arXiv:2602.13672cs.NIcs.LG2026-02中稿 · publication in IEE…被引 2

用机器学习提前7.3分钟预警网络意图漂移,减少80%误报。

LEAD-Drift: Real-time and Explainable Intent Drift Detection by Learning a Data-Driven Risk Score

  • 训练轻量神经网络预测未来风险分数,实时检测意图漂移。
  • 相比基线提前7.3分钟预警,误报率降低80.2%。
  • 支持故障原因解释与动态失效时间预估,适合运维团队使用。

基于意图的网络(IBN)简化了网络管理,但其可靠性受“意图漂移”挑战——网络状态逐渐偏离预期目标,常导致无声故障。传统方法难以检测早期细微漂移,仅在退化严重时才触发警报,限制了主动保障能力。为此,我们提出LEAD-Drift框架,实现意图漂移的实时检测以支持主动预防。其核心是将意图失败检测重构为监督学习问题,通过在固定时间窗标签上训练轻量神经网络,预测未来风险分数。模型原始输出经指数移动平均(EMA)平滑后,通过统计调优阈值生成稳健实时告警。此外,框架还引入两项关键功能:多时间窗建模实现动态失效时间估计,以及基于SHAP的每条告警可解释性,识别根因KPI。在时间序列数据集上的评估显示,相较于距离基线,LEAD-Drift平均提前7.3分钟预警(提升17.8%);相比加权KPI启发式方法,告警噪声减少80.2%,仅轻微牺牲预警提前量。结果表明,LEAD-Drift是一种高效、可解释且具备操作性的主动网络保障方案。

原文摘要 · Abstract (English)

Intent-Based Networking (IBN) simplifies network management, but its reliability is challenged by "intent drift", where the network's state gradually deviates from its intended goal, often leading to silent failures. Conventional approaches struggle to detect the subtle, early stages of intent drift, raising alarms only when degradation is significant and failure is imminent, which limits their effectiveness for proactive assurance. To address this, we propose LEAD-Drift, a framework that detects intent drift in real time to enable proactive failure prevention. LEAD-Drift's core contribution is reformulating intent failure detection as a supervised learning problem by training a lightweight neural network on fixed-horizon labels to predict a future risk score. The model's raw output is then smoothed with an Exponential Moving Average (EMA) and passed through a statistically tuned threshold to generate robust, real-time alerts. Furthermore, we enhance the framework with two key features for operational intelligence: a multi-horizon modeling technique for dynamic time-to-failure estimation, and per-alert explainability using SHAP to identify root-cause KPIs. Our evaluation on a time-series dataset shows LEAD-Drift provides significantly earlier warnings, improving the average lead time by 7.3 minutes (+17.8\%) compared to a distance-based baseline. It also reduces alert noise by 80.2\% compared to a weighted-KPI heuristic, with only a minor trade-off in lead time. These results demonstrate that LEAD-Drift as a highly effective, interpretable, and operationally efficient solution for proactive network assurance in IBN.

网络运维异常检测可解释性实时预警

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。