Alarm correlation analysis method, device, equipment and medium

Abstract

The embodiment of the invention discloses an alarm correlation analysis method, device, equipment and medium. The method comprises the following steps of: acquiring alarm data, and carrying out line segment deduplication and standardization on the alarm data to obtain standardized alarm data; corresponding each alarm data according to the standardized alarm data and the characteristic field; excavating an alarm association rule according to a preset alarm rule mining parameter based on an alarm family spectrum so as to obtain an alarm association rule after mining; obtaining a preset alarm social network according to the mining alarm association rules; presetting to carry out alarm analysis on the real time alarm data, according to the alarm family spectrum, the minded alarm association rule, and the alarm social network. The invention can effectively de-emphasize the massive alarm data, improve the calculation efficiency through association rule mining, and quickly grasp the main features of the alarm storm, and the complex relationship between the alarms, in particular to the root cause alarm the chain alarm occurs. Derived alarms have a more in-depth analysis.

Description

technical field [0001] The present invention relates to the technical field of network management alarm analysis, in particular to an alarm correlation analysis method, an alarm correlation analysis device, computer equipment and a computer-readable storage medium. Background technique [0002] With the increasing complexity of the mobile communication network topology, various network types will generate a large number of alarms during operation. A device failure may cause several alarms to be generated for different types of devices related to services, and may also cause other alarms to be generated in the form of a reaction chain. [0003] Alarms can be divided into two situations: one is the alarm issued by the object that actually has a fault, which is called the root alarm; the other is that other related object instances cannot work normally due to the occurrence of the root alarm. The alerts are called derived alerts. Under the actual network architecture, when a ...

AI Technical Summary

Problems solved by technology

[0011] 2) For cross-professional associations such as transmission, wireless, and dynamic ring equipment associations, as well as transmission, bearer, and core network equipment associations, it is difficult to comprehensively analyze the relationship between professional alarms because it involves inter-disciplinary department management and complex resource relationships. It is more difficult to quickly form association rules that can be ITized

[0012] 3) It is difficult to evaluate the effect of rules, and there are deficiencies in actual business application

The existing correlation analysis regards the alarm relationship as an isolated existence, and does not consider the family tree relationship and social network relationship of the alarm from a more macro perspective.

Images