KR20250041463A - A system for predicting network load and detecting failures based on artificial intelligence and method using the same - Google Patents

Abstract

The present invention relates to a system and method for network load prediction and fault detection based on artificial intelligence, and more particularly, to a system for network load prediction and fault detection based on artificial intelligence and an operating method thereof, comprising: a collection server for collecting network traffic generated from virtualized resources in a hybrid cloud network, a big data server for storing the collected network traffic and analysis results in a database, a control server for providing the network traffic collection results and network status information, and a learning server for predicting network load and classifying system and service abnormalities and faults through machine learning. The present invention relates to a traffic collection device of a virtualized machine and a traffic collection method for operating the same.

Description

{A system for predicting network load and detecting failures based on artificial intelligence and method using the same}

The present invention relates to a system for network load prediction and fault detection based on artificial intelligence and an operating method thereof, and more specifically, to detecting abnormalities and faults in systems and services by predicting the load of network traffic generated in a cloud computing environment in advance using an artificial intelligence model.

Recently, with the advancement of ICT technology, the existing computing environment that depended on the independent hardware performance of terminals is evolving into cloud computing, which provides services by utilizing all computing resources on the network.

This realization of cloud computing is being carried out in various service areas and has many problems to be solved, such as data protection, resource management, availability assurance, and privacy protection.

In particular, as cloud computing, which utilizes virtual machines in a virtualized environment, rapidly spreads, the trend of converting ICT resources to the cloud or using cloud service providers' services is increasing, and the traffic used for cloud services is increasing exponentially.

In this way, increased traffic can cause service performance degradation or quality issues, which can lead to service delays and reduced service availability, which in turn leads to decreased productivity and sales.

Therefore, the cause of the performance degradation must be quickly identified and a response must be made as quickly as possible. However, traffic collection and analysis are becoming more important than ever to identify the cause of this performance degradation.

Figure 1 is a conceptual diagram of a cloud control platform. As shown in Figure 1, in order to predict network load and detect abnormalities and failures in the past, network traffic of various cloud configurations is collected and monitored within the cloud control platform, and when a predefined threshold is reached, i.e., a threshold set directly by the user based on past collection statistics is reached, the network is controlled and managed by system rather than being service-centric.

However, there is a large difference in the operating cost of the system depending on these preset thresholds.

For example, if the threshold is set too low, there is a problem that the cost of operating the system increases due to frequent system status checks by the service manager for notifications that occur even under low load, which requires additional operating personnel and systems.

On the other hand, if the threshold value is set too high, it has the disadvantage of delaying the confirmation of system abnormalities due to the system resource slack and making it difficult to guarantee service quality. In addition, if the application service changes or the network environment of the service platform changes, a lot of effort and time must be invested in testing and verification work to reset the threshold.

Therefore, a series of automated methods are needed that can adaptively predict appropriate load thresholds even in the changing environment of the current network and guarantee service quality without threshold adjustment by users.

In this regard, Patent Document 1 relates to a method for learning an artificial intelligence model for predicting IT service failures, a server, and a computer program that enable more accurate prediction of failures by determining the possibility of a failure in an IT service using two failure prediction models learned using indicator information including various indicators of the IT service, and only discloses an algorithm for extracting a future critical load value based on indicator information of the IT service to determine the possibility of a service failure, and does not disclose system operation involving specific control functions.

Korean Patent Publication No. 10-2023-0063413

In order to solve the above problems, the present invention introduces an artificial intelligence technique based on a deep neural network to actively predict the network load after a certain period of time, thereby providing a function to notify of system abnormality/failure status due to an increase in service load, and a function to notify of service abnormality/failure status based on the inspection results of a service manager, thereby providing an intelligent load prediction and abnormality/failure detection method.

In order to achieve the above purpose, the system for AI-based network load prediction and fault detection according to the present invention comprises a collection server which collects network traffic and network metrics generated from a virtual machine in a hybrid cloud network, a big data server which stores the network traffic collected from the collection server and the analysis results of the network traffic in a database, a control server which provides the network traffic collection results and network status information to a service manager, and a learning server which predicts the network load through AI-based machine learning using the network traffic collected from the big data server, and predicts and classifies system and service abnormalities and faults through the same.

In addition, in a system for network load prediction and fault detection based on artificial intelligence according to the present invention, the network traffic is netflow, and the collection server includes a netflow collection unit that collects at least one or more of a source IP, a destination IP, a port number, an IP protocol type, a service type, and an AS number included in the netflow, a netflow analysis unit that analyzes at least one or more of an IP that generates excessive traffic, a PC infected with a virus, or a traffic type using the netflow, and a netflow storage unit that stores the netflow collected by the netflow collection unit and the result analyzed by the netflow analysis unit in a database.

In addition, in the system for artificial intelligence-based network load prediction and fault detection according to the present invention, the collection server is characterized in that it further includes an API manager that collects network traffic generated from a legacy server in a hybrid cloud network, a private cloud based on Openstack, and a virtualized machine of a public cloud through an API.

In addition, in a system for network load prediction and fault detection based on artificial intelligence according to the present invention, the control server is characterized by including an intelligent load prediction unit that predicts network load for a certain period of time, a system abnormality/failure detection unit that predicts network abnormality/failure status using the results of the load prediction, and a service abnormality/failure classification unit that classifies the expected service status through the abnormality/failure status.

In addition, in a system for artificial intelligence-based network load prediction and fault detection according to the present invention, the learning server is characterized by including a load prediction learning unit that predicts a load generated from the network traffic, and a service abnormality/failure learning unit that classifies service abnormalities/failures due to abnormal operation of the network system after a predetermined period of time using the predicted load.

In addition, in a system for network load prediction and fault detection based on artificial intelligence according to the present invention, the load prediction learning unit is characterized by including an artificial intelligence model based on a deep neural network including an input layer, a hidden layer, and an output layer, and an LSTM model that uses the result of the output layer as an input.

In addition, in the system for artificial intelligence-based network load prediction and fault detection according to the present invention, the input layer is composed of seven nodes, and each input node is characterized in that day-of-the-week information, hourly information, minute-by-minute information, input flow rate, input packet rate, and input byte count are input.

In addition, in a system for network load prediction and fault detection based on artificial intelligence according to the present invention, a service anomaly/failure learning unit is composed of a two-stage deep neural network-based artificial intelligence model, wherein the deep neural network-based artificial intelligence model of the first stage includes an input layer, a hidden layer, and an output layer that receives status information from one of a plurality of systems, and the deep neural network-based artificial intelligence model of the second stage includes an input layer, a hidden layer, and an output layer that inputs the result of the output layer of the first stage.

In addition, in the system for network load prediction and fault detection based on artificial intelligence according to the present invention, the input layer of the artificial intelligence model based on a deep neural network in the first stage is characterized by being composed of three input nodes into which the number of system input bytes, the number of system output bytes, and the status information of the system are input.

In addition, the method for artificial intelligence-based network load prediction and fault detection according to the present invention comprises a first step of collecting netflows from multiple virtual machines in a hybrid cloud network, a second step of analyzing the collected netflows to classify network traffic information and status information and storing them in a database, a third step of predicting network load from the traffic information, a fourth step of detecting system abnormalities and faults from the predicted load, and It consists of the fifth step of classifying network service abnormalities and failures based on the status of the detected system. Steps 3 and 5 are characterized by being performed by artificial intelligence models through machine learning.

In addition, in the method for artificial intelligence-based network load prediction and fault detection according to the present invention, after the fifth step, the method further includes a step of notifying a service manager of the results of comparison with the abnormality/failure situations of systems and services that occurred in the past as an alarm.

As described above, the system and operating method for artificial intelligence-based network load prediction and fault detection have the advantage of helping to add resources or remove unnecessary resources to satisfy users' service quality requirements.

In addition, the system and operating method for artificial intelligence-based network load prediction and fault detection have the advantage of being able to be utilized to detect a decrease/increase in load due to a system fault, enabling a service provider to respond quickly.

In addition, the system and operating method for network load prediction and fault detection based on artificial intelligence have the advantage of being able to classify service abnormalities and faults through artificial intelligence-based machine learning and promptly notify service providers in case similar situations occur in the future, thereby enabling the provision of high-quality services and stable operation of the system at low cost.

Figure 1 is a conceptual diagram of a conventional network load prediction and anomaly/fault detection system.
FIG. 2 is a drawing showing a basic concept of a hybrid cloud network based on SD-WAN according to one embodiment of the present invention.
FIG. 3 is a diagram showing the basic configuration of a system for artificial intelligence-based network load prediction and fault detection according to one embodiment of the present invention.
FIG. 4 is a drawing showing a connection configuration and functional block diagram of a collection server according to one embodiment of the present invention.
FIG. 5 is a drawing showing a functional block diagram of a control server according to an embodiment of the present invention.
FIG. 6 is a drawing showing a functional block diagram of an intelligent load prediction unit according to an embodiment of the present invention.
FIG. 7 is a drawing showing a functional block diagram of a service abnormality/failure classification unit according to one embodiment of the present invention.
Figure 8 is a drawing showing a functional block diagram of a learning server according to one embodiment of the present invention.
FIG. 9 is a diagram showing an artificial intelligence model structure of a load prediction model according to an embodiment of the present invention.
FIG. 10 is a diagram showing the artificial intelligence model structure of a service abnormality/failure classification model according to one embodiment of the present invention.
FIG. 11 is a flowchart for explaining an operation for artificial intelligence-based network load prediction and fault detection according to one embodiment of the present invention.

Hereinafter, with reference to the attached drawings, embodiments of the present invention will be described in detail so that those with ordinary skill in the art can easily implement the present invention. However, when describing the operating principles of preferred embodiments of the present invention in detail, if it is determined that a specific description of a related known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted.

Also, the same drawing symbols are used for parts that have similar functions and actions throughout the drawings. Throughout the specification, when a part is said to be connected to another part, this includes not only cases where it is directly connected, but also cases where it is indirectly connected with another function in between. Also, including a certain component does not mean excluding other components unless specifically stated otherwise, but rather means that other components can be included.

Figure 2 is a diagram illustrating the basic concept of an SD-WAN-based hybrid cloud network.

Referring to Figure 2, a hybrid cloud network based on SD-WAN (Software-Defined Wide Area Network) is a network architecture that combines both hybrid cloud and SD-WAN technologies, and provides connectivity, management, and optimization for network infrastructure spanning both private and public cloud environments using SD-WAN technologies.

Here, SD-WAN is a virtualized or appliance-based software that uses centralized policy control and management to seamlessly, securely and efficiently route traffic between remote locations over traditional branch router connections, while virtualization separates networking functions and control functions from physical hardware devices.

As illustrated in Figure 2, various network traffics occurring in private clouds, public clouds, and legacy networks are typically collected in batches through an intelligent cloud control platform, and the protocol stack that constitutes the cloud network can be controlled again through analysis of the collected information.

The present invention is characterized by an SD-WAN-based intelligent hybrid cloud network control platform that collects and stores infrastructure (networking, computing, etc.) resources (NetFlow, syslog, SNMP, etc.) of an SD-WAN-based hybrid cloud network (20) environment based on big data, and provides load prediction of systems and services and detection of abnormalities and failures based on artificial intelligence, and provides flow-based traffic monitoring and analysis, and control for the entire network.

Hereinafter, an embodiment of the present invention will be described focusing on a hybrid cloud network based on SD-WAN, but is not limited thereto and can be applied to various cloud platforms.

FIG. 3 is a drawing showing the basic configuration of a system for artificial intelligence-based network load prediction and fault detection according to one embodiment of the present invention. The system (10) for network load prediction and fault detection may include a collection server (100), a big data server (200), a control server (300), and a learning server (400).

Referring to FIG. 3, the collection server (100) performs a function of collecting and analyzing Netflow and network metrics, which are a type of virtualized traffic generated from a virtualized machine within a hybrid cloud network (20).

Here, Netflow is a networking protocol designed by Cisco Systems to record traffic flows transmitted and received within a network, and is effective in monitoring network behavior, traffic patterns, and bandwidth usage. In addition, network metrics refer to various measurement indicators (e.g., delay, loss, throughput, etc.) that occur on the network.

The collection server (100) is equipped with an API manager and can collect network traffic generated from a legacy server within a hybrid cloud network (20), a virtual machine of a private cloud based on Openstack, and a virtual machine of a public cloud based on AWS, Azure, or GCP through an API.

The big data server (200) stores network traffic and traffic analysis results collected from the collection server (100) in a database and performs the function of providing training or test data for machine learning.

The control server (300) provides traffic collection results and network status information to the network operator (30) and controls the cloud control and linkage protocol.

In addition, the learning server (400) uses network traffic information collected from the big data server (200) to predict network load through artificial intelligence-based machine learning, and thereby provides an artificial intelligence model that predicts and classifies system and service abnormalities and failures.

Below we describe each server in detail.

FIG. 4 is a drawing showing a connection configuration and functional block diagram of a collection server according to one embodiment of the present invention.

As shown in Fig. 4, the collection server (100) consists of a netflow collection unit (110), a netflow analysis unit (120), and a netflow storage unit (130).

First, taking NetFlow generation as an example in a private cloud, traffic generated from multiple virtual machines (VMs, which are configured on compute nodes within a private cloud platform and serve as traffic generators that generate traffic) is generated as NetFlow in a separate NetFlow generator through a switch (also called a 'bridge', which is connected to input/output interfaces provided within the virtual machines and performs a network management role for transmitting/receiving and switching traffic with other virtual machines), and the generated NetFlow is transmitted to a collection server (100) via an external network.

In the embodiment of the present invention, the NetFlow generator is described assuming that it is implemented in a virtual machine to collect and analyze traffic, but it can also be implemented in a physical server other than a virtual machine and is not limited thereto.

Referring to FIG. 4, the Netflow collection unit (110) can collect source IP, destination IP, port number, IP protocol type, timestamp, service type, AS number, number of packets/bytes, etc. included in Netflow.

The Netflow analysis unit (120) can use the information collected through the Netflow collection unit (110) to track events and analyze IPs that generate excessive traffic, PCs infected with viruses, and what type of traffic is abundant in the network. In addition, collection and analysis are possible according to various versions such as Netflow version V5, V9, and IPFIX (Internet Protocol Flow Information Export).

The Netflow storage unit (130) performs the function of storing the Netflow information collected by the Netflow collection unit (110) and the traffic analysis results analyzed by the Netflow analysis unit (120) in a database.

FIG. 5 is a drawing showing a functional block diagram of a control server according to an embodiment of the present invention.

Referring to FIG. 5, the control server (300) can prevent system failures that may cause service failures in advance, and when an abnormality or failure occurs, it can notify the service manager (30) via an alarm to support rapid failure analysis, and based on the experience of the service manager (30), it can play a role in helping to analyze the situation of service abnormality or failure when a system failure occurs.

As illustrated in FIG. 5, the control server (300) is composed of an intelligent load prediction unit (310) that predicts network load for a certain period of time, a system abnormality/failure detection unit (320) that predicts an abnormality/failure state of a currently input network through a predicted load value, and a service abnormality/failure classification unit (330) that learns the results of system abnormality/failure detection and the operation results of a service manager to classify an expected state when a system abnormality/failure state occurs.

Below, the intelligent load prediction unit (310) and the service abnormality/failure classification unit (330) are described in detail in FIGS. 6 and 7.

The system abnormality/failure detection unit (320) is a means for detecting traffic in which the amount of data processed by each system constituting the service exceeds the prescribed predicted range. This may be caused by a system failure, abnormal operation of an external linkage system, or a sudden occurrence of a large number of service requests.

Here, if a failure occurs in the system, the amount of incoming data increases due to a large number of retransmissions caused by the inability to process requested data, or the system is recognized as having a failure and the amount of incoming data decreases, or an external linkage system failure suddenly decreases the amount of incoming data, or the amount of data processed increases due to a malfunction, or the amount of data processed increases due to external factors such as a DoS attack, etc., which can occur in various situations.

To diagnose this, the required data processing volume range can be actively set based on the results of the load prediction model described above, and the incoming data processing volume is compared with the set threshold to notify the manager using an alarm.

FIG. 6 is a drawing showing a functional block diagram of an intelligent load prediction unit according to one embodiment of the present invention. The intelligent load prediction unit (310) is composed of a load prediction model unit (311), a load prediction judgment unit (312), and a load notification unit (313).

Referring to FIG. 6, when a processing request exceeds the data processing limit that each network system (e.g., virtual machine for realizing the service) that constitutes the service can process, the intelligent load prediction unit (310) can discard the data or load it into a buffer and then delay processing according to each network or service policy.

In addition, the intelligent load prediction unit (310) should be able to predict future system loads based on recent system load change trends, and based on the predicted results, the system capacity can be increased or additional systems can be installed to distribute the load, thereby preventing quality degradation, and the service manager can be notified using an alarm by comparing it with a threshold value set in the system.

Meanwhile, the intelligent load prediction unit (310) utilizes a load prediction model through artificial intelligence-based machine learning, and learns to predict data 15 or 30 minutes later by utilizing learning data for a certain period of time stored in the big data server (200).

Referring to Fig. 6, the load prediction model unit (311) uses the load prediction model to predict the system load that will occur in the future according to the recent change trend of the system load.

The load prediction judgment unit (312) uses the learned model and the currently input metrics to predict the system load that will occur in the future based on the recent change trend of the system load, and compares the predicted result with the threshold value set in the system and notifies the service manager using an alarm through the load notification unit (313).

In addition, by using the predicted load value to set the system abnormality/failure threshold, the system's abnormal operation can be predicted by comparing it with the load actually collected after a certain period of time, and the service abnormality/failure classification model learned by organizing the types through the analysis results of the service manager who received the system abnormality/failure alert and the information of the service system classifies the service abnormality/failure when a system failure occurs, helping the manager determine whether there is a system failure.

The load notification unit (313) may additionally be provided with a function for determining whether to immediately notify the service manager with an alarm based on the degree of load determined by the load prediction judgment unit (312) or to notify when the load is likely to cause system and service abnormalities or failures.

FIG. 7 is a drawing showing a functional block diagram of a service abnormality/failure classification unit according to one embodiment of the present invention.

Referring to FIG. 7, the service abnormality/failure classification unit (331) can classify service abnormalities/failures. First, when an alarm notifying an abnormality/failure state is generated in the system abnormality/failure detection unit (320), the service abnormality/failure learning unit (420) illustrated in FIG. 8 can classify the service abnormality/failure by a machine-learned model.

The service abnormality/failure status notification unit (332) notifies the service manager of abnormalities/failures classified by the service abnormality/failure classification unit (331) as an alarm.

FIG. 8 is a diagram showing a functional block diagram of a learning server according to an embodiment of the present invention, and FIG. 9 is a diagram showing an artificial intelligence model structure of a load prediction model according to an embodiment of the present invention. In addition, FIG. 10 is a diagram showing an artificial intelligence model structure of a service abnormality/failure classification model according to an embodiment of the present invention.

In general, changes in the network environment due to limitations in computer resources and unexpected situations that are difficult to predict cause changes in network traffic, which is one of the service qualities, so a means to predict and respond to them in advance is required first. However, it is very difficult to simply measure the amount of traffic and predict the load that changes frequently through quantitative thresholds, and for this purpose, technologies that predict the load through artificial intelligence-based machine learning are being introduced recently.

Service anomalies and failures may occur due to failures based on analysis results by the service manager, and may also occur when service requests are significantly reduced compared to usual. This requires a model that learns the operation results of the service manager and the status of other surrounding systems at the time of the predicted alarm occurrence, and compares it with past phenomena to make a judgment when a system alarm occurs. This may not be very useful at first, but it can reduce the fatigue of the service manager over time.

As shown in Figure 8, the learning server (400) consists of a load prediction learning unit (410) and a service abnormality/failure learning unit (420).

The load prediction learning unit (410) predicts the input traffic volume. This is because the traffic volume in a network service is measured by dividing it into input traffic volume and output traffic volume, but in reality, the input traffic volume mostly affects the system.

As illustrated in Figure 9, the load prediction learning unit (410) consists of a deep neural network (DNN) structure of three layers: an input layer (411), a hidden layer (412), and an output layer (413), and an LSTM model (414) that takes as input the results of a certain period of time in the past.

As illustrated in Figure 9, the load prediction learning unit (410) consists of a deep neural network (DNN) structure of three layers: an input layer (411), a hidden layer (412), and an output layer (413), and an LSTM model (414) that takes as input the results of a certain period of time in the past.

In addition, seven input parameters, namely, day of the week information, hourly information, minutely information, number of input flows, number of input packets, number of input bytes, and input byte ratio (number of input bytes / total number of bytes), are input to the input node of the input layer (411), but this is not limited thereto, and addition, deletion, or change of input parameters is possible.

The input parameters of the input layer (411) are calculated through the hidden layer (411), and finally, the incoming traffic prediction value is output through the output layer (413).

The LSTM (Long Short-Term Memory) model (414) can predict current traffic by using past information stored in advance by receiving predicted traffic output from the output layer (413) in a time-series manner at regular time intervals.

In the load prediction learning unit (410), 80% of the collected learning data is divided into learning data and the remaining 20% is divided into test data, and model learning and testing are performed, and learning can be repeated until the test accuracy reaches a certain value or higher.

As illustrated in Figure 10, the service abnormality/failure learning unit (420) is composed of a first DNN (421) and a second DNN (422) having a three-layer deep neural network (DNN) structure of an input layer, a hidden layer, and an output layer.

Here, in the input layer of the first DNN (421), three parameters, i.e., the number of input bytes of each corresponding system, the number of output bytes of each corresponding system, and the abnormality/failure status of each corresponding system, are input to the input node from one of a plurality of cloud network systems (such as a legacy server in a hybrid cloud network, a virtual machine of a private cloud based on OpenStack, or a virtual machine of a public cloud based on AWS, Azure, or GCP). The types and numbers of these input parameters are not limited and can be added, deleted, or changed.

The output values of the first DNN (421) for each of the multiple systems are input into the input layer of the second DNN (422), and the operation results through the hidden layer are finally output as classification results through the output layer.

In the service abnormality/failure learning department (420), 80% of the collected learning data is divided into learning data and the remaining 20% is divided into test data, and model learning and testing are performed, and learning can be repeated until the test accuracy reaches a certain value or higher.

FIG. 11 is a flowchart for explaining an operation for artificial intelligence-based network load prediction and fault detection according to one embodiment of the present invention.

Referring to FIG. 11, the method comprises a first step of collecting netflows from multiple virtual machines within a hybrid cloud network (20), a second step of analyzing the collected netflows to classify network traffic information and status information and storing them in a database, a third step of predicting network load from the traffic information, a fourth step of detecting system abnormalities and failures from the predicted load, and a fifth step of classifying network service abnormalities and failures based on the detected system status.

In addition, the third and fifth steps are performed by an artificial intelligence model through machine learning, and after the fifth step, a step may further be included of notifying the service manager of the results compared with the abnormality/failure situations of systems and services that occurred in the past as an alarm.

The present invention has been described so far with reference to specific embodiments. However, those skilled in the art will be able to perform various applications and modifications within the scope of the present invention based on the above contents.

10: System for network load prediction and fault detection
20: Hybrid Cloud Network
30: Service Manager
100: Collection Server
110: Netflow collection unit
120: Netflow Analysis Department
130: Netflow storage
200: Big Data Server
300: Control Server
310: Intelligent Load Forecasting Unit
311: Load Prediction Model Section
312: Load prediction judgment unit
313: Subordinate Notification Department
320: Service Abnormality/Failure Detection Department
330: Service Abnormality/Failure Classification Department
400: Learning Server
410: Load Prediction Learning Unit
411: Input layer
412: Hidden layer
413: Output layer
414: LSTM model
420: Service Abnormalities/Disability Learning Department
421: 1st DNN
422: 2nd DNN

Claims (11)

A collection server that collects network traffic and network metrics generated from virtual machines within a hybrid cloud network;
A big data server that stores the network traffic collected from the collection server and the analysis results of the network traffic in a database;
A control server that provides the network traffic collection results and network status information to the service manager; and
A system for predicting network load and detecting failures based on artificial intelligence, characterized in that it includes a learning server that predicts network load through artificial intelligence-based machine learning using the network traffic collected from the big data server, and predicts and classifies system and service abnormalities and failures through this. In the first paragraph,
The above network traffic is Netflow,
The above collection server is a Netflow collection unit that collects at least one of the source IP, destination IP, port number, IP protocol type, service type, and AS number included in the Netflow;
A netflow analysis unit that uses the above netflow to track events, analyze IPs that generate excessive traffic, PCs infected with viruses, or at least one of the traffic types; and
A system for artificial intelligence-based network load prediction and fault detection, characterized by further including a netflow storage unit that stores the netflow collected from the netflow collection unit and the results analyzed from the netflow analysis unit in a database. In the second paragraph,
A system for artificial intelligence-based network load prediction and fault detection, characterized in that the above collection server further includes an API manager that collects network traffic generated from the virtualized machines of legacy servers, private clouds based on Openstack, and public clouds within a hybrid cloud network through API. In the first paragraph,
The above control server is an intelligent load prediction unit that predicts network load for a certain period of time;
A system abnormality/failure detection unit that predicts network abnormality/failure status using the results of the above load prediction; and
A system for network load prediction and fault detection based on artificial intelligence, characterized in that it further includes a service abnormality/failure classification unit that classifies the expected service status through the above abnormality/failure status. In the first paragraph,
The above learning server comprises a load prediction learning unit that predicts the load generated from the network traffic; and
A system for predicting network load and detecting faults based on artificial intelligence, characterized by further including a service abnormality/failure learning unit that classifies service abnormalities/failures due to abnormal operation of the network system after a predetermined period of time has elapsed by using the above load. In paragraph 5,
A system for network load prediction and fault detection based on artificial intelligence, characterized in that the load prediction learning unit comprises an artificial intelligence model based on a deep neural network including an input layer, a hidden layer, and an output layer, and an LSTM model that uses the result of the output layer as input. In Article 6,
A system for network load prediction and fault detection based on artificial intelligence, characterized in that the input layer is composed of 7 nodes, and each input node inputs day of the week information, time unit information, minute unit information, number of input flows, number of input packets, number of input bytes, and input byte ratio. In paragraph 5,
The above service abnormality/failure learning unit is composed of a two-stage deep neural network-based artificial intelligence model,
The artificial intelligence model based on the deep neural network of the first stage includes an input layer, a hidden layer, and an output layer that receives state information from one of the plurality of cloud networks.
A system for artificial intelligence-based network load prediction and fault detection, characterized in that the artificial intelligence model based on a deep neural network of the second stage includes an input layer, a hidden layer, and an output layer that inputs the result of the output layer of the first stage. In Article 8,
A system for network load prediction and fault detection based on artificial intelligence, characterized in that the input layer of the artificial intelligence model based on the deep neural network of the first stage is composed of three input nodes into which the number of system input bytes, the number of system output bytes, and the status information of the system are input. In a method for network load prediction and fault detection based on artificial intelligence,
Step 1: Collecting NetFlow from multiple virtual machines within a hybrid cloud network;
A second step of analyzing the collected netflow and classifying the network traffic information and status information and storing them in a database;
A third step of predicting network load from the above traffic information;
A fourth step of detecting system abnormalities and failures from the predicted load; and
It consists of the fifth step of classifying network service abnormalities and failures based on the status of the system detected above.
A method for network load prediction and fault detection, characterized in that the third and fifth steps are performed by an artificial intelligence model through machine learning. In Article 10,
A method for network load prediction and fault detection, characterized in that, after the fifth step, it further includes a step of notifying a service manager of the results compared with the abnormality/failure situations of systems and services that occurred in the past as an alarm.