CN-122027446-A - Air-sea cross-domain network state intelligent sensing method combining TWAMP LIGHT and TELEMETRY

Abstract

The invention discloses an intelligent sensing method for the state of an air-sea cross-domain network combining TWAMP LIGHT and TELEMETRY, which belongs to the technical field of network communication and comprises the steps of constructing a service data packet by an intelligent sensing platform, configuring TWAMP LIGHT to detect session to acquire end-to-end network performance indexes, embedding telemetry metadata through INT functions, constructing a dynamic health baseline based on bidirectional time delay data, combining Z-score method anomaly detection, automatically triggering a diagnosis process, executing double-layer joint screening based on timestamp and flow path matching, extracting telemetry data subsets from original telemetry data sets, extracting statistical features and trend features, splicing feature vectors to input the feature vectors into a pre-trained GBDT model, realizing automatic classification and positioning of fault root causes, and generating an operable alarm. The invention realizes low-overhead abnormal triggering, depth-based visual and intelligent root cause positioning as required, solves the problems of active detection of 'black box', remote measurement data storm and insufficient intelligent traditional diagnosis, and is suitable for high-efficiency operation and maintenance of an air-sea cross-domain network.

Inventors

• SHANG ZHIGANG
• WEN JIAPENG
• YANG JING
• LI MO

Assignees

• 哈尔滨工程大学三亚南海创新发展基地

Dates

Publication Date

20260512

Application Date

20260413

Claims (6)

1. 1. An intelligent sensing method for the state of a sea-sky cross-domain network combining TWAMP LIGHT and TELEMETRY is characterized by comprising the following steps: Constructing an air-sea cross-domain communication scene, wherein the scene comprises an intelligent sensing platform, a detection endpoint and a telemetry node, wherein the intelligent sensing platform is deployed in a land network operation and maintenance center, the detection endpoint comprises a shipborne router and a land data center server which are positioned on a ship, and the telemetry node comprises a satellite network gateway and a ground station router which are deployed in a satellite ground station; Step S1, an intelligent perception platform constructs a service data packet, and is configured TWAMP LIGHT to detect a session to obtain an end-to-end network performance index, wherein telemetry metadata is embedded in the service data packet by a telemetry node through an INT function and is converged with the service data packet to form an original telemetry data set; Step S2, based on TWAMP LIGHT bidirectional time delay data measured by a detection session, a dynamic health baseline is established in a sliding window mode, the bidirectional time delay data is subjected to anomaly detection based on a Z-score method in a macroscopic KPI anomaly detection method, a diagnosis process is automatically triggered after anomaly, and corresponding anomaly event information is packaged; step S3, using abnormal event For high value beacons, a dual layer joint screening method based on timestamp and flow path matching is performed to accurately extract telemetry data subsets highly correlated to an abnormal event from the original telemetry data set ; Will be an abnormal event As a high value beacon when After the abnormal trigger signal is generated, starting an automatic trigger diagnosis flow: constructing a double-layer joint screening method based on time stamp and flow path matching based on abnormal event information, performing joint inquiry in an original telemetry data set, executing double screening of time stamp and flow path matching, and carrying out double screening on the original telemetry data set Searching and screening out telemetry data subset related to abnormal event The calculation formula is as follows: ; Wherein, the The traffic flow is represented by a sequence of data, A timestamp indicating the departure of the telemetry metadata from the on-board router, Representing traffic flows Is a complete network path information of the network; Representing probe flow Is provided with a network path information of (a), A time stamp indicating the occurrence of an abnormal event, Representing the time window offset before the occurrence of the abnormal event, Representing the time window offset after the occurrence of the abnormal event; S4, converting the telemetry data subset into feature vectors And inputting the pre-trained GBDT model, realizing automatic classification of the fault root cause, and generating an operable warning on an operation and maintenance interface.
2. 2. The method for intelligently sensing the state of the open sea cross-domain network according to claim 1 by combining TWAMP LIGHT and TELEMETRY, wherein in the step S1, the intelligent sensing platform constructs a service data packet, configures TWAMP LIGHT to detect a session to obtain an end-to-end network performance index, specifically as follows: The intelligent perception platform collects the relevant data of the air-sea cross-domain and constructs a service data packet, and configures and starts TWAMP LIGHT detection sessions between the shipborne router and the land data center server through a network management protocol, wherein the TWAMP LIGHT detection sessions continuously transmit and detect between detection endpoints at the frequency of transmitting one UDP detection packet per second and are used for continuously detecting end-to-end network performance indexes, and the end-to-end network performance indexes comprise bidirectional time delay data, jitter and packet loss rate.
3. 3. The method for intelligent sensing of the state of the open sea cross-domain network according to claim 1, wherein in step S1, the telemetry node embeds telemetry metadata in the service data packet through a hop-by-hop state embedding function, and the telemetry metadata is converged with the service data packet to form an original telemetry data set, specifically as follows: The intelligent sensing platform starts INT function on each telemetry node to realize hop-by-hop state embedding function, namely when a service data packet flows through each telemetry node, the telemetry node automatically embeds telemetry metadata in the message header of the service data packet, and the telemetry metadata is converged along with the service data packet to form an original telemetry data set The telemetry metadata includes an ID, an entry timestamp, an exit timestamp, a queue occupancy depth, and a processing delay 。
4. 4. The method for intelligent sensing of the state of the open sea cross-domain network by combining TWAMP LIGHT and TELEMETRY according to claim 1, wherein the step S2 is specifically as follows: firstly, a sliding window mode is adopted to construct a dynamic health baseline for the obtained TWAMP LIGHT detection session bidirectional time delay data, and a sliding time window is set Calculating sliding time window in real time Moving average of internal bi-directional delay data And standard deviation Based on And The formed dynamic change interval is used as a dynamic health baseline of the network; Next, the exception event is completed by the Z-score method in the macroscopic KPI exception detection method Is to generate an adaptive threshold based on a dynamic health baseline When at a certain moment Is of the two-way delay value of (2) When the dynamic health baseline is deviated and the adaptive threshold is exceeded, the abnormal event is judged The calculation formula of the Z-score method is as follows: ; Wherein, the And Respectively represent past time windows The moving average and standard deviation of the internal bi-directional delay, The sensitivity coefficient is represented by a value representing the sensitivity, Representing the current The absolute deviation from the historical mean value, Representing other conditions; When (when) When the diagnosis process is triggered automatically; And finally, packaging the abnormal event information, wherein the abnormal event information comprises an abnormal time stamp, a bidirectional time delay value and quintuple information of TWAMP LIGHT detection sessions triggering the abnormality of the abnormal event information.
5. 5. The method for intelligently sensing the state of an open sea cross-domain network by combining TWAMP LIGHT and TELEMETRY according to claim 1, wherein the dual-layer joint screening method includes a time stamp condition and a flow path matching condition, specifically including the following steps: ① Time stamp condition Based on the abnormal time stamp, defining an abnormal time neighborhood, screening telemetry data in an original telemetry data set of a period before and after the occurrence of the abnormality, wherein a specific calculation formula is as follows: ; ② Flow path matching condition Screening out telemetry data paths with paths highly coincident by taking paths of abnormal TWAMP LIGHT detection sessions as references, wherein the telemetry data paths are specifically as follows: Extracting traffic from telemetry metadata Complete network path information of (a) Re-extracting abnormal TWAMP LIGHT probe session probe flow Network path information of (a) Will (i) be And (3) with In contrast, the paths are required to be highly coincident.
6. 6. The method for intelligent sensing of the state of the open sea cross-domain network according to claim 1, wherein the step S4 specifically comprises: For telemetry data subsets According to telemetry node Ordering the time stamps, and in a time window corresponding to the abnormal event, carrying out first order Each telemetry node Constructing queue depth sequences Processing time delay sequences Node residence time delay sequence Wherein Based on the following 、 And Extraction of the first The calculation formula of the node characteristic vectors of the telemetry nodes is as follows: ; ; ; ; ; ; Wherein, the Representing nodes within a time window Is used for the number of samples of (a), Represent the first Individual task entry nodes Is used for the time stamp of (a), Represent the first Individual task departure node Is a time stamp of (2); Finally, according to the sequence of the telemetry nodes on the service flow path, the node characteristic vector corresponding to each telemetry node is obtained Sequentially splicing to obtain feature vectors of the input GBDT model ; Then, adopting GBDT model based on gradient lifting decision tree to make depth analysis and adopting feature vector Input to a pre-trained GBDT model And outputs the root cause of the fault The calculation formula of the classification prediction result is expressed as follows: ; Wherein, the Representing a set of all predefined fault categories, Representing characteristics Corresponding fault class Is a function of the probability of (1), Representing the selection of the category corresponding to the maximum probability value as the prediction of the final fault root cause; GBDT model output fault root cause The classification prediction results of the intelligent sensing platform are synchronously accompanied with specific positioning information, and by training on a large amount of historical fault data, the intelligent sensing platform finally generates a clear and operable warning on an operation and maintenance interface.

Description

Air-sea cross-domain network state intelligent sensing method combining TWAMP LIGHT and TELEMETRY Technical Field The invention belongs to the technical field of network communication, and particularly relates to an intelligent sensing method for a state of an air-sea cross-domain network by combining TWAMP LIGHT and TELEMETRY. Background The air-sea cross-domain network is used as a key information infrastructure for connecting air, ground and ocean platforms, has the remarkable characteristics of extension during link transmission, dynamic change of topological structure, coexistence of heterogeneous devices and the like, and makes network state monitoring and fault rapid positioning face serious challenges. Currently, there are a number of technical bottlenecks mainly existing in performance monitoring and diagnostics for such networks, specifically in the following aspects: (1) The network performance measurement technology based on active detection is represented by a bidirectional active measurement protocol lightweight (TWAMP LIGHT), and the measurement of macroscopic performance indexes such as end-to-end network delay, jitter, packet loss rate and the like is realized by periodically sending detection messages among network key nodes. The core problem with this technique is that the "black box" measurement, i.e. can only identify if there is performance degradation in the end-to-end path, and cannot accurately locate the specific network device or link segment where the failure occurred. If the positioning accuracy is to be improved by adding the probing session, significant additional overhead is introduced in the limited air-sea link bandwidth, and the method is not feasible in actual deployment. (2) The technology is characterized by taking In-band network telemetry (In-band Network Telemetry, INT) as a representative, and by directly embedding microscopic state information (such as queue waiting time of data packets, occupancy rate of an outlet port and the like) In network equipment into the passing service data packets, hop-by-hop visibility of a data forwarding path is provided for network operation staff. However, while this technology is capable of providing rich device internal state data, its major challenge is the "data storm" problem caused by the enormous size of telemetry data. Because each service data packet may carry telemetry information, the amount of data generated by the service data packet is extremely large, and a huge pressure is built on the data acquisition, storage and real-time analysis system. Without explicit fault event guidance, it is extremely difficult to efficiently extract useful information from massive telemetry data and perform correlation analysis, and the lack of an effective, low-cost triggering and screening mechanism for this technology also makes it difficult to continue to apply efficiently in practical operation and maintenance. (3) The traditional fault diagnosis and positioning method is that the current network fault diagnosis is largely dependent on the manual experience judgment of a network manager or an alarm system based on a static threshold value. For example, an alarm is triggered when the device CPU utilization exceeds 80%. The method has the defects of response lag and insufficient intelligent level when dealing with the complex dynamic environment of the air-sea cross-domain network. Manual obstacle removal efficiency is low, real-time requirements of services cannot be met, a static threshold value lacks adaptability to dynamic changes of environments, dynamic changes of network loads are difficult to adapt, a large number of false positives and false negatives are extremely easy to cause, and accurate and rapid positioning of performance degradation root causes cannot be achieved fundamentally. In summary, the prior art scheme has obvious defects in an air-sea cross-domain network environment that the active detection technology is difficult to realize fine-grained positioning, the in-band telemetry technology faces data overload pressure, and the traditional diagnosis method has the defects of dependence on manpower, low intelligent degree and the like. Therefore, a new network state sensing and fault location method capable of combining macroscopic detection and microscopic visibility and introducing an intelligent analysis means is needed to realize accurate and active state sensing and fault cause location of the air-sea cross-domain network in a low-cost manner. Disclosure of Invention Aiming at the defects existing in the background technology, the invention aims to provide an intelligent sensing method for the state of the air-sea cross-domain network by combining TWAMP LIGHT and TELEMETRY, which is characterized in that TWAMP LIGHT is used as a whistle with abnormal macroscopic performance and a trigger of a diagnosis flow, the accurate screening of telemetry data is realized through event driving, and the automatic and intelli