CN116436792A

CN116436792A - Information acquisition method and device and network equipment

Info

Publication number: CN116436792A
Application number: CN202111649062.1A
Authority: CN
Inventors: 李唯源; 李琴; 刘荣鑫
Original assignee: China Mobile Communications Group Co Ltd; China Mobile Communications Ltd Research Institute
Current assignee: China Mobile Communications Group Co Ltd; China Mobile Communications Ltd Research Institute
Priority date: 2021-12-30
Filing date: 2021-12-30
Publication date: 2023-07-14

Abstract

The invention provides an information acquisition method, an information acquisition device and network equipment, wherein the information acquisition method comprises the following steps: acquiring a time sequence feature set corresponding to terminal network data in a first time period; acquiring a recognition result corresponding to the time sequence feature set by using the first unsupervised model and the second unsupervised model; the identification result indicates that an abnormal value exists in the time sequence feature set or indicates that an abnormal value does not exist in the time sequence feature set; the outlier is used to indicate that the terminal is in a network abnormal state. The embodiment of the invention can acquire the network data of the terminal individual, and can analyze the network data through an unsupervised model to identify whether the network state of the terminal individual is abnormal or not, thereby realizing the monitoring of the network state of the network terminal individual.

Description

Information acquisition method and device and network equipment

Technical Field

The present invention relates to the field of network intelligence technologies, and in particular, to an information acquisition method, an information acquisition device, and a network device.

Background

The number of network terminals is explosively increased, and how to effectively manage a large number of terminals becomes a big problem for network operators, especially how to monitor the health status of the terminals. When the network terminal is abnormal, the abnormal information may not be reported, and the network operator needs to judge whether the terminal is in normal state or abnormal state according to the user plane data and the control plane data of the terminal, so as to provide fault analysis and solution for the abnormal terminal in a targeted manner.

Currently, network operators mainly monitor network quality through statistics indexes such as adhesion success rate, public data network (Public Data Network, PDN) connection success rate, bearer establishment success rate and the like, and the network is considered to be abnormal when the success rate is lower than 95%. However, the existing technical scheme monitors the overall quality of the network and lacks monitoring the individual network terminals.

Disclosure of Invention

The invention aims to provide an information acquisition method, an information acquisition device and network equipment, so as to solve the problem that the network state of a network terminal individual cannot be monitored in the prior art.

In order to solve the above technical problems, an embodiment of the present invention provides an information acquisition method, including:

acquiring a time sequence feature set corresponding to terminal network data in a first time period; the time sequence characteristic set comprises time sequence characteristic values of at least two dimensions;

acquiring a recognition result corresponding to the time sequence feature set by using the first unsupervised model and the second unsupervised model;

wherein the recognition result indicates that an abnormal value exists in the time sequence feature set or indicates that an abnormal value does not exist in the time sequence feature set; the abnormal value is used for indicating that the terminal is in a network abnormal state.

Optionally, the acquiring the time sequence feature set corresponding to the terminal network data in the first period includes:

acquiring an initial time sequence characteristic value of the terminal network data in the first time period;

and carrying out similarity analysis and clustering treatment on the initial time sequence characteristic value to obtain the time sequence characteristic set.

Optionally, the acquiring, by using the unsupervised model, the recognition result corresponding to the time sequence feature set includes:

acquiring a first prediction error value of the time sequence feature set by using a first unsupervised model;

obtaining a reconstruction error value of the time sequence feature set by using a second unsupervised model;

and obtaining the identification result according to the first prediction error value and the reconstruction error value.

Optionally, the obtaining the identification result according to the first prediction error value and the reconstruction error value includes:

updating the time sequence feature set according to the first prediction error value, the reconstruction error value and the reconstruction error threshold value to obtain an updated time sequence feature set;

acquiring a second prediction error value corresponding to the updated time sequence feature set by using the first unsupervised model;

And acquiring the identification result according to the comparison result of the first prediction error value and the second prediction error value.

Optionally, the updating the time sequence feature set according to the first prediction error value, the reconstruction error value and the reconstruction error threshold value, to obtain an updated time sequence feature set includes:

obtaining a predicted outlier according to the first predicted error value, the reconstruction error value and the reconstruction error threshold;

and deleting the predicted outlier from the time sequence feature set to obtain the updated time sequence feature set.

Optionally, the obtaining a predicted outlier according to the first predicted error value, the reconstructed error value, and the reconstructed error threshold value includes:

determining a first target predicted outlier in the set of timing features, the reconstruction error value being greater than the reconstruction error threshold;

determining a first target time sequence characteristic value of a first preset number with the maximum reconstruction error value in the time sequence characteristic set;

determining a second target time sequence characteristic value of a second preset number with the largest first prediction error value in the time sequence characteristic set;

determining a time sequence characteristic value overlapped in the first target time sequence characteristic value and the second target time sequence characteristic value as a second target predicted abnormal value;

And obtaining the predicted outlier according to the first target predicted outlier and the second target predicted outlier.

Optionally, the obtaining the identification result according to the comparison result of the first prediction error value and the second prediction error value includes:

determining that the recognition result indicates that an outlier exists in the time sequence feature set under the condition that the second prediction error value is smaller than the first prediction error value;

the outlier is the predicted outlier.

Optionally, after the obtaining the identification result according to the comparison result of the first prediction error value and the second prediction error value, the method further includes:

performing a first operation in a circulating manner until the first prediction error value is smaller than a prediction error threshold value;

wherein the first operation comprises: updating the reconstruction error threshold according to the comparison result of the first prediction error value and the second prediction error value; updating the time sequence feature set according to the first prediction error value, the reconstruction error value and the reconstruction error threshold value to obtain an updated time sequence feature set; the reconstruction error threshold is an updated reconstruction error threshold.

Optionally, the updating the reconstruction error threshold according to the comparison result of the first prediction error value and the second prediction error value includes:

reducing the reconstruction error threshold by a first threshold value if the second prediction error value is less than the first prediction error value;

and increasing the reconstruction error threshold by a second threshold value when the second prediction error value is greater than or equal to the first prediction error value.

Optionally, after the identifying result corresponding to the time sequence feature set is obtained by using the unsupervised model, the method further includes:

and updating the first time period according to the preset time length and the current time.

The embodiment of the invention also provides an information acquisition device, which comprises:

the first acquisition module is used for acquiring a time sequence feature set corresponding to the terminal network data in a first time period; the time sequence characteristic set comprises time sequence characteristic values of at least two dimensions;

the second acquisition module is used for acquiring the identification result corresponding to the time sequence feature set by using an unsupervised model;

Optionally, the first acquisition module includes:

a first obtaining unit, configured to obtain an initial timing characteristic value of terminal network data in the first period;

and the first processing unit is used for carrying out similarity analysis and clustering processing on the initial time sequence characteristic values to obtain the time sequence characteristic set.

Optionally, the second acquisition module includes:

a second obtaining unit, configured to obtain a first prediction error value of the time sequence feature set by using a first unsupervised model;

the third acquisition unit is used for acquiring a reconstruction error value of the time sequence feature set by using a second unsupervised model;

and the second processing unit is used for obtaining the identification result according to the first prediction error value and the reconstruction error value.

Optionally, the second processing unit is specifically configured to:

The outlier is the predicted outlier.

Optionally, the second processing unit is further specifically configured to:

Optionally, the apparatus further comprises:

and the updating module is used for updating the first time period according to the preset duration and the current time.

The embodiment of the invention also provides a network device, which comprises a processor and a transceiver, wherein:

The processor is used for acquiring a time sequence feature set corresponding to the terminal network data in the first time period; the time sequence characteristic set comprises time sequence characteristic values of at least two dimensions;

acquiring a recognition result corresponding to the time sequence feature set by using an unsupervised model;

Optionally, the processor is specifically configured to:

the obtaining, by using the unsupervised model, the recognition result corresponding to the time sequence feature set includes:

obtaining a first prediction error value of the time sequence feature set by using a first unsupervised model;

Optionally, the processor is specifically configured to:

the outlier is the predicted outlier.

Optionally, after the processor obtains the identification result according to a comparison result of the first prediction error value and the second prediction error value, the processor is further specifically configured to:

Optionally, the processor is specifically configured to:

Optionally, after the processor obtains the recognition result corresponding to the time sequence feature set by using an unsupervised model, the processor is further configured to:

The embodiment of the invention also provides a network device, which comprises a memory, a processor and a program stored in the memory and capable of running on the processor; the processor, when executing the program, implements the information acquisition method according to any one of the above.

The embodiment of the present invention also provides a readable storage medium having a program stored thereon, which when executed by a processor, implements the steps in the information acquisition method as set forth in any one of the above.

At least one of the above technical solutions of the invention has the following beneficial effects:

In the above scheme, the acquisition of the network data of the terminal individual can be realized by acquiring the time sequence feature set corresponding to the terminal network data in the first time period, wherein the time sequence feature set comprises at least two time sequence feature values; acquiring a recognition result corresponding to the time sequence feature set by using an unsupervised model, wherein the recognition result indicates that an abnormal value exists in the time sequence feature set or indicates that an abnormal value does not exist in the time sequence feature set; the abnormal value is used for indicating that the terminal is in a network abnormal state, namely, whether the network state of the terminal individual is abnormal or not can be identified by analyzing the network data through an unsupervised model, and further, the network state of the network terminal individual is monitored.

Drawings

FIG. 1 is a flowchart of an information acquisition method according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of a timing prediction model according to an embodiment of the present invention;

FIG. 3 is a second flowchart of an information acquisition method according to an embodiment of the present invention

Fig. 4 is a flowchart of acquiring a recognition result of a time sequence feature set corresponding to dynamic terminal network data according to an embodiment of the present invention;

fig. 5 is a schematic structural diagram of an information acquisition device according to an embodiment of the present invention;

Fig. 6 is a schematic structural diagram of a network device according to an embodiment of the present invention;

fig. 7 is a second schematic structural diagram of a network device according to an embodiment of the present invention.

Detailed Description

In order to make the technical problems, technical solutions and advantages to be solved more apparent, the following detailed description will be given with reference to the accompanying drawings and specific embodiments.

As shown in fig. 1, an embodiment of the present invention provides an information acquisition method, including:

step 101: acquiring a time sequence feature set corresponding to terminal network data in a first time period; the time sequence characteristic set comprises time sequence characteristic values of at least two dimensions.

In step 101, network data of the terminal individual may be acquired through external data (External Data Representation, xDR) based on a depth detection technology (Deep Packet Inspection, DPI) of the data packet, where the acquisition of the terminal network data specifically includes: the user plane characteristics of uplink and downlink internet protocol (Internet Protocol, IP) message quantity, uplink and downlink time delay and the like, and the control plane characteristics of the number of bearer establishment requests, the number of bearer establishment successes and the like are extracted from xDR. That is, the terminal network data includes control plane data and user plane data.

After acquiring network data of a terminal individual in a first time period, obtaining a corresponding time sequence feature set according to the terminal network data, wherein one time sequence feature set comprises time sequence feature values of at least two dimensions. Step 101 may be implemented to acquire network data of the terminal individual, and combine the network data of the terminal individual into a time sequence feature set, so as to monitor a network state of the terminal individual according to the time sequence feature set.

Step 102: acquiring a recognition result corresponding to the time sequence feature set by using an unsupervised model;

After acquiring the network data of the terminal individual, in step 102, according to the terminal network data, performing anomaly identification on the terminal network data in combination with an unsupervised learning algorithm to obtain an identification result, where the identification result may indicate that an anomaly value exists in the time sequence feature set, that is, that the terminal network state is abnormal at a moment corresponding to the anomaly value, and the identification result may also indicate that an anomaly value does not exist in the time sequence feature set, that is, that the terminal network state is not abnormal.

In the step, the operator does not need to analyze the communication protocol of the terminal, but analyzes the network data of the terminal to detect the abnormality of the terminal through an unsupervised learning algorithm, so that the monitoring and management of the operation state of the terminal can be realized.

Since the feature dimension of the acquired terminal network data is large, it is necessary to perform a dimension reduction process on the terminal network data to obtain a time sequence feature set. Specifically, terminal network data in a first time period is obtained, an initial time sequence feature value is obtained according to the terminal network data, similarity analysis and feature clustering processing are carried out on the initial time sequence feature value, similar features and features in each cluster are combined into a time sequence feature set, the terminal network data of one terminal can comprise a plurality of time sequence feature sets, each time sequence feature set comprises time sequence feature values of at least two dimensions, and each time sequence feature value of each dimension comprises time sequence feature values of at least two moments.

And carrying out similarity analysis and clustering treatment on the initial time sequence characteristic values of the terminal network data to obtain a time sequence characteristic set of the terminal as shown in the following table 1.

Table 1 timing characteristics set schematic table of terminals

As shown in table 1, the initial time sequence Feature values of the terminal network data are subjected to similarity analysis and clustering processing to obtain time sequence Feature values corresponding to three dimensions, wherein the time sequence Feature values are Feature1, feature2 and Feature3, T1, T2, T3 and T4 respectively represent four moments in a first time period, and the time sequence Feature value of one dimension is a time sequence Feature value included in Feature1 ₁ 、a ₂ 、a ₃ And a ₄ The timing characteristic value included in the timing characteristic value Feature2 of the dimension two is b ₁ 、b ₂ 、b ₃ And b ₄ The timing characteristic value included in the timing characteristic value Feature3 of the dimension three is c ₁ 、c ₂ 、c ₃ And c ₄ 。

In order to improve the accuracy of the recognition result of the unsupervised learning algorithm for carrying out abnormal recognition on the terminal network data, the embodiment of the invention marks and verifies the terminal network data by using two unsupervised models, namely the first unsupervised model and the second unsupervised model, so that the accuracy of the unsupervised algorithm for carrying out abnormal recognition on the terminal network data can be improved.

Further, the first unsupervised model is a Long short-term memory (LSTM) prediction model, and the second unsupervised model is a variable auto-encoder (VAE) recognition model.

Specifically, a first prediction error value of the time sequence feature set is obtained by using a first unsupervised model, a reconstruction error value of the time sequence feature set is obtained by using a second unsupervised model, and a recognition result is obtained according to the results (the first prediction error value and the reconstruction error value) of the two unsupervised models.

In the embodiment of the invention, the time sequence feature set is updated by means of mutual verification and interaction of an LSTM prediction model (a first unsupervised model) and a VAE identification model (a second unsupervised model). Specifically, a first prediction error value corresponding to the time sequence feature set is obtained by using an LSTM prediction model, a reconstruction error value corresponding to the time sequence feature set is obtained by using a VAE recognition model, the time sequence feature set is updated according to the first prediction error value corresponding to the time sequence feature set, the reconstruction error value and a preset reconstruction error threshold value, and the updated time sequence feature set is compared with the original time sequence feature set, so that the time sequence feature value in the time sequence feature set is possibly deleted. And then, obtaining a second prediction error value corresponding to the updated time sequence feature set by using the LSTM prediction model, and obtaining a recognition result according to a comparison result of the second prediction error value and the first prediction error value, namely, according to a comparison result of the second prediction error value and the first prediction error value, determining whether the updated time sequence feature set is abnormal compared with the original time sequence feature set, namely, indicating whether the deleted time sequence feature value corresponds to the time sequence feature value, wherein the terminal is in a network abnormal state.

Further, the obtaining the updated time sequence feature set according to the first prediction error value, the reconstruction error value and the reconstruction error threshold value includes:

Further, the updated timing feature set is compared with the original timing feature set, and the predicted outlier, that is, the "deleted timing feature value" is deleted, where the predicted outlier is obtained according to the first predicted error value, the reconstructed error value, and the preset reconstructed error threshold.

The predicted outlier may be considered as a highly probable outlier, but the determination of whether the predicted outlier is determined as an outlier is determined from the comparison result of the second predicted error value and the first predicted error value.

In this step, the abnormal predicted value is deleted, and the time sequence feature set is updated, so that the interference item in the time sequence feature set can be reduced, and the training set of the LSTM prediction model is optimized, the accuracy of the LSTM prediction model is optimized, and the prediction error is reduced according to the updated time sequence feature set.

Preferably, the obtaining, by using a first unsupervised model, a first prediction error value corresponding to the time sequence feature set includes:

training the first unsupervised model according to the training value in the time sequence feature set to obtain a time sequence prediction model;

and obtaining a first prediction error value of the test value according to the time sequence prediction model and the test value in the time sequence feature set.

The process of obtaining the first prediction error value corresponding to the time sequence feature set by using the LSTM prediction model is described in detail below.

For one time sequence Feature set, in this step, the time sequence Feature value a in the time sequence Feature value Feature1 of dimension one in the time sequence Feature set shown in table 1 is selected ₁ 、a ₂ 、a ₃ And a ₄ The above-mentioned time sequence characteristic value (a ₁ 、a ₂ 、a ₃ And a ₄ ) Splitting into a training set and a test set, wherein the training set comprises training values, the test set comprises test values, the training set is input into an LSTM prediction model for training, when a preset training end condition is met, such as that a loss function is not reduced any more, or the training reaches a certain number of iteration times, and the like, the training is stopped, a time sequence prediction model is obtained, the time sequence prediction model is used for predicting, the prediction result is compared with the test values in the test set, and a first prediction error value Err is obtained _t 。

Preferably, the ratio of the number of training values to the number of test values is 3:1, exemplary, timing characteristic value a in Feature1 ₁ 、a ₂ 、a ₃ And a ₄ Wherein a is ₁ 、a ₂ 、a ₃ For training value, a ₄ Is the test value.

Referring to fig. 2, a training set is input into an LSTM prediction model for training, and the obtained time sequence prediction model is shown in fig. 2, and in fig. 2, a solid line represents a prediction result and a dotted line represents a test value in a time sequence prediction model portion corresponding to a test set.

Preferably, the obtaining, by using a second unsupervised model, a reconstruction error value corresponding to the time sequence feature set includes:

training the second unsupervised model according to the time sequence feature set to obtain an abnormal recognition model;

and obtaining the reconstruction error value according to the anomaly identification model and the time sequence feature set.

In this step, a process of obtaining a reconstruction error value corresponding to the time series feature set by using the VAE recognition model will be described first.

For one time series Feature set, in this step, the time series Feature value a in the time series Feature value Feature1 of dimension one shown in table 1 is also selected ₁ 、a ₂ 、a ₃ And a ₄ The above-mentioned time sequence characteristic value (a ₁ 、a ₂ 、a ₃ And a ₄ ) Inputting the VAE recognition model for training, when a preset training ending condition is met, for example, the loss function is not reduced any more, or the training is stopped for a certain number of iterations, etc., namely, the training is stopped, an abnormal recognition model is obtained, and the time sequence characteristic value a can be obtained through the abnormal recognition model ₁ 、a ₂ 、a ₃ And a ₄ And respectively corresponding reconstruction error values.

Preferably, the obtaining a predicted outlier according to the first predicted error value, the reconstructed error value and the reconstructed error threshold value includes:

The process of obtaining the predicted outlier from the first predicted error value, the reconstructed error value, and the preset reconstructed error threshold is specifically described below.

If at least one time sequence feature value a in the time sequence feature set _k The corresponding reconstruction error value is larger than a preset reconstruction error threshold value T ₀ The at least one timing characteristic value a can be determined _k Predicting an outlier for a first target, i.e., predicting an outlier for the first target may be considered (a _k ) The large probability is an outlier, i.e., the timing Feature set (Feature 1) of the network data of the terminal is abnormal at the time k. Wherein the error threshold T is reconstructed ₀ May be a larger value.

And under the condition that the first preset number is M and the second preset number is N, judging M time sequence characteristic values (first target time sequence characteristic values) with the largest reconstruction error value and N time sequence characteristic values (second target time sequence characteristic values) with the largest first prediction error value, then determining whether the first target time sequence characteristic values and the second target time sequence characteristic values are overlapped, and if so, determining that the overlapped time sequence characteristic values are second target predicted abnormal values. Exemplary, if m=2, n=3, and a certain timing characteristic value a _p The corresponding reconstruction error value is the second largest, and the timing characteristic value a _p If the corresponding first prediction error value is first large, determining the time sequence characteristic value a _p Predicting an outlier for a second target, i.e., accounting for the predicted outlier (a) _p ) Is not correctly predicted or reconstructed in both unsupervised models, the second target predicted outlier (a _p ) The large probability is an outlier, i.e. the time series Feature set (Feature 1) of the network data of the terminal is abnormal at time p.

Predicting an outlier (a) of the first target _k ) And a second target predicted outlier (a _p ) As the predicted outliers.

The second target predicted outlier (a _p ) May be empty, i.e., there may be no coincidence of the first target timing characteristic value and the second target timing characteristic value, i.e., there is no second predicted outlier (a _p ) Then the predicted outliers include only the first targetPredicting outliers (a) _k )。

And deleting the predicted abnormal value from the time sequence feature set to obtain an updated time sequence feature set, correspondingly updating a test set and a training set in the time sequence feature set, training the LSTM prediction model again to obtain an updated time sequence prediction model, predicting the time sequence prediction model through the updated time sequence prediction model, and comparing the prediction result with the test value in the test set of the updated time sequence feature set to obtain a second prediction error value.

According to the embodiment of the invention, the interference items (predicted abnormal values) in the time sequence feature set are reduced by deleting the value with the large probability of abnormality obtained by the abnormality recognition model and deleting the value with the abnormality judgment of the time sequence prediction model and the abnormality recognition model, so that the training set of the time sequence prediction model can be optimized, the accuracy of the time sequence prediction model is optimized, and the prediction error is reduced.

Preferably, the obtaining the identification result according to the comparison result of the first prediction error value and the second prediction error value includes:

determining that an abnormal value exists in the time sequence feature set of the identification result under the condition that the second prediction error value is smaller than the first prediction error value;

the outlier is the predicted outlier.

That is, when judging whether the predicted outlier is an outlier indicating abnormality of the terminal network data, the predicted outlier of the previous round is verified and determined by the prediction error change condition of the time sequence prediction model of the present round. Specifically, if the new prediction error value (second prediction error model) corresponding to the updated timing feature set is lower than the prediction error value (first prediction error value) corresponding to the timing feature set of the previous round, it is explained that the deleted timing feature value (prediction outlier) does indeed have an abnormal effect on the data distribution in the timing feature set, that is, the prediction outlier is determined as an outlier, and conversely, if the new prediction error value (second prediction error model) corresponding to the updated timing feature set is not lower than the prediction error value (first prediction error value) corresponding to the timing feature set of the previous round, it is explained that the deleted timing feature value (prediction outlier) does not have an abnormal effect on the data distribution in the timing feature set, and the prediction outlier cannot be determined as an outlier.

Further, after the obtaining the identification result according to the comparison result of the first prediction error value and the second prediction error value, the method further includes:

That is, when determining whether the predicted abnormal value is an abnormal value indicating that the terminal network data is abnormal according to the first predicted error value and the second predicted error value, adjusting the reconstruction error threshold according to the comparison result of the first predicted error value and the second predicted error value to obtain an updated reconstruction error threshold, and repeating the following steps: updating the time sequence feature set according to the first prediction error value, the reconstruction error value and the updated reconstruction error threshold value, and obtaining an updated time sequence feature set, namely selecting the reconstruction error value corresponding to the updated time sequence feature set as a first target prediction outlier, selecting a second target prediction outlier overlapped with the N time sequence feature values (first target time sequence feature values) with the largest first prediction error value and the M time sequence feature values (second target time sequence feature values) with the largest reconstruction error value, taking the first target prediction outlier and the second target prediction outlier as prediction outliers, and deleting the prediction outlier from the updated time sequence feature set. And after each round of circulation, determining whether the predicted outlier of the previous round is an outlier indicating the abnormality of the terminal network data according to a comparison result of the second predicted error value corresponding to the updated time sequence feature set of the next round and the first predicted error value corresponding to the time sequence feature set of the previous round.

When the first prediction error value is small enough (the first prediction error value is smaller than the prediction error threshold value), it can be considered that the time sequence prediction model can accurately predict, and it is indicated that the training set and the test set in the updated time sequence feature set have similar and undisturbed data distribution, i.e. all abnormal values are deleted, training can be stopped, and the finally obtained updated time sequence feature set is stopped from having abnormal values, i.e. the terminal is in normal state at the moment corresponding to the time sequence feature value in the final time sequence feature set.

Preferably, the updating the reconstruction error threshold according to the comparison result of the first prediction error value and the second prediction error value includes:

That is, according to the comparison result of the first prediction error value and the second prediction error value, the process of adjusting the reconstruction error threshold is:

If the new prediction error value (second prediction error model) corresponding to the updated time sequence feature set is lower than the prediction error value (first prediction error value) corresponding to the time sequence feature set of the previous round, the deleted time sequence feature value (prediction abnormal value) really generates abnormal influence on the data distribution in the time sequence feature set, and the reconstruction error threshold value can be reduced (the reconstruction error threshold value is reduced by a first threshold value); if the new prediction error value (second prediction error model) corresponding to the updated time sequence feature set is not lower than the prediction error value (first prediction error value) corresponding to the time sequence feature set of the previous round, the deleted time sequence feature value (prediction abnormal value) does not affect the data distribution in the time sequence feature set abnormally, and the reconstruction error threshold is increased (the reconstruction error threshold is increased by a second threshold).

The first threshold value and the second threshold value may be the same or different.

According to the embodiment of the invention, the reconstruction error threshold value of the abnormal recognition model is dynamically adjusted according to the change condition of the prediction error of the time sequence prediction model prediction time sequence feature set, so that a new prediction abnormal value is obtained.

The flow of the information acquisition method is specifically described below with reference to fig. 3.

Step 1, training an LSTM prediction model through a time sequence feature set to obtain a trained time sequence prediction model, and obtaining a first prediction error value corresponding to the time sequence feature set by using the trained time sequence prediction model; step 2: training a VAE recognition model through the time sequence feature set to obtain a trained abnormal recognition model, and obtaining a reconstruction error value corresponding to the time sequence feature set by using the trained abnormal recognition model; step 3: selecting a first target prediction abnormal value with a reconstruction error value larger than a reconstruction error threshold value and M first target time sequence characteristic values with the maximum reconstruction error value from the time sequence characteristic set; step 4: selecting N second target time sequence characteristic values with the largest first prediction error value from the time sequence characteristic set; step 5: comparing the M first target time sequence characteristic values with the N second target time sequence characteristic values, and selecting the coincident time sequence characteristic values as second predicted abnormal values; step 6: deleting the first predicted abnormal value and the second predicted abnormal value from the time sequence feature set to obtain an updated time sequence feature set, and retraining the LSTM prediction model by using the updated time sequence feature set to obtain a second predicted error value; step 7: obtaining a comparison result of the second prediction error value and the first prediction error value, namely judging whether the second prediction error value is increased or decreased compared with the first prediction error value; step 8: according to the comparison result, a reconstruction error threshold value is adjusted to obtain an updated reconstruction error threshold value, and the first prediction abnormal value and the second prediction abnormal value are determined to be abnormal values indicating abnormal states of the terminal network under the condition that the second prediction error value is lower than the first prediction error value; step 9: and (3) repeating the steps (3), 4 and 5), obtaining a first predicted abnormal value and a second predicted abnormal value corresponding to the updated time sequence feature set, and repeating the steps (6), 7 and 8 until the first predicted error value is smaller than a preset error threshold.

According to the embodiment of the invention, the accuracy of the time sequence prediction model is optimized by utilizing the result of the abnormality recognition model through the mutual verification and action modes of the two unsupervised models of the time sequence prediction model and the abnormality recognition model, the reconstruction error threshold value of the abnormality recognition model is determined by utilizing the result of the time sequence prediction model, and the abnormal value is obtained according to the common result of the two models, namely, the abnormal state of the time sequence characteristic value of the terminal at a certain moment or at certain moments is indicated, namely, the network state of the terminal at a certain moment or at certain moments is abnormal.

Further, after the identifying result is obtained according to the time sequence feature set by using the first unsupervised model and the second unsupervised model, the method further includes:

It should be noted that, considering the time variation, the samples of the terminal network data are accumulated accordingly, and then the recognition result of the time sequence feature set corresponding to the dynamic terminal network data needs to be considered.

In this embodiment, the first time period is updated according to the preset life cycle (preset duration) and the current time, that is, the data (data with too long history) exceeding the life cycle in the time sequence feature set corresponding to the first time period is deleted, and the data of the latest time is added, where the data of the latest time is determined according to the current time, and through the steps above, the first time period and the time sequence feature set corresponding to the first time period are updated.

The following specifically describes a process of acquiring the identification result of the time sequence feature set corresponding to the dynamic terminal network data with reference to fig. 4.

The contents of steps 1 to 5 are the same as those of steps 1 to 5 in fig. 3, and are not described here again, and step 6: deleting a first predicted abnormal value and a second predicted abnormal value in the time sequence feature set, deleting data exceeding a life cycle (data with too long history), adding data at the latest moment to obtain an updated time sequence feature set, and retraining the LSTM prediction model by using the updated time sequence feature set to obtain a second predicted error value; step 7: obtaining a comparison result of the second prediction error value and the first prediction error value, namely judging whether the second prediction error value is increased or decreased compared with the first prediction error value; step 8: training the VAE recognition model again by utilizing the updated time sequence feature set obtained in the step 6 according to the comparison result, adjusting a reconstruction error threshold value to obtain an updated reconstruction error threshold value, and determining the first prediction abnormal value and the second prediction abnormal value as abnormal values indicating abnormal states of the terminal network under the condition that the second prediction error value is lower than the first prediction error value; step 9: and (3) repeating the steps (3), 4 and 5), obtaining a first predicted abnormal value and a second predicted abnormal value corresponding to the updated time sequence feature set, and repeating the steps (6), 7 and 8 until the first predicted error value is smaller than a preset error threshold.

As shown in fig. 5, an embodiment of the present invention further provides an information obtaining apparatus, including:

a first obtaining module 501, configured to obtain a time sequence feature set corresponding to terminal network data in a first period; the time sequence characteristic set comprises time sequence characteristic values of at least two dimensions;

a second obtaining module 502, configured to obtain, using an unsupervised model, a recognition result corresponding to the time sequence feature set;

According to the embodiment of the invention, the acquisition of the network data of the terminal individual can be realized by acquiring the time sequence feature set corresponding to the terminal network data in the first time period, wherein the time sequence feature set comprises at least two time sequence feature values; acquiring a recognition result corresponding to the time sequence feature set by using an unsupervised model, wherein the recognition result indicates that an abnormal value exists in the time sequence feature set or indicates that an abnormal value does not exist in the time sequence feature set; the abnormal value is used for indicating that the terminal is in a network abnormal state, namely, whether the network state of the terminal individual is abnormal or not can be identified by analyzing the network data through an unsupervised model, and further, the network state of the network terminal individual is monitored.

Optionally, the first obtaining module 501 includes:

Optionally, the second obtaining module 502 includes:

Optionally, the second processing unit is specifically configured to:

The outlier is the predicted outlier.

Optionally, the second processing unit is further specifically configured to:

Optionally, the apparatus further comprises:

It should be noted that, the information acquisition device provided in the embodiment of the present invention is a device capable of executing the above-mentioned information acquisition method, and all embodiments of the above-mentioned information acquisition method are applicable to the device, and can achieve the same or similar technical effects.

As shown in fig. 6, the embodiment of the present invention further provides a network device, including a processor 601 and a transceiver 602, wherein:

the processor 602 is configured to obtain a time sequence feature set corresponding to terminal network data in a first period; the time sequence characteristic set comprises time sequence characteristic values of at least two dimensions;

Optionally, the processor 602 is specifically configured to:

and acquiring a second prediction error value corresponding to the updated time sequence feature set by using the first unsupervised model.

Optionally, the processor 602 is specifically configured to:

the outlier is the predicted outlier.

Optionally, after the processor obtains the identification result according to the comparison result of the first prediction error value and the second prediction error value, the processor 602 is further specifically configured to:

Optionally, the processor 602 is further specifically configured to:

It should be noted that, if the network device provided in the embodiment of the present invention is a network device capable of executing the above-mentioned information acquisition method, all embodiments of the above-mentioned information acquisition method are applicable to the network device, and the same or similar technical effects can be achieved.

As shown in fig. 7, an embodiment of the present invention further provides a network device, including: a processor 701; and a memory 703 connected to the processor 701 through a bus interface 702, the memory 703 being for storing programs and data used by the processor 701 in executing operations, the processor 701 calling and executing the programs and data stored in the memory 703.

Wherein the transceiver 704 is connected to a bus interface 702 for receiving and transmitting data under the control of the processor 701, specifically, the processor 701 is configured to read a program in the memory 703, and perform the following procedures:

Optionally, the processor 701 is specifically configured to:

the outlier is the predicted outlier.

Optionally, after the processor 701 obtains the identification result according to the comparison result of the first prediction error value and the second prediction error value, the processor 701 is further specifically configured to:

Optionally, the processor 701 is further specifically configured to:

Optionally, after the processor 701 obtains the recognition result corresponding to the time sequence feature set by using an unsupervised model, the processor 701 is further configured to:

Where in FIG. 7, a bus architecture may comprise any number of interconnected buses and bridges, and in particular one or more processors represented by the processor 701 and various circuits of the memory represented by the memory 703, are linked together. The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, power management circuits, etc., which are well known in the art and, therefore, will not be described further herein. The bus interface provides an interface. The transceiver 704 may be a number of elements, i.e. include a transmitter and a receiver, providing a means for communicating with various other apparatus over a transmission medium. The processor 701 is responsible for managing the bus architecture and general processing, and the memory 703 may store data used by the processor 701 in performing operations.

In addition, a specific embodiment of the present invention also provides a computer-readable storage medium having stored thereon a computer program, wherein the program when executed by a processor implements the steps in the information acquisition method as described in any one of the above.

Specifically, the computer readable storage medium is applied to the above terminal, and when applied to the terminal, the execution steps in the method for reporting the corresponding smoke alarm are described in detail above, and are not repeated herein.

In the several embodiments provided in this application, it should be understood that the disclosed methods and apparatus may be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the units is merely a logical function division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

In addition, each functional unit in the embodiments of the present invention may be integrated in one processing unit, or each unit may be physically included separately, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in hardware plus software functional units.

The integrated units implemented in the form of software functional units described above may be stored in a computer readable storage medium. The software functional unit is stored in a storage medium, and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform part of the steps of the transceiving method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (Random Access Memory, RAM), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

While the foregoing is directed to the preferred embodiments of the present invention, it will be appreciated by those skilled in the art that various modifications and changes can be made without departing from the principles of the present invention, and such modifications and changes should also be considered as being within the scope of the present invention.

Claims

1. An information acquisition method, characterized by comprising:

2. The method for acquiring information according to claim 1, wherein the acquiring the timing characteristic set corresponding to the terminal network data in the first period of time includes:

3. The method of claim 1, wherein the acquiring, using the unsupervised model, the recognition result corresponding to the time sequence feature set includes:

4. The information acquisition method according to claim 3, wherein the obtaining the identification result according to the first prediction error value and the reconstruction error value includes:

5. The method according to claim 4, wherein updating the timing feature set according to the first prediction error value, the reconstruction error value, and the reconstruction error threshold value, to obtain the updated timing feature set, comprises:

6. The method according to claim 4, wherein obtaining the predicted outlier from the first predicted error value, the reconstructed error value, and the reconstructed error threshold value comprises:

7. The information acquisition method according to claim 6, wherein the acquiring the identification result based on the comparison result of the first prediction error value and the second prediction error value includes:

the outlier is the predicted outlier.

8. The information acquisition method according to claim 4, characterized in that, after the acquisition of the identification result from the comparison result of the first prediction error value and the second prediction error value, the method further comprises:

9. The information acquisition method according to claim 8, wherein the updating the reconstruction error threshold value based on a comparison result of the first prediction error value and the second prediction error value includes:

10. The information acquisition method according to claim 1, characterized by further comprising, after the acquisition of the recognition result corresponding to the time series feature set using an unsupervised model:

11. An information acquisition apparatus, characterized by comprising:

12. A network device comprising a processor and a transceiver, characterized by:

13. A network device comprising a memory, a processor, and a program stored on the memory and executable on the processor; the information acquisition method according to any one of claims 1 to 10, characterized in that the processor executes the program.

14. A readable storage medium, characterized in that the readable storage medium has stored thereon a program which, when executed by a processor, realizes the steps in the information acquisition method according to any one of claims 1 to 10.