Fault correlation method, device and computer-readable storage medium

Abstract

The present invention provides a fault association method, apparatus, and computer-readable storage medium, the method comprising: obtaining alarm logs from one or more devices and performing word vector encoding on the alarm logs; inputting the encoded alarm logs into a pre-trained deep neural network model to obtain a first fault classification associated with the encoded alarm logs; generating a fault ticket based on the first fault classification and a preset work order template, and determining the equipment maintenance personnel corresponding to the fault ticket; receiving a feedback work order sent by the equipment maintenance personnel based on the fault ticket, and retraining the pre-trained deep neural network model based on a second fault classification in the feedback work order and the corresponding encoded alarm log. The method, apparatus, and computer-readable storage medium can address the problems of existing rule-based network fault detection methods, which have poor robustness and fail to associate alarms with faults.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a fault correlation method, device, and computer-readable storage medium. Background Art

[0002] The stability and security of the network are related to every aspect of people's daily work and life, and this issue is also a focus of telecom operators. How to use equipment alarms to predict faults before they occur is the current research focus of operators. Most existing methods are rule-based methods, which use algorithms to mine association rules between alarms or add expert experience to form a rule base, and then rely on the rule base to compress and trace alarms. When using the rule base method, if a new alarm that is not in the rule base is encountered, the rule base needs to be updated.

[0003] The robustness is poor. In addition, existing methods usually end after mining the root cause alarm and do not associate the alarm with the fault. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to address the above-mentioned deficiencies in the prior art and provide a fault correlation method, device and computer-readable storage medium to solve the problems that the existing rule-based network fault detection method has poor robustness and does not associate alarms with faults.

[0005] In a first aspect, the present invention provides a fault correlation method, comprising:

[0006] Obtain alarm logs of one or more devices and perform word vector encoding on the alarm logs;

[0007] Inputting the encoded alarm log into a pre-trained deep neural network model to obtain a first fault classification associated with the encoded alarm log;

[0008] Generate a fault ticket according to the first fault classification and a preset work order template, and determine the equipment maintenance personnel corresponding to the fault ticket;

[0009] Receive a feedback work order sent by the equipment maintenance personnel based on the fault order, and retrain the pre-trained deep neural network model according to the second fault classification in the feedback work order and the corresponding encoded alarm log.

[0010] Preferably, obtaining the alarm logs of one or more devices specifically includes:

[0011] The alarm logs of the one or more devices are obtained according to pre-stored topology information of the target network and a preset broad search round.

[0012] Preferably, the acquiring of the alarm logs of the one or more devices according to the pre-stored topology information of the target network and the preset broad search rounds specifically includes:

[0013] Obtain the broad search round, and determine whether the broad search round is 0;

[0014] If the broad search round is 0, obtain the alarm log of the device to be analyzed;

[0015] If the broad search round is not 0, then obtaining alarm logs of the device to be analyzed and one or more neighboring devices of the device to be analyzed obtained according to the topology information and the broad search round.

[0016] Preferably, the alarm log of each device includes one or more alarm information, each alarm information includes the alarm time, alarm location and alarm content, and the word vector encoding of the alarm log specifically includes:

[0017] For each device's alarm log, encode the alarm time, alarm location, and alarm content of each alarm message in the alarm log to form a feature matrix of length m*n, where m is the sum of the number of bits of the encoded alarm time, alarm location, and alarm content, and n is the number of alarm messages;

[0018] The feature matrices of all devices are combined according to a preset uniform size to form a third-order tensor of M*N*k, where M*N is the preset uniform size and k is the number of all feature matrices.

[0019] Preferably, before inputting the encoded alarm log into a pre-trained deep neural network model to obtain the first fault classification associated with the encoded alarm log, the method further includes:

[0020] Obtain historical alarm logs of one or more devices and perform word vector encoding on the historical alarm logs;

[0021] The encoded historical alarm logs and the associated fault classification labels are used as training data to pre-train the deep neural network model to obtain the pre-trained deep neural network model.

[0022] Preferably, the deep neural network model is a modified visual geometry group VGG16 model. Before pre-training the deep neural network model using the encoded historical alarm logs and the associated fault classification labels as training data, the method further includes:

[0023] All maximum pooling layers in the VGG16 model are replaced with average pooling layers, and the last fully connected layer in the VGG16 model is removed to obtain a modified VGG16 model.

[0024] Preferably, the first fault classification is no fault or one of a plurality of preset fault classifications, and generating a fault ticket according to the first fault classification and a preset work order template specifically includes:

[0025] If the first fault classification is not no fault, the fault ticket is generated according to the first fault classification and a preset work order template, wherein the fault ticket is used to indicate that a fault corresponding to the first fault classification occurs in one of the one or more devices.

[0026] Preferably, if the broad search round is not 0 and the first fault classification is not no fault, before generating a fault ticket according to the first fault classification and a preset work order template, the method further includes:

[0027] Acquire alarm logs of a portion of the devices from a plurality of devices including the device to be analyzed and the adjacent devices as first alarm logs, and perform word vector encoding on the first alarm logs;

[0028] Inputting the encoded first alarm log into a pre-trained deep neural network model to obtain a third fault classification associated with the encoded first alarm log;

[0029] The location range of the fault corresponding to the first fault classification is narrowed down according to the first fault classification and the third fault classification.

[0030] In a second aspect, the present invention provides a fault correlation device, comprising:

[0031] A log encoding module is used to obtain alarm logs of one or more devices and perform word vector encoding on the alarm logs;

[0032] a fault association module, connected to the log encoding module, configured to input the encoded alarm log into a pre-trained deep neural network model to obtain a first fault classification associated with the encoded alarm log;

[0033] a work order generation module, connected to the fault association module, configured to generate a fault ticket according to the first fault classification and a preset work order template, and determine the equipment maintenance personnel corresponding to the fault ticket;

[0034] A model retraining module is connected to the work order generation module, and is used to receive the feedback work order sent by the equipment maintenance personnel based on the fault order, and retrain the pre-trained deep neural network model according to the second fault classification in the feedback work order and the corresponding encoded alarm log.

[0035] In a third aspect, the present invention provides a fault correlation device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the fault correlation method described in the first aspect.

[0036] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the fault association method described in the first aspect is implemented.

[0037] The fault association method, device, and computer-readable storage medium provided by the present invention obtain the alarm logs of one or more devices, perform word vector encoding on the alarm logs, and input the encoded alarm logs into a pre-trained deep neural network model to obtain the first fault classification associated with the encoded alarm logs. Since the pre-trained deep neural network model is used for fault association, there is no need to incorporate expert experience or extract rules. Even when new alarms occur, alarm features can still be extracted, which is more robust. At the same time, after determining the first fault classification, a fault ticket is generated based on the first fault classification and a preset work order template, and the equipment maintenance personnel corresponding to the fault ticket are determined, thereby enabling automatic maintenance dispatch. In addition, by receiving a feedback work order sent by the equipment maintenance personnel based on the fault ticket and retraining the pre-trained deep neural network model based on the second fault classification in the feedback work order and the corresponding encoded alarm log, the accuracy of the deep neural network model prediction can be further improved, making the model's prediction effect better, solving the problem that the existing rule-based network fault method has poor robustness and does not associate alarms with faults. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 : is a flow chart of a fault correlation method according to embodiment 1 of the present invention;

[0039] Figure 2 : A schematic diagram of the topology information of the target network according to an embodiment of the present invention;

[0040] Figure 3 : This is a schematic diagram of an alarm log according to an embodiment of the present invention;

[0041] Figure 4 : A schematic structural diagram of a fault correlation device according to embodiment 2 of the present invention;

[0042] Figure 5 : This is a structural diagram of a fault correlation device according to embodiment 3 of the present invention. DETAILED DESCRIPTION

[0043] In order to enable those skilled in the art to better understand the technical solutions of the present invention, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0044] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0045] It is understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments may be combined with each other.

[0046] It can be understood that, for the convenience of description, the drawings of the present invention only show parts related to the present invention, while parts unrelated to the present invention are not shown in the drawings.

[0047] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0048] It will be understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0049] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to various embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented using a hardware-based system that implements the specified functions, or may be implemented using a combination of hardware and computer instructions.

[0050] It can be understood that the units and modules involved in the embodiments of the present invention can be implemented by software or hardware. For example, the units and modules can be located in a processor.

[0051] Example 1:

[0052] This embodiment provides a fault correlation method, such as Figure 1 As shown, the method includes:

[0053] Step S102: Obtain alarm logs of one or more devices and perform word vector encoding on the alarm logs.

[0054] Specifically, the alarm logs of one or more devices may be obtained according to pre-stored topology information of the target network and a preset broad search round.

[0055] In this embodiment, in order to obtain the alarm log, you can first obtain the broad search round number and determine whether the broad search round number is 0. If the broad search round number is 0, then obtain the alarm log of the device to be analyzed. If the broad search round number is not 0, then obtain the alarm log of the device to be analyzed and one or more neighboring devices of the device to be analyzed obtained based on the topology information and the broad search round number. Assume that the topology information of the target network is as follows: Figure 2 As shown, if the broad search round is 0, only the alarm log of the device to be analyzed is obtained. If the broad search round is 1, the alarm logs of the device to be analyzed and device A, device B, and device C, a total of 4 devices, are obtained. If the broad search round is 2, the alarm logs of the device to be analyzed and device A, device B, device C, device A1, device A2, device B1, device B2, device C1, and device C2, a total of 10 devices, are obtained. The broad search round value in the actual scenario can be determined according to the actual topology.

[0056] Optionally, the alarm log of each device includes one or more alarm messages, each alarm message includes the alarm time, alarm location, and alarm content. The alarm log is word-vector encoded, specifically including:

[0057] For each device's alarm log, encode the alarm time, alarm location, and alarm content of each alarm message in the alarm log to form a feature matrix of length m*n, where m is the sum of the number of bits of the encoded alarm time, alarm location, and alarm content, and n is the number of alarm messages;

[0058] The feature matrices of all devices are combined according to a preset uniform size to form a third-order tensor of M*N*k, where M*N is the preset uniform size and k is the number of all feature matrices.

[0059] In this embodiment, alarm logs are generated over time and events. Each device may contain one or more alarm logs, and each alarm log contains one or more alarm information, such as Figure 3 As shown, each alarm message includes three types of information: alarm time, alarm location, and alarm content. Among them, the alarm time can be accurate to milliseconds, the alarm location can be accurate to the sub-device at the CPU level, and the alarm content is a sentence in the original text. For the alarm log of each device, the encoding is based on each alarm message, and the alarm time, alarm location, and alarm content of each alarm message in the alarm log are encoded. In a specific embodiment, as shown in FIG. Figure 3As shown, the alarm time can be expressed using a 17-bit feature vector, the alarm location can be expressed using a 10-bit feature vector, and the alarm content can be expressed using a 197-bit feature vector. After encoding, this forms a feature vector of length m = 224. To standardize the statistical distribution of the sample, all codes in the feature vector can be normalized so that all eigenvalues ​​are distributed in the interval (0, 1). After encoding each device's alarm log, each feature matrix is ​​formed into an m*n feature matrix, where n is the number of alarm messages. Assuming there are k devices, after forming each device's alarm log into an m*n feature matrix (where n can vary for different devices), the k feature matrices are resized to M*N (here M=224, N=224). The combination of all feature matrices forms a 3rd-order tensor of M*N*k.

[0060] Step S104: input the encoded alarm log into a pre-trained deep neural network model to obtain a first fault classification associated with the encoded alarm log.

[0061] In this embodiment, the third-order tensor is input into the pre-trained deep neural network model to obtain the first fault classification associated with the encoded alarm log.

[0062] Optionally, before inputting the encoded alarm log into a pre-trained deep neural network model to obtain a first fault classification associated with the encoded alarm log, the method may further include:

[0063] Obtain historical alarm logs of one or more devices and perform word vector encoding on the historical alarm logs;

[0064] The encoded historical alarm logs and the associated fault classification labels are used as training data to pre-train the deep neural network model to obtain a pre-trained deep neural network model.

[0065] In this embodiment, the pre-trained deep neural network model is obtained by training the encoded historical alarm logs and the associated fault classification labels.

[0066] In this embodiment, the deep neural network model can be a modified visual geometry group VGG16 (Visual Geometry Group 16) model, that is, all maximum pooling layers in the VGG16 model are replaced with average pooling layers, and the last fully connected layer in the VGG16 model is removed to obtain a modified VGG16 model. The original VGG16 model has 13 convolutional layers, 3 fully connected layers, 5 maximum pooling layers and 1 soft-max layer. The modified VGG16 model has 13 convolutional layers, 2 fully connected layers, 5 average pooling layers and 1 soft-max layer. During the average pooling process, the eigenvalues ​​of 0 are discarded and the average value is not calculated. The modified VGG16 model is mainly used for feature extraction and classification discrimination. The part other than the soft-max layer is used for feature extraction, which can be called a feature extraction network. Since the last fully connected layer in the model is removed, the feature extraction network ultimately outputs a 1*1*4096-dimensional feature vector. The soft-max layer is used as a discriminator for classification discrimination. When the M*N*k third-order tensor is input into the modified VGG16 model, the feature extraction network extracts the third-order tensor features and outputs a 4096-dimensional feature vector. After the 4096-dimensional feature vector is input into the discriminator, the discriminator determines the probability of the feature belonging to each fault category. The one with the highest probability is considered to be the first fault category associated with the alarm log input this time. When the probabilities of all categories are lower than a certain threshold (set to 50% in this device, and other scenarios can be set according to actual conditions), it is considered that the fault is not faulty or there is an unknown fault, which may require manual investigation.

[0067] It should be noted that the discriminator uses softmax. If there are i types of faults, a multi-class classification of i+1 categories is performed. Here, no fault is also considered a category. This means that the fault classification is either no fault or one of multiple preset fault categories. The feature extraction network is used to extract features, and softmax supervises the suitability of the features extracted by the feature extraction network. The training process involves the softmax supervision of the feature extraction network, which continuously adjusts its parameters to improve feature extraction performance. Classification performance is evaluated based on the loss value calculated by the loss function of the deep neural network model and the classification accuracy of the training data (labeled data). Only when the loss value is below a certain threshold and the accuracy is above a certain threshold is the overall threshold considered met, and the trained feature extraction network (i.e., the portion of VGG16 excluding the softmax layer) is output. If the overall threshold is not met, the weights of each layer of the feature extraction network are adjusted using the backpropagation algorithm, using stochastic gradient descent, until the threshold is reached.

[0068] Step S106: Generate a fault ticket according to the first fault classification and a preset work order template, and determine the equipment maintenance personnel corresponding to the fault ticket.

[0069] Specifically, if the first fault classification is not no fault, a fault ticket is generated according to the first fault classification and a preset work order template, wherein the fault ticket is used to indicate that a fault corresponding to the first fault classification occurs in one of the one or more devices.

[0070] In this embodiment, fault classifications may include, for example, no fault, unknown service interruption fault, insufficient memory fault, physical disconnection fault, service offline fault, and so on. Assuming the current broad search round is 0 and the first fault classification obtained is an unknown service interruption fault, a fault ticket is generated based on the work order template and input into the work order system. The fault ticket indicates that the device to be analyzed has an unknown service interruption fault. Assuming the current broad search round is 1 and the first fault classification obtained is insufficient memory fault, a fault ticket is generated based on the work order template and input into the work order system. The fault ticket indicates that the device to be analyzed and one or at least one of device A, device B, and device C has an insufficient memory fault. The generated fault ticket is then dispatched to the equipment maintenance personnel to implement automatic maintenance dispatch.

[0071] Optionally, if the broad search round is not 0 and the first fault classification is not no fault, before generating a fault ticket according to the first fault classification and a preset work order template, the method may further include:

[0072] Acquire alarm logs of a portion of the devices from a plurality of devices including the device to be analyzed and adjacent devices as first alarm logs, and perform word vector encoding on the first alarm logs;

[0073] Inputting the encoded first alarm log into a pre-trained deep neural network model to obtain a third fault classification associated with the encoded first alarm log;

[0074] The location range of the fault corresponding to the first fault classification is narrowed down according to the first fault classification and the third fault classification.

[0075] In this embodiment, in order to further narrow the fault location range or accurately locate the fault, the range of the device alarm logs input to the model can be narrowed, that is, the encoded alarm logs of some of the multiple devices are further input into the pre-trained deep neural network model to obtain the corresponding fault classification results (i.e., the third fault classification), and then the fault location range can be further narrowed or the fault can be accurately located based on the obtained fault classification results. Figure 2As shown, assuming that the broad search round is 1 and the first fault classification is a physical disconnection fault, at this time, one broad search round can be reduced, that is, only the alarm log of the device to be analyzed is input into the pre-trained deep neural network model. If the third fault classification obtained is a physical disconnection fault, it proves that a physical disconnection fault has occurred in the device to be analyzed. If the third fault classification is no fault, it proves that a physical disconnection fault has occurred in one or at least one of device A, device B, and device C. At this time, the alarm logs of device A, device B, and device C can be word vector encoded respectively, and the encoded alarm logs can be input into the pre-trained deep neural network model to obtain the corresponding fault classification results, thereby accurately locating the fault. It should be noted that in addition to reducing the number of broad search rounds, you can also use a random selection method to obtain the alarm logs of some of the devices. For example, when the broad search round is 2, it proves that the device to be analyzed and one or at least one of the 10 devices including device A, device B, device C, device A1, device A2, device B1, device B2, device C1, and device C2 has a physical offline fault. At this time, the encoded alarm logs of device A, device A1, and device A2 can be input into the pre-trained deep neural network model to obtain the corresponding fault classification result. If the fault classification result happens to be a physical offline fault, it can be determined that one or at least one of the devices A, device A1, and device A2 has a physical offline fault. At this time, a fault ticket can be generated, or the above steps can be further repeated until the specific device is located and the corresponding fault ticket is generated.

[0076] Step S108: Receive a feedback work order sent by the equipment maintenance personnel based on the fault ticket, and retrain the pre-trained deep neural network model according to the second fault classification in the feedback work order and the corresponding encoded alarm log.

[0077] In this embodiment, after the equipment maintenance personnel handles the fault, they fill out a feedback work order. When receiving the feedback work order sent by the equipment maintenance personnel based on the fault order, the fault classification in the feedback work order, i.e., the second fault classification, is first extracted. The extracted second fault classification is used as a label, and the associated encoded alarm log is used as training data, which is fed back to the pre-trained deep neural network model for retraining. It should be noted that if the maintenance personnel discover a new type of fault upon arrival, this fault will be added to the label item, and the algorithm will be optimized and iterated. That is, at this time, the trained deep neural network model can recognize i+2 type faults, thereby further improving the accuracy of the deep neural network model's predictions, making the model's prediction effect better.

[0078] The fault association method provided in an embodiment of the present invention obtains the alarm logs of one or more devices, performs word vector encoding on the alarm logs, and inputs the encoded alarm logs into a pre-trained deep neural network model to obtain the first fault classification associated with the encoded alarm logs. Since the pre-trained deep neural network model is used for fault association, there is no need to incorporate expert experience or extract rules. Even when new alarms occur, alarm features can still be extracted, which is more robust. At the same time, after determining the first fault classification, a fault ticket is generated based on the first fault classification and a preset work order template, and the equipment maintenance personnel corresponding to the fault ticket are determined, thereby enabling automatic maintenance dispatch. In addition, by receiving a feedback work order sent by the equipment maintenance personnel based on the fault ticket and retraining the pre-trained deep neural network model based on the second fault classification in the feedback work order and the corresponding encoded alarm log, the accuracy of the deep neural network model's prediction can be further improved, resulting in better prediction results. This solves the problem that existing rule-based network fault detection methods have poor robustness and fail to associate alarms with faults.

[0079] Example 2:

[0080] like Figure 4 As shown, this embodiment provides a fault correlation device, including:

[0081] Log encoding module 12, used to obtain alarm logs of one or more devices and perform word vector encoding on the alarm logs;

[0082] The fault association module 14 is connected to the log encoding module 12 and is used to input the encoded alarm log into the pre-trained deep neural network model to obtain the first fault classification associated with the encoded alarm log;

[0083] A work order generation module 16 is connected to the fault association module 14 and is used to generate a fault ticket according to the first fault classification and a preset work order template, and determine the equipment maintenance personnel corresponding to the fault ticket;

[0084] The model retraining module 18 is connected to the work order generation module 16, and is used to receive the feedback work order sent by the equipment maintenance personnel based on the fault order, and retrain the pre-trained deep neural network model according to the second fault classification in the feedback work order and the corresponding encoded alarm log.

[0085] Optionally, the log encoding module 12 specifically includes:

[0086] A log acquisition unit, configured to acquire alarm logs of one or more devices based on pre-stored target network topology information and a preset broad search round;

[0087] The log encoding unit is used to encode the word vector of the alarm log.

[0088] Optionally, the log acquisition unit specifically includes:

[0089] A broad search round determination unit, configured to obtain a broad search round and determine whether the broad search round is 0;

[0090] A first acquisition unit is configured to acquire an alarm log of a device to be analyzed if the broad search round is 0;

[0091] The second acquiring unit is configured to acquire, if the broad search round is not 0, alarm logs of the device to be analyzed and one or more neighboring devices of the device to be analyzed obtained according to the topology information and the broad search round.

[0092] Optionally, the alarm log of each device includes one or more alarm messages, each alarm message includes the alarm time, alarm location, and alarm content, and the log coding unit specifically includes:

[0093] The feature matrix unit is used to encode the alarm time, alarm location, and alarm content of each alarm message in the alarm log of each device to form a feature matrix of length m*n, where m is the sum of the number of bits of the encoded alarm time, alarm location, and alarm content, and n is the number of alarm messages;

[0094] The tensor forming unit is used to combine the feature matrices of all devices according to a preset uniform size to form a third-order tensor of M*N*k, where M*N is the preset uniform size and k is the number of all feature matrices.

[0095] Optionally, it may also include:

[0096] The historical alarm log acquisition module is used to obtain the historical alarm logs of one or more devices and perform word vector encoding on the historical alarm logs;

[0097] The pre-training module is used to pre-train the deep neural network model using the encoded historical alarm logs and the associated fault classification labels as training data to obtain a pre-trained deep neural network model.

[0098] Optionally, the deep neural network model is a modified Visual Geometry Group (VGG16) model, and the apparatus may further include:

[0099] The model modification module is used to replace all maximum pooling layers in the VGG16 model with average pooling layers and remove the last fully connected layer in the VGG16 model to obtain the modified VGG16 model.

[0100] Optionally, the first fault classification is no fault or one of multiple preset fault classifications. The work order generation module 16 is specifically used to generate a fault ticket based on the first fault classification and the preset work order template if the first fault classification is not no fault, and determine the equipment maintenance personnel corresponding to the fault ticket, wherein the fault ticket is used to indicate that a fault corresponding to the first fault classification has occurred in one of one or more devices.

[0101] Optionally, if the broad search round is not 0 and the first fault classification is not no fault, the apparatus may further include:

[0102] a re-encoding module, configured to obtain alarm logs of a portion of the devices from a plurality of devices including the device to be analyzed and adjacent devices as first alarm logs, and perform word vector encoding on the first alarm logs;

[0103] a re-prediction module, configured to input the encoded first alarm log into a pre-trained deep neural network model to obtain a third fault classification associated with the encoded first alarm log;

[0104] The fault locating module is configured to narrow down a locating range of a fault corresponding to the first fault classification according to the first fault classification and the third fault classification.

[0105] Example 3:

[0106] refer to Figure 5 This embodiment provides a fault correlation device, including a memory 22 and a processor 24. The memory 22 stores a computer program, and the processor 24 is configured to run the computer program to execute the fault correlation method in Example 1.

[0107] The memory 22 is connected to the processor 24 . The memory 22 may be a flash memory, a read-only memory, or other memory. The processor 24 may be a central processing unit or a single-chip microcomputer.

[0108] Example 4:

[0109] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the fault correlation method in the above-mentioned embodiment 1 is implemented.

[0110] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0111] The fault association device and computer-readable storage medium provided in Examples 2 to 4 can obtain the first fault classification associated with the encoded alarm log by obtaining the alarm log of one or more devices, performing word vector encoding on the alarm log, and inputting the encoded alarm log into a pre-trained deep neural network model. Since the pre-trained deep neural network model is used for fault association, there is no need to add expert experience or extract rules. Even when a new alarm occurs, the alarm features can still be extracted, which is more robust. At the same time, after determining the first fault classification, a fault ticket is generated according to the first fault classification and a preset work order template, and the equipment maintenance personnel corresponding to the fault ticket are determined, thereby enabling automatic maintenance dispatch. In addition, by receiving the feedback work order sent by the equipment maintenance personnel based on the fault ticket, and retraining the pre-trained deep neural network model based on the second fault classification in the feedback work order and the corresponding encoded alarm log, the accuracy of the deep neural network model prediction can be further improved, making the model's prediction effect better, solving the problem that the existing rule-based network fault method has poor robustness and does not associate alarms with faults.

[0112] It will be understood that the above embodiments are merely exemplary embodiments for illustrating the principles of the present invention, and the present invention is not limited thereto. Those skilled in the art will appreciate that various modifications and improvements can be made without departing from the spirit and substance of the present invention, and such modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A fault correlation method, characterized in that: include: Obtain alarm logs of one or more devices and perform word vector encoding on the alarm logs; Inputting the encoded alarm log into a pre-trained deep neural network model to obtain a first fault classification associated with the encoded alarm log, where the fault classification includes no fault, unknown service interruption fault, insufficient memory fault, physical disconnection fault, and service offline fault; Generate a fault ticket according to the first fault classification and a preset work order template, and determine the equipment maintenance personnel corresponding to the fault ticket, so that the equipment maintenance personnel fills out a feedback work order after handling the fault according to the fault ticket; receiving a feedback work order sent by the equipment maintenance personnel based on the fault ticket, and retraining the pre-trained deep neural network model according to the second fault classification in the feedback work order and the corresponding encoded alarm log; Obtaining the alarm logs of one or more devices specifically includes: Obtaining alarm logs of the one or more devices according to pre-stored target network topology information and a preset broad search round; If the broad search round is not 0 and the first fault classification is not no fault, before generating a fault ticket according to the first fault classification and a preset work order template, the method further includes: Acquire alarm logs of a portion of devices from a plurality of devices including the device to be analyzed and its adjacent devices as first alarm logs by reducing the number of broad search rounds or by random selection, and perform word vector encoding on the first alarm logs; Inputting the encoded first alarm log into a pre-trained deep neural network model to obtain a third fault classification associated with the encoded first alarm log; The location range of the fault corresponding to the first fault classification is narrowed down according to the first fault classification and the third fault classification, and the step of narrowing the fault location range is repeated until a specific device is located.

2. The fault correlation method according to claim 1, characterized in that: The obtaining of the alarm logs of the one or more devices according to the pre-stored topology information of the target network and the preset broad search rounds specifically includes: Obtain the broad search round, and determine whether the broad search round is 0; If the broad search round is 0, obtain the alarm log of the device to be analyzed; If the broad search round is not 0, then obtaining alarm logs of the device to be analyzed and one or more neighboring devices of the device to be analyzed obtained according to the topology information and the broad search round.

3. The fault correlation method according to claim 1, characterized in that: The alarm log of each device includes one or more alarm information, each alarm information includes the alarm time, alarm location and alarm content, and the word vector encoding of the alarm log specifically includes: For each device's alarm log, encode the alarm time, alarm location, and alarm content of each alarm message in the alarm log to form a feature matrix of length m*n, where m is the sum of the number of bits of the encoded alarm time, alarm location, and alarm content, and n is the number of alarm messages; The feature matrices of all devices are combined according to a preset uniform size to form a third-order tensor of M*N*k, where M*N is the preset uniform size and k is the number of all feature matrices.

4. The fault correlation method according to claim 1, characterized in that: Before inputting the encoded alarm log into the pre-trained deep neural network model to obtain the first fault classification associated with the encoded alarm log, the method further includes: Obtain historical alarm logs of one or more devices and perform word vector encoding on the historical alarm logs; The encoded historical alarm logs and the associated fault classification labels are used as training data to pre-train the deep neural network model to obtain the pre-trained deep neural network model.

5. The fault correlation method according to claim 4, characterized in that: The deep neural network model is a modified visual geometry group VGG16 model. Before pre-training the deep neural network model using the encoded historical alarm logs and the associated fault classification labels as training data, the method further includes: All maximum pooling layers in the VGG16 model are replaced with average pooling layers, and the last fully connected layer in the VGG16 model is removed to obtain a modified VGG16 model. The fault correlation method according to claim 1 , wherein: The first fault classification is no fault or one of a plurality of preset fault classifications, and generating a fault ticket according to the first fault classification and a preset work order template specifically includes: If the first fault classification is not no fault, the fault ticket is generated according to the first fault classification and a preset work order template, wherein the fault ticket is used to indicate that a fault corresponding to the first fault classification occurs in one of the one or more devices.

7. A fault correlation device, characterized in that: include: A log encoding module is used to obtain alarm logs of one or more devices and perform word vector encoding on the alarm logs; a fault association module, connected to the log encoding module, configured to input the encoded alarm log into a pre-trained deep neural network model to obtain a first fault classification associated with the encoded alarm log, the fault classification including no fault, unknown service interruption fault, insufficient memory fault, physical disconnection fault, and service offline fault; a work order generation module, connected to the fault association module, for generating a fault ticket based on the first fault classification and a preset work order template, and determining the equipment maintenance personnel corresponding to the fault ticket, so that the equipment maintenance personnel fills out a feedback work order after handling the fault according to the fault ticket; a model retraining module, connected to the work order generation module, configured to receive a feedback work order sent by the equipment maintenance personnel based on the fault order, and retrain the pre-trained deep neural network model according to the second fault classification in the feedback work order and the corresponding encoded alarm log; The log encoding module specifically includes: A log acquisition unit, configured to acquire alarm logs of one or more devices based on pre-stored target network topology information and a preset broad search round; Log encoding unit, used to encode word vectors for alarm logs; If the broad search round is not 0 and the first fault classification is not no fault, the apparatus further includes: a re-encoding module, configured to obtain alarm logs of a portion of devices, including the device to be analyzed and its adjacent devices, as first alarm logs by reducing the number of broad search rounds or randomly selecting the device, and perform word vector encoding on the first alarm logs; a re-prediction module, configured to input the encoded first alarm log into a pre-trained deep neural network model to obtain a third fault classification associated with the encoded first alarm log; The fault location module is used to narrow the location range of the fault corresponding to the first fault category according to the first fault category and the third fault category, and repeat the steps of narrowing the fault location range until a specific device is located.

8. A fault correlation device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the fault correlation method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the fault correlation method according to any one of claims 1 to 6 is implemented.

Images