МЕТОДИКА ПРЕВЕНТИВНОЙ ИДЕНТИФИКАЦИИ СОСТОЯНИЯ ОБЪЕКТОВ МОНИТОРИНГА НА ОСНОВЕ СИМВОЛЬНОГО ПРЕДСТАВЛЕНИЯ ВРЕМЕННЫХ РЯДОВ ИХ МЕТРИК

Abstract

Introduction: based on the analysis of methods for estimating time series of observed parameters of devices of public information and telecommunications networks, to develop a method for preventive identification of the state of monitoring objects using a symbolic representation of time series of their metrics. Purpose: of the study is to determine the generalized universal characteristics of the time series, according to which it is possible to evaluate the variety of observed values of metrics related to a certain area of the state of the monitoring object (the class of its technical condition). Results: preventive identification of the abnormal state of the network element is carried out by identifying "forbidden" code syllables on the code word describing the observed time series of the metric. This approach to time series processing is borrowed from symbolic dynamics, which is used in bioinformatics when analyzing complex nucleotide genomic sequences. As a generalized universal characteristic of the time series, the entropy of code words is used, describing the time series encoded by the method of symbolic representation of the data of the observed metrics. An algorithm of the method of preventive identification of an abnormal situation on a time series of its parameters is developed, consisting of four stages: at the first stage, the time series is symbolically encoded according to possible parameter values; at the second, the entropy of the code word describing the time series of the observed metric is estimated; at the third, the classifier of the states of the measurement object is trained based on the entropy of shifts; at the fourth stage, the state is classified according to a test sample of measurements, in which the measured characteristic is described by its law of probability distribution of shifts. Practical relevance: when an abnormal functional state of a network element is detected, a transition to a special monitoring mode is carried out, when the frequency of polling by the monitoring server of the network element is significantly increased in order to timely take preventive control actions on the network infrastructure and prevent failure (the occurrence of an accident). Discussion: the methodology will allow to form the order of operation of the monitoring server in the future to identify the functional state of the network element and the public information and telecommunications network as a whole.