Alarm association method, device, equipment and computer storage medium

Abstract

The application discloses an alarm correlation method, device and equipment and a computer storage medium, the alarm correlation method comprises the following steps: constructing a training set according to obtained original data, and determining characteristic data of alarm data pairs in the training set; determining all network elements according to the characteristic data, and constructing a network topology graph according to the network elements; determining all network element sequences in the network topology graph, and constructing an alarm correlation model according to network element vectors corresponding to the network element sequences; if an input test alarm data pair is received, performing alarm correlation prediction on the test alarm data pair according to the alarm correlation model, so as to determine an alarm correlation relationship of the test alarm data pair. The application realizes deep mining of alarm data, and improves the correlation effect between correlated alarm data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information model, and particularly relates to an alarm correlation method and device, equipment and computer storage medium. BACKGROUND

[0002] In the process of mining alarm data, at present, the analysis of the correlation rules between alarm data mainly calculates the correlation between each pair of alarm data. However, there are higher-level and more complex relationships between alarm data, that is, a kind of genealogy structure and social network structure. The existing correlation analysis regards the alarm relationship as isolated existence, without deeply considering the genealogy relationship and social network relationship of the alarm from a more macroscopic perspective, so that the depth mining of the alarm data cannot be realized. SUMMARY

[0003] The main purpose of the present application is to provide an alarm correlation method, device, equipment and computer storage medium, which aims to solve the technical problem of how to realize the depth mining of alarm data and improve the correlation effect between correlated alarm data.

[0004] To achieve the above purpose, the present application provides an alarm correlation method, comprising the following steps:

[0005] According to the obtained original data, a training set is constructed, and the feature data of the alarm data pairs in the training set is determined;

[0006] According to the feature data, all network elements are determined, and a network topology graph is constructed according to each network element;

[0007] All network element sequences in the network topology graph are determined, and an alarm correlation model is constructed according to the network element vectors corresponding to each network element sequence;

[0008] If an inputted test alarm data pair is received, the alarm correlation model is used to predict the alarm correlation of the test alarm data pair, so as to determine the alarm correlation relationship of the test alarm data pair.

[0009] Optionally, the step of determining all network element sequences in the network topology graph comprises:

[0010] The network element set and the edge set in the network topology graph are determined, and the network element starting point is determined based on the network element set, and all related network elements corresponding to the network element starting point are determined according to the edge set, wherein the edge set comprises one or more of the physical connection, logical connection and weak connection of the network elements in the network element set;

[0011] The connection probability between each related network element and the network element starting point is calculated, and the network element sequence is constructed according to each connection probability.

[0012] Optionally, the step of calculating the connection probability between each of the associated network elements and the starting point of the network element includes:

[0013] Traverse each of the associated network elements, determine the weights corresponding to the connection relationships between the traversed associated network elements and the starting point of the network element, and calculate the connection probability between the traversed associated network elements and the starting point of the network element according to the weights and the preset jump probability calculation formula.

[0014] Optionally, the step of constructing an alarm association model based on the network element vectors corresponding to each network element sequence includes:

[0015] Obtain the classification feature data from the feature data, and encode all fields in the classification feature data to obtain field codes;

[0016] Determine the time difference corresponding to the alarm occurrence time in the feature data, and construct an association model based on the field encoding, the time difference, and the network element vector corresponding to each network element sequence. Then, iteratively optimize the association model to obtain an alarm association model.

[0017] Optionally, the step of constructing an association model based on the field encoding, the time difference, and the network element vectors corresponding to each network element sequence includes:

[0018] The alarm information in the feature data is segmented according to a preset alarm-specific vocabulary to obtain multiple segments, and the word vector corresponding to each segment is determined.

[0019] The field codes, word vectors, time differences, and network element vectors corresponding to each network element sequence are input into a preset neural network model for model training to obtain an association model.

[0020] Optionally, the step of iteratively optimizing the association model to obtain the alarm association model includes:

[0021] Identify all alarm data pairs in the original data that have the same fault cause, and input each alarm data pair into the association model in sequence for model training;

[0022] The association model is iteratively optimized based on the training results of the model training to obtain an alarm association model.

[0023] Optionally, the step of iteratively optimizing the associated model based on the training results of the model training includes:

[0024] Obtain all alarm correlation degrees corresponding to the training results of the model training, and detect whether each alarm correlation degree is greater than a preset correlation degree;

[0025] Iteratively optimize the correlation model according to detection results of whether each of the alarm correlation degrees is greater than a preset correlation degree.

[0026] In addition, to achieve the above object, the present application also provides an alarm correlation device, comprising:

[0027] The acquisition module is configured to construct a training set according to the acquired original data and determine feature data of alarm data pairs in the training set.

[0028] The construction module is configured to determine all network elements according to the feature data and construct a network topology graph according to each of the network elements.

[0029] The determination module is configured to determine all network element sequences in the network topology graph and construct an alarm correlation model according to network element vectors corresponding to each of the network element sequences.

[0030] The alarm correlation prediction module is configured to, if an inputted alarm data pair to be tested is received, perform alarm correlation prediction on the alarm data pair to be tested according to the alarm correlation model to determine an alarm correlation relationship of the alarm data pair to be tested.

[0031] In addition, to achieve the above object, the present application also provides an alarm correlation device, comprising a memory, a processor and an alarm correlation program stored in the memory and executable on the processor, wherein the alarm correlation program, when executed by the processor, implements the steps of the alarm correlation method as described above.

[0032] In addition, to achieve the above object, the present application also provides a computer storage medium, wherein the computer storage medium stores an alarm correlation program, and the alarm correlation program, when executed by a processor, implements the steps of the alarm correlation method as described above.

[0033] The present application constructs a training set according to acquired original data, constructs network elements according to feature data of alarm data pairs in the training set, constructs a network topology graph according to the network elements, constructs a correlation model according to network element vectors corresponding to all network element sequences in the network topology graph, iteratively optimizes the correlation model to obtain an alarm correlation model, and performs alarm correlation prediction on an alarm data pair to be tested according to the alarm correlation model to determine an alarm correlation relationship of the alarm data pair to be tested. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1 is a terminal device structure schematic diagram of a hardware running environment involved in an embodiment scheme of the present application.

[0035] Figure 2 This is a flowchart illustrating the first embodiment of the alarm association method of the present invention;

[0036] Figure 3 This is a schematic diagram of the device modules of the alarm association device of the present invention;

[0037] Figure 4 This is a schematic diagram of the alarm association process in the alarm association method of the present invention;

[0038] Figure 5 This is a schematic diagram of the network element sequence construction process of the alarm association method of the present invention;

[0039] Figure 6 This is a schematic diagram of word segmentation display in the alarm association method of the present invention;

[0040] Figure 7 This is a schematic diagram of word vector generation in the alarm association method of the present invention.

[0041] The objectives, features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0042] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0043] like Figure 1 As shown, Figure 1 This is a schematic diagram of the terminal structure of the hardware operating environment involved in the embodiments of the present invention.

[0044] In this embodiment of the invention, the terminal is an alarm-associated device.

[0045] like Figure 1 As shown, the terminal may include: a processor 1001, such as a CPU; a network interface 1004; a user interface 1003; a memory 1005; and a communication bus 1002. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen and an input unit such as a keyboard. Optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be high-speed RAM or non-volatile memory, such as a disk drive. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0046] Optionally, the terminal can further include a camera, RF (Radio Frequency) circuit, sensors, audio circuit, WiFi module, etc. The sensors can include, for example, light sensors, motion sensors, and other sensors. Specifically, the light sensors can include ambient light sensors and proximity sensors, wherein the ambient light sensors can adjust the brightness of the display according to the brightness of ambient light, and the proximity sensors can turn off the display and / or backlight when the terminal device is moved to the ear. Of course, the terminal device can also be configured with a gyroscope, barometer, hygrometer, thermometer, infrared sensor, and other sensors, which will not be described here.

[0047] Those skilled in the art can understand that Figure 1 The terminal structure shown in the above embodiments does not constitute a limitation on the terminal, and can include more or fewer components than shown, or combine certain components, or different component arrangements.

[0048] As shown in Figure 1 The memory 1005 as a computer storage medium can include an operating system, a network communication module, a user interface module, and an alarm correlation program.

[0049] In the terminal shown in Figure 1 The network interface 1004 is mainly used to connect to a background server and communicate data with the background server; the user interface 1003 is mainly used to connect to a client (user end) and communicate data with the client; and the processor 1001 can be used to call the alarm correlation program stored in the memory 1005 and perform the following operations:

[0050] According to the obtained original data, a training set is constructed, and feature data of alarm data pairs in the training set is determined;

[0051] According to the feature data, all network elements are determined, and a network topology graph is constructed according to each network element;

[0052] All network element sequences in the network topology graph are determined, and an alarm correlation model is constructed according to the network element vectors corresponding to each network element sequence;

[0053] If an input test alarm data pair is received, the alarm correlation model is used to predict the alarm correlation of the test alarm data pair, so as to determine the alarm correlation relationship of the test alarm data pair.

[0054] Referring to Figure 2 , the present application provides an alarm correlation method. In a first embodiment of the alarm correlation method, the alarm correlation method comprises the following steps:

[0055] Step S10, according to the obtained original data, a training set is constructed, and feature data of alarm data pairs in the training set is determined;

[0056] Currently, in the process of mining the alarm data, the analysis of the association rules between the alarm data mainly focuses on calculating the association between each two alarm data. However, there are higher level and more complex relationships between the alarm data, that is, a kind of genealogy structure and social network structure, and the existing association analysis does not consider the genealogy structure and social network structure, and does not perform deep mining, resulting in low efficiency of alarm association. Therefore, in the embodiment, the original data including historical alarm data, work order data and resource data are acquired first. Then the acquired alarm data is preprocessed, such as data set construction (including training set and test set) and feature construction, and then an alarm association model is constructed according to the processed data. That is, in the embodiment, different types of data are processed differently, and the network topology graph based on physical connection, logical connection and weak connection is established for the network element ID, and all network elements in the network topology graph can be processed according to random walk or other preset methods, and the alarm association model is constructed according to the processed result, so that the association between the alarm data can be deeply mined according to the alarm association model, and the problem of missing cross-professional resource data is solved, and the efficiency of alarm association is improved.

[0057] Therefore, in the embodiment, the original data including historical alarm data, work order data and resource data need to be acquired first. The historical alarm data includes alarm unique identifier, alarm occurrence time, alarm clearing time, province, city, alarm state, alarm title, professional, network element name, device type, manufacturer, alarm positioning information and the like. The work order data includes work order number, work order theme, occurrence time, associated alarm, fault reason and the like. The resource data includes network element name, province, city, professional and the like, wherein the resource data includes core network, bearing, transmission, NFV (Network Functions Virtualization) and the like.

[0058] When the original data is acquired, the construction of the data set can be performed, including the construction of the training set and the construction of the test set. The construction of the training set can be extracting alarm generation pair p from the historical alarm data, p = (x1, x2, y), where x1 and x2 represent an alarm respectively, y = {0, 1}, 1 is two alarms associated, 0 is two alarms not associated, and setting all p as the training set. The construction of the test set is to extract associated alarms from the work order data to generate pair Q, and all Q are the test set. In the training set, there is at least one p, and p contains two alarms, so it can be considered that each p corresponds to a group of alarm data pairs, and the number of p in the training set and the number of alarm data pairs in the training set are equal.

[0059] When all alarm data pairs in the training set are determined, a pair of alarm data pairs can be selected as a target alarm data pair, and the feature data of the target alarm data pair can be determined. That is, the alarm occurrence time, province, city, alarm title, alarm text, professional, device type, manufacturer, and network element name of x1 and x2 in the alarm pair p can be used to construct features to obtain feature data. As shown in Table 1.

[0060]

[0061] Table 1

[0062] And the network element name will be preprocessed, all network element names will be de-duplicated and encoded to obtain the network element ID.

[0063] Step S20, determining all network elements according to the feature data, and constructing a network topology graph according to each network element;

[0064] In the model construction, the alarm data pairs are divided into four parts and input into the initially set deep neural network model for training, i.e., the alarm occurrence time, classification features, alarm information and network element ID are determined according to the feature data. Among them, the time difference between the two alarms in the target alarm data pair is calculated, and the time difference is vectorized and then embedded into the model. The classification features include province, city, profession, device type and manufacturer, each field is encoded and vectorized, and then embedded into the model. The alarm information includes alarm title and alarm text, which is segmented and vectorized, and then embedded into the model. For the network element ID, the connection relationship between the network elements corresponding to each network element ID can be extracted according to the resource data, historical alarm data and work order data, and all network elements in the model are connected according to the connection relationship to construct a network topology graph. Among them, the network topology graph G=(V, E), V=(v1, v2,..., vn) is a set of network elements, including a full set of network elements of each profession such as core network, bearer, CMNET, transmission, NFV, etc., E={e ij} is an edge set, e ij represents that there is a directed edge with weight w i between the v j th network element and the v ij th network element, where the edge includes physical connection, such as direct connection between v i and v j , also includes logical connection, such as two network elements belonging to the same POOL, and also includes weak connection, such as two network elements belonging to the same machine room / city / province, and the larger the range is, the lower w ij is. Among them, the weight w ij represents the credibility of the connection relationship between two network elements, and wijphysical connection>logical connection>weak connection.

[0065] Step S30, determine all network element sequences in the network topology graph, and construct an alarm correlation model according to the network element vectors corresponding to each network element sequence;

[0066] When the network topology graph is constructed, all network element sequences in the network topology graph need to be determined, that is, a network element can be randomly selected as a network element starting point in the network topology graph by using random walk, and a network element adjacent point adjacent to the network element starting point is determined, and a network element sequence is constructed according to the network element starting point and the network element adjacent point. Among them, when the network element adjacent point is determined, the jump probability of random walk can be determined first, that is, after reaching node v i , the next step is to traverse the network element adjacent point of v j , and the jump probability can be calculated according to the following formula:

[0067]

[0068] wherein, N+(v i ) is the network element v i All out-edge set, w ij is the network element v i to the network element v j The weight of the edge.

[0069] Then all the network element sequences constructed are input into the network model set in advance for training, such as input into the skip-gram model, to generate the final network element vector, and then the correlation model is constructed according to the network element vector. The vector representation between network elements with strong connection relationship is closer. For example, as shown in the figure, if there are network elements A, B, C, D, E, F; the network element sequence can be A-B-E-F; B-E-C-B-A; C-B-A-B-E; D-A-B-E-C; E-C-B-A; A-B-E-C-B, etc., and will be trained according to the skip-gram model, to obtain each network element vector, that is, the corresponding network element sequence is input through the input matrix in the projection layer, and is processed through the hidden agent layer, and the corresponding network element vector P, N, etc. is output through the output matrix, and is classified through the classifier. Figure 5

[0070] When the correlation model is generated, the correlation model can be iteratively optimized according to the alarms in the test set, and the iteratively optimized correlation model is used as the alarm correlation model. When iteratively optimizing, the correlation model is used to calculate the correlation between two alarms in the test set, and the calculated correlation is compared with the preset correlation (any correlation set by the user in advance, such as 0.5). If the correlation is greater than the preset correlation, the determination result of the correlation model is that the two alarms in the test set are associated. If the correlation is less than or equal to the preset correlation, the determination result of the correlation model is that the two alarms in the test set are not associated. However, since the two alarms in the test set are associated in advance, the accuracy of the correlation model can be evaluated according to the determination result of the correlation model, and the correlation model is iteratively optimized according to the accuracy to obtain the alarm correlation model.

[0071] Step S40, if the input test alarm data pair is received, the alarm correlation model is used to predict the alarm correlation of the test alarm data pair to determine the alarm correlation relationship of the test alarm data pair.

[0072] ​When the alarm correlation is associated, subsequent alarm correlation processing can be performed according to the alarm correlation model, that is, when at least one pair of alarm data input by other terminals or users is received, the pair of alarm data is input into the generated alarm correlation model as a pair of alarm data to be tested, and the pair of alarm data to be tested is predicted by the alarm correlation model to obtain the correlation degree of the pair of alarm data to be tested, and the alarm correlation relationship of the pair of alarm data to be tested is determined according to the correlation degree.

[0073] It should be noted that the embodiment is based on a neural network algorithm to generate an alarm correlation model, which can automatically calculate the correlation between any two alarms, facilitate the generation of a test set of work order data, automatically evaluate the correlation effect, and optimize the correlation model based on the correlation effect. Moreover, in the embodiment, a network topology graph is generated based on resource data, and the network topology graph includes physical connections, logical connections, and weak connections, and different weights are set for different connection relationships to form the connection relationship between various professional network elements. Moreover, the embodiment is based on historical alarm data to learn the correlation between alarms using an MLP model, so that the research on alarm correlation is no longer strongly dependent on the integrity of resources.

[0074] In addition, the following examples are provided to assist in understanding the principles of the alarm correlation model construction in the embodiment.

[0075] For example, as shown in Figure 4 , first, the pair of alarm data is split into alarm occurrence time, classification features, alarm information, and network element ID, and the four features are used as input parts of the model. Then, the time difference between the occurrence times of the two alarms corresponding to the pair of alarm data is calculated, that is, the time difference is calculated and embedded into the model. Each field in the classification features is encoded and embedded into the model after encoding. The alarm information can be converted into a corresponding word vector according to word2vec (i.e., a correlation model), and the network element ID can be converted into a network element vector using a deep walk algorithm. Then, the batch normalization layer is used for summarization, and the multi-layer neural network is used for training, and the training result (i.e., the correlation degree) is output.

[0076] In the embodiment, the training set is constructed according to the obtained original data, the network element is constructed according to the feature data corresponding to the alarm data in the training set, the network topology graph is constructed according to the network element, the correlation model is constructed according to the network element vectors corresponding to all the network element sequences in the network topology graph, the correlation model is iteratively optimized to obtain the alarm correlation model, and the alarm correlation prediction is performed on the to-be-tested alarm data pair according to the alarm correlation model to determine the alarm correlation relationship of the to-be-tested alarm data pair. Thus, the phenomenon that the alarm data is not deeply mined in the prior art and the correlation effect of the alarm data is poor is avoided, the alarm data is deeply mined through the network topology graph, the correlation of the alarm data is determined according to the constructed alarm correlation model, and the correlation effect between the correlated alarm data is improved.

[0077] Further, based on the first embodiment of the present application, a second embodiment of the alarm correlation method of the present application is provided. In the embodiment, the step of determining all the network element sequences in the network topology graph in the step S20 of the above embodiment is refined, which includes:

[0078] Step a, determining the network element set and the edge set in the network topology graph, and determining the network element starting point based on the network element set, and determining all the correlated network elements corresponding to the network element starting point according to the edge set, wherein the edge set includes one or more of the physical connection, the logical connection and the weak connection of the network elements in the network element set;

[0079] In the embodiment, the network topology graph includes the network element set and the edge set, and the network elements in the network element set can be full-quantity network element sets of various professions such as the core network, the bearer, the CMNET, the transmission and the NFV. The edge set includes one or more of the physical connection, the logical connection and the weak connection between the network elements in the network element set, wherein the weak connection is a relatively weak connection relationship between the network elements. Therefore, a random walk method can be used to randomly select a network element in each network element in the network element set as a network element starting point, and then determine the network elements having the physical connection, the logical connection or the weak connection with the network element starting point as the correlated network elements according to the edge set.

[0080] Step b, calculating the connection probability between each of the correlated network elements and the network element starting point, and constructing the network element sequence according to each of the connection probabilities.

[0081] After the determination of each of the correlated network elements and the network element starting point, the connection probability between the network element starting point and each of the correlated network elements can be calculated, the network element adjacent point (i.e., one of the correlated network elements) connected with the network element starting point can be determined according to the different connection probabilities, and the sequence from the network element starting point to the network element adjacent point is taken as the network element sequence after the determination of the network element adjacent point. It should be noted that there can be multiple network element sequences in the embodiment.

[0082] In the embodiment, the network element starting point is determined according to the network element set in the network topology graph, all related network elements are determined according to the edge set, and the network element sequence is constructed according to the connection probability between each related network element and the network element starting point, so that the effectiveness of the obtained network element sequence is ensured.

[0083] Specifically, the step of calculating the connection probability between each related network element and the network element starting point comprises:

[0084] Step c, traversing each related network element, determining the weight corresponding to the connection relationship between the traversed related network element and the network element starting point, and calculating the connection probability between the traversed related network element and the network element starting point according to the weight and a preset jump probability calculation formula.

[0085] In the embodiment, when calculating the connection probability, each related network element can be traversed first, and the weight corresponding to the connection relationship between the traversed related network element and the network element starting point is determined. Different connection relationships correspond to different weights, and the connection relationship can be determined according to the edge set. Then the jump probability calculation formula set in advance is determined, such as:

[0086]

[0087] Wherein, N+(v i ) is the network element v i All out-edge set, w ij is the weight of the edge from the network element v i to the network element v j .

[0088] Then the weight is input into the jump probability calculation formula for calculation to obtain the connection probability between the traversed related network element and the network element starting point.

[0089] In the embodiment, by traversing each related network element, the connection probability is calculated according to the weight corresponding to the connection relationship between the traversed related network element and the network element starting point and the jump probability calculation formula, so that the accuracy of the calculated connection probability is ensured.

[0090] Further, the step of constructing an alarm association model according to the network element vector corresponding to each network element sequence comprises:

[0091] Step d, obtaining classification feature data in the feature data, and performing encoding processing on all fields in the classification feature data to obtain field encoding;

[0092] In the embodiment, when the correlation model is constructed according to the network element vector, other parameters required for constructing the correlation model, such as field coding and time difference value, also need to be determined. That is, the classification feature data in the feature data can be acquired first, wherein the classification feature data includes five fields of province, city, specialty, device type and manufacturer, and each field is coded by using one-hot coding. For each field, if there are m possible values, then after one-hot coding, m binary features are obtained. The binary features are mutually exclusive, and only one binary feature is activated each time, and the activated binary feature is the field coding.

[0093] In step e, the time difference value corresponding to the alarm occurrence time in the feature data is determined, the correlation model is constructed according to the field coding, the time difference value and the network element vector corresponding to each network element sequence, and the correlation model is iteratively optimized to obtain the alarm correlation model.

[0094] Moreover, when the field coding is acquired, the two alarm occurrence times corresponding to the target alarm data are calculated, the difference between the two alarm occurrence times is calculated as the time difference value, and the field coding, the time difference value, the network element vector corresponding to each network element sequence and other parameters required for model training are input into the pre-set deep network algorithm for training to obtain the correlation model. Then the correlation model is iteratively optimized by using the pre-set test set to improve the accuracy of the correlation model, and the iteratively optimized correlation model is taken as the alarm correlation model.

[0095] In the embodiment, by coding all fields of the classification feature data in the feature data, the field difference value is obtained, and the alarm correlation model is constructed according to the time difference value corresponding to the alarm occurrence time and the network element vector, so that the effective construction of the alarm correlation model is ensured.

[0096] Specifically, the step of constructing the correlation model according to the field coding, the time difference value and the network element vector corresponding to each network element sequence includes:

[0097] In step f, the alarm information in the feature data is segmented according to a pre-set alarm exclusive vocabulary table to obtain a plurality of segmented words, and a word vector corresponding to each segmented word is determined.

[0098] In the embodiment, when the correlation model is constructed, the alarm information also needs to be processed accordingly, that is, the alarm information is segmented according to a pre-set alarm exclusive vocabulary table to obtain a plurality of segmented words, such as alarm information W = {w1, w2,..., wt}, wherein t represents the number of words contained in the alarm title. After each segmented word is determined, the adjacent words between the segmented words can be determined according to the skip-gram model, such as Figure 6As shown, the adjacent words of segment w(t) can be w(t-2), w(t-1), w(t+1), and w(t+2), and a sliding window of 2c+1 (c words before and after the target word) is selected. For each word wt from the left to the right of the alarm information, its left and right adjacent words form a positive template. Then, the skip-gram model is used to generate the word vector corresponding to each segment. In this embodiment, meaningless high-frequency segmented words need to be downsampled. For example, such as Figure 7 As shown, x1, x2, x3, xk, xv, etc., are input into the input matrix, processed accordingly through the hidden layer, and the corresponding results, such as y1, y2, y3, yj, yv, etc., are output through the output matrix. The input matrix includes W. V*N ={W ki The output matrix includes W. / V*N ={W / ki Hidden layers include h1, h2, hi, hN, etc.

[0099] Step g: Input the field codes, word vectors, time differences, and network element vectors corresponding to each network element sequence into a preset neural network model for model training to obtain an association model.

[0100] After obtaining the field codes, word vectors, time differences, and network element vectors, all field codes, word vectors, time differences, and network element vectors can be input together into the pre-set initial neural network model for model training to obtain the associated model.

[0101] In this embodiment, the alarm information is segmented to obtain multiple words. The word vectors, field codes, time differences, and network element sequences corresponding to each word are then input into the neural network model for model training to obtain the association model, thereby ensuring the effectiveness of the constructed association model.

[0102] Further, the step of iteratively optimizing the correlation model to obtain the alarm correlation model includes:

[0103] Step h: Identify all alarm data pairs in the original data that have the same fault cause, and input each alarm data pair into the association model in sequence for model training;

[0104] In this embodiment, after generating the association model, all alarm data pairs Q with consistent fault causes in the pre-built test set can be used, and each alarm data pair can be sequentially input into the association model for model training.

[0105] Step k, iteratively optimizing the correlation model based on the training result of the model training to obtain an alarm correlation model.

[0106] The correlation model is iteratively optimized based on the training result of the model training, i.e., the alarm correlation degree corresponding to each alarm data pair, to obtain an alarm correlation model.

[0107] In this embodiment, the correlation model is iteratively optimized based on the training result of the model training, i.e., the alarm correlation degree corresponding to each alarm data pair, to obtain an alarm correlation model, thereby ensuring the accuracy of the obtained alarm correlation model.

[0108] Specifically, the step of iteratively optimizing the correlation model based on the training result of the model training comprises:

[0109] Step m, obtaining all alarm correlation degrees corresponding to the training result of the model training, and detecting whether each alarm correlation degree is greater than a preset correlation degree;

[0110] When iteratively optimizing the correlation model, the training result of the model training of the correlation model on all alarm data pairs, i.e., the alarm correlation degree corresponding to each alarm data pair, needs to be obtained, and whether each alarm correlation degree is greater than a preset correlation degree needs to be detected.

[0111] Step n, iteratively optimizing the correlation model according to the detection result of detecting whether each alarm correlation degree is greater than a preset correlation degree.

[0112] The accuracy of the correlation model is determined according to the detection result of detecting whether each alarm correlation degree is greater than a preset correlation degree, and if the accuracy is lower than a certain value, the correlation model is iteratively optimized according to the training set, and the iteratively optimized correlation model is taken as an alarm correlation model.

[0113] In this embodiment, all alarm correlation degrees are obtained, and the correlation model is iteratively optimized according to the detection result of detecting whether each alarm correlation degree is greater than a preset correlation degree, thereby ensuring the effective performance of obtaining an alarm correlation model.

[0114] In addition, with reference to Figure 3 The embodiment of the present application also provides an alarm correlation device, comprising:

[0115] The obtaining module A10 is configured to construct a training set according to the obtained original data, and determine the feature data of the alarm data pairs in the training set;

[0116] The constructing module A20 is configured to determine all network elements according to the feature data, and construct a network topology graph according to each network element.

[0117] The determining module A30 is configured to determine all network element sequences in the network topology graph, and construct an alarm correlation model according to a network element vector corresponding to each of the network element sequences.

[0118] The alarm correlation prediction module A40 is configured to, if a pair of input test alarm data is received, perform alarm correlation prediction on the pair of test alarm data according to the alarm correlation model, to determine an alarm correlation relationship of the pair of test alarm data.

[0119] Optionally, the determining module A30 is configured to:

[0120] determine a network element set and an edge set in the network topology graph, and determine a network element starting point based on the network element set, and determine all related network elements corresponding to the network element starting point according to the edge set, wherein the edge set includes one or more of physical connection, logical connection and weak connection of a network element in the network element set;

[0121] calculate a connection probability between each of the related network elements and the network element starting point, and construct a network element sequence according to each of the connection probabilities.

[0122] Optionally, the determining module A30 is configured to:

[0123] traverse each of the related network elements, determine a weight corresponding to a connection relationship between a traversed related network element and the network element starting point, and calculate a connection probability between the traversed related network element and the network element starting point according to the weight and a preset jump probability calculation formula.

[0124] Optionally, the determining module A30 is configured to:

[0125] obtain classification feature data in the feature data, and perform encoding processing on all fields in the classification feature data to obtain field encoding;

[0126] determine a time difference value corresponding to an alarm occurrence time in the feature data, and construct an association model according to the field encoding, the time difference value and a network element vector corresponding to each of the network element sequences, and perform iterative optimization on the association model to obtain an alarm correlation model.

[0127] Optionally, the determining module A30 is configured to:

[0128] perform word segmentation processing on alarm information in the feature data according to a preset alarm exclusive vocabulary table to obtain a plurality of segmented words, and determine a word vector corresponding to each of the segmented words;

[0129] The field encoding, the word vector, the time difference value and the network element vector corresponding to each network element sequence are input into a preset neural network model for model training to obtain an association model.

[0130] Optionally, the determining module A30 is configured to:

[0131] determine all alarm data pairs with consistent fault causes in the original data, and sequentially input each alarm data pair into the association model for model training;

[0132] iteratively optimize the association model based on a training result of the model training to obtain an alarm association model.

[0133] Optionally, the determining module A30 is configured to:

[0134] obtain all alarm association degrees corresponding to the training result of the model training, and detect whether each alarm association degree is greater than a preset association degree;

[0135] iteratively optimize the association model according to a detection result of whether each alarm association degree is greater than the preset association degree.

[0136] Each functional module of the alarm association device implements the steps of each embodiment of the alarm association method, which will not be described here.

[0137] In addition, the present application also provides an alarm association device, the terminal comprises: a memory, a processor, a communication bus and an alarm association program stored in the memory:

[0138] The communication bus is used to realize the connection communication between the processor and the memory;

[0139] The processor is used to execute the alarm association program to realize the steps of each embodiment of the alarm association method.

[0140] The present application also provides a computer storage medium, the computer storage medium stores one or more programs, the one or more programs can also be executed by one or more processors to realize the steps of each embodiment of the alarm association method.

[0141] The computer readable storage medium of the present application has basically the same embodiment as the above-mentioned alarm association method, which will not be described here.

[0142] It should be noted that, in this document, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or system. Without further limitation, an element preceded by "comprises... a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or system that comprises the recited element.

[0143] The above-mentioned embodiment numbers of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0144] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by means of software and the necessary general hardware platform, and of course, they can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, or an optical disk) as described above, and includes a number of instructions for making a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) execute the methods described in the various embodiments of the present application.

[0145] The above is only the preferred embodiment of the present application, and does not limit the patent scope of the present application, and any equivalent structure or equivalent flow transformation made by using the content of the specification and drawings of the present application, or directly or indirectly applied to other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. An alarm association method, characterized in that, The alarm association method includes the following steps: A training set is constructed based on the acquired raw data, and the feature data of the alarm data pairs in the training set are determined. All network elements are determined based on the aforementioned feature data, and a network topology diagram is constructed based on each of the aforementioned network elements; Determine all network element sequences in the network topology diagram, and construct an alarm association model based on the network element vectors corresponding to each network element sequence; If an input pair of alarm data to be tested is received, alarm association prediction is performed on the pair of alarm data to be tested according to the alarm association model to determine the alarm association relationship of the pair of alarm data to be tested. The step of determining all network element sequences in the network topology diagram includes: The set of network elements and the set of edges in the network topology graph are determined, and the starting point of the network element is determined based on the set of network elements. All associated network elements corresponding to the starting point of the network element are determined according to the set of edges. The set of edges includes one or more of the physical connections, logical connections and weak connections of the network elements in the set of network elements. Calculate the connection probability between each associated network element and the starting point of the network element, and construct a network element sequence based on each connection probability; The step of calculating the connection probability between each of the associated network elements and the starting point of the network element includes: Traverse each of the associated network elements, determine the weights corresponding to the connection relationships between the traversed associated network elements and the starting point of the network element, and calculate the connection probability between the traversed associated network elements and the starting point of the network element according to the weights and the preset jump probability calculation formula. The step of constructing an alarm association model based on the network element vectors corresponding to each network element sequence includes: Obtain the classification feature data from the feature data, and encode all fields in the classification feature data to obtain field codes; Determine the time difference corresponding to the alarm occurrence time in the feature data, construct an association model based on the field code, the time difference and the network element vector corresponding to each network element sequence, and iteratively optimize the association model to obtain an alarm association model; The step of constructing an association model based on the field encoding, the time difference, and the network element vectors corresponding to each network element sequence includes: The alarm information in the feature data is segmented according to a preset alarm-specific vocabulary to obtain multiple segments, and the word vector corresponding to each segment is determined. The field codes, word vectors, time differences, and network element vectors corresponding to each network element sequence are input into a preset neural network model for model training to obtain an association model.

2. The alarm association method as described in claim 1, characterized in that, The step of iteratively optimizing the correlation model to obtain the alarm correlation model includes: Identify all alarm data pairs in the original data that have the same fault cause, and input each alarm data pair into the association model in sequence for model training; The association model is iteratively optimized based on the training results of the model training to obtain an alarm association model.

3. The alarm association method as described in claim 2, characterized in that, The step of iteratively optimizing the associated model based on the training results of the model training includes: Obtain all alarm correlation degrees corresponding to the training results of the model training, and detect whether each alarm correlation degree is greater than a preset correlation degree; The correlation model is iteratively optimized based on the detection results of whether the correlation degree of each alarm is greater than the preset correlation degree.

4. An alarm association device, characterized in that, The alarm association device includes: The acquisition module is used to construct a training set based on the acquired raw data and determine the feature data of alarm data pairs in the training set. A construction module is used to determine all network elements based on the feature data, and to construct a network topology diagram based on each network element; A determination module is used to determine all network element sequences in the network topology diagram and construct an alarm association model based on the network element vectors corresponding to each network element sequence. The determination of all network element sequences in the network topology diagram includes: determining the network element set and edge set in the network topology diagram, determining the network element starting point based on the network element set, and determining all associated network elements corresponding to the network element starting point based on the edge set, wherein the edge set includes one or more of physical connections, logical connections, and weak connections of the network elements in the network element set; calculating the connection probability between each associated network element and the network element starting point, and constructing a network element sequence based on each connection probability; the calculation of the connection probability between each associated network element and the network element starting point includes: traversing each associated network element, determining the weight corresponding to the connection relationship between the traversed associated network element and the network element starting point, and calculating the connection probability between the traversed associated network element and the network element starting point based on the weight and a preset jump probability calculation formula. The connection probability; the step of constructing an alarm association model based on the network element vectors corresponding to each network element sequence includes: acquiring classification feature data in the feature data, and encoding all fields in the classification feature data to obtain field codes; determining the time difference value corresponding to the alarm occurrence time in the feature data, constructing an association model based on the field codes, the time difference value, and the network element vectors corresponding to each network element sequence, and iteratively optimizing the association model to obtain an alarm association model; the step of constructing an association model based on the field codes, the time difference value, and the network element vectors corresponding to each network element sequence includes: performing word segmentation on the alarm information in the feature data according to a preset alarm-specific vocabulary to obtain multiple words, and determining the word vectors corresponding to each word segment; inputting the field codes, the word vectors, the time difference value, and the network element vectors corresponding to each network element sequence into a preset neural network model for model training to obtain an association model; The alarm association prediction module is used to predict the alarm association of the input alarm data pair to be tested according to the alarm association model if it receives the input alarm data pair to be tested, so as to determine the alarm association relationship of the alarm data pair to be tested.

5. An alarm association device, characterized in that, The alarm association device includes: a memory, a processor, and an alarm association program stored in the memory and executable on the processor. When the alarm association program is executed by the processor, it implements the steps of the alarm association method as described in any one of claims 1 to 3.

6. A computer storage medium, characterized in that, The computer storage medium stores an alarm association program, which, when executed by a processor, implements the steps of the alarm association method as described in any one of claims 1 to 3.

Images