Faulty equipment determination method and device, storage medium and electronic equipment

Abstract

The present disclosure relates to the field of communication technology, and specifically to a method and device for determining a faulty device, a computer-readable storage medium, and an electronic device, wherein the method comprises: obtaining multiple alarms, and sorting the multiple alarms according to the time information corresponding to the alarms to obtain an alarm sequence, dividing the alarm sequence according to the time window to obtain a first alarm item set, removing the alarms that do not meet the location conditions in the first alarm item set according to the location information of the alarm to obtain a second alarm item set, obtaining at least two alarm devices corresponding to the multiple alarms in the second alarm item set, and calculating the support and confidence between the alarm devices, and determining the faulty device according to the support and confidence between the alarm devices. The technical solution of the embodiment of the present disclosure can solve the problem of low efficiency in determining the faulty device.

Description

Background Art

[0002] Existing communication links are usually composed of multiple devices. During the operation of these devices, some equipment failures are inevitable, affecting the user experience. In related technologies, when a device fails, the faulty device can be determined based on the manually formulated rules for the alarm, or the staff can determine the faulty device based on the experience accumulated in the equipment inspection work, and dispatch the determined faulty device, and the operation and maintenance personnel repair the faulty device according to the dispatch content.

[0003] However, the existing faulty equipment identification scheme relies heavily on manually formulated rules or work experience. As network relationships become more complicated, it is easy to cause mis-dispatching. The number of dispatched orders is large, the workload of operation and maintenance personnel is heavy, and multiple devices need to be checked. The manpower and material costs are high, and the efficiency of faulty equipment identification is low, so related faults cannot be handled in a timely manner, which leads to user complaints.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present disclosure is to provide a method and apparatus for determining a faulty device, a computer-readable storage medium, and an electronic device, which can solve the problem of low efficiency in determining a faulty device.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to a first aspect of the present disclosure, a method for determining a faulty device is provided, comprising: obtaining a plurality of alarms, and sorting the plurality of alarms according to time information corresponding to the alarms to obtain an alarm sequence; dividing the alarm sequence according to a time window to obtain a first alarm item set; eliminating alarms that do not meet location conditions in the first alarm item set according to location information of the alarms to obtain a second alarm item set; obtaining at least two alarm devices corresponding to a plurality of alarms in the second alarm item set, and calculating support and confidence between the alarm devices; and determining the faulty device according to the support and confidence between the alarm devices.

[0008] In an exemplary embodiment of the present disclosure, based on the above-mentioned solution, the time information corresponding to the alarm is the alarm start time.

[0009] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the dividing the alarm sequence according to the time window to obtain the first alarm item set includes: dividing the alarms occurring in the same time window in the alarm sequence into a first alarm item set; according to a sliding time window with a sliding step size for one alarm in the alarm sequence, dividing the alarms in the next time window into another first alarm item set to obtain multiple first alarm item sets.

[0010] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the second alarm item set is obtained by eliminating the alarms that do not meet the location conditions in the first alarm item set according to the location information of the alarm, including: obtaining multiple alarm devices corresponding to multiple alarms in the first alarm item set; obtaining the location information corresponding to the alarm devices, and eliminating the alarms that do not meet the location conditions in the first alarm item set according to the location information corresponding to the multiple alarm devices to obtain the second alarm item set.

[0011] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the second alarm item set is obtained by eliminating alarms that do not meet the location conditions in the first alarm item set according to the location information corresponding to the multiple alarm devices, including: obtaining multiple error alarm devices outside a preset range with the location information corresponding to the benchmark alarm device among the multiple alarm devices as the center; and obtaining the second alarm item set by eliminating the alarms corresponding to the error alarm devices in the first alarm item set.

[0012] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, determining the faulty device according to the support and confidence between the alarm devices includes: when the support and confidence between the alarm devices are greater than a preset threshold, determining that there is a strong correlation between the alarm devices; and determining the faulty device based on the strong correlation.

[0013] In an exemplary embodiment of the present disclosure, based on the above-mentioned scheme, multiple alarms corresponding to the alarm devices with strong correlation are obtained; and the alarm work orders corresponding to the multiple alarms corresponding to the alarm devices with strong correlation are merged and processed.

[0014] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, before sorting the multiple alarms according to the time information corresponding to the alarms to obtain an alarm sequence, the method also includes: obtaining the alarm start time and the alarm end time corresponding to the alarm; determining the alarm duration based on the alarm start time and the alarm end time, and eliminating the alarms whose alarm duration is less than a preset time.

[0015] According to a second aspect of the present disclosure, a faulty device determination apparatus is provided, comprising: an alarm acquisition module, used to acquire multiple alarms, and sort the multiple alarms according to time information corresponding to the alarms to obtain an alarm sequence; a first alarm item set determination module, used to divide the alarm sequence according to a time window to obtain a first alarm item set; a location condition screening module, used to eliminate alarms that do not meet location conditions in the first alarm item set according to location information of the alarm to obtain a second alarm item set; a device data calculation module, used to acquire at least two alarm devices corresponding to multiple alarms in the second alarm item set, and calculate support and confidence between the alarm devices; a faulty device determination module, used to determine the faulty device according to the support and confidence between the alarm devices.

[0016] According to a third aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method for determining a faulty device as described in the first aspect of the above embodiment is implemented.

[0017] According to a fourth aspect of the present disclosure, there is provided an electronic device, including:

[0018] Processor; and

[0019] The memory is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the faulty device determination method as described in the first aspect of the above embodiment.

[0020] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0021] In a faulty device determination method provided in an embodiment of the present disclosure, multiple alarms can be obtained, and the multiple alarms are sorted according to time information corresponding to the alarms to obtain an alarm sequence; the alarm sequence is divided according to a time window to obtain a first alarm item set; according to location information of the alarms, alarms that do not meet location conditions are eliminated in the first alarm item set to obtain a second alarm item set; at least two alarm devices corresponding to multiple alarms in the second alarm item set are obtained, and support and confidence between the alarm devices are calculated; the faulty device is determined based on the support and confidence between the alarm devices.

[0022] On the one hand, it can avoid the reliance on manually set rules or work experience when determining faulty equipment, thereby improving the versatility of faulty equipment determination; on the other hand, it improves the accuracy of faulty equipment determination, thereby improving fault handling efficiency and reducing manpower and material costs, so that faulty equipment can be quickly found and handled, thereby improving the user experience.

[0023] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0025] Figure 1 A schematic diagram schematically shows an exemplary system architecture to which a method for determining a faulty device according to an embodiment of the present disclosure can be applied;

[0026] Figure 2 A flowchart schematically illustrates a method for determining a faulty device in an exemplary embodiment of the present disclosure;

[0027] Figure 3 A schematic diagram schematically shows a method of dividing an alarm in an alarm sequence into another alarm item set to obtain multiple first alarm item sets according to an alarm in an exemplary embodiment of the present disclosure as a sliding time window with a sliding step length;

[0028] Figure 4 A flowchart schematically illustrates obtaining location information corresponding to an alarm device and eliminating alarms that do not meet location conditions in a first alarm item set according to location information corresponding to multiple alarm devices to obtain a second alarm item set in an exemplary embodiment of the present disclosure;

[0029] Figure 5 A flowchart schematically illustrates how to remove the alarm corresponding to the error alarm device from the first alarm item set to obtain the second alarm item set in an exemplary embodiment of the present disclosure;

[0030] Figure 6 A flowchart schematically shows a method of determining that there is a strong correlation between alarm devices and determining a faulty device based on the strong correlation when the support and confidence between the alarm devices are greater than a preset threshold in an exemplary embodiment of the present disclosure;

[0031] Figure 7 A flowchart schematically illustrates a process of merging alarm work orders corresponding to multiple alarms corresponding to faulty equipment with a strong correlation in an exemplary embodiment of the present disclosure;

[0032] Figure 8 A schematic diagram schematically shows how to determine the alarm duration according to the alarm start time and the alarm end time in an exemplary embodiment of the present disclosure, and remove alarms whose alarm duration is less than a preset time;

[0033] Fig. 9 A schematic diagram schematically shows the composition of a device for determining a faulty device in an exemplary embodiment of the present disclosure;

[0034] Fig.10 The structure diagram of a computer system suitable for implementing the electronic device of the exemplary embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0035] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concept of the example embodiments will be fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In addition, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known structures, methods, devices, implementations, materials, or operations are not shown or described in detail to avoid blurring various aspects of the present disclosure.

[0036] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or these functional entities or parts of functional entities may be implemented in one or more software hardened modules, or these functional entities may be implemented in different networks and / or processor devices and / or microcontroller devices.

[0037] Figure 1 A schematic diagram showing an exemplary system architecture to which the method for determining a faulty device according to an embodiment of the present disclosure can be applied is shown.

[0038] like Figure 1 As shown, the system architecture 1000 may include one or more of terminal devices 1001, 1002, 1003, a network 1004, and a server 1005. The network 1004 is used to provide a medium for communication links between the terminal devices 1001, 1002, 1003 and the server 1005. The network 1004 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0039] It should be understood that Figure 1The number of terminal devices, networks and servers in the embodiment is only for illustration. According to the implementation requirements, there may be any number of terminal devices, networks and servers. For example, the server 1005 may be a server cluster composed of multiple servers.

[0040] Users can use terminal devices 1001, 1002, 1003 to interact with server 1005 through network 1004 to receive or send messages, etc. Terminal devices 1001, 1002, 1003 can be various electronic devices with display screens, including but not limited to smart phones, tablet computers, portable computers, desktop computers, etc. In addition, server 1005 can be a server that provides various services.

[0041] In one embodiment, the execution subject of the faulty device determination method of the present disclosure may be an embodiment of the server 1005, and the server 1005 may obtain the alarms sent by the terminal devices 1001, 1002, and 1003, and process the alarms according to the faulty device determination method of the present disclosure, and then return the processed faulty devices to the terminal devices 1001, 1002, and 1003. In addition, the faulty device determination method of the present disclosure may also be executed by the terminal devices 1001, 1002, 1003, etc., so as to realize the process of obtaining the faulty device according to the alarm sequence obtained by sorting the alarms.

[0042] In addition, the implementation process of the faulty device determination method disclosed in the present invention can also be implemented by the terminal devices 1001, 1002, 1003 and the server 1005. For example, the terminal devices 1001, 1002, 1003 can obtain multiple alarms, and sort the multiple alarms according to the time information corresponding to the alarms to obtain an alarm sequence; divide the alarm sequence according to the time window to obtain a first alarm item set; remove the alarms that do not meet the location conditions in the first alarm item set according to the location information of the alarm to obtain a second alarm item set; obtain at least two alarm devices corresponding to the multiple alarms in the second alarm item set, and calculate the support and confidence between the alarm devices, and then send the obtained support and confidence between the alarm devices to the server 1005, so that the server 1005 can determine the faulty device according to the support and confidence between the alarm devices.

[0043] In related technologies, when a device fails (such as power outage, link interruption, device performance indicator overload, device board failure), the faulty device can be determined based on manually formulated rules based on the alarm. Alternatively, the staff can determine the faulty device based on the experience accumulated in the equipment inspection work and assign an order to the determined faulty device. The operation and maintenance personnel will repair the faulty equipment based on the content of the order.

[0044] However, the existing faulty equipment identification scheme relies heavily on manually formulated rules or work experience. As network relationships become more complicated, it is easy to mis-dispatch orders. For example, when an alarm occurs in the power environment system, an alarm will also occur in the base station. At this time, alarms will be issued for both the power environment system and the base station. This will result in a large number of dispatches, a large workload for operation and maintenance personnel, and the need to troubleshoot multiple devices. The manpower and material costs are high, and the efficiency of faulty equipment identification is low, so related faults cannot be handled in a timely manner, which leads to user complaints.

[0045] According to the faulty device determination method provided in this exemplary embodiment, multiple alarms can be obtained, and the multiple alarms are sorted according to the time information corresponding to the alarms to obtain an alarm sequence. The alarm sequence is divided according to the time window to obtain a first alarm item set, and the alarms that do not meet the location conditions are eliminated in the first alarm item set according to the location information of the alarm to obtain a second alarm item set, and at least two alarm devices corresponding to multiple alarms in the second alarm item set are obtained, and the support and confidence between the alarm devices are calculated, and the faulty device is determined according to the support and confidence between the alarm devices. Figure 2 As shown, the method for determining a faulty device may include the following steps:

[0046] Step S210, obtaining multiple alarms, and sorting the multiple alarms according to time information corresponding to the alarms to obtain an alarm sequence;

[0047] Step S220, dividing the alarm sequence according to the time window to obtain a first alarm item set;

[0048] Step S230, removing alarms that do not meet the location condition from the first alarm item set according to the location information of the alarms to obtain a second alarm item set;

[0049] Step S240, obtaining at least two alarm devices corresponding to the multiple alarms in the second alarm item set, and calculating the support and confidence between the alarm devices;

[0050] Step S250: determining the faulty device according to the support and confidence between the alarm devices.

[0051] In the faulty device determination method provided in this example implementation, the faulty device can be determined based on the support and confidence between the alarm devices. On the one hand, the reliance on manually set rules or work experience when determining the faulty device can be avoided, and the versatility of the faulty device determination is improved; on the other hand, the accuracy of the faulty device determination is improved, thereby improving the efficiency of fault handling, and reducing the cost of manpower and material resources, so that the faulty device can be quickly found and handled, thereby improving the user experience.

[0052] Next, steps S210 to S250 of the method for determining a faulty device in this exemplary embodiment will be described in more detail with reference to the accompanying drawings and embodiments.

[0053] Step S210, obtaining multiple alarms, and sorting the multiple alarms according to time information corresponding to the alarms to obtain an alarm sequence;

[0054] In an exemplary embodiment of the present disclosure, an alarm may include alarm data generated when an abnormality occurs in a device. Specifically, the device may include a device involved in a mobile communication link. For example, the device may include a wireless base station, a transmission device, a bearer network, a core network, etc. It should be noted that the present disclosure does not specifically limit the type of device.

[0055] In an example embodiment of the present disclosure, multiple alarms can be obtained. Specifically, the alarms can be obtained directly. For example, after a device fails, the alarm can be sent directly to the subject executing the present solution through a monitoring device that monitors the failed device; or, the alarm can be obtained indirectly. For example, after a device fails, the alarm can be sent to an intelligent network management system, and multiple alarms can be obtained from the intelligent network management system. It should be noted that the present disclosure does not specifically limit the specific method of obtaining multiple alarms and the source of the alarms.

[0056] Furthermore, the intelligent network management system can save the alarm-related data into the ORACLE database, and when the alarm is obtained, the alarm can be exported through the SQOOP method.

[0057] Furthermore, when obtaining an alarm, the alarm can be obtained in real time; or, the alarm can be obtained at preset intervals. Specifically, a polling time can be set, and every time the polling time passes, the monitoring device or intelligent network management system of the device can be accessed to obtain these newly triggered alarms. For example, the polling time is set to 5 seconds, that is, the monitoring device or intelligent network management system of the device is accessed every 5 seconds to obtain the newly triggered alarms in the 5 seconds before the current moment. It should be noted that the present disclosure does not make any special limitation on the polling time.

[0058] Furthermore, after obtaining multiple alarms, the data involved in the alarms can be processed. Specifically, the data can be unified. For example, the data involved in the alarms can be stored in a pickle manner; or, base64 can be used to encode the data involved in the alarms. The processed data involved in the alarms loads faster and is more stable when executing the scheme of the present disclosure. It should be noted that the present disclosure does not specifically limit the way in which the data involved in the alarms is processed.

[0059] In an exemplary embodiment of the present disclosure, multiple alarms are sorted according to the time information corresponding to the alarms to obtain an alarm sequence. Specifically, multiple alarms can be sorted according to the alarm start time corresponding to the alarm to obtain an alarm sequence. That is, the alarm start time corresponding to the alarm can be obtained, and the alarms are sorted in sequence according to the alarm start time to obtain an alarm sequence. For example, the 5 alarms obtained and the corresponding alarm start times are Alarm A-June 25, 2021 13:45, Alarm B-June 25, 2021 11:25, Alarm C-June 25, 2021 14:30, Alarm D-June 25, 2021 16:30, Alarm E-

[0060] At 14:25 on June 25, 2021, the five alarms can be sorted according to their alarm start time, that is, after sorting, the alarm sequence of Alarm B, Alarm A, Alarm E, Alarm C, and Alarm D is obtained.

[0061] Furthermore, before sorting multiple alarms according to the time information corresponding to the alarms to obtain an alarm sequence, the multiple alarms may be screened to obtain alarms that meet the preset conditions. For example, an alarm device whitelist may be set, and if the device corresponding to the acquired alarm is a device in the alarm device whitelist, all alarms corresponding to the device may be removed. It should be noted that the present disclosure does not specifically limit the specific content of the preset conditions.

[0062] Step S220, dividing the alarm sequence according to the time window to obtain a first alarm item set;

[0063] In an exemplary embodiment of the present disclosure, after the alarms are sorted to obtain an alarm sequence, the alarm sequence can be divided according to a time window to obtain a first alarm item set. Specifically, the time window can be set according to business experience, that is, the time window can be used to indicate that the alarms occurring within this period of time may be associated, so the alarms within this period of time are divided into a first alarm item set for analysis. Specifically, the first alarm item set can be obtained by randomly dividing the alarm sequence according to the time window, or the first alarm item set can be obtained by dividing the alarm sequence according to a preset division rule. Further, when dividing, the alarm sequence can be divided according to the time window to obtain a first alarm item set, or the alarm sequence can be divided according to the time window to obtain multiple first alarm item sets.

[0064] For example, the alarm sequence includes alarm D-13:45 on June 25, 2021, alarm A-13:46 on June 25, 2021, alarm B-13:47 on June 25, 2021, alarm E-13:48 on June 25, 2021, alarm F-13:49 on June 25, 2021, alarm C-13:50 on June 25, 2021, alarm H-13:51 on June 25, 2021, and alarm G-13:52 on June 25, 2021. The acquired time window is 300 seconds. At this time, the alarm sequence is randomly divided according to the time window, and the first alarm item set obtained is alarm B, alarm E, alarm F, alarm C, and alarm H. It should be noted that the present disclosure does not impose any special limitation on the specific manner of dividing the alarm sequence according to the time window to obtain the first alarm item set and the number of the divided first alarm item sets.

[0065] In an exemplary embodiment of the present disclosure, alarms occurring in the same time window in an alarm sequence may be divided into a first alarm item set, and according to a sliding step sliding time window for one alarm in the alarm sequence, the alarm in the next time window may be divided into another first alarm item set to obtain multiple first alarm item sets. Figure 3 As shown, according to an alarm in the alarm sequence as a sliding time window with a sliding step, the alarm in the next time window is divided into another alarm item set to obtain multiple first alarm item sets, which may include the following steps S310-S320:

[0066] Step S310, dividing the alarms occurring in the same time window in the alarm sequence into an alarm item set;

[0067] In an exemplary embodiment of the present disclosure, alarms occurring in the same time window in an alarm sequence may be divided into an alarm item set. Specifically, alarms occurring in the same time window in an alarm sequence may be divided into an alarm item set at any position in the alarm sequence. For example, the alarm item set may be divided into an alarm item set according to a time window starting from the first alarm in the alarm sequence, or the alarm item set may be divided into an alarm item set according to a time window starting from the last alarm in the alarm sequence. It should be noted that the present disclosure does not specifically limit the specific manner of dividing alarms occurring in the same time window in an alarm sequence into an alarm item set.

[0068] Step S320: according to one alarm in the alarm sequence as a sliding time window with a sliding step, the alarm in the next time window is divided into another first alarm item set to obtain multiple first alarm item sets.

[0069] In an exemplary embodiment of the present disclosure, a time window may be slid according to a sliding step size of one alarm in the alarm sequence, and the alarm in the next time window may be divided into another first alarm item set to obtain multiple first alarm item sets. Specifically, the next time window may refer to sliding the time window in the direction of sliding backward of the alarm sequence, or may refer to sliding the time window in the direction of sliding forward of the alarm sequence.

[0070] For example, when the alarm item set is divided according to the time window with the first alarm in the alarm sequence as the starting point, the time window can be slid backward by one alarm in the direction of the alarm sequence sliding backward. For example, the alarm sequence includes alarm A-June 25, 2021 13:47, alarm B-June 25, 2021 13:48, alarm C-June 25, 2021 13:49, alarm D-June 25, 2021 13:50, alarm E-June 25, 2021 13:51, alarm F-June 25, 2021 13:52, alarm G-June 25, 2021 At 13:53 on the 5th, with alarm A in the alarm sequence as the starting point, the alarm is divided into a first alarm item set of alarm A, alarm B, alarm C, alarm D, and alarm E according to a time window of 300 seconds. At this time, the time window is slid with one alarm in the alarm sequence as the sliding step. The corresponding first alarm item set in the next time window includes alarms B, alarm C, alarm D, alarm E, and alarm F. Multiple first alarm item sets can be obtained by analogy. It should be noted that the present disclosure does not specifically limit the sliding method of the time window.

[0071] Furthermore, the alarm sequence can be divided in a concurrent manner to obtain multiple first alarm item sets. For example, the alarm sequence includes 100 alarms, and the server executing this solution has a 4-core processor. At this time, 4 processes can be started, and 25 alarms can be placed in each process to divide the alarm sequence to obtain multiple first alarm item sets. It should be noted that the present disclosure does not specifically limit the specific method of concurrent processing.

[0072] Through the above steps S310 to S320, the alarms occurring in the same time window in the alarm sequence can be divided into a first alarm item set, and according to a sliding time window with a sliding step length of one alarm in the alarm sequence, the alarms in the next time window can be divided into another first alarm item set to obtain multiple first alarm item sets.

[0073] Step S230, removing alarms that do not meet the location condition from the first alarm item set according to the location information of the alarms to obtain a second alarm item set;

[0074] In an exemplary embodiment of the present disclosure, after the alarm sequence is divided to obtain the first alarm item set, the alarms that do not meet the location conditions can be eliminated in the first alarm item set according to the location information of the alarm to obtain the second alarm item set. Specifically, the location information of the alarm can be used to indicate the location of the device corresponding to the triggering alarm. If the location information corresponding to the alarms is close, it means that the alarms may be correlated, and if the location information corresponding to the alarms is far apart, it means that the alarms may not be correlated. Therefore, the alarms that do not meet the location conditions can be eliminated in the first alarm item set to obtain the second alarm item set. For example, the distance between the location information of alarm A and the location information of alarm B is C, that is, the distance C between the two alarms is greater than the preset distance. When alarm A is a benchmark alarm, alarm B can be eliminated, and when alarm B is a benchmark, alarm A can be eliminated. It should be noted that the present disclosure does not specifically limit the specific content of the location condition.

[0075] In an exemplary embodiment of the present disclosure, multiple alarm devices corresponding to multiple alarms in the first alarm item set may be obtained, and location information corresponding to the alarm devices may be obtained. Alarms that do not meet the location conditions may be eliminated from the first alarm item set according to the location information corresponding to the multiple alarm devices to obtain a second alarm item set. Figure 4 As shown, the location information corresponding to the alarm device is obtained, and the alarms that do not meet the location conditions are eliminated from the first alarm item set according to the location information corresponding to the multiple alarm devices to obtain the second alarm item set. The following steps S410 to S420 may be included:

[0076] Step S410, obtaining multiple alarm devices corresponding to multiple alarms in the first alarm item set;

[0077] In an exemplary embodiment of the present disclosure, multiple alarm devices corresponding to multiple alarms in the first alarm item set may be obtained. Specifically, the multiple alarms in the first alarm item set are all generated by the alarm device, so the alarm device corresponding to the alarm may be obtained. For example, the alarm may correspond to a device code, that is, the alarm device may be determined by the device code. It should be noted that the present disclosure does not specifically limit the method for obtaining multiple alarm devices corresponding to multiple alarms in the first alarm item set.

[0078] Step S420: acquiring location information corresponding to the alarm device, and removing alarms that do not meet the location condition from the first alarm item set according to the location information corresponding to the plurality of alarm devices to obtain a second alarm item set.

[0079] In an example embodiment of the present disclosure, after obtaining multiple alarm devices corresponding to multiple alarms in the first alarm item set, the location information corresponding to the alarm device can be obtained. Specifically, the location information corresponding to the alarm device may include the latitude and longitude information of the alarm device, and may also include the name of the alarm device, and the location information corresponding to the alarm device can be determined by the name of the alarm device. For example, the name of a certain alarm device is XX Base Station, D Street, C District, B City, and the location information of the alarm device can be determined according to the name. It should be noted that the present disclosure does not specifically limit the location information corresponding to the alarm device and the specific method of obtaining the location information corresponding to the alarm device.

[0080] In an exemplary embodiment of the present disclosure, after determining the location information corresponding to the alarm device, the alarms that do not meet the location conditions can be eliminated from the first alarm item set based on the location information corresponding to multiple alarm devices to obtain a second alarm item set. Specifically, it can be determined whether the location conditions are met between the alarm devices, and the alarms corresponding to the alarm devices that do not meet the location conditions are eliminated to obtain the second alarm item set. For example, the location conditions may include whether the distance between the alarm devices is greater than a preset distance, that is, when the distance between the two alarm devices is greater than the preset distance, it is determined that one of the two alarm devices does not meet the location conditions, and the alarm corresponding to the alarm device that does not meet the location conditions is eliminated to obtain the second alarm item set. It should be noted that the present disclosure does not specifically limit the specific content of the location conditions.

[0081] Through the above steps S410 to S420, multiple alarm devices corresponding to multiple alarms in the first alarm item set can be obtained, and the location information corresponding to the alarm devices can be obtained. According to the location information corresponding to the multiple alarm devices, the alarms that do not meet the location conditions are eliminated in the first alarm item set to obtain the second alarm item set.

[0082] In an exemplary embodiment of the present disclosure, the location information corresponding to the reference alarm device among the multiple alarm devices can be used as the center to obtain multiple error alarm devices outside the preset range, and the alarms corresponding to the error alarm devices can be eliminated from the first alarm item set to obtain the second alarm item set. Figure 5 As shown, removing the alarm corresponding to the error alarm device from the first alarm item set to obtain the second alarm item set may include the following steps S510 to S520:

[0083] Step S510, taking the location information corresponding to the reference alarm device among the multiple alarm devices as the center, acquiring multiple error alarm devices outside the preset range;

[0084] In an example embodiment of the present disclosure, multiple error alarm devices outside a preset range can be obtained with the location information corresponding to a benchmark alarm device among multiple alarm devices as the center. Specifically, when determining the benchmark alarm device among multiple alarm devices, the determination can be made based on business experience; or, the alarm device with the largest number of alarms can be used as the benchmark alarm device. It should be noted that the present disclosure does not specifically limit the method for determining the benchmark alarm device. After the benchmark alarm device is determined, the location information corresponding to the benchmark alarm device can be obtained at this time, and based on the location information corresponding to the benchmark alarm device as the center, a preset range centered on the location information corresponding to the benchmark alarm device is determined, and multiple error alarm devices outside the preset range are obtained. It should be noted that the present disclosure does not specifically limit the specific numerical value of the preset range.

[0085] Step S520: Eliminate the alarm corresponding to the error alarm device from the first alarm item set to obtain a second alarm item set.

[0086] In an exemplary embodiment of the present disclosure, after acquiring multiple error alarm devices outside a preset range, the alarm corresponding to the error alarm device can be eliminated from the first alarm item set to obtain a second alarm item set. Specifically, when the location information corresponding to two alarm devices is far apart, it can be determined that there is no correlation between the two alarm devices. In this case, the alarm corresponding to the error alarm device can be eliminated from the first alarm item set to obtain the second alarm item set.

[0087] For example, the first alarm item set includes alarm A, alarm B, alarm C, alarm D, and alarm E. Alarm A and alarm B correspond to device 1, alarm C and alarm D correspond to device 2, and alarm E corresponds to device 3. Device 1 is used as the benchmark alarm device, the preset range is 500 meters, the distance between device 1 and device 2 is 300 meters, and the distance between device 1 and device 3 is 800 meters. At this time, alarm E corresponding to device 3 can be eliminated from the first alarm item set to obtain the second alarm item set, where the second alarm item set includes alarm A, alarm B, alarm C, and alarm D.

[0088] Through the above steps S510 to S520, multiple error alarm devices outside the preset range can be obtained with the location information corresponding to the benchmark alarm device among the multiple alarm devices as the center, and the alarms corresponding to the error alarm devices can be eliminated from the first alarm item set to obtain the second alarm item set, which can avoid the problem that the alarms corresponding to the error alarm devices reduce the efficiency of determining the faulty equipment.

[0089] Step S240, obtaining at least two alarm devices corresponding to the multiple alarms in the second alarm item set, and calculating the support and confidence between the alarm devices;

[0090] In an exemplary embodiment of the present disclosure, after obtaining the second alarm item set, at least two alarm devices corresponding to multiple alarms in the second alarm item set can be obtained. Specifically, the second alarm item set includes multiple alarms, and the multiple alarms correspond to different alarm devices. For example, the second alarm item set includes alarm A, alarm B, alarm C, alarm D, and alarm E. Alarm A and alarm B correspond to device 1, alarm C and alarm D correspond to device 2, and alarm E corresponds to device 3. Then, three alarm devices corresponding to these five alarms can be obtained. Specifically, when obtaining at least two alarm devices corresponding to multiple alarms in the second alarm item set, the alarm device can be determined according to the code corresponding to the alarm; or, the alarm device can be determined according to the alarm name corresponding to the alarm. It should be noted that the present disclosure does not specifically limit the method of obtaining at least two alarm devices corresponding to multiple alarms in the second alarm item set.

[0091] After obtaining the alarm devices, the support and confidence between the alarm devices can be calculated. The support of the alarm device can be used to indicate the probability that the A alarm device and the B alarm device fail at the same time, where Support = P(A&B); the confidence of the alarm device can be used to indicate the probability that the B alarm device fails when the A alarm device fails, or the confidence of the alarm device can be used to indicate the probability that the A alarm device fails when the B alarm device fails, where Confidence = P(A&

[0092] B) / P(A).

[0093] In an exemplary embodiment of the present disclosure, the support and confidence between multiple alarm devices are calculated. For example, the second alarm item set includes alarm A, alarm B, alarm C, alarm D, and alarm E. Alarm A and alarm B correspond to device 1, alarm C and alarm D correspond to device 2, and alarm E corresponds to device 3. At this time, the support and confidence between device 1 and device 2, the support and confidence between device 1 and device 3, the support and confidence between device 2 and device 3, the support and confidence between device 3 and device 1, the support and confidence between device 3 and device 2, and the support and confidence between device 2 and device 1 can be calculated.

[0094] After the calculation is completed, the result of the calculation can be stored in HDFS (distributed file system). Specifically, HDFS has the characteristics of high fault tolerance and can provide high throughput to access application data, which is suitable for applications with very large data sets. HDFS relaxes the requirements of POSIX so that data in the file system can be accessed in the form of streams. And the results are finally generated through hive, where hive is a data warehouse tool based on Hadoop, which is used for data extraction, transformation, and loading. This is a mechanism that can store, query and analyze large-scale data stored in Hadoop. It should be noted that the present disclosure does not specifically limit the specific method of calculating the support and confidence between alarm devices.

[0095] Furthermore, in order to simplify the computational complexity, the 1v1 mode can be used for computation. For example, based on the above example, device 1, device 2, and device 3 need to calculate the support and confidence between the devices six times, while the 1v1 mode means that only the support and confidence between device 1 and device 2, the support and confidence between device 1 and device 3, and the support and confidence between device 2 and device 3 are calculated, which can reduce the amount of computation and improve computational efficiency. Furthermore, when generating 1v1 data, the 1v1 data can be obtained by using the Cartesian product and deduplication method.

[0096] Step S250: determining the faulty device according to the support and confidence between the alarm devices.

[0097] In an exemplary embodiment of the present disclosure, after the support and confidence between the alarm devices are obtained through the above steps, the faulty device can be determined according to the support and confidence between the alarm devices. Specifically, when the support and confidence between the alarm devices are greater than a preset threshold, the faulty device is determined in the alarm device according to the support and confidence between the alarm devices. It should be noted that the present disclosure does not specifically limit the specific method of determining the faulty device according to the support and confidence between the alarm devices.

[0098] In an exemplary embodiment of the present disclosure, when the support and confidence between the alarm devices are greater than a preset threshold, it is determined that there is a strong correlation between the alarm devices, and the faulty device is determined based on the strong correlation. Figure 6 As shown, when the support and confidence between the alarm devices are greater than a preset threshold, determining that there is a strong correlation between the alarm devices, and determining the faulty device according to the strong correlation may include the following steps S610-S620:

[0099] Step S610, when the support and confidence between the alarm devices are greater than a preset threshold, it is determined that there is a strong correlation between the alarm devices;

[0100] In an exemplary embodiment of the present disclosure, after obtaining the support and confidence between the alarm devices through the above steps, it can be determined whether the support and confidence between the alarm devices are greater than the preset threshold. Specifically, if the support and confidence between the alarm devices are greater than the preset threshold, it can be determined that there is a strong correlation between the alarm devices. A strong correlation means that when an alarm device fails, another alarm device will also fail. Among them, the preset threshold can be set according to manual experience, or the preset threshold can be determined through machine learning and simulation experiments. For example, when the support between the alarm devices is greater than 0.4 and the confidence between the alarm devices is greater than 0.8, it is determined that there is a strong correlation between the alarm devices. It should be noted that the present disclosure does not specifically limit the specific value of the preset threshold.

[0101] Step S620: determine the faulty device based on the strong correlation.

[0102] In an exemplary embodiment of the present disclosure, after determining that there is a strong correlation between the alarm devices through the above steps, the faulty device can be determined based on the strong correlation. Specifically, the confidences between the alarm devices can be compared, and the alarm device with a larger confidence value can be determined as the faulty device. For example, when alarm device 1 fails, the probability of alarm device 2 failing is 0.9, that is, the confidence is 0.9. When alarm device 2 fails, the probability of alarm device 1 failing is 0.8, that is, the confidence is 0.8. At this time, the faulty device can be determined to be alarm device 1. It should be noted that the present disclosure does not specifically limit the method of determining the faulty device based on the strong correlation.

[0103] Through the above steps S610 to S620, when the support and confidence between the alarm devices are greater than the preset threshold, it is determined that there is a strong correlation between the alarm devices, and the faulty device is determined based on the strong correlation.

[0104] In an exemplary embodiment of the present disclosure, multiple alarms corresponding to alarm devices with strong correlations may be obtained, and the alarm work orders corresponding to the multiple alarms corresponding to the alarm devices with strong correlations may be merged. Figure 7 As shown, merging the alarm work orders corresponding to multiple alarms corresponding to faulty devices with strong correlation may include the following steps S710 to S720:

[0105] Step S710, obtaining multiple alarms corresponding to alarm devices having a strong correlation;

[0106] Step S720: merging the alarm work orders corresponding to multiple alarms corresponding to the alarm devices having a strong correlation.

[0107] In an example embodiment of the present disclosure, multiple alarms corresponding to alarm devices with strong correlations can be obtained, and the alarm work orders corresponding to the multiple alarms corresponding to the alarm devices with strong correlations can be merged. Specifically, the alarm device can correspond to an alarm work order, which can be used to indicate the fault content. The alarm work orders corresponding to the alarm devices can be obtained, and these alarm work orders can be merged. For example, the alarm work order corresponding to the non-faulty device can be deleted, or the alarm work order corresponding to the non-faulty device can be integrated into the alarm work order corresponding to the faulty device, which can indicate that the alarm work order corresponding to the non-faulty device is caused by the faulty device, and the alarm work order corresponding to the non-faulty device can be resolved as long as the faulty device is repaired.

[0108] Through the above steps S710 to S720, multiple alarms corresponding to alarm devices with strong correlation can be obtained, and the alarm work orders corresponding to the multiple alarms corresponding to alarm devices with strong correlation can be merged and processed, which can reduce the number of alarm work orders and improve fault handling efficiency.

[0109] In an exemplary embodiment of the present disclosure, the alarm start time and the alarm end time corresponding to the alarm may be obtained, and the alarm duration is determined according to the alarm start time and the alarm end time, and the alarms whose alarm duration is less than the preset time are eliminated. Figure 8 As shown, determining the alarm duration according to the alarm start time and the alarm end time, and eliminating the alarm whose alarm duration is less than the preset time, may include the following steps S810-S820:

[0110] Step S810, obtaining the alarm start time and alarm end time corresponding to the alarm;

[0111] In an example embodiment of the present disclosure, the alarm start time and the alarm end time corresponding to the alarm can be obtained. Specifically, the alarm start time and the alarm end time corresponding to the alarm can be stored in the intelligent network management system. When the alarm start time and the alarm end time corresponding to the alarm are needed, the alarm start time and the alarm end time corresponding to the alarm can be called in the intelligent network management system. It should be noted that the present disclosure does not specifically limit the method for obtaining the alarm start time and the alarm end time corresponding to the alarm.

[0112] Step S820, determining the alarm duration according to the alarm start time and the alarm end time, and eliminating alarms whose alarm duration is less than a preset time.

[0113] In an example embodiment of the present disclosure, after obtaining the alarm start time and the alarm end time corresponding to the alarm, the alarm duration can be determined according to the alarm start time and the alarm end time. Specifically, the difference between the alarm start time and the alarm end time can be calculated, and the alarm duration can be determined according to the difference. For example, the alarm start time is 13:50 on June 25, 2021, and the alarm end time is 13:52 on June 25, 2021, that is, the alarm duration is 2 minutes. It should be noted that the present disclosure does not specifically limit the method for determining the alarm duration.

[0114] In an example embodiment of the present disclosure, after determining the alarm duration, alarms with an alarm duration shorter than a preset time may be eliminated. Specifically, a shorter alarm duration indicates that the fault corresponding to the alarm has been repaired. Therefore, alarms with a shorter alarm duration need to be eliminated to avoid these alarms from affecting the determination of the faulty device. Specifically, the preset time may be determined based on business experience, or the preset time may be determined through simulation experiments. It should be noted that the present disclosure does not specifically limit the specific value of the preset time.

[0115] Through the above steps S810 to S820, the alarm start time and alarm end time corresponding to the alarm can be obtained, and the alarm duration is determined according to the alarm start time and the alarm end time, and alarms with an alarm duration less than a preset time are eliminated.

[0116] According to the faulty device determination method provided in this exemplary embodiment, multiple alarms can be obtained, and the multiple alarms can be sorted according to the time information corresponding to the alarms to obtain an alarm sequence. The alarm sequence is divided according to the time window to obtain a first alarm item set, and according to the location information of the alarm, the alarms that do not meet the location conditions are eliminated in the first alarm item set to obtain a second alarm item set, and at least two alarm devices corresponding to the multiple alarms in the second alarm item set are obtained, and the support and confidence between the alarm devices are calculated, and the faulty device is determined based on the support and confidence between the alarm devices.

[0117] On the one hand, it can avoid the reliance on manually set rules or work experience when determining faulty equipment, thereby improving the versatility of faulty equipment determination; on the other hand, it improves the accuracy of faulty equipment determination, thereby improving fault handling efficiency and reducing manpower and material costs, so that faulty equipment can be quickly found and handled, thereby improving the user experience.

[0118] In addition, this solution is highly versatile. For device failure determination scenarios with topological structure information, it is only necessary to determine the information entropy of the alarm node calculated based on the user-perceived indicator information, and this can be used to determine the faulty nodes in different scenarios.

[0119] It should be noted that the above figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0120] In addition, in an exemplary embodiment of the present disclosure, a faulty device determining apparatus is also provided. Fig. 9 As shown, a faulty equipment determination device 900 includes: an alarm acquisition module 910, a first alarm item set determination module 920, a location condition screening module 930, an equipment data calculation module 940, and a faulty equipment determination module 950.

[0121] Among them, the alarm acquisition module 910 is used to obtain multiple alarms, and sort the multiple alarms according to the time information corresponding to the alarms to obtain an alarm sequence; the first alarm item set determination module 920 is used to divide the alarm sequence according to the time window to obtain a first alarm item set; the location condition screening module 930 is used to eliminate the alarms that do not meet the location conditions in the first alarm item set according to the location information of the alarm to obtain a second alarm item set; the equipment data calculation module 940 is used to obtain at least two alarm devices corresponding to multiple alarms in the second alarm item set, and calculate the support and confidence between the alarm devices; the faulty device determination module 950 is used to determine the faulty device according to the support and confidence between the alarm devices.

[0122] In an exemplary embodiment of the present disclosure, based on the above-mentioned solution, the time information corresponding to the alarm is the alarm start time.

[0123] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the alarm sequence is divided according to the time window to obtain a first alarm item set, and the device also includes: a first alarm item set division unit, used to divide the alarms occurring in the same time window in the alarm sequence into a first alarm item set; a time window sliding unit, used to slide the time window according to a sliding step size of one alarm in the alarm sequence, and divide the alarm in the next time window into another first alarm item set to obtain multiple first alarm item sets.

[0124] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, alarms that do not meet the location conditions are eliminated in the first alarm item set according to the location information of the alarm to obtain a second alarm item set. The apparatus also includes: an alarm device acquisition unit, used to obtain multiple alarm devices corresponding to multiple alarms in the first alarm item set; a first alarm elimination unit, used to obtain the location information corresponding to the alarm device, and eliminate the alarms that do not meet the location conditions in the first alarm item set according to the location information corresponding to the multiple alarm devices to obtain the second alarm item set.

[0125] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the second alarm item set is obtained by eliminating alarms that do not meet the location conditions in the first alarm item set according to the location information corresponding to the multiple alarm devices, and the device also includes: a center determination unit, which is used to obtain multiple error alarm devices outside a preset range with the location information corresponding to the benchmark alarm device among the multiple alarm devices as the center; and a second alarm elimination unit, which is used to eliminate the alarms corresponding to the error alarm devices in the first alarm item set to obtain the second alarm item set.

[0126] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the faulty device is determined according to the support and confidence between the alarm devices, and the device also includes: a strong correlation determination unit, which is used to determine that there is a strong correlation between the alarm devices when the support and confidence between the alarm devices are greater than a preset threshold; and a faulty device determination unit, which is used to determine the faulty device based on the strong correlation.

[0127] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the device also includes a related alarm acquisition unit, which is used to acquire multiple alarms corresponding to alarm devices with strong correlation; and a work order merging and processing unit, which is used to merge and process alarm work orders corresponding to multiple alarms corresponding to alarm devices with strong correlation.

[0128] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, before sorting multiple alarms according to the time information corresponding to the alarms to obtain an alarm sequence, the device also includes: an alarm start and end time acquisition unit, used to obtain the alarm start time and the alarm end time corresponding to the alarm; a third alarm elimination unit, used to determine the alarm duration based on the alarm start time and the alarm end time, and eliminate alarms whose alarm duration is less than a preset time.

[0129] Since the various functional modules of the faulty device determination apparatus of the example embodiment of the present disclosure correspond to the steps of the example embodiment of the faulty device determination method described above, for details not disclosed in the apparatus embodiment of the present disclosure, please refer to the embodiment of the faulty device determination method described above in the present disclosure.

[0130] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0131] In addition, in an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above-mentioned faulty device determination method is also provided.

[0132] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware embodiments, complete software embodiments (including firmware, microcode, etc.), or embodiments combining hardware and software aspects, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0133] Refer to the following Fig.10 hereinafter describes an electronic device 1080 according to such an embodiment of the present disclosure. Fig.10 The electronic device 1080 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0134] like Fig.10 As shown, the electronic device 1080 is in the form of a general computing device. The components of the electronic device 1080 may include, but are not limited to: the at least one processing unit 1010, the at least one storage unit 1020, a bus 1030 connecting different system components (including the storage unit 1020 and the processing unit 1010), and a display unit 1040.

[0135] The storage unit stores program codes, which can be executed by the processing unit 1010, so that the processing unit 1010 performs the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 1010 can perform the following steps: Figure 2 In step S210 shown in the figure, multiple alarms are obtained, and the multiple alarms are sorted according to the time information corresponding to the alarms to obtain an alarm sequence; in step S220, the alarm sequence is divided according to the time window to obtain a first alarm item set; in step S230, alarms that do not meet the location conditions are eliminated in the first alarm item set according to the location information of the alarm to obtain a second alarm item set; in step S240, at least two alarm devices corresponding to the multiple alarms in the second alarm item set are obtained, and the support and confidence between the alarm devices are calculated; in step S250, the faulty device is determined according to the support and confidence between the alarm devices.

[0136] For example, electronic devices can achieve Figure 2 The steps shown.

[0137] The storage unit 1020 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 1021 and / or a cache memory unit 1022 , and may further include a read-only memory unit (ROM) 1023 .

[0138] The storage unit 1020 may also include a program / utility 1024 having a set (at least one) of program modules 1025, such program modules 1025 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0139] Bus 1030 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0140] The electronic device 1080 may also communicate with one or more external devices 1070 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1080, and / or communicate with any device that enables the electronic device 1080 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1050. In addition, the electronic device 1080 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 1060. As shown, the network adapter 1060 communicates with other modules of the electronic device 1080 via a bus 1030. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1080, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0141] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a device, etc.) to execute the method according to the embodiment of the present disclosure.

[0142] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible embodiments, various aspects of the present disclosure can also be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of the present specification.

[0143] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0144] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0145] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0146] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0147] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are to be considered as exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

Claims

1. A method for determining a faulty device, characterized in that: The method comprises: Acquire multiple alarms, and sort the multiple alarms according to time information corresponding to the alarms to obtain an alarm sequence; Dividing the alarm sequence according to the time window to obtain a first alarm item set; Eliminating alarms that do not meet the location condition in the first alarm item set according to the location information of the alarm to obtain a second alarm item set; Obtain at least two alarm devices corresponding to multiple alarms in the second alarm item set, and calculate the support and confidence between the alarm devices; the support is used to characterize the probability that any two alarm devices fail at the same time; the any two alarm devices include a first alarm device and a second alarm device, the confidence includes a first confidence and a second confidence, the first confidence is used to characterize the probability that the second alarm device fails when the first alarm device fails, and the second confidence is used to characterize the probability that the first alarm device fails when the second alarm device fails; when the support and confidence between the any two alarm devices are both greater than a preset threshold, it is determined that there is a strong correlation between the any two alarm devices; According to a numerical comparison result between the first confidence level and the second confidence level, a faulty device is determined from the any two alarm devices.

2. The method according to claim 1, characterized in that The step of dividing the alarm sequence according to the time window to obtain a first alarm item set includes: Dividing the alarms occurring in the same time window in the alarm sequence into a first alarm item set; According to one alarm in the alarm sequence as a sliding time window with a sliding step, the alarm in the next time window is divided into another first alarm item set to obtain multiple first alarm item sets.

3. The method according to claim 1, characterized in that The step of removing alarms that do not meet the location condition from the first alarm item set according to the location information of the alarm to obtain the second alarm item set includes: Acquire multiple alarm devices corresponding to multiple alarms in the first alarm item set; The location information corresponding to the alarm device is obtained, and the alarms that do not meet the location condition are eliminated from the first alarm item set according to the location information corresponding to the multiple alarm devices to obtain a second alarm item set.

4. The method according to claim 3, characterized in that The step of removing alarms that do not meet the location condition from the first alarm item set according to the location information corresponding to the multiple alarm devices to obtain the second alarm item set includes: Taking the position information corresponding to the reference alarm device among the multiple alarm devices as the center, acquiring multiple error alarm devices outside the preset range; The alarm corresponding to the error alarm device is removed from the first alarm item set to obtain a second alarm item set.

5. The method according to claim 1, characterized in that The method further comprises: Acquire multiple alarms corresponding to the alarm devices having a strong correlation; The alarm work orders corresponding to the multiple alarms corresponding to the alarm devices having a strong correlation are merged and processed.

6. The method according to claim 1, characterized in that Before sorting the multiple alarms according to the time information corresponding to the alarms to obtain an alarm sequence, the method further includes: Obtain the alarm start time and alarm end time corresponding to the alarm; The alarm duration is determined according to the alarm start time and the alarm end time, and alarms whose alarm duration is less than a preset time are eliminated.

7. A device for determining a faulty device, characterized in that: The device comprises: An alarm acquisition module, used to acquire multiple alarms, and sort the multiple alarms according to time information corresponding to the alarms to obtain an alarm sequence; A first alarm item set determination module, configured to divide the alarm sequence according to a time window to obtain a first alarm item set; A location condition screening module, configured to remove alarms that do not meet the location condition from the first alarm item set according to the location information of the alarm to obtain a second alarm item set; A device data calculation module, used to obtain at least two alarm devices corresponding to multiple alarms in the second alarm item set, and calculate the support and confidence between the alarm devices; the support is used to characterize the probability of any two alarm devices failing at the same time; the any two alarm devices include a first alarm device and a second alarm device, the confidence includes a first confidence and a second confidence, the first confidence is used to characterize the probability of the second alarm device failing when the first alarm device fails, and the second confidence is used to characterize the probability of the first alarm device failing when the second alarm device fails; a faulty device determination module, used to determine that there is a strong correlation between the any two alarm devices when the support and confidence between the any two alarm devices are both greater than a preset threshold; and determine the faulty device from the any two alarm devices based on the numerical comparison result between the first confidence and the second confidence.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

9. An electronic device, characterized in that: include: processor; as well as A memory, used to store one or more programs, when the one or more programs are executed by the one or more processors, enables the one or more processors to implement the method according to any one of claims 1 to 6.

Images