A network fault analysis method, device and equipment

Abstract

The present application provides a method, device and equipment for analyzing network faults, which solves the problems of inaccurate network fault location and low network fault processing efficiency. The method includes: obtaining fault processing information of multiple work orders in a first network, and generating a first knowledge graph based on the fault processing information of multiple work orders in the first network, the first knowledge graph including the relationship between the work order and the root cause of the fault; inputting the first knowledge graph into a preset first model for prediction to obtain a second model; inputting the target work order into the second model for reasoning to obtain a second knowledge graph, the second knowledge graph including the relationship between the target work order and the first root cause of the fault; processing the first root cause of the fault corresponding to the target work order according to the second knowledge graph.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method, device and equipment for analyzing network failures. Background Art

[0002] With the rapid development of the Internet, communication networks carry more user services and more physical devices are connected to them, making the structure of communication networks more and more complex. When a device in a communication network fails, it may cause one or more other devices in the communication network to fail to work, generating corresponding alarms, i.e., derivative alarms.

[0003] At present, the handling of network faults mainly relies on the experience of the operation and maintenance personnel themselves. However, when the communication network is relatively complex, it is difficult for the operation and maintenance personnel to quickly locate the network fault. In the prior art, the association between alarms can also be determined based on the semantic similarity between the alarms, and then the network fault can be located based on the association between the alarms. However, the root alarm and the derived alarm are not always semantically similar, so relying solely on semantic similarity will result in the root alarm being determined to be inaccurate, thereby affecting the efficiency of network fault handling. Summary of the invention

[0004] The present application provides a network fault analysis method, device and equipment, which can more accurately locate the root cause of the network fault, which is conducive to improving the efficiency of network fault handling.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, the present application provides a method for analyzing network faults, including: obtaining fault handling information of multiple work orders in a first network; generating a first knowledge graph based on the fault handling information of multiple work orders in the first network, the first knowledge graph including the relationship between the work order and the root cause of the fault; the first knowledge graph also includes one or more of the alarms contained in the work order, the derivative relationship between the alarms, the equipment where the alarms occur, the root cause of the fault corresponding to the alarm, and the relationship between the root cause of the fault and the equipment; inputting the first knowledge graph into a preset first model for prediction to obtain a second model; inputting a target work order into the second model for reasoning to obtain a second knowledge graph, the second knowledge graph including the relationship between the target work order and the first root cause of the fault; the second knowledge graph also includes one or more of the alarms contained in the target work order, the derivative relationship between the alarms, the equipment where the alarms occur, the first root cause of the fault corresponding to the alarm, and the relationship between the first root cause of the fault and the equipment; processing the first root cause of the fault corresponding to the target work order according to the second knowledge graph.

[0007] In combination with the above-mentioned first aspect, in a possible implementation method, the first knowledge graph contains multiple triples, each triple is used to characterize the relationship between nodes in the first knowledge graph, where the node is any one of a work order, an alarm, equipment, and a root cause of a fault, and the relationship between nodes includes one or more of the relationship between a work order and a root cause of a fault, the inclusion relationship between a work order and an alarm, the derivative relationship between alarms, the occurrence relationship between alarms and equipment, the correspondence relationship between alarms and root causes of faults, and the relationship between the root cause of a fault and equipment.

[0008] In combination with the first aspect above, in a possible implementation method, the first knowledge graph is input into a preset first model for prediction to obtain a second model, including: encoding the nodes of the first knowledge graph to determine the first embedding vector; decoding the first embedding vector to obtain a second embedding vector, the second embedding vector being an embedding vector of the relationship between nodes in the first knowledge graph; and obtaining the second model based on the first embedding vector, the second embedding vector and the loss function.

[0009] In combination with the above-mentioned first aspect, in a possible implementation method, the preset first model includes a graph neural network GNN model and a Distmult model.

[0010] In combination with the above-mentioned first aspect, in a possible implementation method, the target work order is input into the second model for reasoning to obtain a second knowledge graph, including: obtaining candidate triples based on the target work order and the first knowledge graph; and obtaining the second knowledge graph based on the scoring values ​​of the candidate triples in the second model.

[0011] In combination with the first aspect above, in a possible implementation method, after inputting the target work order into the second model for reasoning to obtain the second knowledge graph, it also includes: inputting the second knowledge graph into the second model for iterative calculation to update the second model.

[0012] In a second aspect, the present application provides a network fault analysis device, the device comprising an acquisition module and a processing module; the acquisition module is used to acquire fault handling information of multiple work orders in a first network; the processing module is used to generate a first knowledge graph based on the fault handling information of multiple work orders in the first network, the first knowledge graph including the relationship between the work order and the root cause of the fault; the first knowledge graph also includes one or more of the alarms contained in the work order, the derivative relationship between the alarms, the equipment where the alarms occur, the root cause of the fault corresponding to the alarm, and the relationship between the root cause of the fault and the equipment; the processing module is also used to input the first knowledge graph into a preset first model for prediction to obtain a second model; the processing module is also used to input the target work order into the second model for reasoning to obtain a second knowledge graph, the second knowledge graph including the relationship between the target work order and the first root cause of the fault; the second knowledge graph also includes one or more of the alarms contained in the target work order, the derivative relationship between the alarms, the equipment where the alarms occur, the first root cause of the fault corresponding to the alarm, and the relationship between the first root cause of the fault and the equipment; the processing module is also used to process the first root cause of the fault corresponding to the target work order according to the second knowledge graph.

[0013] In combination with the above-mentioned second aspect, in a possible implementation method, the first knowledge graph contains multiple triples, each triple is used to characterize the relationship between nodes in the first knowledge graph, where the node is any one of a work order, an alarm, equipment, and a root cause of a fault, and the relationship between nodes includes one or more of the relationship between a work order and a root cause of a fault, the inclusion relationship between a work order and an alarm, the derivative relationship between alarms, the occurrence relationship between alarms and equipment, the correspondence relationship between alarms and root causes of faults, and the relationship between root causes of faults and equipment.

[0014] In combination with the above-mentioned second aspect, in a possible implementation method, the processing module is also used to input the first knowledge graph into a preset first model for prediction to obtain a second model, including: encoding the nodes of the first knowledge graph to determine the first embedding vector; decoding the first embedding vector to obtain the second embedding vector, the second embedding vector being the embedding vector of the relationship between nodes in the first knowledge graph; and obtaining the second model based on the first embedding vector, the second embedding vector and the loss function.

[0015] In combination with the above-mentioned second aspect, in a possible implementation method, the preset first model includes a graph neural network GNN model and a Distmult model.

[0016] In summary, a network fault analysis method provided in an embodiment of the present application obtains fault handling information of multiple work orders in a first network and generates a first knowledge graph. The first knowledge graph is input into a preset first model for prediction to obtain a second model. The target work order is input into the second model for reasoning to obtain a second knowledge graph. The first root cause of the fault corresponding to the target work order is processed according to the second knowledge graph. In addition, the second knowledge graph can also be input into the second model for iterative calculation to update the second model. In this way, the work order root cause relationship between the work order and the root cause of the fault can be clearly indicated, network faults can be located more accurately, human reasoning of faults can be avoided, time can be saved, and efficiency can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A schematic diagram of the structure of a network fault analysis system provided in an embodiment of the present application;

[0019] Figure 2 A flowchart of a method for analyzing network failures provided in an embodiment of the present application;

[0020] Figure 3 A schematic diagram of a knowledge graph framework provided in an embodiment of the present application;

[0021] Figure 4 A schematic diagram of a first knowledge graph provided in an embodiment of the present application;

[0022] Figure 5 A flowchart of a method for analyzing network failures provided in an embodiment of the present application;

[0023] Figure 6 A flowchart of another method for analyzing network failures provided in an embodiment of the present application;

[0024] Figure 7 A flowchart of another method for analyzing network failures provided in an embodiment of the present application;

[0025] Figure 8 A schematic diagram of a network fault analysis method provided in an embodiment of the present application;

[0026] Fig. 9 A device schematic diagram of a network fault analysis method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0028] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0029] Before introducing the method provided in the embodiments of the present application, a brief introduction to the terms involved in the embodiments of the present application is given.

[0030] Knowledge graph: is a structured semantic knowledge base that describes entities (or concepts) in the objective world and their relationships in symbolic form. From the perspective of a graph, a knowledge graph is essentially a network in which nodes represent entities in the objective world and edges represent various relationships between entities.

[0031] Each node in the knowledge graph corresponds to an entity. Each entity can have its own attributes, such as name, number, size, etc.

[0032] Relationships are used to describe the objective associations between entities. In the knowledge graph, each edge corresponds to a relationship, and each relationship can have its own name and weight information. Exemplarily, the relationship between entities can be a containment relationship, a derivative relationship, etc. For example, in an embodiment of the present application, a work order contains an alarm, that is, there is a containment relationship between the work order and the alarm.

[0033] The framework (schema) of the knowledge graph is a specification for modeling nodes. It is an abstract model that describes the objective world and gives a clear definition of nodes and the relationships between them in a formal way. It can be understood that the schema defines the data model in the knowledge graph. Specifically, the schema defines the types of nodes and the types of relationships.

[0034] Graph Neural Network (GNN): refers to the general term for algorithms that use neural networks to learn graph structured data, extract and discover features and patterns in graph structured data, and meet the needs of graph learning tasks such as clustering, classification, prediction, segmentation, and generation. The goal of a graph neural network is to learn a vector representation of each node, which can be used for many tasks, such as link prediction. Consider abstracting each entity in the actual scenario as a different node, and abstracting the physical connection or software call relationship between entities as an edge connection, so as to model the problem as a link prediction problem on a heterogeneous graph.

[0035] Embedding vector: refers to a representation method of mapping samples into vector space.

[0036] Distmult model: It is a knowledge graph representation learning model that measures the possibility of latent semantics of entities and relationships in vector space through bilinear functions.

[0037] Loss function: also known as cost function, a measure of the difference between the predicted output of a learning model for a sample and the true value of the sample. This loss function can usually include error mean square, cross entropy, logarithm, exponential and other loss functions. For example, cross entropy can be used as a loss function, and a specific loss function can be selected according to the actual application scenario.

[0038] like Figure 1 As shown, it is a structural diagram of a network fault analysis system provided in an embodiment of the present application. The network fault analysis system may include: a first network 110, a first device 120 and a second device 130.

[0039] The first network 110 includes at least one device, which together executes one or more services. During the execution of tasks by the first network 110, one or more of the devices may fail, thereby generating an alarm. In some examples, the device may be implemented by software, such as a virtual machine, a container, an application, a service, a microservice, a module, a submodule, a class or a function, etc. The device may be software running in one device or a collection of software running in multiple devices. In another example, the device may also be implemented in hardware, which may be a server, a base station, a switch, a router, a relay, a bridge, a firewall, a mobile terminal, a personal computer, a laptop computer, a disk, a solid state drive (SSD), a disk array (RAID), a storage area network (SAN), an Internet Protocol (IP) SAN, a Fiber Channel (FC) SAN, a network attached storage (NAS), a load balancer, a mobility management entity (MME), a home subscriber server (HSS), a serving-gateway (SGW), a packet data network gateway (PGW), a policy and charging rules function (PCRF) network element, an optical network terminal (ONT), an optical network unit (ONU), a splitter, an Internet of Things terminal, a sensor, etc.; the device may be implemented in an independent hardware or in multiple hardwares connected via a wired or wireless network. This embodiment does not limit the specific form of the device.

[0040] The first device 120 may be a maintenance management device of the first network 110, and is used to collect fault handling information of work orders in the first network 110. The work order refers to a fault handling task generated during the operation of the first network 110. In some examples, the work order may be a fault handling task automatically generated after a fault occurs during the operation of the first network 110. For example, the first device 120 may generate a work order based on a device alarm in the first network 110. Alternatively, the maintenance personnel of the first network 110 manually generates a fault handling task for the first network 110 after receiving a user's complaint. The work order includes a work order number, a device name, an alarm name, an occurrence time, etc. The fault handling information of the work order also includes a root cause of the fault, wherein the root cause of the fault refers to the root cause of the fault in the network, that is, the root fault in the network.

[0041] When the first device 120 generates a work order, the operation and maintenance personnel can combine the work orders generated at the same location within a period of time to conduct on-site inspections, determine and repair the fault, and fill in the root cause of the fault in the work order, so that the first device 120 can obtain the fault handling information of the work order in the first network 110. It is understandable that the content of the work order obtained based on the user complaint is not necessarily accurate and can be modified by the operation and maintenance personnel after repairing the fault. Exemplarily, the first device 120 can be a server, a server cluster consisting of multiple servers, or a cloud computing service center.

[0042] The second device 130 is an electronic device with data processing capabilities. In some examples, the second device 130 can obtain the fault handling information of multiple work orders in the first network 110 stored by the first device 120, and generate a first knowledge graph. The second model is obtained through the first knowledge graph. The target work order is input into the second model for reasoning to obtain the second knowledge graph, so as to process the root cause of the fault corresponding to the target work order according to the second knowledge graph. Exemplarily, the second device 130 can be a server, a server cluster consisting of multiple servers, or a cloud computing service center.

[0043] It should be noted that the devices included in the above-mentioned network fault analysis system and the division of labor (functions performed) of each device are only examples. The embodiment of the present application does not limit the number of devices included in the network fault analysis system and the specific division of labor of each device. It is understandable that in some other examples, the first device 120 and the second device 130 can be the same device, and the present application does not make specific limitations on this.

[0044] The embodiments provided in this application are described in detail below in conjunction with the accompanying drawings.

[0045] like Figure 2FIG. 1 is a flow chart of a method for analyzing network failures provided in an embodiment of the present application. The method can be applied to Figure 1 The second device 130 in the network fault analysis system, the process includes:

[0046] S201. Obtain fault handling information of multiple work orders in a first network.

[0047] The work order refers to a fault handling task generated during the operation of the first network. In some examples, the work order may be a fault handling task automatically generated after a fault occurs during the operation of the first network, or the work order may be a fault handling task of the first network manually generated by the maintenance personnel of the first network after receiving a user's complaint. The work order may include the work order number, device name, alarm name, occurrence time, etc.

[0048] In some embodiments, when a fault occurs in the first network (such as a broken optical cable or a municipal power outage), the devices in the first network will report an alarm. The alarm includes a root alarm and a derivative alarm. A root alarm refers to an alarm directly generated by a faulty device, or an alarm generated by a device due to a fault in the network (such as a broken optical cable). Derivative alarms are some alarms derived from the root alarm. It is understandable that when a fault occurs somewhere in the first network, multiple root alarms may be generated. For example, device A and device B may communicate through optical cable C. If optical cable C is damaged, the alarms generated by device A and device B are root alarms. Other devices on the service path including device A and device B will report related alarms, i.e., derivative alarms, which will result in a large number of alarms. According to the alarms reported by the devices in the first network, a corresponding work order is generated, wherein a work order includes at least one alarm, and may also include multiple alarms. It is understandable that a work order includes multiple alarms, and in this case, the multiple alarms are reported by the same device.

[0049] In other embodiments, a corresponding work order is generated based on the user complaint. The content of the complaint should correspond to the content required by the work order, including time (i.e., the occurrence time in the corresponding work order), location, abnormal device (i.e., the location and abnormal device correspond to the device name in the work order), and abnormal situation (i.e., the alarm name in the corresponding work order). For example, a user complained that there was a weak signal when using a mobile phone to communicate at home at 4 pm.

[0050] As described above, after obtaining multiple work orders in the first network, the operation and maintenance personnel can combine the work orders generated at the same location over a period of time, conduct on-site inspections, determine and repair the fault, and fill in the root cause of the fault in the work order, thereby obtaining the fault handling information of the work order in the first network. It is understandable that the content of the work order obtained based on the user complaint (such as the alarm name) is not necessarily accurate and can be modified by the operation and maintenance personnel after repairing the fault.

[0051] As shown in Table 1, this is an example of fault handling information of a work order provided in this application. The fault information of the work order includes the work order number, device name, alarm name, occurrence time, and root cause of the fault, wherein the root cause of the fault refers to the root cause of the fault in the network, that is, the root fault in the network.

[0052] Table 1

[0053]

[0054] S202. Generate a first knowledge graph based on fault handling information of multiple work orders in the first network.

[0055] In some embodiments, a knowledge graph framework is formed based on the fault handling information of multiple work orders in the first network, such as Figure 3 As shown, a schematic diagram of the framework of a knowledge graph provided in an embodiment of the present application is provided. The nodes in the framework of the knowledge graph may include work orders, alarms, equipment, and root causes of faults. The relationship between nodes in the framework of the knowledge graph (also referred to as edges) may include the relationship between work orders and root causes of faults (referred to as work order root cause relationships), and may also include one or more of the inclusion relationship between work orders and alarms, the derivative relationship between alarms and alarms, the occurrence relationship between alarms and equipment, the corresponding relationship between alarms and root causes of faults, and the relationship between root causes of faults and equipment (such as association relationships).

[0056] In some embodiments, the fault handling information of multiple work orders in the first network can be processed based on the framework of the knowledge graph to obtain a first knowledge graph. The first knowledge graph includes the entities contained in each work order, namely the work order number, alarm name, device name and root cause of the fault, the work order root cause relationship between the work order and the root cause of the fault, and also includes one or more of the alarms contained in the work order, the derivative relationship between the alarms, the equipment where the alarm occurs, the root cause of the fault corresponding to the alarm, and the association relationship between the root cause of the fault and the equipment. Specifically, when extracting the fault handling information in the work order, the entities in the fault handling information are obtained according to the nodes in the framework of the knowledge graph, and the relationship between entities in the fault handling information is obtained according to the relationship between nodes in the framework of the knowledge graph. For example, the work order in the first knowledge graph framework corresponds to the work order number in the work order (such as No. 10), the alarm in the first knowledge graph framework corresponds to the alarm name in the work order (such as cell unavailable alarm_line), the equipment in the first knowledge graph framework corresponds to the equipment name in the work order (such as the base station room in Building X, XX Community, XX District, XX City, XX Province), and the root cause of the fault in the first knowledge graph framework corresponds to the root cause of the fault in the work order (such as a broken optical cable). According to the fault handling information of each work order, multiple groups of nodes included in each edge type are obtained. Among them, the edge type is used to represent the type of association relationship between nodes. A group of nodes includes two nodes and the relationship between the two nodes.

[0057] like Figure 4 As shown, it is a schematic diagram of a first knowledge graph provided in an embodiment of the present application. It should be noted that two nodes included in a group of nodes in the first knowledge graph can be nodes of the same type, such as Figure 4 A group of nodes in includes node D and node E, both of which belong to alarms, and there is a derivative relationship between node D and node E. Multiple groups of nodes in the first knowledge graph can contain the same node, that is, entities with the same name in the fault handling information of multiple work orders of the first network correspond to the same node in the first knowledge graph. For example, Figure 4 One group of nodes in includes node F and node G. Node F is a work order, node G is a root cause of the fault (such as a broken optical cable), and there is a work order root cause relationship between node F and node G. Another group of nodes includes node H and node G. Node H is a work order, node G is a root cause of the fault (such as a broken optical cable), and there is a work order root cause relationship between node H and node G. In other words, the names of the root causes of the faults of the two groups of nodes are the same.

[0058] In some embodiments, the first knowledge graph can be represented in the form of triples, where triples are a general form of representation, and the basic form of triples includes (node ​​1-relationship-node 2). For example, in an embodiment of the present application, work order-inclusion-alarm is an example of a triple of (node ​​1-relationship-node 2), where the work order is node 1, the alarm is node 2, and inclusion is the relationship between the work order and the alarm. That is, the multiple groups of nodes contained in each edge type in the first knowledge graph are represented in the form of (h, r, t), where h represents node 1, r represents the relationship, and t represents node 2. Specifically, the nodes in the first knowledge graph correspond to node 1 or node 2 in the triple, and the edges in the first knowledge graph correspond to the relationships in the triples. For example, a group of nodes contained in the root cause relationship of the work order in the first knowledge graph are "No. 5" and "Municipal Power Outage", then the group of nodes can be represented as (5, work order root cause, municipal power outage).

[0059] S203: Input the first knowledge graph into a preset first model for prediction to obtain a second model.

[0060] Among them, the preset first model includes a GNN model and a Distmult model, and may also include a loss function.

[0061] For example, see Figure 5 , step S203 may include the following steps S2031-S2033.

[0062] S2031. Encode the nodes of the first knowledge graph and determine a first embedding vector.

[0063] The nodes include node 1 and node 2, and the first embedding vector includes the embedding vector of node 1 and the embedding vector of node 2.

[0064] In some embodiments, a GNN model is used to encode the nodes in the first knowledge graph (encoder) to obtain a first embedding vector. The dimension n of the first embedding vector is pre-set, for example, n is any integer in [50, 200]. It should be understood that the dimension corresponds to the granularity of the sample mapping to the vector space. The higher the dimension, the smaller the granularity, the more accurate the sample semantics represented, and the greater the amount of calculation; the lower the dimension, the larger the granularity, the more ambiguous the sample semantics represented, and the smaller the amount of calculation. Specifically, the nodes in the first knowledge graph are initialized to embedding vectors, which are the node features extracted by the GNN model. For example, take n as 50, and initialize the work order "No. 10" in the first knowledge graph as an embedding vector, then the initialized embedding vector can be expressed as [a1, a2,…, a 50], where a1=1 and the rest are 0. After initializing the nodes in the first knowledge graph as embedding vectors, the initialized embedding vectors are updated using Formula 1:

[0065]

[0066] Where l represents the number of times node i is updated in the preset first model, l∈[0,M], l is a positive integer, M∈[2,4], e i (l+1) represents the embedding vector of the (l+1)th update of node i, i∈Y, Y is the number of nodes in the first knowledge graph; σ represents a nonlinear function, R represents a set of edge types, r represents any edge type in the edge types, represents the number of neighbor nodes with edge type r with node i, j represents any neighbor node among the neighbor nodes with edge type r with node i; c i,r represents the normalization constant, represents the weight matrix corresponding to the lth edge type r, represents the embedding vector of node j for the lth update, represents the weight matrix corresponding to the lth self-loop of node i, represents the embedding vector of node i for the lth update.

[0067] It can be understood that each update of the embedding vector is obtained by the previous embedding vector and relationship, and each update of the embedding vector is obtained by weighting the embedding vector of the neighboring node and its own embedding vector.

[0068] S2032. Obtain a second embedded vector by decoding the first embedded vector.

[0069] The second embedding vector is the embedding vector of the relationship between nodes in the first knowledge graph.

[0070] In some embodiments, the node 1, the relationship and the node 2 in the triple are mapped to the vector space to obtain the embedding vector of node 1, the embedding vector of the relationship and the embedding vector of node 2. The embedding vector of node 1 plus the embedding vector of the relationship is very close to the embedding vector of node 2, that is, h+r≈t, where h is the embedding vector of node 1, r is the embedding vector of the relationship, and t is the embedding vector of node 2. The Distmult model can be used to decode the first embedding vector to obtain the second embedding vector. The Distmult model can be expressed by formula 2:

[0071]

[0072] in, represents the transposed matrix of the embedding vector of node 1 obtained in step S2021, e t represents the embedding vector of node 2 obtained in step S2021, R r Represents the diagonal matrix corresponding to the relationship embedding vector, that is, the second embedding vector.

[0073] S2033. Obtain a second model according to the first embedding vector, the second embedding vector and the loss function.

[0074] In some embodiments, the first embedding vector and the second embedding vector are substituted into the loss function, and the score of the triple of the positive sample (i.e., the triple of the first knowledge graph) is higher than the score of the negative sample triple by adjusting the loss function (such as the cross entropy loss function), and the optimized first embedding vector and the optimized second embedding vector are obtained, and the optimized first embedding vector and the optimized second embedding vector are substituted into Formula 2 to obtain the second model. Specifically, a negative sample triple is constructed. For example, for the triple (h, r, t), node h is replaced with another node h', or node t is replaced with another node t'. At this time, the following three triplets can be obtained: (h', r, t'), (h, r, t), (h', r, t'). If the above triplets do not exist in the knowledge graph corresponding to the user, a negative sample triplet of the positive sample triple (h, r, t) is obtained. The positive sample triple combined with the negative sample triple is substituted into the loss function, and the loss function can be expressed by Formula 3:

[0075]

[0076] Among them, T represents the set of positive sample triplets and negative sample triplets; (h, r, t, y) represents a triplet of positive samples or a triplet of negative samples. When a positive sample is taken, y=1, and when a negative sample is taken, y=0; f(h, r, t) represents the Distmult model; l represents the S-shaped growth curve function, which can also be called the Sigmoid function or the Logistic function.

[0077] The stochastic gradient descent method is used to iteratively update the embedding vector of node 1, the embedding vector of node 2, and the embedding vector of the relationship. By adjusting the loss function, such as solving the minimum value of the loss function, the optimized embedding vector of node 1, the optimized embedding vector of node 2, and the optimized embedding vector of the relationship, that is, the optimized first embedding vector and the optimized second embedding vector, are determined.

[0078] It should be noted that the gradient descent algorithm can refer to the prior art, and the embodiments of the present application will not elaborate on this.

[0079] S204: Input the target work order into the second model for reasoning to obtain a second knowledge graph.

[0080] The target work order includes at least one work order, and the target work order is a work order to be processed, that is, the root cause of the failure of the target work order is unknown.

[0081] In some embodiments, the information in the target work order is extracted based on the framework of the above-mentioned knowledge graph to obtain a third knowledge graph. Among them, the third knowledge graph includes the entities contained in each target work order, namely the work order number, alarm name and device name, and may also include one or more of the alarms contained in the target work order and the devices where the alarms occur. In addition, it may also include the derivative relationship between the alarms in some target work orders. It is understandable that the third knowledge graph lacks the first root cause of the target work order, and the work order root cause relationship between the target work order and the first root cause of the fault, and may also lack one or more of the alarms contained in the target work order, the derivative relationship between the alarms, the devices where the alarms occur, the first root cause of the fault corresponding to the alarm, and the association relationship between the first root cause of the fault and the device. Among them, the first root cause of the fault is the root cause of the fault corresponding to the target work order.

[0082] Specifically, when extracting information from the target work order, the entities in the information are obtained according to the nodes in the framework of the knowledge graph, and the relationships between entities in the information are obtained according to the relationships between nodes in the framework of the knowledge graph. The specific process can be referred to step S202, which will not be repeated here.

[0083] The process of reasoning on the third knowledge graph is explained below, that is, step S204 can specifically include the following steps S2041-S2043.

[0084] S2041. Obtain candidate triples based on the third knowledge graph and the first knowledge graph.

[0085] In some embodiments, the work order in the third knowledge graph is taken as node 1, the work order root cause relationship is taken as the relationship, and the fault root cause in the first knowledge graph is taken as node 2 to form a candidate triple. Specifically, if the third knowledge graph contains I work order nodes and the first knowledge graph contains J fault root cause nodes, each work order node in the third knowledge graph and each fault root cause node in the first knowledge graph are combined into a candidate triple, that is, (I×J) candidate triples are constructed.

[0086] In other embodiments, the alarm in the third knowledge graph is taken as node 1, the derived relationship is taken as the relationship, and the alarm in the third knowledge graph is taken as node 2 to form a candidate triple. Specifically, if the third knowledge graph contains K alarm nodes, each alarm node in the third knowledge graph is combined with each alarm node in the third knowledge graph except itself to form a candidate triple, that is, [K×(K-1)] candidate triples are constructed.

[0087] S2042: Convert the nodes in the candidate triples into optimized first embedding vectors, and convert the relations in the candidate triples into optimized second embedding vectors.

[0088] In some embodiments, an optimized first embedding vector and an optimized second embedding vector are obtained based on the fault handling information of multiple work orders in the first network. At this time, there is a one-to-one correspondence between the nodes in the first knowledge graph and the optimized first embedding vector, and similarly, there is a one-to-one correspondence between the edges in the first knowledge graph and the optimized second embedding vector. Based on the one-to-one correspondence between the nodes in the first knowledge graph and the optimized first embedding vector, the nodes in the candidate triples are converted into the optimized first embedding vector, and similarly, based on the one-to-one correspondence between the edges in the first knowledge graph and the optimized second embedding vector, the relationships in the candidate triples are converted into the optimized second embedding vector.

[0089] S2043. Obtain a second knowledge graph based on the scoring values ​​of the candidate triples in the second model.

[0090] Among them, the second knowledge graph includes the entities contained in each target work order, namely the work order number, alarm name, equipment name and the first root cause of the fault, the work order root cause relationship between the target work order and the first root cause of the fault, and may also include one or more of the alarms contained in the target work order, the derivative relationship between the alarms, the equipment where the alarm occurs, the first root cause of the fault corresponding to the alarm, and the association relationship between the first root cause of the fault and the equipment.

[0091] In some embodiments, the candidate triples whose edge type is the root cause relationship of the work order are input into the second model, i.e., the Distmult model (Formula 2), and scored. The candidate triple with the highest score among the candidate triples corresponding to each work order is taken as the inference result, and the inference result is supplemented into the third knowledge graph to obtain the second knowledge graph. For example, continuing to take the example that there are (I×J) candidate triples whose edge type is the root cause relationship of the work order, where there are I work order nodes in the third knowledge graph, and each work order node has J candidate triples. The candidate triple with the highest score among the J candidate triples of each work order node is taken as the inference result, and then I triples are obtained as the inference result, and supplemented into the third knowledge graph. Optionally, a first threshold can be set according to the score value in the candidate triple corresponding to each work order, and the candidate triple with a score value exceeding the first threshold is taken as the inference result.

[0092] In other embodiments, the candidate triples whose edge type is a derivative relationship are input into the second model, i.e., the Distmult model (Formula 2), for scoring. The candidate triple with the highest score among the candidate triples is taken as the inference result, and the inference result is added to the third knowledge graph to obtain the second knowledge graph. For example, continuing to take the example that there are [K×(K-1)] candidate triples whose edge type is a derivative relationship, the candidate triple with the highest score among the candidate triples is taken as the inference result, and added to the third knowledge graph. Optionally, a second threshold can be set according to the score of the candidate triple with the edge type being a derivative relationship, and the candidate triple with a score exceeding the second threshold is taken as the inference result.

[0093] S205. Process the first root cause of the fault corresponding to the target work order according to the second knowledge graph.

[0094] In some embodiments, the second knowledge graph represents the work order root cause relationship between the first work order and the first fault root cause in the target work order. The operation and maintenance personnel can repair the fault according to the first fault root cause corresponding to the target work order in the second knowledge graph and the device name in the target work order.

[0095] Optionally, if there is an error in the first root cause of the fault corresponding to the target work order in the second knowledge graph, the operation and maintenance personnel can also make corrections based on the actual situation.

[0096] It is understandable that when a work order node in the second knowledge graph corresponds to multiple first root causes of the fault, the operation and maintenance personnel can conduct on-site inspections based on the multiple first root causes of the fault, and determine the first root cause of the fault after repairing the fault.

[0097] In another possible design, see Figure 6 As shown, after step S205, the method further includes:

[0098] S301. Input the second knowledge graph into the second model for iterative calculation to update the second model.

[0099] In some embodiments, after the target work order is input into the second model for inference, a new connection relationship between nodes can be obtained. For example, in the first knowledge graph, there is no derivative relationship between alarm 1 and alarm 2. After the target work order is input into the second model for inference, it is obtained that there is a derivative relationship between alarm 1 and alarm 2. When the second knowledge graph is input into the second model, the weight matrix of the edge type in formula 1 will change, and further, the optimized first embedding vector and the optimized second embedding vector will change, thereby updating the second model.

[0100] In summary, if Figure 7As shown, the fault handling information of multiple work orders in the first network is obtained to generate a first knowledge graph. The first knowledge graph is input into the preset first model for prediction to obtain a second model. Among them, the preset first model includes two parts: model establishment and model training. Model establishment includes encoding the nodes in the first knowledge graph using the GNN model to obtain a first embedding vector, and then decoding the first embedding vector using a model such as the Distmult model to obtain a second embedding vector. The model is trained by minimizing the loss function (such as the cross entropy loss function) to obtain the second model. The target work order is input into the second model for reasoning to obtain the second knowledge graph. The first root cause of the fault corresponding to the target work order is processed according to the second knowledge graph. In addition, the second knowledge graph can also be input into the second model for iterative calculation to update the second model.

[0101] In this way, by generating the second knowledge graph through the method provided in the embodiment of the present application, the work order root cause relationship between the work order and the root cause of the fault can be clearly expressed. Compared with other methods, the influence of the relationship between nodes on the completion of the knowledge graph is considered, and the network fault can be located more accurately, avoiding human reasoning of the fault, saving time, and helping to improve efficiency. In addition, in addition to predicting the work order root cause relationship between the target work order and the first root cause of the fault in the target work order, the present application also predicts the derivative relationship between the alarms in the target work order, which can be used as an experience accumulation and input into the second model to update the second model, so that the updated second model is more accurate.

[0102] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. It can be understood that in order to realize the above functions, the device provided by the embodiment of the present application includes a hardware structure and / or software network element corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed in this document, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0103] like Figure 8, which is a schematic diagram of a structure of a device 400 provided in an embodiment of the present application. The device 400 includes an acquisition module 401 and a processing module 402. The acquisition module 401 is used to acquire the fault handling information of multiple work orders in the first network; the processing module 402 is used to generate a first knowledge graph based on the fault handling information of multiple work orders in the first network, the first knowledge graph including the relationship between the work order and the root cause of the fault; the first knowledge graph also includes one or more of the alarms contained in the work order, the derivative relationship between the alarms, the equipment where the alarm occurs, the root cause of the fault corresponding to the alarm, and the relationship between the root cause of the fault and the equipment; the processing module 402 is also used to input the first knowledge graph into a preset first model for prediction to obtain a second model; the processing module 402 is also used to input the target work order into the second model for reasoning to obtain a second knowledge graph, the second knowledge graph including the relationship between the target work order and the first root cause of the fault; the second knowledge graph also includes one or more of the alarms contained in the target work order, the derivative relationship between the alarms, the equipment where the alarm occurs, the first root cause of the fault corresponding to the alarm, and the relationship between the first root cause of the fault and the equipment; the processing module 402 is also used to process the first root cause of the fault corresponding to the target work order according to the second knowledge graph.

[0104] Optionally, the first knowledge graph contains multiple triples, each triple is used to characterize the relationship between nodes in the first knowledge graph, where the node is any one of a work order, an alarm, equipment, and a root cause of a fault, and the relationship between nodes includes one or more of the relationship between a work order and a root cause of a fault, the inclusion relationship between a work order and an alarm, the derivative relationship between alarms, the occurrence relationship between alarms and equipment, the correspondence relationship between alarms and root causes of faults, and the relationship between a root cause of a fault and equipment.

[0105] Optionally, the processing module 402 is also used to input the first knowledge graph into a preset first model for prediction to obtain a second model, including: encoding the nodes of the first knowledge graph to determine the first embedding vector; decoding the first embedding vector to obtain a second embedding vector, the second embedding vector being an embedding vector of the relationship between nodes in the first knowledge graph; and obtaining the second model based on the first embedding vector, the second embedding vector and the loss function.

[0106] Optionally, the preset first model includes a graph neural network GNN model and a Distmult model.

[0107] Optionally, the device 400 may further include a storage unit.

[0108] Since the device 400 provided in this embodiment can execute the above-mentioned network failure analysis method, the technical effects that can be obtained can refer to the above-mentioned method embodiment, which will not be repeated here.

[0109] The structure of the device 400 can also be as follows Fig. 9 The server 500 shown. Fig. 9 As shown, the server 500 includes one or more processors 501 , one or more memories 502 , and one or more communication interfaces 503 .

[0110] The processor 501, the memory 502 and the communication interface 503 are connected via a bus. The processor 501 may include a general-purpose central processing unit (CPU) (such as CPU0 and CPU1), a microprocessor, an application-specific integrated circuit (ASIC), a graphics processing unit (GPU), a neural-network processing unit (NPU), or an integrated circuit for controlling the execution of the program of the present application.

[0111] The memory 502 can be used to store computer executable program codes, and the executable program codes include instructions. The memory 502 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system and application program code, etc. In addition, the memory 502 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 501 executes various functional applications and data processing of the server 500 by running the instructions stored in the memory 502. In one example, the processor 501 may also include multiple CPUs, and the processor 501 may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. The processor here may refer to one or more devices, circuits, or processing cores for processing data (such as computer program instructions).

[0112] The communication interface 503 can be used to communicate with other devices or communication networks, such as Ethernet, wireless local area networks (WLAN), etc.

[0113] Another embodiment of the present application further provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on the server 500, the server 500 executes each step in the method flow shown in the above method embodiment.

[0114] In another embodiment of the present application, a computer program product is provided. When the computer program product is run on a computer, the computer is enabled to execute each step in the method flow shown in the above method embodiment.

[0115] Another embodiment of the present application also provides a chip system, which is applied to a server 500. The chip system includes one or more interface circuits and one or more processors. The interface circuit and the processor are interconnected by a line. The interface circuit is used to receive a signal from the memory of the server 500 and send the signal to the processor, wherein the signal includes a computer instruction stored in the memory. When the processor executes the computer instruction, the server 500 executes each step in the method flow shown in the above method embodiment.

[0116] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0117] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0118] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for analyzing network failures, characterized in that: The method comprises: Obtaining fault handling information of multiple work orders in the first network; Generate a first knowledge graph based on the fault handling information of multiple work orders in the first network, wherein the first knowledge graph includes the relationship between the work order and the root cause of the fault; the first knowledge graph also includes one or more of the alarms included in the work order, the derivative relationship between the alarms, the device where the alarm occurs, the root cause of the fault corresponding to the alarm, and the relationship between the root cause of the fault and the device; Input the first knowledge graph into a preset first model for prediction to obtain a second model; the preset first model includes a graph neural network GNN model and a Distmult model; Input the target work order into the second model for reasoning to obtain a second knowledge graph, wherein the second knowledge graph includes the relationship between the target work order and the first root cause of the fault; the second knowledge graph also includes one or more of the alarms included in the target work order, the derivative relationship between the alarms, the device where the alarm occurs, the first root cause of the fault corresponding to the alarm, and the relationship between the first root cause of the fault and the device; Processing a first root cause of the fault corresponding to the target work order according to the second knowledge graph; The step of inputting the first knowledge graph into a preset first model for prediction to obtain a second model includes: Encode the nodes of the first knowledge graph to determine a first embedding vector; By decoding the first embedding vector, a second embedding vector is obtained, where the second embedding vector is an embedding vector of the relationship between nodes in the first knowledge graph; Obtaining the second model according to the first embedding vector, the second embedding vector and the loss function; The step of inputting the target work order into the second model for reasoning to obtain a second knowledge graph includes: Obtaining candidate triples according to the target work order and the first knowledge graph; The second knowledge graph is obtained according to the scoring values ​​of the candidate triples in the second model.

2. The method according to claim 1, characterized in that The first knowledge graph contains multiple triples, each triple is used to characterize the relationship between nodes in the first knowledge graph, wherein the node is any one of a work order, an alarm, equipment, and a root cause of a fault, and the relationship between the nodes includes one or more of the relationship between a work order and a root cause of a fault, the inclusion relationship between a work order and an alarm, the derivative relationship between alarms, the occurrence relationship between alarms and equipment, the correspondence relationship between alarms and root causes of faults, and the relationship between a root cause of a fault and equipment.

3. The method according to claim 1, characterized in that After inputting the target work order into the second model for reasoning to obtain the second knowledge graph, the method further includes: Input the second knowledge graph into the second model for iterative calculation to update the second model.

4. A network fault analysis device, characterized in that: The device comprises an acquisition module and a processing module; The acquisition module is used to acquire fault handling information of multiple work orders in the first network; The processing module is used to generate a first knowledge graph based on the fault processing information of multiple work orders in the first network, wherein the first knowledge graph includes the relationship between the work order and the root cause of the fault; the first knowledge graph also includes one or more of the alarms included in the work order, the derivative relationship between the alarms, the equipment where the alarm occurs, the root cause of the fault corresponding to the alarm, and the relationship between the root cause of the fault and the equipment; The processing module is also used to input the first knowledge graph into a preset first model for prediction to obtain a second model; the preset first model includes a graph neural network GNN model and a Distmult model The processing module is further configured to input the target work order into the second model for inference to obtain a second knowledge graph, wherein the second knowledge graph includes a relationship between the target work order and the first root cause of the fault; the second knowledge graph also includes one or more of the alarms included in the target work order, the derivative relationship between the alarms, the device where the alarm occurs, the first root cause of the fault corresponding to the alarm, and the relationship between the first root cause of the fault and the device; The processing module is further used to process the first root cause of the fault corresponding to the target work order according to the second knowledge graph; The processing module is further used to input the first knowledge graph into a preset first model for prediction to obtain a second model, including: Encode the nodes of the first knowledge graph to determine a first embedding vector; By decoding the first embedding vector, a second embedding vector is obtained, where the second embedding vector is an embedding vector of the relationship between nodes in the first knowledge graph; Obtaining the second model according to the first embedding vector, the second embedding vector and the loss function; The processing module is further used to input the target work order into the second model for reasoning to obtain a second knowledge graph, including: Obtaining candidate triples according to the target work order and the first knowledge graph; The second knowledge graph is obtained according to the scoring values ​​of the candidate triples in the second model.

5. The device according to claim 4, characterized in that The first knowledge graph contains multiple triples, each triple is used to characterize the relationship between nodes in the first knowledge graph, wherein the node is any one of a work order, an alarm, equipment, and a root cause of a fault, and the relationship between the nodes includes one or more of the relationship between a work order and a root cause of a fault, the inclusion relationship between a work order and an alarm, the derivative relationship between alarms, the occurrence relationship between alarms and equipment, the correspondence relationship between alarms and root causes of faults, and the relationship between a root cause of a fault and equipment.

Images