Optical transmission network alarm prediction method and device

Abstract

The invention provides an optical transmission network alarm prediction method and device, and relates to the technical field of data processing, and the method comprises the steps: obtaining the performance monitoring data of optical transmission network equipment and reported alarm information; performing alarm association processing and alarm label extraction according to the alarm data to obtain an alarm label vector; and after the performance data and the alarm label vector are aligned, alarm prediction is carried out through a random forest.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to an optical transmission network alarm prediction method and device. Background Art

[0002] Optical transmission networks form the core of modern communication infrastructure, especially playing a vital role in backbone networks. In these networks, any service interruption may lead to significant business interruption and economic losses. In actual operation and maintenance scenarios, faced with complex network structures and changing failure modes, it is often difficult for operation and maintenance personnel to quickly and accurately locate and analyze the source of the fault. In this context, alarm information provides an important diagnostic means, which can extract key fault information from complex network environments. Real-time and accurate alarm analysis has become the key to effective fault management. It can not only reveal abnormal conditions in the network in a timely manner, but also predict potential failure points. In addition, systematic predictive analysis can identify network hidden dangers in advance and take corresponding preventive measures, thereby greatly reducing or avoiding the occurrence of failures. However, large-scale alarm data sets pose a severe challenge to the automated analysis of operation and maintenance.

[0003] Therefore, how to effectively predict alarms in optical transmission networks has become an urgent problem to be solved in the industry. Summary of the invention

[0004] The present invention provides an optical transmission network alarm prediction method and device, which are used to solve the problem in the prior art that how to effectively perform alarm prediction on an optical transmission network has become an urgent problem to be solved in the industry.

[0005] The present invention provides an optical transmission network alarm prediction method, comprising: Obtain performance monitoring data and reported alarm information of optical transmission network equipment; Performing alarm association processing and alarm label extraction according to the alarm data to obtain an alarm label vector; After aligning the performance data and the alarm label vector, alarm prediction is performed through random forest.

[0006] According to an optical transmission network alarm prediction method provided by the present invention, alarm association processing and alarm label extraction are performed according to the alarm data to obtain an alarm label vector, including: Preprocess the alarm data, extract the alarm labels, and use the Apriori algorithm to identify the association rules between the alarm data and generate the association matrix; Perform dot multiplication of the alarm label and the correlation matrix to embed the correlation between alarms and obtain the alarm label vector.

[0007] According to an optical transmission network alarm prediction method provided by the present invention, the alarm data is preprocessed and the alarm label is extracted, including: Determine important alarm information based on the frequency and urgency of the alarm information; An alarm tag is generated according to the location information and occurrence time of the important alarm information.

[0008] According to an optical transmission network alarm prediction method provided by the present invention, after aligning the performance data and the alarm label vector, alarm prediction is performed through a random forest, including: Use the random forest model to predict multi-label alarms, build multiple decision trees and obtain the average results to predict multi-label alarms; The probability of each alarm occurring is predicted through a multi-output wrapper, and the probability of occurrence of each alarm is output.

[0009] According to an optical transmission network alarm prediction method provided by the present invention, each element of the correlation matrix is ​​calculated according to the following formula: ; in, and Respectively indicate different alarms. Indicates an alarm and The probability of simultaneous occurrence, Respectively indicate warning and Probability of a single occurrence.

[0010] The present invention also provides an optical transmission network alarm prediction device, comprising: An acquisition module is used to obtain performance monitoring data of optical transmission network equipment and reported alarm information; An extraction module, used to perform alarm association processing and alarm label extraction according to the alarm data to obtain an alarm label vector; The alarm module is used to align the performance data with the alarm label vector and then perform alarm prediction through random forest.

[0011] The device is also used for: Preprocess the alarm data, extract the alarm labels, and use the Apriori algorithm to identify the association rules between the alarm data and generate the association matrix; Perform dot multiplication of the alarm label and the correlation matrix to embed the correlation between alarms and obtain the alarm label vector.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the optical transmission network alarm prediction method as described in any one of the above is implemented.

[0013] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the optical transmission network alarm prediction method as described in any one of the above is implemented.

[0014] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the optical transmission network alarm prediction method as described in any one of the above is implemented.

[0015] The optical transmission network alarm prediction method and device provided by the present invention can realize data fusion by converting alarm data into labels, which can be used as additional information of performance data. Through labeling, alarm data and performance data can be used at the same time, and considering the dependency between them, richer context information is provided for alarm prediction. Then, the random forest model is used to predict the alarm of the optical transmission network, and the potential possibility and probability of failure of the transmission segment are evaluated. According to the prediction results, corresponding management measures are formulated to reduce or control the risk of failure and improve the efficiency and reliability of network operation and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A schematic diagram of a process flow of an optical transmission network alarm prediction method provided in an embodiment of the present application; Figure 2 A schematic diagram of the alarm prediction process provided in an embodiment of the present application; Figure 3 A schematic diagram of experimental results provided for the embodiments of the present application; Figure 4 A schematic diagram of the structure of an optical transmission network alarm prediction device provided in an embodiment of the present application; Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] Figure 1 A schematic diagram of a method for predicting an alarm in an optical transmission network provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, including: Step 110, obtaining performance monitoring data of the optical transmission network equipment and reported alarm information; Collect performance monitoring data and reported alarm information of each transmission segment in the optical transmission network. Alarm data usually includes information such as alarm type, timestamp, location, etc. Performance monitoring data may include indicators such as optical power, signal-to-noise ratio, and crosstalk.

[0020] The alarm data can also be further pre-processed, including cleaning, formatting and standardization.

[0021] Step 120, performing alarm association processing and alarm label extraction according to the alarm data to obtain an alarm label vector; Use association rule mining algorithms (such as the Apriori algorithm) to identify and quantify the correlation between different alarms and build an alarm correlation matrix.

[0022] According to the alarm frequency, urgency, and impact range, key alarms are extracted and encoded into alarm label vectors. These label vectors will serve as the basis for subsequent analysis and prediction.

[0023] The alarm label vector is dot-multiplied with the alarm association matrix to embed the correlation between alarms. In this way, the alarm label vector not only contains the status of a single alarm, but also reflects the mutual influence and dependency between alarms.

[0024] Step 130: After aligning the performance data and the alarm label vector, perform alarm prediction through random forest.

[0025] The performance data is aligned with the alarm label vector according to the timestamp to ensure the consistency of the two in time series. This allows the model to consider both performance indicators and alarm information at the same time.

[0026] The aligned data is trained and predicted using a random forest model. Random forest improves the accuracy and robustness of predictions by building multiple decision trees.

[0027] During the training process of each tree, randomness is introduced through bootstrap sampling and random feature selection to enhance the generalization ability of the model.

[0028] For multi-label alarm prediction, a multi-output wrapper is used so that the model can predict the occurrence of multiple alarms at the same time and output the occurrence probability for each alarm.

[0029] Analyze the prediction results of the random forest model to evaluate the potential possibility and probability of failure in the transmission segment. According to the prediction results, formulate corresponding management measures to reduce or control the risk of failure and improve the efficiency and reliability of network operation and maintenance.

[0030] In the embodiment of the present application, by converting alarm data into labels, it can be used as additional information of performance data, thereby realizing data fusion. Through labeling, alarm data and performance data can be used at the same time, and considering the dependency between them, richer context information is provided for alarm prediction. Then, the alarm prediction of the optical transmission network is performed through the random forest model to evaluate the potential possibility and probability of failure of the transmission segment. According to the prediction results, corresponding management measures are formulated to reduce or control the risk of failure and improve the efficiency and reliability of network operation and maintenance.

[0031] Optionally, performing alarm association processing and alarm label extraction according to the alarm data to obtain an alarm label vector includes: Preprocess the alarm data, extract the alarm labels, and use the Apriori algorithm to identify the association rules between the alarm data and generate the association matrix; Perform dot multiplication of the alarm label and the correlation matrix to embed the correlation between alarms and obtain the alarm label vector.

[0032] In the embodiment of the present application, the alarm data is cleaned to remove invalid or erroneous records, and the alarm data is formatted to ensure the consistency and processability of the data.

[0033] Extract key information based on the characteristics of alarm data, such as alarm type, severity, occurrence time, etc. Encode these key information into alarm tags, each of which represents a specific alarm feature.

[0034] The Apriori algorithm is used to analyze the alarm data and find out the frequently occurring alarm combinations. Based on the algorithm results, the association rules between alarms are determined, which can reveal the potential connections between different alarms.

[0035] Using the identified association rules, a correlation matrix is ​​constructed. The rows and columns of the matrix represent different alarm labels. The elements in the matrix represent the degree of association between the alarm labels. The larger the value, the stronger the association.

[0036] Perform a dot product operation on each alarm label vector and the correlation matrix. The result of the dot product is a new vector in which each element represents an alarm label and contains information about the association between the alarm and other alarms. After the dot product operation is completed, the alarm label vector obtained combines the status of a single alarm and the correlation between alarms. This vector provides rich feature information for subsequent alarm prediction.

[0037] Using the alarm label vector as input and combining it with performance data, alarm prediction is performed. Machine learning models, such as random forests, can be used to analyze this data and predict possible alarms in the future.

[0038] Figure 2 The alarm prediction process diagram provided in the embodiment of the present application is as follows: Figure 2 As shown in the figure, the alarm data and performance data collected from the network elements at the transmitting and receiving ends of the transmission segment are schematically shown. The two types of data need to be processed separately: for performance data, only data cleaning and standardization are required; for alarm data, after basic data preprocessing, alarm label extraction and alarm correlation embedding are required.

[0039] In the embodiment of the present application, alarm association: the Apriori algorithm is used to identify the association rules between alarms and generate an association matrix C, in which each element C_(i,j) is calculated according to formula (1) and represents the degree of association between different alarms.

[0040]

[0041] in, and Respectively indicate different alarms. Indicates an alarm and The probability of simultaneous occurrence, Respectively indicate warning and Probability of a single occurrence.

[0042] Alarm label extraction: Extract important alarms based on the frequency and urgency of alarms. Combine the location information and occurrence time of important alarms and encode them into independent label vectors. .

[0043] Alarm correlation embedding: embedding the original alarm vector Alarm related matrix Perform point multiplication to embed the correlation between alarms. The resulting alarm label vector In the , each element represents the weighted sum of the alarm status and its related intensity, which deeply reflects the dependency and impact relationship between alarms, thereby making more accurate alarm predictions.

[0044] Optionally, after aligning the performance data and the alarm label vector, performing alarm prediction through random forest includes: Use the random forest model to predict multi-label alarms, build multiple decision trees and obtain the average results to predict multi-label alarms; The probability of each alarm occurring is predicted through a multi-output wrapper, and the probability of occurrence of each alarm is output.

[0045] In the embodiment of the present application, random forest is an integrated learning method that improves the accuracy and robustness of prediction by constructing multiple decision trees. Each decision tree uses a self-service sampling method to extract samples from the original data set during training, increasing the diversity of the model.

[0046] During the splitting process of each tree, a subset of all features is randomly selected for node splitting, which increases the generalization ability of the model.

[0047] By using a multi-output wrapper, the random forest model is able to predict the occurrence of multiple alerts at the same time. The model can also output a specific probability for the occurrence of each alert, which improves the interpretability and practicality of the prediction results.

[0048] In the embodiment of the present application, the alarm prediction results are used to evaluate the potential possibility of failure in the transmission segment of the optical transmission network. The consequences of these hidden dangers and their probability of occurrence are analyzed. Based on the evaluation results, effective management measures are formulated to reduce or control the risk of failure.

[0049] In an optional embodiment, the alarm data is mainly text data, while the performance data is monitoring values. The two types of data cannot be merged, but are highly correlated. Therefore, the alarm is used as a label of the performance data to utilize the two types of data at the same time, and the dependency between the two types of data can be taken into account.

[0050] Alarm correlation embedding: There is correlation between alarms, especially alarms triggered by the same type of faults. The correlation between alarms is embedded in the form of matrix and dot product, so that independent alarm labels become correlated alarm labels, thereby improving the accuracy of alarm prediction.

[0051] Figure 3 The schematic diagram of the experimental results provided in the embodiments of the present application is as follows: Figure 3 As shown, it includes the first five rows and five columns of the correlation matrix C. The values ​​in the matrix have been normalized and processed for sparsity. Each element in the matrix Calculated by formula (1), used to quantify alarm With Alarm The correlation between The higher the value, the stronger the correlation.

[0052] In the embodiment of the present application, a random forest model is used for alarm prediction and is packaged with a multi-outputter so that multiple alarm labels can be predicted simultaneously, thereby simplifying model management and processing and interpreting multiple alarms under a unified framework.

[0053] In an optional embodiment, four methods are compared using four evaluation indicators: accuracy, F1 score, false alarm rate, and missed alarm rate: a random forest algorithm that does not consider alarm relevance, and a random forest algorithm that considers alarm relevance, an extreme gradient boosting algorithm, and a support vector machine algorithm.

[0054] Compared with the random forest algorithm that considers alarm relevance and does not consider alarm relevance, the embedding that can highlight alarm relevance improves the accuracy and F1 score, and reduces the false alarm rate by 0.0235 and the missed alarm rate by 0.0117.

[0055] Compared with all models that consider the relevance of alarm labels, random forest outperforms other models in various indicators. It is worth noting that the false alarm rate of all schemes that consider the relevance of alarm labels is 0. In actual alarm prediction scenarios, it is crucial to obtain low false alarm and false alarm rates. These rates ensure the timely capture of critical alarms, avoid operational interference and resource waste, and thus improve the response efficiency of the operation and maintenance team.

[0056] The optical transmission network alarm prediction device provided by the present invention is described below. The optical transmission network alarm prediction device described below and the optical transmission network alarm prediction method described above can be referred to each other.

[0057] Figure 4 A schematic diagram of the structure of an optical transmission network alarm prediction device provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, including: The acquisition module 410 is used to obtain the performance monitoring data of the optical transmission network equipment and the reported alarm information; The extraction module 420 is used to perform alarm association processing and alarm label extraction according to the alarm data to obtain an alarm label vector; The alarm module 430 is used to align the performance data and the alarm label vector and then perform alarm prediction through random forest.

[0058] The device is also used for: Preprocess the alarm data, extract the alarm labels, and use the Apriori algorithm to identify the association rules between the alarm data and generate the association matrix; Perform dot multiplication of the alarm label and the correlation matrix to embed the correlation between alarms and obtain the alarm label vector.

[0059] In the embodiment of the present application, by converting alarm data into labels, it can be used as additional information of performance data, thereby realizing data fusion. Through labeling, alarm data and performance data can be used at the same time, and considering the dependency between them, richer context information is provided for alarm prediction. Then, the alarm prediction of the optical transmission network is performed through the random forest model to evaluate the potential possibility and probability of failure of the transmission segment. According to the prediction results, corresponding management measures are formulated to reduce or control the risk of failure and improve the efficiency and reliability of network operation and maintenance.

[0060] Figure 5 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 5 As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 communicate with each other through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the optical transmission network alarm prediction method, which includes: obtaining performance monitoring data of the optical transmission network equipment and the reported alarm information; Performing alarm association processing and alarm label extraction according to the alarm data to obtain an alarm label vector; After aligning the performance data and the alarm label vector, alarm prediction is performed through random forest.

[0061] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0062] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the optical transmission network alarm prediction method provided by the above-mentioned methods, and the method includes: obtaining performance monitoring data of optical transmission network equipment and reported alarm information; performing alarm association processing and alarm label extraction according to the alarm data to obtain an alarm label vector; after aligning the performance data and the alarm label vector, performing alarm prediction through random forest.

[0063] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the optical transmission network alarm prediction method provided by the above-mentioned methods, the method comprising: obtaining performance monitoring data of the optical transmission network equipment and reported alarm information; performing alarm association processing and alarm label extraction according to the alarm data to obtain an alarm label vector; after aligning the performance data and the alarm label vector, performing alarm prediction through random forest.

[0064] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0065] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0066] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for predicting an alarm in an optical transmission network, characterized in that: include: Obtain performance monitoring data and reported alarm information of optical transmission network equipment; Performing alarm association processing and alarm label extraction according to the alarm data to obtain an alarm label vector; After aligning the performance data and the alarm label vector, alarm prediction is performed through random forest.

2. The optical transmission network alarm prediction method according to claim 1, characterized in that: Perform alarm association processing and alarm label extraction according to the alarm data to obtain an alarm label vector, including: Preprocess the alarm data, extract the alarm labels, and use the Apriori algorithm to identify the association rules between the alarm data and generate the association matrix; Perform dot multiplication of the alarm label and the correlation matrix to embed the correlation between alarms and obtain the alarm label vector.

3. The optical transmission network alarm prediction method according to claim 2, characterized in that: The preprocessing of the alarm data and extraction of the alarm label include: Determine important alarm information based on the frequency and urgency of the alarm information; An alarm tag is generated according to the location information and occurrence time of the important alarm information.

4. The optical transmission network alarm prediction method according to claim 1, characterized in that: After aligning the performance data and the alarm label vector, an alarm prediction is performed through a random forest, including: Use the random forest model to predict multi-label alarms, build multiple decision trees and obtain the average results to predict multi-label alarms; The probability of each alarm occurring is predicted through a multi-output wrapper, and the probability of occurrence of each alarm is output.

5. The optical transmission network alarm prediction method according to claim 2, characterized in that: Each element of the incidence matrix is ​​calculated according to the following formula: ； in, and Respectively indicate different alarms. Indicates an alarm and The probability of simultaneous occurrence, Respectively indicate warning and Probability of a single occurrence.

6. An optical transmission network alarm prediction device, characterized in that: include: An acquisition module is used to obtain performance monitoring data of optical transmission network equipment and reported alarm information; An extraction module, used to perform alarm association processing and alarm label extraction according to the alarm data to obtain an alarm label vector; The alarm module is used to align the performance data with the alarm label vector and then perform alarm prediction through random forest.

7. The optical transmission network alarm prediction device according to claim 6, characterized in that: The device is also used for: Preprocess the alarm data, extract the alarm labels, and use the Apriori algorithm to identify the association rules between the alarm data and generate the association matrix; Perform dot multiplication of the alarm label and the correlation matrix to embed the correlation between alarms and obtain the alarm label vector.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, it implements the optical transmission network alarm prediction method as described in any one of claims 1 to 5.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the optical transmission network alarm prediction method according to any one of claims 1 to 5 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the optical transmission network alarm prediction method according to any one of claims 1 to 5 is implemented.

Images