprising:
the system comprises a data acquisition module, a classification module, a time sequence prediction module and a control module, wherein the data acquisition module is used for responding to the occurrence of an alarm of network equipment, acquiring target work order data and target alarm data corresponding to the network equipment, and a classification model for identifying user behaviors and a time sequence prediction model for predicting the flow condition of a user at the current moment, and the target work order data and the target alarm data are both associated with a user identifier;
The prediction result generation module is used for inputting the target work order data and the target alarm data into the classification model to predict the user behavior and obtain a prediction result corresponding to the alarm;
the flow value determining module is used for acquiring user flow use information corresponding to the user identifier if the prediction result represents that the alarm is caused by user power-off behavior, inputting the user flow use information into the time sequence prediction model and acquiring a flow value corresponding to the user identifier;
and the behavior detection module is used for judging that the alarm is caused by the user power-off behavior if the flow value is smaller than a preset flow threshold corresponding to the user flow use information.
9. An electronic device comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;
the memory is used for storing a computer program;
the processor is configured to implement the method according to any one of claims 1-7 when executing a program stored on a memory.
10. A computer-readable storage medium having instructions stored thereon, which when executed by one or more processors, cause the processors to perform the method of any of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211735181.3A CN116112341B (en) | 2022-12-30 | 2022-12-30 | Network equipment detection method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211735181.3A CN116112341B (en) | 2022-12-30 | 2022-12-30 | Network equipment detection method and device, electronic equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN116112341A true CN116112341A (en) | 2023-05-12 |
| CN116112341B CN116112341B (en) | 2024-04-30 |
Family
ID=86257502
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211735181.3A Active CN116112341B (en) | 2022-12-30 | 2022-12-30 | Network equipment detection method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116112341B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116302661A (en) * | 2023-05-15 | 2023-06-23 | 合肥联宝信息技术有限公司 | Abnormality prediction method and device, electronic equipment and storage medium |
| CN116634473A (en) * | 2023-07-21 | 2023-08-22 | 中国铁塔股份有限公司云南省分公司 | Method and device for predicting failure of power failure and service withdrawal of wireless station |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2018126645A1 (en) * | 2017-01-05 | 2018-07-12 | 深圳奇迹智慧网络有限公司 | Communication network management method and apparatus therefor |
| CN113687969A (en) * | 2021-07-29 | 2021-11-23 | 济南浪潮数据技术有限公司 | Alarm information generation method and device, electronic equipment and readable storage medium |
| CN114430363A (en) * | 2020-10-29 | 2022-05-03 | ***通信有限公司研究院 | Fault reason positioning method, device, equipment and storage medium |
| CN114780358A (en) * | 2021-12-10 | 2022-07-22 | 中国工商银行股份有限公司 | Detection method and detection device for abnormal operation behaviors |
| CN115102836A (en) * | 2022-07-13 | 2022-09-23 | 中国联合网络通信集团有限公司 | Network equipment fault analysis method and device and storage medium |
-
2022
- 2022-12-30 CN CN202211735181.3A patent/CN116112341B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2018126645A1 (en) * | 2017-01-05 | 2018-07-12 | 深圳奇迹智慧网络有限公司 | Communication network management method and apparatus therefor |
| CN114430363A (en) * | 2020-10-29 | 2022-05-03 | ***通信有限公司研究院 | Fault reason positioning method, device, equipment and storage medium |
| CN113687969A (en) * | 2021-07-29 | 2021-11-23 | 济南浪潮数据技术有限公司 | Alarm information generation method and device, electronic equipment and readable storage medium |
| CN114780358A (en) * | 2021-12-10 | 2022-07-22 | 中国工商银行股份有限公司 | Detection method and detection device for abnormal operation behaviors |
| CN115102836A (en) * | 2022-07-13 | 2022-09-23 | 中国联合网络通信集团有限公司 | Network equipment fault analysis method and device and storage medium |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116302661A (en) * | 2023-05-15 | 2023-06-23 | 合肥联宝信息技术有限公司 | Abnormality prediction method and device, electronic equipment and storage medium |
| CN116302661B (en) * | 2023-05-15 | 2023-10-13 | 合肥联宝信息技术有限公司 | Abnormality prediction method and device, electronic equipment and storage medium |
| CN116634473A (en) * | 2023-07-21 | 2023-08-22 | 中国铁塔股份有限公司云南省分公司 | Method and device for predicting failure of power failure and service withdrawal of wireless station |
| CN116634473B (en) * | 2023-07-21 | 2023-10-10 | 中国铁塔股份有限公司云南省分公司 | Method and device for predicting failure of power failure and service withdrawal of wireless station |
Also Published As
| Publication number | Publication date |
|---|---|
| CN116112341B (en) | 2024-04-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN116112341B (en) | Network equipment detection method and device, electronic equipment and storage medium | |
| CN111984401A (en) | Memory overflow management method and device, electronic equipment and storage medium | |
| CN109271297A (en) | A kind of abnormal prompt method and mobile terminal | |
| CN112050970A (en) | Environment monitoring method and device | |
| CN110022235B (en) | Information processing method, terminal and server | |
| CN112596980A (en) | ios performance collection method and device, mobile terminal and computer readable storage medium | |
| CN110046033A (en) | Applied program processing method and device, electronic equipment, computer readable storage medium | |
| CN112256748A (en) | Abnormity detection method and device, electronic equipment and storage medium | |
| CN117076295A (en) | Database detection method, system, electronic equipment and storage medium | |
| CN108287863B (en) | Message record cleaning method and device | |
| CN115510005A (en) | Display method and device of abnormal log information, electronic equipment and storage medium | |
| WO2001059736A3 (en) | System and method of facilities and operations monitoring and remote management support | |
| CN109992371A (en) | Applied program processing method, device, electronic equipment, computer readable storage medium | |
| CN113518152B (en) | Telephone number identification method and system and electronic equipment | |
| CN106896896B (en) | Electricity saving method, device and electronic equipment | |
| CN112862120A (en) | Power maintenance and repair supervision system and method | |
| CN111723003A (en) | Gray scale testing method and device, electronic equipment and storage medium | |
| CN115102930B (en) | Conference map generation method and device, electronic equipment and readable storage medium | |
| CN115333928B (en) | Network early warning method and device, electronic equipment and storage medium | |
| CN111866599A (en) | Quality difference delimiting method, device and equipment | |
| CN113095517B (en) | Method and device for monitoring and early warning charging error codes and electronic equipment | |
| CN115378791A (en) | Data management method, device, storage medium and electronic equipment | |
| CN110532748B (en) | Battery management method and related product | |
| CN116070743A (en) | Arrearage early warning method and device, electronic equipment and storage medium | |
| CN115344484A (en) | Method, device, medium and equipment for optimizing test resources based on bill inspection |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |