Alarm mining model determination method, device, equipment and storage medium

Abstract

The present invention discloses a method, device, equipment and storage medium for determining an alarm mining model, and belongs to the technical field of data analysis and processing. The method comprises: mining training data according to initial full mining parameters to obtain a set of all alarm association relationships, and then marking a specified alarm according to a rule base and a set of all alarm association relationships, and performing specified alarm mining according to test data and the marked specified alarms, and generating an alarm mining model when the mining results meet the convergence conditions. In this way, on the basis of full mining, by marking the specified alarm mining, and analyzing and iterating on this basis, the certainty of the alarm association relationship is continuously enhanced, thereby scientifically obtaining an alarm mining model.

Description

Technical Field

[0001] The present invention relates to the field of data analysis and processing, and in particular to an alarm mining model determination method, device, equipment and storage medium. Background Art

[0002] In the communications field, communications equipment often generates massive amounts of alarms, such as equipment alarms, business alarms, single-domain alarms, cross-domain and cross-vendor alarms, etc. Among these alarms, a large number of alarms have root cause relationships among them. By determining the root cause relationships, alarm merging and alarm compression fault location can be performed.

[0003] At present, the way to determine the root cause relationship is to obtain the association relationship through frequent set mining, and then refer to factors such as artificial experience knowledge base, network topology relationship and business relationship to achieve it. In the mining process, it is necessary to specify mining configuration parameters, such as algorithm selection parameters, result clipping parameters, and mining parameters. However, in the scenario of the fifth generation wireless systems (5G), based on the multi-level business, application diversity and non-linear increase of network complexity, the effectiveness of the alarm association obtained by mining will be greatly reduced by using the traditional method of setting alarm mining configuration parameters. In addition, after mining all alarm data, it is necessary to establish an evaluation based on the frequent set model, but among the alarms and their correlations that need to be focused on, some alarms do not occur frequently. If the mining configuration parameters such as support, confidence and time window are set relatively broadly, more redundant relationships will appear when more associations are mined. Summary of the invention

[0004] The main purpose of the embodiments of the present invention is to propose a method, device, equipment and storage medium for determining an alarm mining model, which aims to mark the specified alarm mining on the basis of full mining, and analyze and iterate on this basis, so that the certainty of the alarm association relationship is continuously enhanced, thereby scientifically obtaining the alarm mining model.

[0005] To achieve the above object, an embodiment of the present invention provides a method for determining an alarm mining model, the method comprising the following steps:

[0006] The training data is mined according to the initial full mining parameters to obtain a set of all alarm association relationships;

[0007] Specify alarms based on the rule base and all alarm association set tags;

[0008] Perform designated alarm mining based on test data and marked designated alarms;

[0009] When the mining results meet the convergence conditions, an alarm mining model is generated.

[0010] To achieve the above purpose, an embodiment of the present invention further proposes a device for determining an alarm mining model, the device comprising:

[0011] The mining module is used to mine the training data according to the initial full mining parameters to obtain a set of all alarm association relationships;

[0012] A marking module is used to mark specific alarms according to the rule base and all alarm association relationship sets;

[0013] The mining module is also used to mine designated alarms based on the test data and the marked designated alarms;

[0014] The generation module is used to generate an alarm mining model when the mining results meet the convergence conditions.

[0015] To achieve the above objectives, an embodiment of the present invention further proposes a device, which includes: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the above method are implemented.

[0016] To achieve the above objectives, the present invention provides a readable and writable storage medium for computer storage, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the aforementioned method.

[0017] The embodiment of the present application provides a method, device, equipment and storage medium for determining an alarm mining model, wherein the method includes mining the training data according to the initial full mining parameters to obtain a set of all alarm association relationships, and then marking the specified alarm according to the rule base and the set of all alarm association relationships, and performing specified alarm mining according to the test data and the marked specified alarms, and generating an alarm mining model when the mining results meet the convergence conditions. In this way, on the basis of full mining, by marking the specified alarm mining, and analyzing and iterating on this basis, the certainty of the alarm association relationship is continuously enhanced, thereby scientifically obtaining the alarm mining model. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flow chart of a method for determining an alarm mining model provided by an embodiment of the present invention.

[0019] Figure 2 It is a structural schematic diagram of an alarm mining model determination device provided by an embodiment of the present invention.

[0020] Figure 3 It is a schematic diagram of a device structure provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the present application more clear, the embodiments of the present application will be described in detail below with reference to the accompanying drawings. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other arbitrarily without conflict.

[0022] In addition, in the embodiments of the present application, words such as "optionally" or "exemplarily" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "optionally" or "exemplarily" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "optionally" or "exemplarily" is intended to present related concepts in a specific way.

[0023] In order to facilitate understanding of the solutions provided by the embodiments of the present application, some descriptions of concepts related to the present application are given as examples for reference. As shown below:

[0024] Full mining: All alarm data is mined to obtain relevant correlations. For example, a remote radio unit (RRU) link disconnection causes a cell to be out of service, a base station board clock anomaly causes a cell to be out of service, etc. Among them, RRU link disconnection occurs frequently, while base station board clock anomalies occur infrequently.

[0025] Designated mining: Mining of alarms of key concern, for example, mining only alarms such as cell decommissioning and base station decommissioning that have a greater impact on business.

[0026] Based on the above concepts, the present application embodiment provides a method for determining an alarm mining model, such as Figure 1 As shown, the method comprises the following steps:

[0027] S101. Mining the training data according to the initial full mining parameters to obtain a set of all alarm association relationships.

[0028] In the embodiment of the present application, the alarm data can be cleaned before mining, for example, the alarm data without obvious topological network element location, unclear service, and no alarm identification (Identity, ID) are filtered, while the alarm data with confirmed service and alarm ID are retained. For example, the ID of the "base station decommissioning" alarm is 1001-11, the ID of the "cell decommissioning" alarm is 1003-12, the ID of the "network element disconnection" alarm is 1005-13, etc., that is, in the embodiment of the present application, different alarms have their own corresponding IDs.

[0029] In addition, in the embodiment of the present application, the training data is a part of the alarm data, and the alarm data may also include test data.

[0030] Exemplarily, the alarm data may be divided according to the alarm data size, time, etc. For example, 60% of the alarm data is used as training data, that is, the ratio of the total amount of training data to the total amount of test data is 3:2.

[0031] It should be noted that in order to ensure the relevance of alarms across time periods, the alarm time of training data and test data is required to be roughly continuous and cannot be frequently interrupted. For example, the alarm data from May to September can be divided by month or week, but not by morning, afternoon or smaller periods.

[0032] The initial full mining parameter in this step can be a time window, a first mining parameter, wherein the first mining parameter can be support and / or confidence. The value of the initial full mining parameter can be a set initial value, for example, the initial value of the time window is 10 minutes, the initial value of the support is 0.005, and the initial value of the confidence is 0.065. Of course, in the embodiment of the present application, the numerical range of the mining parameter can also be set, for example, the maximum value of the time window is 40 minutes, the minimum value of the support is 0.001, and the minimum value of the confidence is 0.002.

[0033] Exemplarily, in an embodiment of the present application, the training data may be mined using an FP-Growth algorithm to obtain a set of all alarm association relationships.

[0034] S102: Mark a specified alarm according to a rule base and a set of all alarm association relationships.

[0035] The rule base in this step can be used to mark the effective association relationships and root cause relationships determined by experts. As the rule base, the rule base can adopt any rule base in the prior art.

[0036] After all alarm association relationship sets are obtained based on step S101, the set can be compared with the association relationship between faults and alarms stored in the rule base to determine the mined alarms and the unmined alarms, which are the full mining results. Then, the mined designated alarms and the unmined designated alarms are marked according to the designated alarms and the full mining results. For example, assuming that the designated alarm is "cell exit service", the association relationships stored in the rule base are "cell exit service--RRU link broken" and "cell exit service--base station single board clock abnormality", in the full mining process of step S101, "cell exit service--RRU link broken" is mined, but "cell exit service--base station single board clock abnormality" is not mined, then "cell exit service--RRU link broken" can be marked as the mined designated alarm, and "cell exit service--base station single board clock abnormality" can be marked as the unmined designated alarm.

[0037] For example, the mined designated alarm can be set to 1, and the unmined designated alarm can be set to 0, that is, "cell exit service--RRU link disconnection" is marked as 1, and "cell exit service--base station board clock abnormality" is marked as 0. Of course, those skilled in the art can also mark and distinguish in other ways, and this application is not limited to this.

[0038] S103: Perform designated alarm mining based on the test data and the marked designated alarms.

[0039] Based on step S102, the designated alarms are marked to clarify the mined designated alarms and the unmined designated alarms, and then the designated alarm mining is performed in an iterative manner in combination with the test data. In this way, during the mining process, the certainty is continuously enhanced, thereby obtaining a better correlation relationship between the alarms.

[0040] S104: When the mining results meet the convergence condition, generate an alarm mining model.

[0041] The specified alarm mining is performed in an iterative manner. After repeated mining for multiple times, if the mining result meets the convergence condition, an alarm mining model can be generated according to the mining parameters corresponding to the mining result.

[0042] The alarm mining model can be used to determine the subsequent alarm association relationship. For example, for new data, the mining parameters configured at different operators are obtained, and the alarm mining model is combined to perform full mining and specified alarm mining to obtain the association relationship of the specified alarm.

[0043] In the embodiment of the present application, the training data is mined according to the initial full mining parameters to obtain a set of all alarm association relationships, and then the specified alarm is marked according to the rule base and the set of all alarm association relationships, and the specified alarm mining is performed according to the test data and the marked specified alarm, and the alarm mining model is generated when the mining results meet the convergence conditions. In this way, on the basis of full mining, by marking the specified alarm mining, and analyzing and iterating on this basis, the certainty of the alarm association relationship is continuously enhanced, so as to scientifically obtain the alarm mining model.

[0044] In one embodiment, the process of performing designated alarm mining in step S103 may include but is not limited to the following steps:

[0045] Step 1: Determine the initial mining parameter value of the marked designated alarm, and use the initial mining parameter as the current mining parameter value.

[0046] The initial mining parameter value in this step may be a parameter value of a first mining parameter (ie, a numerical value of support and / or confidence) and a parameter value of a time window.

[0047] Exemplarily, the implementation method of determining the initial mining parameter value can be to determine the first mining parameter value of the mined designated alarm and the unmined designated alarm, calculate the value of the time window of the unmined designated alarm, and determine the initial mining parameter value of the marked designated alarm according to the first mining parameter value, the calculated time window value and the value of the time window of the mined designated alarm, wherein the first mining parameter is support and / or confidence, and the value of the time window of the mined designated alarm is the initial set value.

[0048] The following is a further detailed description of the implementation method of determining the initial mining parameter value using a specific example.

[0049] For example, assuming that the mined designated alarm is marked as 1, and the unmined designated alarm is marked as 0, the first mining parameter of the designated alarms marked as 1 and 0 (i.e., all designated alarms) is obtained according to the frequent set mining algorithm, the value of the time window of the designated alarm marked as 0 is calculated, and the value of the time window of the designated alarm marked as 1 is set to the initial setting value. Since a designated alarm may be caused by multiple faults, that is, a designated alarm may correspond to multiple fault causes, for example, RRU link disconnection and base station board clock abnormality may cause the cell to exit service, then in the designated mining process, the first mining parameter of each corresponding relationship of the designated alarm can be obtained, and then the smallest first mining parameter is used as the first mining parameter of the designated alarm. Of course, if the designated alarm has only one corresponding relationship first mining parameter, then the first mining parameter can be directly determined as the first mining parameter of the designated alarm.

[0050] In addition, the time window of each designated alarm can be calculated based on the initial setting value of the time window of the mined designated alarm and the calculated value of the time window of the unmined designated alarm. For example, based on the mined time window setting value of "cell exit service--RRU link disconnection" and the unmined time window calculation value of "cell exit service--base station board clock abnormality", the value of the maximum time window of the designated alarm "cell exit service" is determined and used as the mining time window of the designated alarm, then the mining time window and the above-mentioned first mining parameter are the initial mining parameters of the designated alarm "cell exit service".

[0051] In the same way, after obtaining the initial mining parameter values ​​of each designated alarm (ie, the designated alarms marked with 1 and 0), each initial mining parameter value is used as the current mining value of each designated alarm to perform designated alarm mining.

[0052] Step 2: Perform specified alarm mining based on current mining parameters and test data to obtain a specified alarm association relationship set.

[0053] Step 3: Update the tag of the specified alarm according to the specified alarm association relationship set and the association relationship between the fault and the alarm in the rule base.

[0054] After obtaining the specified alarm association relationship set corresponding to the current mining parameters according to the above steps, the set can be compared with the association relationship between faults and alarms in the rule base. Since the current mining parameters are re-determined, the specified alarm association relationship set corresponding to the current mining parameters will also change. Therefore, when it is compared with the rule base, the mining results of the specified alarms obtained will also change, that is, it is necessary to update the tags of the specified alarms and redisting the mined specified alarms and the unmined specified alarms.

[0055] Step 4: Determine the current mining parameters of the specified alarm according to the updated tag of the specified alarm.

[0056] There may be two situations for the updated tags of the designated alarms: one is that there are 1 and 0 in the tags, that is, there are still designated alarms that have not been mined in the designated alarms; the other is that all the tags are 1, that is, all the designated alarms are mined.

[0057] For these two different situations, the embodiments of the present application are designed with different mining parameter adjustment methods. For example, in the first case, the current mining parameters of the specified alarm can be determined in the negative direction; in the second case, the mining parameters of the specified alarm can be determined in the positive direction.

[0058] The negative direction indicates that the first mining parameter is reduced according to a preset step size and the value of the time window is increased according to a preset time, and the positive direction indicates that the first mining parameter is increased according to a preset step size and the value of the time window is reduced according to a preset time.

[0059] That is, when there are still unmined designated alarms in the designated alarms after mining, the value of the time window can be increased, and the support and / or confidence can be reduced, and the designated alarm mining can be performed again with the re-adjusted mining parameters; if all the designated alarms in the designated alarms after mining are mined, the value of the time window can be reduced, and the support and / or confidence can be increased, and mining can be performed again with the adjusted mining parameters to minimize redundant information in the mining results.

[0060] Repeat steps 2 to 4 until all specified alarms meet the convergence conditions.

[0061] Repeat steps 2 to 4 above to continuously perform designated alarm mining in an iterative manner. During the mining process, the mining parameters are adjusted according to the marked mining results. This will continuously enhance the mining certainty during the mining process until all designated alarms meet the convergence conditions.

[0062] Exemplarily, the above convergence condition may be any one of the following judgment conditions:

[0063] Condition 1: the tags of the last designated alarm are all the tags of the mined designated alarm, and the tags of the current designated alarm include tags of the designated alarm that have not been mined.

[0064] After several minings, if all marks in the last mining result are 1, that is, all designated alarms are mined, and there are marks of designated alarms that have not been mined in the current designated alarm mining result, then it means that the result of the last mining is the optimal result, and the mining parameters corresponding to the last mining are also the optimal designated alarm mining parameters.

[0065] Condition 2: There are tags of designated alarms that have not been mined in the tags of the last designated alarm, and the tags of the designated alarms this time are all tags of designated alarms that have been mined.

[0066] Contrary to the above conditions, after several minings, if there are designated alarms that have not been mined in the mining results of the last designated alarm, and the mining results of this time are that all designated alarms are mined, it means that the mining results of this time are optimal, and there is no need to continue adjusting the mining parameters. The mining parameters of this time can be determined as the optimal mining parameters.

[0067] Condition three: The number of times the specified alarm is mined or the mining parameter of the specified alarm is greater than the corresponding threshold value.

[0068] Since the initial value and adjustment range of each parameter are preset, for example, the initial value of the time window is 10 minutes, the initial value of the support is 0.005, the initial value of the confidence is 0.065, the maximum value of the time window is 40 minutes, the minimum value of the support is 0.001, and the minimum value of the confidence is 0.002. When adjusting the first mining parameter and the time window in the positive or negative direction, assuming that the preset step size is 0.001 and the preset time is 5 minutes, then the parameters can be adjusted based on the initial values ​​of the parameters according to the preset step size and the preset time. For example, based on the time window of 20 minutes, the time window is adjusted once in the negative direction to 25 minutes; based on the support of 0.003 and the confidence of 0.063, after adjusting the first mining parameter in the positive direction once, the support is 0.004 and the confidence is 0.064. Of course, those skilled in the art can also set the adjustment step size of the support and confidence to different values, and the embodiment of the present application is not limited to this.

[0069] As in the above example, if both conditions one and two are not met, that is, the mining result is not the optimal result, if the number of mining times or related parameters meet the above condition three, forced convergence is achieved and the mining ends.

[0070] In one embodiment, the process of mining the specified alarm in the above step S104 may include but is not limited to the following implementation methods: when the mining result satisfies the above condition 1 or condition 2, since the optimal result has been mined and the optimal mining parameters have been obtained, an alarm mining model may be generated according to the current mining parameters corresponding to the tags of the mined specified alarms, that is, the alarm mining model is generated according to the optimal mining parameters;

[0071] Alternatively, when the mining result satisfies condition three, the alarm mining model is generated according to the current mining parameters corresponding to the most mined designated alarm tags. In other words, if all designated alarms have not been mined, and the mining times or parameters have reached the upper limit, the result with the most designated alarms mined previously can be taken as the optimal mining result, and the corresponding mining parameters can be taken as the optimal mining parameters, and the alarm mining model is generated according to the mining parameters.

[0072] Figure 2 A schematic diagram of a structure of an alarm mining model determination device provided in an embodiment of the present application, such as Figure 2 As shown, the device includes: a mining module 201, a marking module 202, and a generating module 203;

[0073] Among them, the mining module is used to mine the training data according to the initial full mining parameters to obtain a set of all alarm association relationships;

[0074] A marking module is used to mark specific alarms according to the rule base and all alarm association relationship sets;

[0075] The mining module is also used to mine designated alarms based on the test data and the marked designated alarms;

[0076] The generation module is used to generate an alarm mining model when the mining results meet the convergence conditions.

[0077] In one embodiment, the above-mentioned marking module can be used to determine the full mining results based on the association relationship between all alarm association relationships and the faults and alarms in the rule base, and mark the mined specified alarms and the unmined specified alarms according to the specified alarms and the full mining results, wherein the full mining results include the mined alarms and the unmined alarms.

[0078] Exemplarily, the above mining module can also be used to perform the following steps to perform specified alarm mining, for example:

[0079] Step 1: Determine the initial mining parameter value of the marked specified alarm, and use the initial mining parameter as the current mining parameter value;

[0080] Step 2: Perform specified alarm mining based on current mining parameter values ​​and test data to obtain a specified alarm association relationship set;

[0081] Step 3: Update the tag of the specified alarm according to the specified alarm association relationship set and the association relationship between the fault and the alarm in the rule base;

[0082] Step 4: Determine the current mining parameter value of the specified alarm according to the updated tag of the specified alarm;

[0083] Repeat steps 2 to 4 until all specified alarms meet the convergence conditions.

[0084] In one embodiment, the mining module may include a determination unit and a calculation unit:

[0085] The determining unit is used to determine the first mining parameter values ​​of the mined designated alarms and the unmined designated alarms;

[0086] A calculation unit, used for calculating the value of the time window of the specified alarm that has not been mined;

[0087] The determination unit is further used to determine the initial mining parameter value of the marked designated alarm according to the first mining parameter value, the calculated time window value and the mined time window value of the designated alarm, that is, the mining module performs the above step 1 through the determination unit and the calculation unit:

[0088] The first mining parameter is support and / or confidence, and the mined value of the designated alarm time window is an initial setting value.

[0089] In one embodiment, the determination unit is further configured to determine the current mining parameters of the designated alarm in a negative direction when there is a mark of the designated alarm that has not been mined in the marks of the updated designated alarm; or, in a case where the marks of the updated designated alarm are all marks of the mined designated alarm, determine the current mining parameters of the designated alarm in a positive direction;

[0090] The negative direction indicates that the first mining parameter is reduced according to a preset step size and the value of the time window is increased according to a preset time, and the positive direction indicates that the first mining parameter is increased according to a preset step size and the value of the time window is reduced according to a preset time.

[0091] Exemplarily, the convergence condition in the above process may include any one of the following:

[0092] Condition 1: The tags of the last designated alarm are all the tags of the mined designated alarm, and the tags of the current designated alarm contain tags of the designated alarm that have not been mined;

[0093] Condition 2: There is a tag of the designated alarm that has not been mined among the tags of the last designated alarm, and the tags of the designated alarm this time are all tags of the designated alarm that have been mined;

[0094] Condition three: The number of times the specified alarm is mined or the mining parameter of the specified alarm is greater than the corresponding threshold value.

[0095] In one embodiment, the generation module can be used to generate an alarm mining model based on the current mining parameters corresponding to the tags of the mined specified alarms when the mining results meet the above-mentioned condition one or condition two; or, when the mining results meet the above-mentioned condition three, generate an alarm mining model based on the current mining parameters corresponding to the most mined tags of the specified alarms.

[0096] The alarm mining model determination device provided in this embodiment is used to implement Figure 1 The alarm mining model determination method of the illustrated embodiment has similar implementation principles and technical effects, which will not be described in detail here.

[0097] Figure 3 A schematic diagram of a device provided in an embodiment is shown in FIG. Figure 3 As shown, the device includes a processor 301 and a memory 302; the number of processors 301 in the device can be one or more. Figure 3 A processor 301 is taken as an example; the processor 301 and the memory 302 in the device can be connected by a bus or other means. Figure 3The example of connecting through bus is taken in the following.

[0098] The memory 302 is a computer-readable storage medium that can be used to store software programs, computer executable programs, and modules. Figure 1 The program instructions / modules corresponding to the alarm mining model determination method in the embodiment (for example, the mining module 201, the marking module 202, and the generating module 203 in the alarm mining model determination device). The processor 301 implements the above-mentioned alarm mining model determination method by running the software programs, instructions, and modules stored in the memory 302.

[0099] The memory 302 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the set-top box, etc. In addition, the memory 302 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage devices.

[0100] The embodiment of the present application also provides a readable and writable storage medium for computer storage, the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to perform an alarm mining model determination method, the method comprising:

[0101] The training data is mined according to the initial full mining parameters to obtain a set of all alarm association relationships;

[0102] Specify alarms based on the rule base and all alarm association set tags;

[0103] Perform designated alarm mining based on test data and marked designated alarms;

[0104] When the mining results meet the convergence conditions, an alarm mining model is generated.

[0105] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above and the functional modules / units in the devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0106] In hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0107] The above only illustrates the exemplary embodiments of the present application with reference to the accompanying drawings, and does not limit the scope of the present invention. Any modification, equivalent substitution and improvement made by those skilled in the art without departing from the scope and essence of the present invention shall be within the scope of the present invention.

Claims

1. A method for determining an alarm mining model, characterized in that: The method comprises the following steps: The training data is mined according to the initial full mining parameters to obtain a set of all alarm association relationships; Marking a specified alarm according to a rule base and a set of all the alarm association relationships; Perform designated alarm mining based on test data and marked designated alarms; When the mining results meet the convergence conditions, an alarm mining model is generated; The step of marking the specified alarm according to the rule base and the set of all alarm association relationships includes: Determine a full mining result according to the set of all alarm association relationships and the association relationship between faults and alarms in the rule base; The full mining result includes the mined alarms and the unmined alarms; The mined designated alarms and the unmined designated alarms are marked according to the designated alarms and the full mining results.

2. The method for determining an alarm mining model according to claim 1, characterized in that: The performing designated alarm mining according to the test data and the marked designated alarms includes: Step 1: Determine the initial mining parameter value of the marked designated alarm, and use the initial mining parameter as the current mining parameter value; Step 2: Perform designated alarm mining according to the current mining parameter value and the test data to obtain a designated alarm association relationship set; Step 3: updating the mark of the specified alarm according to the specified alarm association relationship set and the association relationship between the fault and the alarm in the rule base; Step 4: Determine the current mining parameter value of the specified alarm according to the updated mark of the specified alarm; Repeat steps 2 to 4 until all specified alarms meet the convergence conditions.

3. The method for determining an alarm mining model according to claim 2, characterized in that: The determining of the initial mining parameter value of the marked designated alarm includes: Determine first mining parameter values ​​of mined designated alarms and unmined designated alarms; Calculate the value of the time window of the specified alarm that has not been mined; Determine an initial mining parameter value of the marked designated alarm according to the first mining parameter value, the calculated time window value, and the mined time window value of the designated alarm; The first mining parameter is support and / or confidence, and the mined value of the specified alarm time window is an initial setting value.

4. The method for determining an alarm mining model according to claim 3, characterized in that: Determining the current mining parameters of the designated alarm according to the updated mark of the designated alarm includes: In the case that there is a mark of the designated alarm that has not been mined in the marks of the updated designated alarm, determining the current mining parameter of the designated alarm in a negative direction; In a case where the updated marks of the designated alarm are all marks of the mined designated alarm, determining the current mining parameters of the designated alarm in a positive direction; The negative direction indicates that the first mining parameter is reduced according to a preset step size and the value of the time window is increased according to a preset time, and the positive direction indicates that the first mining parameter is increased according to a preset step size and the value of the time window is reduced according to a preset time.

5. The method for determining an alarm mining model according to claim 4, characterized in that: The convergence condition includes any one of the following: Condition 1: the tags of the designated alarms last time were all the tags of the designated alarms that were mined, and there are tags of the designated alarms that have not been mined among the tags of the designated alarms this time; Condition 2: There is a mark of the designated alarm that has not been mined out among the marks of the designated alarm last time, and the marks of the designated alarm this time are all marks of the designated alarm that have been mined out; Condition three: the number of times the designated alarm is mined or the mining parameter of the designated alarm is greater than the corresponding threshold value.

6. The method for determining an alarm mining model according to claim 5, characterized in that: When the mining results meet the convergence conditions, an alarm mining model is generated, including: In the case where the mining result satisfies the first condition or the second condition, generating an alarm mining model according to current mining parameters corresponding to the mining marks of the designated alarms, wherein the marks of the designated alarms are all the marks of the designated alarms; Alternatively, when the mining result satisfies the third condition, an alarm mining model is generated according to the current mining parameters corresponding to the largest number of the mined designated alarm tags.

7. An alarm mining model determination device, characterized in that: include: The mining module is used to mine the training data according to the initial full mining parameters to obtain a set of all alarm association relationships; A marking module, used for marking a specified alarm according to a rule base and a set of all alarm association relationships; The mining module is further used to mine designated alarms based on the test data and the marked designated alarms; A generation module, used to generate an alarm mining model when the mining results meet the convergence conditions; The marking module is specifically used to determine the full mining results based on the association relationship between all alarm association relationships and the faults and alarms in the rule base, and mark the mined designated alarms and the unmined designated alarms according to the designated alarms and the full mining results, wherein the full mining results include the mined alarms and the unmined alarms.

8. A device, characterized in that include: A memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein when the program is executed by the processor, the method for determining an alarm mining model according to any one of claims 1 to 6 is realized.

9. A readable and writable storage medium for computer storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the alarm mining model determination method according to any one of claims 1 to 6.

Images