A method and device for constructing a cloud network alarm root cause relationship tree model

Abstract

According to a method and device for constructing a cloud network alarm root cause relationship tree model provided by an embodiment of the present invention, a first alarm tree model mined from a traditional network is determined to have corresponding classification weight values ​​according to different classification categories through machine learning. In the network to be modeled, the second alarm data mined is modeled using the classification weight values ​​obtained from the traditional network using the same machine learning to obtain a second alarm tree model, thereby realizing the establishment of an alarm root cause relationship tree model for a new network based on the traditional network. At the same time, the machine learning method is used to make the model establishment process more flexible and accurate.

Description

Technical Field

[0001] The embodiments of the present invention relate to, but are not limited to, the field of communication technology, and specifically, relate to, but are not limited to, a method and device for constructing a cloud network alarm root cause relationship tree model. Background Art

[0002] In the communications field, devices generate massive amounts of alarms, a large number of which have related root causes. In traditional practices, their root causes are mostly determined by factors such as topological links, business relationships, professional relationships, and alarm levels.

[0003] The following uses common alarms in mobile wireless networks as examples.

[0004] Example 1: A 4G wireless side base station is composed of a BBU (baseband processing unit), an RRU (radio remote unit) and an antenna feed system (antenna + feeder). When the radio frequency unit maintenance link alarm and the BBU (baseband processing unit) optical module transceiver abnormality alarm occur within a certain period of time, such as 5 minutes, since they are both devices of the same base station in the topological relationship and have a business relationship, the two alarms can be considered to have a root cause relationship, and the two alarms will be merged into the primary and secondary alarms. The primary alarm is the radio frequency unit maintenance link alarm, and the secondary alarm is the BBU (baseband processing unit) optical module transceiver abnormality alarm.

[0005] When the RF unit maintenance link abnormality alarm and the base station signaling link interruption occur within a certain period of time, since the two are directly related to each other, they will be merged into the primary and secondary alarms. Since the base station signaling link interruption is a secondary alarm, the level is higher than the third level alarm of the RF unit maintenance link abnormality alarm. Therefore, the base station signaling link interruption alarm is the primary alarm and the RF unit maintenance link abnormality alarm is the secondary alarm.

[0006] When the alarms of BBU (baseband processing unit), radio frequency unit and / or base station signaling link and the cell out-of-service alarm occur within a certain period of time, such as within 5 minutes, since the cell belongs to a higher layer in terms of topological logic and business relationship, they will be merged into primary and secondary alarms, with cell out-of-service being the primary alarm and other alarms being sub-alarms.

[0007] Example 2: In wireless equipment, the OML operation and maintenance link is used to transmit the control commands of the base station. When the OML fault alarm and the cell decommissioning occur successively within a certain period of time, such as 5 minutes, although the OML and the cell do not have a strict upper and lower parent-child relationship in the topology relationship, they have a business relationship. Therefore, the two alarms can also be considered to have a root cause relationship. The two alarms will be merged into the primary and secondary alarms. The primary alarm is the cell decommissioning, and the secondary alarm is the OML fault.

[0008] These root causes can form a tree, see the diagram Figure 1, which can clearly indicate the primary and secondary relationships of root causes. This tree is the alarm root cause relationship tree.

[0009] How are the parent-child relationships among these alarm root causes determined?

[0010] There are two traditional common practices in the industry. The simple approach is to determine based on the topology link diagram relationship and business relationship under the basically fixed same network topology relationship. The complex approach is to determine based on the topology relationship, business relationship, alarm level and alarm frequency and other factors based on expert experience and on-site engineering experience. These experiences will form an expert knowledge base.

[0011] In traditional communication equipment and networks, such as 2G / 3G / 4G networks, with the joint efforts of operators such as China Mobile and equipment vendors such as ZTE and Huawei, and through accumulated practical experience, the primary and secondary relationships of the root causes of these failures have formed a relatively mature expert knowledge base. That is, in traditional networks, mining and analyzing alarm data may not generate much value. The mined data model requires a certain amount of expert manpower to manually identify its effectiveness, and the results can only be limited to supplement its already relatively mature expert knowledge base. For operators, some gains do not outweigh the losses, and the motivation for alarm data mining is not sufficient.

[0012] However, with the development of 5G networks, the situation has changed due to the emergence of virtualization and slicing technologies. Not only has the core network changed greatly, but the access network has also changed greatly. For example, unlike the BBU (baseband processing unit) + RRU (remote radio unit) architecture of 4G base stations, 5G base stations are redefined as CU (central unit), DU (distributed unit) and AAU / RRU (remote radio unit) / (remote radio unit), and their topological relationships and business relationships have changed.

[0013] Note that this network topology is not a simple name change, such as BBU (baseband processing unit) + RRU (radio remote unit) becomes CU + DU + AAU, but due to slicing, the network layer has undergone major changes, and the networking has also undergone major changes. In addition to the more complex network layer of 5G, the 5G network is more complex in terms of networking. For example, the current 4G / 5G hybrid networking, 4G is the main, wide area coverage, 5G is hot spot key area coverage, and future changes will be more complex, and the uncertainty of the network layer is more complex than the traditional network.

[0014] During the network transformation period, the knowledge base cannot be updated in a timely manner, and the depth of the original knowledge base cannot meet the multi-level merging of alarms for new networks and new services. The common practice of assisting in determining the root cause of alarms based on topology link diagrams will significantly reduce its effectiveness in the complex 5G slicing network.

[0015] On the one hand, the root cause relationship of alarms will undergo a relatively large change, and on the other hand, the service relationship and topology relationship of the original traditional network and the alarm service are still partially valid in the 4G / 5G converged network. In this case, the traditional expert knowledge base is still useful, but it cannot fully meet the new alarm service processing.

[0016] In other words, traditional industry methods have obvious shortcomings. Simple methods such as topology link diagrams are only local topologies of the entire network, so they do not have many topological levels and cannot correlate the alarms of the entire network, that is, the growth of the alarm root cause tree is difficult to establish. With the major changes in network topology and business relationships caused by 5G slicing, and the complexity of networking methods, the experience knowledge base method cannot effectively and quickly establish the alarm root cause model tree for new networks and new services. Summary of the invention

[0017] The embodiments of the present invention provide a method and device for constructing a cloud network alarm root cause relationship tree model, which mainly solves the technical problem of how to quickly and accurately reconstruct a cloud network alarm root cause relationship tree model of a new network based on the currently known traditional network alarm root cause relationship tree model.

[0018] In order to solve the above technical problems, an embodiment of the present invention provides a method for constructing a cloud network alarm root cause relationship tree model, including:

[0019] Mining the first alarm data of the traditional network according to the frequent set to obtain a first alarm tree model, and using the traditional expert knowledge base as a label, performing feature extraction on the first alarm tree model to obtain a first feature parameter;

[0020] Customize the classification categories according to the preset classification rules, and use the machine learning to determine the classification weight values ​​corresponding to each classification category in the first alarm tree model;

[0021] The second alarm data of the network to be modeled is mined according to the frequent set, and the second alarm data is modeled using the classification weight value by machine learning to obtain a second alarm tree model; the second alarm data is root cause relationship data.

[0022] The embodiment of the present invention also provides a device for constructing a cloud network alarm root cause relationship tree model, including: a processor, a memory and a communication bus;

[0023] The communication bus is used to realize the connection and communication between the processor and the memory;

[0024] The processor is used to execute one or more computer programs stored in the memory to implement the steps of a method for constructing a cloud network alarm root cause relationship tree model described in an embodiment of the present invention.

[0025] An embodiment of the present invention also provides a computer storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of a method for constructing a cloud network alarm root cause relationship tree model as described in an embodiment of the invention.

[0026] According to an embodiment of the present invention, a method and device for constructing a cloud network alarm root cause relationship tree model is provided, including: mining the first alarm data of a traditional network according to a frequent set to obtain a first alarm tree model, and using a traditional expert knowledge base as a label to extract features of the first alarm tree model to obtain a first feature parameter; customizing classification categories according to preset classification rules, and using machine learning to determine the classification weight values ​​corresponding to each classification category in the first alarm tree model; mining the second alarm data of the network to be modeled according to the frequent set, and using machine learning to model the second alarm data using the classification weight value to obtain a second alarm tree model; the second alarm data is the root cause relationship data. Through machine learning, the first alarm tree model mined from the traditional network is determined according to different classification categories, and in the network to be modeled, the second alarm data mined is modeled using the classification weight value obtained by the traditional network using the same machine learning to obtain a second alarm tree model, thereby realizing the establishment of the alarm root cause relationship tree model of the new network on the basis of the traditional network, and at the same time, the machine learning method is used to make the model establishment process more flexible and accurate.

[0027] Other features and corresponding beneficial effects of the present invention are described in the latter part of the specification, and it should be understood that at least part of the beneficial effects become obvious from the description in the specification of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a simple model diagram of the alarm root cause tree of the traditional network;

[0029] Figure 2 A flowchart of a method for constructing a cloud network alarm root cause relationship tree model according to the first embodiment of the present invention;

[0030] Figure 3 A schematic diagram of the operation flow of the entire method for constructing a cloud network alarm root cause relationship tree model according to an embodiment of the present invention;

[0031] Figure 4A schematic diagram of a process for designing and displaying a cloud network alarm root cause relationship tree model method on AI Studio according to an embodiment of the present invention;

[0032] Figure 5 This is a flowchart of extracting the expert knowledge base to obtain the parent-child relationship in Embodiment 3 of the present invention;

[0033] Figure 6 This is a schematic diagram of the frequent alarm set mining process in the third embodiment of the present invention;

[0034] Figure 7 This is a flow chart of feature engineering processing in Embodiment 3 of the present invention;

[0035] Figure 8 The flowchart of constructing the alarm root cause tree model in the third embodiment of the present invention;

[0036] Fig. 9 This is a structural diagram of a device for constructing a cloud network alarm root cause relationship tree model according to Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the following is a further detailed description of the embodiments of the present invention through specific implementation methods combined with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0038] Embodiment 1:

[0039] The current traditional industry methods have obvious shortcomings. Simple methods such as topology link diagrams are only local topologies of the entire network, so they do not have many topological levels and cannot correlate the alarms of the entire network, that is, the growth of the alarm root cause tree is difficult to establish. With the major changes in network topology and business relationships caused by 5G slicing, and the complexity of networking methods, the experience knowledge base method cannot effectively and quickly establish the alarm root cause model tree for new networks and new services.

[0040] However, the original internal logic for determining the root cause of alarms has not changed much and is still determined by factors such as topological associations, business relationships, professional relationships, alarm levels, and alarm frequency. These factors, such as topological associations, business relationships, and alarm levels, are all defined in advance. These are certain. Factors such as alarm frequency can also be obtained through historical alarm data mining, but we do not yet know the weight of these factors in the formation of the final alarm root cause. We can learn the weights of these factors through machine learning.

[0041] Similarly, for the root cause relationship of alarms in 5G networks (new networks), we need to consider the weighted influence of these factors. These weighted influences are not easy to calculate. We will use machine learning to learn the expert knowledge base of traditional networks, and form a new alarm root cause model tree through the learned weighted influence, which will then be used for alarm root cause analysis of new 5G networks or 4G / 5G hybrid networks.

[0042] That is, the traditional expert knowledge base is an artificial experience base in the 2G / 3G / 4G process. We learn from the traditional expert knowledge base, and what we learn are parameters and capabilities, not specific network topology and business relationships, etc. Through this intelligent learning mechanism, with the expansion and promotion of 5G networks and the hybrid networking of 5G networks and traditional networks, the introduction of new equipment and new services, the uncertainty of the system has increased significantly. Our system can also automatically adapt to the factors that affect the inherent certainty of the root cause of the alarm, forming a relatively complete expert knowledge base for 5G. It is an expert knowledge base formed by AI and artificial intelligence, which can meet the expansion of network topology and business relationships.

[0043] In order to quickly and accurately determine the interrelationships of alarms in the new network before the new network is gradually laid out, an alarm root cause relationship tree model for the new sliced ​​cloud network is established to assist operators in business processing of alarms in intelligent operation and maintenance.

[0044] An embodiment of the present invention provides a method for constructing a cloud network alarm root cause relationship tree model, comprising: mining first alarm data of a traditional network according to a frequent set to obtain a first alarm tree model, and using a traditional expert knowledge base as a label to extract features of the first alarm tree model to obtain a first feature parameter; customizing classification categories according to preset classification rules, and using machine learning to determine classification weight values ​​corresponding to each classification category in the first alarm tree model; mining second alarm data of a network to be modeled according to frequent sets, and using machine learning to model the second alarm data using classification weight values ​​to obtain a second alarm tree model; the second alarm data is root cause relationship data.

[0045] See also Figure 2 , Figure 2 A flowchart of a method for constructing a cloud network alarm root cause relationship tree model provided in this embodiment, the specific steps include:

[0046] S201. Mining first alarm data of a traditional network according to a frequent set to obtain a first alarm tree model.

[0047] In this embodiment, mining the traditional network based on frequent sets is a means of performing data mining on the traditional network using a preset algorithm. The algorithm can use common data mining algorithms such as Apriori or FP Growth to obtain alarm frequent set combinations, which are also candidate combinations of the alarm root cause tree model.

[0048] S202: Using the traditional expert knowledge base as a label, extracting features from the first alarm tree model to obtain first feature parameters.

[0049] After obtaining the first alarm data and the corresponding first alarm tree model in step S201, it is necessary to analyze and extract features from these data and model components. The basis or label for the analysis and feature extraction here is the traditional expert knowledge base accumulated under the traditional network.

[0050] S203: Customize classification categories according to preset classification rules, and use machine learning to determine classification weight values ​​corresponding to each classification category in the first alarm tree model.

[0051] After obtaining the first warning data, the first warning data model and the first characteristic parameter, the data needs to be classified according to certain classification rules. The classified data is conducive to statistics and calculations.

[0052] After completing the data classification, due to the importance and frequency of different classified data, and the obvious differences in different networks and different nodes, the classification weight values ​​of each classification can be determined through machine learning, and the importance of the data can be determined through the classification weight values.

[0053] S204: Mining second alarm data of the network to be modeled according to the frequent set.

[0054] After obtaining the classification weight values ​​of different data classifications in the traditional network, the new network is modeled. At this time, a method similar to step S201L is used to mine the second alarm data of the network to be modeled, wherein the second alarm data is the root cause relationship data.

[0055] S205: Use machine learning to model the second alarm data using classification weight values ​​to obtain a second alarm tree model.

[0056] In this embodiment, in step S201, the first alarm data of the traditional network is mined according to the frequent set to obtain the first alarm tree model. The process also includes: initialization; initialization includes initializing the network element device topology relationship / business relationship / professional relationship / alarm level / expert knowledge base according to the standard and operator specification; and initializing the word segmentation list, which is the keyword for segmenting a description sentence.

[0057] In this embodiment, after initializing the traditional network, it also includes: extracting a rule base that generates a primary and secondary relationship of alarm data from an expert knowledge base; the rule base treats the alarm data of the primary and secondary relationship as the parent and child nodes of a tree model to form a parent-child relationship tree model, that is, the primary alarm data is the parent and the secondary alarm data is the child; the rule base also includes constraints on the alarm data.

[0058] In this embodiment, step S201, first alarm data of a traditional network is mined according to a frequent set to obtain a first alarm tree model. This includes but is not limited to using a preset mining algorithm to mine the traditional network to obtain a first alarm data frequent set combination, and the first alarm data frequent set combination can be used as a candidate combination of the first alarm root cause tree model. The preset mining algorithm includes but is not limited to the Apriori algorithm or the FP Growth algorithm.

[0059] In this embodiment, a preset mining algorithm is used to mine the traditional network, including full alarm data mining and designated alarm data mining; among them, full alarm data mining is mining all alarms; designated alarms are related alarm data obtained for the first time, and the related alarm data obtained for the first time are subdivided and mined according to different time intervals and mutual relationships.

[0060] In this embodiment, step S203, customizing classification categories according to preset classification rules, includes: defining multiple dimensions as features for classification according to preset dimensional classification rules; the dimensions include: network element topology relationship / business relationship / professional relationship / alarm level / support and confidence of frequent sets / alarm occurrence time interval / alarm occurrence transaction count between alarms; the topology relationship / business relationship / professional relationship / alarm level is determined according to the operator network and is fixed; the support and confidence of frequent sets / alarm occurrence time interval / alarm occurrence transaction count are obtained by normalizing the first feature parameter.

[0061] In this embodiment, the training data and test data used in the machine learning are frequent alarm sets of traditional networks, and the machine learning algorithms include: using a classification algorithm for machine learning; the classification algorithm includes any one of a decision tree, random forest, logistic regression, and perceptron.

[0062] In this embodiment, after the weight value of the classification is determined in step S203, before the network to be modeled is mined in step S204, the network to be modeled is also initialized, and a second initialization is performed to initialize the network element device topology relationship / business relationship / professional relationship / alarm level / expert knowledge base according to standards and operator specifications; and the word segmentation list is initialized, and the word segmentation list is the keywords for segmenting a descriptive sentence.

[0063] In this embodiment, mining the second alarm data of the network to be modeled according to the frequent set includes: using a preset mining algorithm to mine the network to be modeled to obtain a frequent set combination of the second alarm data, the frequent set combination of the second alarm data can be used as a candidate combination of the second alarm root cause tree model, wherein mining the second alarm data of the network to be modeled is full mining. Since the network to be modeled is a new network, in order to ensure the accuracy of modeling, when mining the second alarm data and the second alarm root cause tree model, it is necessary to mine the network to be modeled in full.

[0064] The embodiment of the present invention provides a method for constructing a cloud network alarm root cause relationship tree model, including: mining the first alarm data of the traditional network according to the frequent set to obtain the first alarm tree model, and using the traditional expert knowledge base as a label to extract the features of the first alarm tree model to obtain the first feature parameter; customizing the classification category according to the preset classification rule, and using machine learning to determine the classification weight value corresponding to each classification category in the first alarm tree model; mining the second alarm data of the network to be modeled according to the frequent set, and using machine learning to model the second alarm data using the classification weight value to obtain the second alarm tree model; the second alarm data is the root cause relationship data. Through machine learning, the first alarm tree model mined from the traditional network is determined according to different classification categories. In the network to be modeled, the second alarm data mined is modeled using the classification weight value obtained by the traditional network using the same machine learning to obtain the second alarm tree model, thereby realizing the establishment of the alarm root cause relationship tree model of the new network on the basis of the traditional network, and at the same time, the machine learning method is adopted to make the model establishment process more flexible and accurate.

[0065] Embodiment 2:

[0066] This embodiment provides a method for constructing a cloud network alarm root cause relationship tree model, which performs data mining on alarms, learns traditional knowledge bases, analyzes the relationships between alarms, obtains weights of various dimensions that determine the root cause relationships of alarms, applies them to alarms in 5G slicing networks, and forms a root cause relationship tree model for 4G / 5G fusion and 5G slicing.

[0067] This embodiment first mines traditional network alarm data through frequent sets, uses traditional expert knowledge base as labels, extracts features from the alarm root cause tree model, uses machine learning, such as logistic regression, to obtain alarm root cause parameter weights, and then calculates the alarm data of the 5G network to obtain frequent sets. The parent-child relationship is obtained through the learned model, and finally a 5G slice network alarm root cause relationship tree model is formed.

[0068] The method for constructing a cloud network alarm root cause relationship tree model in this embodiment includes the following steps:

[0069] Step 1: Initialization. According to the standards and operator specifications, initialize the network element equipment topology relationship / business relationship / professional relationship / alarm level / expert knowledge base; initialize the word segmentation list, which is the keywords for segmenting a description sentence, such as "minutes", "occurrence", "as", "other", "if exists", "association", etc. These keywords will be useful when extracting expert knowledge base rules.

[0070] Step 2: Extract the production alarm primary and secondary relationship rule base from the expert knowledge base. Treat the alarms in the primary and secondary relationship as the parent and child nodes of the tree to form a parent-child relationship tree, that is, the primary alarm is the parent and the secondary alarm is the child. In addition to the primary and secondary relationship, constraints are also required, such as the time interval between the two alarms and the location relationship.

[0071] Step 3: Use frequent sets to mine traditional network alarm data and obtain candidate combinations of tree models. The algorithm can use common data mining algorithms such as Apriori or FP Growth to obtain alarm frequent set combinations, which are also candidate combinations of alarm root cause tree models. The entire mining is divided into full alarm mining and specified alarm mining. Full alarms are mined for all alarms, and specified alarms are related alarms obtained in the first step. Since the time intervals and relationships are different, they need to be subdivided and mined.

[0072] Step 4: Perform feature engineering on the candidate combination set of the tree model. Define multiple dimensions, which can be selected as follows: network element topology relationship / business relationship / professional relationship / alarm level / support and confidence of frequent sets / alarm occurrence time interval / alarm occurrence transaction count between alarms. These dimensions are used as features, among which the topology relationship / business relationship / professional relationship / alarm level are determined by the operator network and are fixed. The support and confidence of frequent sets / alarm occurrence time interval / alarm occurrence transaction count are calculated in the third step and normalized. Feature engineering, the definition and learning of dimensions, is the core invention of the present invention. If the dimension definition is inaccurate, the accuracy of the entire machine learning will be relatively low, and the tree model will not be effectively constructed. Based on this logic, other steps must be effectively carried out in this step to construct the tree model.

[0073] Step 5: Obtain feature parameter weights through machine learning. Although we have the features of these dimensions, which one has a higher weight, which one is more significant, or when some dimensions are consistent but other dimensions are inconsistent, how to get the primary and secondary relationship, this needs to be determined by machine learning. The training data and test data used by machine learning are the frequent alarm sets of traditional networks, and the parent-child relationship obtained in the third step is used as a label. Since it is a primary and secondary relationship, or defined as a parent-child relationship, it is a classification judgment. The primary and secondary relationship of two alarms is either primary, or child, or not. This can be learned through classification algorithms. Classification algorithms include decision trees / random forests / logistic regression / perceptrons, etc.

[0074] Step 6: Use frequent sets to mine 4G / 5G converged and 5G slicing network alarm data to obtain a tree model candidate combination set. Obtain candidate combinations of alarm root cause parent-child relationships, similar to step 2. The mining here is full mining, and the same alarms as traditional networks must also be fully mined because the topological relationship and business relationship may have changed, so they must be mined again.

[0075] Step 7: Calculate the features of the candidate combination set of the tree model, which are the support and confidence of the topological relationship / business relationship / professional relationship / alarm level / frequent set / alarm occurrence time interval / alarm occurrence transaction count, and perform normalization. Note that in the topological relationship / business relationship, the 5G slice network has a significant change, and the association relationship between network elements and slices / sub-slices has been added, which is different from the traditional network, but these are all determined and defined by initialization. Only the support and confidence of the frequent set / alarm occurrence time interval / alarm occurrence transaction count are obtained through the results of the fifth step of mining.

[0076] Step 8: Use the previously trained logistic regression model to predict the classification results of the feature vector constructed in step 7 and obtain the pairwise parent-child relationships.

[0077] Step 9: Finally form the alarm root cause relationship tree model based on the alarm parent-child relationship.

[0078] Note that the new alarm root cause relationship tree model will not directly enter the expert knowledge base, but it can provide a better reference for the new knowledge base.

[0079] Step 10: Alarm business experts can edit the alarm root cause relationship tree and provide feedback on the real influencing factors, that is, which dimension is more effective. The adjustment results are used as labels, and secondary learning is performed to improve the alarm root cause relationship tree.

[0080] The present embodiment provides a method for constructing a cloud network alarm root cause relationship tree model, which is used to construct a slice network alarm root cause relationship tree model under the current 5G network. The method of the embodiment of the invention has the following advantages compared with the current traditional network model construction method: 1. The tree model used has good growth. When an alarm of a new type, new service, or new topology is generated, it is easy to attach it to the tree model; 2. The tree model can handle multi-level networks, which is more flexible than the knowledge base that can only handle two levels; 3. It has a good reference role in the alarm root cause model of 5G slice complex networks and services; 4. It has a good reference role in the alarm suppression and merging of operators; 5. The tree model itself has good editability. When the model is incorrect, it can be adjusted through editing.

[0081] Embodiment three:

[0082] This embodiment provides another embodiment of a method for constructing a cloud network alarm root cause relationship tree model, including the following contents:

[0083] 1. The entire system architecture process of this embodiment:

[0084] Initialize first, and initialize the network topology relationship / professional relationship / business relationship / alarm level and expert knowledge base.

[0085] Then, data mining is performed on traditional network alarms to obtain frequent sets, which are then processed by feature engineering. Machine learning is then performed in combination with the expert knowledge base to obtain a classification model. The parent-child relationship between two types of alarms is obtained to form a traditional network alarm root cause model tree. This classification model will be released by the machine learning system and used directly in the subsequent 5G slice data.

[0086] Data mining is then performed on the alarms of 5G slicing networks or 4G / 5G hybrid networks to obtain frequent sets, which are also processed by feature engineering. Then, the learned classification model is used to obtain the parent-child relationship for each type of alarm and form an alarm root cause model tree under 4G / 5G fusion and 5G slicing.

[0087] This tree may not be accurate and can be edited by the user. After editing, the results can be sent back through the feedback system to be re-labeled for secondary learning. This process from editability to secondary learning does not need to be protected by a patent, but is only used to provide a complete description of the entire system.

[0088] See also Figure 3 and Figure 4 . Figure 3 The following is a schematic diagram of the operation flow of the entire system. Figure 4 A flowchart for this process designed and displayed on AI Studio.

[0089] 2. Extract the expert knowledge base to obtain the parent-child relationship:

[0090] According to the expert knowledge base composed of standards, operator specifications, and equipment vendor specifications, the topology relationship / business relationship / professional relationship, parent-child alarm ID, and alarm rules are obtained. In addition to describing the association between parent-child alarms within a time window, the alarm rules may also have other auxiliary conditions for judgment.

[0091] for example, Figure 1 The last rule is described as follows: "When the base station is out of service, first determine whether the corresponding dynamic ring has a DC undervoltage alarm or a power outage alarm. If so, associate it." Then this rule will be segmented according to the initialized segmentation list. For example, this rule will use the terms "if it exists" / "associate" / "whether" / "yes" to obtain the necessary condition "DC undervoltage alarm or power outage alarm", and then obtain the parent-child relationship based on the alarm code and alarm object.

[0092] Note that word segmentation is not learned using natural language processing (NLP) because these regular words are very standard and can be obtained using hard coding. See Table 1 and Figure 5 ,Table 1 is a partial example table of the expert knowledge base, Figure 5 Flowchart for extracting the parent-child relationship from the expert knowledge base.

[0093] Table 1 Some examples of expert knowledge base

[0094]

[0095]

[0096]

[0097] 3. Frequent set mining of alarm data:

[0098] Since the alarms with correlation all occur within a certain time window, it is necessary to perform frequent set mining on the alarm data sorted by occurrence time.

[0099] Before mining, the alarm data needs to be cleaned. Alarms with no obvious topological network element location / unclear services / no alarm codes will be filtered out and are not within the mining scope.

[0100] If it is full alarm data, press the maximum time window; if it is a specified alarm, you can press the specified time window.

[0101] The mined alarm data is then calculated using the frequent set algorithm. If the Apriori algorithm is used, the threshold values ​​of confidence and support are determined in advance. Note that they are only frequent sets and do not necessarily have an associated relationship. Figure 6 , Figure 6 This is a schematic diagram of the frequent alarm set mining process.

[0102] 4. Feature Engineering Processing:

[0103] The above seven features are exemplified by network element topology relationship / business relationship / professional relationship / alarm level / confidence of frequent sets / alarm occurrence time interval / alarm occurrence transaction count between alarms. Of course, the features are not limited to these features.

[0104] All data except the alarm level should be normalized. Normalization here means processing the data of each dimension into 1 and 0.

[0105] The alarm level is a dimension, and the value is filled in according to the alarm level. Generally speaking, the higher the alarm level, the more significant it is in the alarm root cause tree model.

[0106] Topological relationship, for example, a pair of alarms A and B occur in BBU (baseband processing unit) and base station respectively, then their topological relationship will have two dimensions. Topological relationship A is the parent of B, and topological relationship B is not the parent of A. Here, the first dimension is filled in with 0 and the second dimension is filled in with 1. If there is no topological superior-subordinate relationship between the two, both items are filled in with 0. The business relationship feature is handled in the same way.

[0107] Professional relationships are processed according to six dimensions: wireless / data / transmission / core / dynamic loop / cross-network. For example, if it is wireless, then fill in 1 for the wireless dimension and 0 for the other dimensions.

[0108] The last three features are obtained when mining frequent sets and also need to be normalized.

[0109] For frequent sets, only confidence is used, and support is not used here, because if a pair of alarms A and B are mined, their support is the same. In the entire set, the number of times A and B occur at the same time is the same, whether A to B or vice versa, but the confidence is different. It refers to the number of times B occurs when A occurs, and the number of times A occurs when B occurs, which may be different. The normalization of confidence is determined by whether it is greater than 0.5 to determine 1 or 0.

[0110] The alarm occurrence time interval will have three dimensions, namely 5 / 10 / 20 minutes, fill in 1 or 0 respectively. Note that if it is 5 minutes, then fill in 1 for 5 and 0 for the other two.

[0111] The alarm occurrence transaction count refers to the number of times the alarm occurs. This will have two dimensions. For example, for a pair of alarms A and B, if A occurs more than B, and if A occurs no more than B, they will be counted as 1 / 0 respectively. Figure 7 , Figure 7 Flowchart for feature engineering process.

[0112] 5. Machine learning knowledge base to obtain the parent-child relationship classification model:

[0113] The knowledge base is learned through machine learning to obtain the weight values ​​of all dimensions of the features mentioned above.

[0114] We use supervised learning and classification learning algorithms, such as logistic regression, decision tree, random forest, etc.

[0115] This process is not complicated and is relatively mature. For example, logistic regression has a mature model algorithm library.

[0116] 6. Construct the alarm root cause relationship tree model:

[0117] For new network alarms, whether they are 5G alarms or alarms generated by 3G / 4G / 5G hybrid networks, we will construct a new alarm root cause tree model.

[0118] First, initialize its topological relationship / business relationship / professional relationship / alarm level, then obtain candidate combinations through frequent set mining, use the previous learning and training to obtain the model, that is, the weight values ​​of all dimensions of these features, and then directly call the classification model learned by the above machine, use its results to obtain the parent-child relationship of all combinations, and then combine all parent-child relationships into a tree, which is the alarm root cause model tree. See Figure 8 , Figure 8 To construct the alarm root cause tree model flow chart.

[0119] After obtaining the above alarm root cause tree model, the alarm root cause model tree will assist operators in intelligent dispatching and locating the real alarm root cause.

[0120] Embodiment 4:

[0121] This embodiment provides a device for constructing a cloud network alarm root cause relationship tree model, see Fig. 9 As shown, the device includes: a processor 211, a memory 212, a communication unit 213 and a communication bus 214;

[0122] The communication bus 214 is used to realize the communication connection between the processor 211, the communication unit 213 and the memory 212;

[0123] The processor 211 is used to execute one or more programs stored in the memory 212 to implement the steps of the method for constructing a cloud network alarm root cause relationship tree model provided in an embodiment of the present invention.

[0124] For the steps and specific processes implemented by each module in the device, reference can be made to the above-mentioned implementation processes, which will not be repeated here.

[0125] The present embodiment also provides a computer-readable storage medium, which includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer.

[0126] The computer-readable storage medium in this embodiment can be used to store one or more computer programs, and the one or more computer programs stored therein can be executed by a processor to implement at least one step of the method for constructing a cloud network alarm root cause relationship tree model in the above-mentioned embodiments 1 to 3.

[0127] It can be seen that those skilled in the art should understand that all or some of the steps, systems, and functional modules / units in the above disclosed methods can be implemented as software (which can be implemented with computer program code executable by a computing device), firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component can have multiple functions, or a function or step can be performed by several physical components in cooperation. Some or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit.

[0128] In addition, it is well known to those skilled in the art that communication media generally contain computer readable instructions, data structures, computer program modules or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery media. Therefore, the present invention is not limited to any specific hardware and software combination.

[0129] The above contents are further detailed descriptions of the embodiments of the present invention in combination with specific implementation methods, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A method for constructing a cloud network alarm root cause relationship tree model, characterized in that: The method for constructing a cloud network alarm root cause relationship tree model includes: Mining the first alarm data of the traditional network according to the frequent set to obtain a first alarm tree model, and using the traditional expert knowledge base as a label, performing feature extraction on the first alarm tree model to obtain a first feature parameter; Customize the classification categories according to the preset classification rules, and use machine learning to determine the classification weight values ​​corresponding to each classification category in the first alarm tree model; Mining the second alarm data of the network to be modeled according to the frequent set, using the machine learning to model the second alarm data using the classification weight value to obtain a second alarm tree model; the second alarm data is root cause relationship data; Before mining the first alarm data of the traditional network according to the frequent set to obtain the first alarm tree model, the method further includes: Initialization; the initialization includes initializing the network element equipment topology relationship / business relationship / professional relationship / alarm level / expert knowledge base according to the standards and operator specifications; and initializing the word segmentation list, which is the keyword for segmenting a description sentence; A rule base for generating primary and secondary relationships of alarm data is extracted from the expert knowledge base; the rule base regards the alarm data of primary and secondary relationships as parent and child nodes of a tree model to form a parent-child relationship tree model, that is, the primary alarm data is the parent and the secondary alarm data is the child; the rule base also includes constraints on the alarm data.

2. The method for constructing a cloud network alarm root cause relationship tree model according to claim 1, characterized in that: The method of mining the first alarm data of the traditional network according to the frequent set to obtain the first alarm tree model includes: using a preset mining algorithm to mine the traditional network to obtain a first alarm data frequent set combination, and the first alarm data frequent set combination is used as a candidate combination of the first alarm root cause tree model.

3. The method for constructing a cloud network alarm root cause relationship tree model according to claim 2, characterized in that: The use of a preset mining algorithm to mine the traditional network includes mining of all alarm data and mining of specified alarm data; The full alarm data mining is to mine all alarms; The designated alarm is obtained through the related alarm data obtained for the first time, and according to different time intervals and mutual relationships, the related alarm data obtained for the first time is segmented and mined.

4. The method for constructing a cloud network alarm root cause relationship tree model according to claim 1, characterized in that: The customizing the classification category according to the preset classification rules includes: defining multiple dimensions as features for classification according to the preset dimension classification rules; The dimensions include: network element topology relationship / business relationship / professional relationship / alarm level / support and confidence of frequent sets / alarm occurrence time interval / alarm occurrence transaction count between alarms; The topology relationship / business relationship / professional relationship / alarm level is determined according to the operator network and is fixed; The support and confidence of the frequent set / alarm occurrence time interval / alarm occurrence transaction count are obtained by normalizing the first characteristic parameter.

5. The method for constructing a cloud network alarm root cause relationship tree model according to claim 1, characterized in that: The training data and test data used by the machine learning are frequent alarm sets of the traditional network, and the machine learning algorithm includes: using a classification algorithm to perform machine learning; The classification algorithm includes any one of decision tree, random forest, logistic regression and perceptron.

6. The method for constructing a cloud network alarm root cause relationship tree model according to any one of claims 1 to 5, characterized in that: Before mining the second alarm data of the network to be modeled according to the frequent set, the method also includes: a second initialization, initializing the network element equipment topology relationship / business relationship / professional relationship / alarm level / expert knowledge base according to the standards and operator specifications; and initializing the word segmentation list, which is the keywords for segmenting a description sentence.

7. The method for constructing a cloud network alarm root cause relationship tree model according to claim 6, characterized in that: The mining of the second alarm data of the network to be modeled according to the frequent set includes: using a preset mining algorithm to mine the network to be modeled to obtain a frequent set combination of second alarm data, the frequent set combination of the second alarm data being used as a candidate combination of a second alarm root cause tree model, wherein the mining of the second alarm data of the network to be modeled is full mining.

8. A device for constructing a cloud network alarm root cause relationship tree model, characterized in that: include: Processor, memory and communication bus; The communication bus is used to realize the connection and communication between the processor and the memory; The processor is used to execute one or more computer programs stored in the memory to implement the steps of a method for constructing a cloud network alarm root cause relationship tree model as described in any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more computer programs, and the one or more computer programs can be executed by one or more processors to implement the steps of a method for constructing a cloud network alarm root cause relationship tree model as described in any one of claims 1 to 7.

Images