A method and device for event analysis

Abstract

The present application discloses a method and device for event analysis, belonging to the technical field of correlation analysis. The method comprises: obtaining a query message of a first event, the query message is used to query the target information of a second event, the second event is triggered by the first event, the first event is an event that has occurred at a first time, the second event is a predicted event that has not occurred at the first time, and the first time is less than or equal to the time when the query message is obtained; based on the query message, obtaining the target information, the target information includes the event identifier, trigger probability and / or predicted occurrence time of the second event. The present application realizes the diversity analysis of the correlation between events and enriches the analysis function of events with correlation.

Description

Technical Field

[0001] The present application relates to the technical field of correlation analysis, and in particular to an event analysis method and device thereof. Background Art

[0002] With the rapid expansion and growth of operator networks, the network topology and topology logic of operator networks have become increasingly complex, and network failures have become more frequent, causing tremendous pressure on operation and maintenance personnel to locate network failures and determine the correlation between failures.

[0003] In the related art, a clustering method can be used to determine the correlation between faults. For example, features can be extracted from multiple faults that have occurred, and multiple faults can be clustered based on the extracted feature information, and faults that are classified into one category are considered to be correlated.

[0004] However, this clustering method can only determine whether there is correlation between faults, and its function is relatively simple. Summary of the invention

[0005] The present application provides an event analysis method and device thereof, wherein the event analysis results obtained by the method include the trigger probability and / or predicted occurrence time of the triggered event, and the analysis results intuitively reflect the analysis results of the associated events, enriching the analysis function of the associated events. The technical solutions provided by the present application are as follows:

[0006] In a first aspect, the present application provides a method for event analysis, which is applied to a communication device, and the method includes: obtaining a query message for a first event, the query message is used to query target information of a second event, the second event is triggered by the first event, the first event is an event that has occurred at a first time, the second event is a predicted event that has not occurred at the first time, and the first time is less than or equal to the time when the query message is obtained; based on the query message, obtaining target information, the target information includes an event identifier, trigger probability and / or predicted occurrence time of the second event.

[0007] In the event analysis method provided in the present application, since the method can predict the second event that is triggered by the first event and has not occurred, and predict at least one of the triggering probability and the predicted occurrence time of the second event, compared with the related art, it can not only analyze whether there is a correlation between events, but also analyze at least one of the triggering probability and the predicted occurrence time of the triggered event in the correlated events. The analysis results intuitively reflect the analysis results of the correlated events and are highly interpretable, thereby realizing diversified analysis of the correlation between events and enriching the analysis function of correlated events.

[0008] Optionally, the query message includes a screening condition, and the query message including the screening condition is used to query target information that meets the screening condition, and the screening condition includes one or more of the following: time condition, probability condition, and device condition. By setting the screening condition, a more targeted query can be performed according to the screening condition.

[0009] The device condition includes one or more of the following device attributes: device identification, device location, device type, network topology of the device, device manufacturer and device user. The device condition is used to indicate a device associated with the occurrence of the second event.

[0010] As an implementable manner, the query message is obtained based on the query parameters input by the user in the query interface, or based on the interface components selected by the user in the query interface, or obtained from a third-party system through an application programming interface.

[0011] Optionally, before obtaining the target information based on the query message, the event analysis method further includes: obtaining first historical data of an event that has occurred at a first time among events managed by the communication device, the first historical data including: an identifier of the event that has occurred and the time of occurrence of the event that has occurred, the first historical data including historical data of the first event and historical data of a third event, the third event being an event that has the same identifier as the second event among events that have occurred at the first time. Accordingly, obtaining the target information includes: analyzing the first historical data to obtain the target information.

[0012] It can be seen that this method actually counts the rules of one event causing another event based on the historical data of the event, and analyzes the correlation between events based on the rules. Compared with the related technology of analyzing the correlation of events based on the rules obtained by expert experience, it can analyze the correlation between events in more situations, ensuring the scope of application of this method without injecting expert experience. And because this method is not analyzed based on the rules obtained by expert experience, it does not need to synchronize the rules according to the expansion of the network, which will not affect the efficiency of development and operation and maintenance, nor will it cause an increase in implementation costs and bit error rates.

[0013] Furthermore, the necessary information in the first historical data is the identifier of the event that has occurred and the time when the event has occurred. Compared with other related technologies for analyzing the correlation between events, the requirements for the data referenced by the analysis are reduced, and the generalization ability of the analysis can be improved.

[0014] The step of analyzing the first historical data to obtain the target information includes: obtaining the target information based on the first historical data and an analysis model. Optionally, the analysis model may be an artificial intelligence model.

[0015] Furthermore, the first historical data is analyzed to obtain target information, including: obtaining target information based on the first historical data, analysis indication information and an analysis model, wherein the analysis indication information is used to indicate that the first event is used as a preceding event that triggers the occurrence of the second event.

[0016] It should be noted that when the analysis model is used for analysis, the analysis instruction information may not be input into the analysis model. In this case, the content indicated by the analysis instruction information may be obtained by analyzing the first historical data by the analysis model.

[0017] Optionally, the second event associated with the first event includes one or more, and based on the first historical data, analysis indication information and analysis model, target information is obtained, including: pre-screening the first historical data to obtain historical data of the first event and historical data of any third event, where any third event is an event that has occurred at the first time and has the same identifier as any second event; inputting the analysis indication information, the historical data of the first event and the historical data of any third event into the analysis model to obtain target information of any second event output by the analysis model.

[0018] By pre-screening the first historical data in advance and providing the pre-screened data to the analysis model, the amount of data that the analysis model needs to process can be reduced, thereby ensuring the speed of analysis performed by the analysis model.

[0019] Furthermore, after pre-screening the first historical data, the communication device may also perform statistics on the first historical data and provide the statistically obtained data to the analysis model, so that the analysis model performs analysis based on the statistically obtained data to reduce the amount of data that the analysis model needs to process for analysis.

[0020] In one achievable manner, the implementation process of performing statistics on the first historical data may include: recording the occurrence time of the third event according to the historical data of the third event, and in the historical data of the first event, taking the occurrence time of the third event as the starting point, and counting the occurrence time of the first event before the occurrence of the third event each time in the direction of time going backwards, obtaining the corresponding time difference between the occurrence time of the third event and the first event, and counting the total number of occurrences of different time differences respectively. In addition, to ensure the validity of the data, when performing statistics, it is also possible to limit the statistics to the occurrence time of the first event within a specified time window before the occurrence of the third event each time. For example, it is possible to limit the occurrence time of the first event to one minute before the occurrence of the third event each time.

[0021] It should be noted that the analysis model can be a pre-trained model, and the pre-trained model can obtain the target information of any second event corresponding to the third event triggered by the first event based on the historical data of the first event and the historical data of the third event. Therefore, before using the analysis model to obtain the target information, the analysis model needs to be trained. In an implementable manner, before obtaining the target information based on the first historical data, the analysis indication information and the analysis model, the event analysis method also includes: based on the historical data of the first event and the historical data of any third event, obtaining reference data of the probability of the first event triggering any third event changing over time, the second event associated with the first event includes one or more, and any third event is an event with the same identifier as any second event in the events that have occurred at the first time; obtaining initialization data of the probability of the first event triggering any third event changing over time, the initialization data is obtained by initializing the probability of occurrence of the first event and any third event; based on the reference data and the initialization data, the analysis model is trained.

[0022] Optionally, initialization data on the variation of the probability of a first event triggering any third event over time is obtained, including: based on the historical data of the first event and the historical data of any third event, counting the total number of times any third event occurs after a specified period of time has passed since the first event occurred; obtaining a time feature point based on the total number of times, the first historical data indicating that the probability of the first event triggering any third event at the time feature point is greater than or equal to a reference probability threshold; performing a first initialization on the probability of the first event triggering any third event at the time feature point; performing a second initialization on the probabilities of the first event and any third event occurring in a specified time period, respectively; and obtaining initialization data on the variation of the probability of the first event triggering any third event over time based on the result of the first initialization and the result of the second initialization.

[0023] It should be noted that when the historical data of the first event and the historical data of the third event reflect that the third event has a delay probability, the delay probability needs to be third initialized in the process of obtaining the initialization data, and accordingly, the initialization data also needs to reflect the result of the third initialization. In one implementable manner, the delay probability can be initialized randomly.

[0024] When it is determined based on historical data that the third event has a delay probability, by performing a third initialization on the delay probability, the probability that the first event triggers the third event obtained according to the initialization data changes over time can be better fit to the probability that the first event triggers the third event obtained according to historical data changes over time, thereby making the training results of the analysis model better and ensuring the performance of the analysis model.

[0025] There are many ways to obtain time feature points. This application takes the following three ways as examples to illustrate the implementation methods.

[0026] In a first possible implementation, a time feature point can be obtained based on the total number of times and the change in the total number of times. For example, the total number of times the third event occurs after the first event occurs for a specified time period t1, t1+1, and t1-1 can be obtained respectively, and the first change gradient of the total number of times the third event occurs after the first event occurs for a specified time period t1-1 relative to the total number of times the third event occurs after the specified time period t1 is obtained, and the second change gradient of the total number of times the third event occurs after the first event occurs for a specified time period t1 relative to the total number of times the third event occurs after the specified time period t1+1 is obtained, and when the total number of times the third event occurs after the first event occurs for a specified time period t1 is greater than the total number of times the third event occurs after the first event occurs for a specified time period t1-1 and t1+1, respectively, and when both the first change gradient and the second change gradient are greater than the specified gradient threshold, the specified time period t1 is determined as a time feature point.

[0027] In a second possible implementation, a sliding window method can be used to obtain time feature points in the generation time period of the historical data of the first event and the historical data of the third event. The implementation process includes: setting a time window with a certain length and a sliding step length of the time window in the generation time period, controlling the time window to slide along the development direction of the generation time period according to the sliding step length from the starting point of the time period, and when the time window slides to a position, in the sub-time period of the generation time period covered by the time window, the first total number of occurrences of the third event at all time points in the sub-time period after the first event occurs for a specified time period is counted, and the second total number of occurrences of the third event at all time points in the generation time period after the first event occurs for a specified time period is counted, and when the percentage of the first total number of occurrences to the second total number of occurrences reaches a percentage threshold, the time center point of the sub-time period is determined as the time feature point.

[0028] In a third possible implementation method, the maximum total number of times the third event occurs after a specified period of time has passed since the first event occurred can be determined based on the historical data of the first event and the historical data of the third event, and a jitter threshold for the maximum value can be set. Then, in the time period when the historical data of the first event and the historical data of the third event are generated, time points within the jitter threshold range when the total number of times the third event occurs after a specified period of time has passed since the first event occurred can be screened, and the screened time points can be determined as time feature points.

[0029] In a second aspect, the present application provides a device for event analysis, which includes: an interaction module, used to obtain a query message for a first event, the query message is used to query target information of a second event, the second event is triggered by the first event, the first event is an event that has occurred at a first time, the second event is a predicted event that has not occurred at the first time, and the first time is less than or equal to the time when the query message is obtained; an acquisition module, used to obtain target information based on the query message, the target information including the event identifier, trigger probability and / or predicted occurrence time of the second event.

[0030] Optionally, the query message includes a filtering condition, and the query message including the filtering condition is used to query target information that meets the filtering condition, and the filtering condition includes one or more of the following: a time condition, a probability condition, and a device condition.

[0031] The device condition includes one or more of the following device attributes: device identification, device location, device type, network topology of the device, device manufacturer and device user. The device condition is used to indicate a device associated with the occurrence of the second event.

[0032] Optionally, the query message is obtained based on query parameters input by the user in the query interface, or based on an interface component selected by the user in the query interface, or obtained from a third-party system through an application programming interface API.

[0033] Optionally, the acquisition module is also used to: obtain first historical data of an event that has occurred at the first time among the events managed by the device, the first historical data including: an identifier of the event that has occurred and the time of occurrence of the event that has occurred, the first historical data including historical data of the first event and historical data of a third event, the third event being an event that has the same identifier as the second event among the events that have occurred at the first time; accordingly, the acquisition module is specifically used to: analyze the first historical data to obtain target information.

[0034] Optionally, the acquisition module is specifically used to: obtain target information based on the first historical data and the analysis model. In one implementable manner, the analysis model is an artificial intelligence model.

[0035] Optionally, the acquisition module is specifically used to: obtain target information based on the first historical data, analysis indication information and the analysis model, and the analysis indication information is used to indicate that the first event is used as a preceding event that triggers the occurrence of the second event.

[0036] Optionally, the second event associated with the first event includes one or more acquisition modules, which are specifically used to: pre-screen the first historical data to obtain the historical data of the first event and the historical data of any third event, where any third event is an event that has occurred at the first time and has the same identifier as any second event; input analysis indication information, the historical data of the first event and the historical data of any third event into the analysis model to obtain target information of any second event output by the analysis model.

[0037] Optionally, the device also includes: a training module, which is used to: obtain reference data on the probability of the first event triggering any third event changing over time based on the historical data of the first event and the historical data of any third event, the second event associated with the first event includes one or more, and any third event is an event that has occurred at the first time and has the same identifier as any second event; obtain initialization data on the probability of the first event triggering any third event changing over time, the initialization data is obtained by initializing the occurrence probabilities of the first event and any third event; and train the analysis model based on the reference data and the initialization data.

[0038] Optionally, the training module is specifically used to: count the total number of times any third event occurs after a specified period of time has passed since the first event, based on historical data of the first event and historical data of any third event; obtain time feature points based on the total number of times, wherein the first historical data indicates that the probability of the first event triggering any third event at the time feature point is greater than or equal to a reference probability threshold; perform a first initialization on the probability of the first event triggering any third event at the time feature point; perform a second initialization on the probability of the first event and any third event occurring in a specified time period, respectively; and obtain initialization data on the probability of the first event triggering any third event that changes with time, based on the results of the first initialization and the second initialization.

[0039] In a third aspect, the present application provides an analysis device, the analysis device comprising: a processor and a memory, wherein a computer program is stored in the memory; when the processor executes the computer program, the analysis device implements the method provided in the first aspect of the present application and any optional implementation. Optionally, the analysis device may be a computer device.

[0040] In a fourth aspect, the present application provides a non-transitory computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by a processor, the method provided in the first aspect of the present application and any optional implementation method is implemented.

[0041] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method provided in the first aspect of the present application and any optional implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a schematic diagram of an application scenario involved in a method for event analysis provided in an embodiment of the present application;

[0043] Figure 2 is a schematic diagram of an application scenario involved in another event analysis method provided in an embodiment of the present application;

[0044] Figure 3 is a schematic diagram of an application scenario involved in another event analysis method provided in an embodiment of the present application;

[0045] Figure 4 is a flow chart of a method for event analysis provided by an embodiment of the present application;

[0046] Figure 5 is a schematic diagram of a graphical user interface for obtaining a query message provided by an embodiment of the present application;

[0047] Figure 6 is a schematic diagram of another graphical user interface for obtaining a query message provided in an embodiment of the present application;

[0048] Figure 7 A waveform diagram of the triggering frequency of a second event at different times when a first event occurs provided in an embodiment of the present application;

[0049] Figure 8 It is a schematic diagram of comparison between an actual waveform diagram of the frequency of a second event occurring at different times and a simulation waveform diagram obtained by analyzing an analysis model, provided by an embodiment of the present application, when a first event occurs;

[0050] Fig. 9 is a flow chart of a training process of an analysis model provided in an embodiment of the present application;

[0051] Fig.10 It is a flow chart of obtaining initialization data of the probability of a first event triggering a third event changing over time provided by an embodiment of the present application;

[0052] Fig.11 is a structural schematic diagram of an event analysis device provided in an embodiment of the present application;

[0053] Fig.12 is a structural schematic diagram of another event analysis device provided in an embodiment of the present application;

[0054] Fig.13 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0056] The embodiment of the present application provides a method for event analysis, which can obtain a query message of a first event, and obtain the target information of a second event based on the query message. Wherein, the second event is an event that can be triggered by the first event and has not occurred, and the target information includes the event identifier, trigger probability and / or predicted occurrence time of the second event. Therefore, the method can predict the second event that is triggered by the first event and has not occurred, and predict at least one of the trigger probability and predicted occurrence time of the second event. Compared with the related art, it can not only analyze whether there is a correlation between events, but also analyze at least one of the trigger probability and predicted occurrence time of the triggered event in the correlated event. The analysis result intuitively reflects the analysis result of the correlated event, and has strong interpretability, realizes the diversity analysis of the correlation between events, and enriches the analysis function of the correlated event. Wherein, when the method can predict the trigger probability and predicted occurrence time of the triggered event in the correlated event, it can enable the user to understand in more detail when the triggered time will be triggered with what probability, and can facilitate a more detailed understanding of the occurrence of the triggered event.

[0057] Figure 1 Schematic diagram of an application scenario involving an event analysis method provided in an embodiment of the present application. Figure 1 As shown, the application scenario includes: a first device 01 and a second device 02. A communication connection is established between the first device 01 and the second device 02 via a wired or wireless network. The second device 02 is used to provide historical data of events to the first device 01. The first device 01 is used to perform the event analysis method provided in the embodiment of the present application based on the historical data of the events.

[0058] Optionally, the first device 01 may be a communication device with computing functions such as a computer or a server. The server may be a single server, or a server cluster consisting of several servers, or a cloud computing service center. The second device 02 may be a computer, a server, a network device (such as a gateway device or a network element device), a personal computer, a cloud host, a portable mobile terminal, a multimedia player, an e-book reader, or a wearable device.

[0059] The application scenario may include one or more second devices 02. In the first application scenario, the application scenario includes a second device 02, which can collect historical data of all events managed by the first device 01 and provide the historical data to the first device 01. Figure 1As shown, the application scenario may also include multiple third devices 03, and each third device 02 and the second device 02 are connected to each other via a wired or wireless network. Each third device 03 is used to provide the second device 02 with historical data of events associated with the third device 03. Optionally, the third device 03 may be a computer, a server, a network device (such as a gateway device or a network element device), a personal computer, a cloud host, a portable mobile terminal, a multimedia player, an e-book reader or a wearable device, etc.

[0060] For example, assuming that the event whose correlation needs to be analyzed is a network failure in the network, the first application scenario may include: a first device 01, a second device 02, and multiple third devices 03. The first device 01 and the second device 02 can both be servers for operation and maintenance management, and the third device 03 can be a network device for data transmission in the network. The third device 03 is used to determine whether there is a network failure in the network according to the data transmission situation during the data transmission process, and when it is determined that there is a network failure, report the network failure and related data to the second device 02, such as reporting the network failure and related data to the second device 02 by way of an alarm. The second device 02 is used to receive the network failure and related data reported by the third device 03, obtain the historical data of the network failure, and send the historical data to the first device 01.

[0061] In the second application scenario, Figure 2 As shown, the application scenario may include multiple second devices 02, each of which is used to provide the first device 01 with historical data of events associated with the second device 02. That is, in the second application scenario, it can be considered that the functions of the second device 02 include the functions of the second device 02 and the third device 03 in the first application scenario. Among them, the events associated with the second device 02 include events perceived by the second device 02.

[0062] For example, assuming that the event that needs to be analyzed for correlation is a network failure in the network, the second application scenario may include: a first device 01 and multiple second devices 02. The first device 01 may be a server for operation and maintenance management. The second device 02 may be a network device for data transmission in the network. In the process of data transmission, the second device 02 may determine whether there is a network failure in the network according to the data transmission situation, and obtain relevant data of the network failure when it is determined that there is a failure, obtain historical data of the network failure device, and report the historical data to the first device 01. Among them, the historical data reported by the second device 02 is the historical data of the network failure that is associated with the second device 02, and the correlation between the network failure and the second device 02 means that the network failure is perceived by the second device 02.

[0063] There are many implementation forms of the event analysis method provided in the embodiments of the present application. The following uses two possible implementation forms as examples to illustrate the method:

[0064] In a first possible implementation, the first device 01 may be a device owned by a user. The first device 01 can use the event analysis method provided in the embodiment of the present application to analyze the correlation between events for which the user has management authority. The first device 01 can obtain the relevant function package (such as a program installation package) required for analyzing events with correlation, and provide the user with the function of analyzing events with correlation by running the function package. Among them, the relevant function package required for analyzing events with correlation can be provided by a service provider that analyzes events with correlation, and after the user obtains the right to use the function package from the service provider, the user can obtain the function package from the service provider.

[0065] For example, a user can download a program installation package required to analyze related events on the first device 01 and install the program installation package in the first device 01. After receiving the query message of the first event, the first device 01 can run the program for analyzing related events and use the program to obtain target information such as the event identifier, trigger probability and / or predicted occurrence time of the second event triggered by the first event.

[0066] In a second possible implementation, the first device 01 may be a device owned by a service provider that analyzes related events. A user can send a query message to the first device 01 through a platform provided by the service provider, and the first device 01 can provide the user with a service for analyzing related events based on the query message.

[0067] In one possible implementation, the first device 01 can be implemented through resources in the cloud platform. The cloud platform is deployed with basic resources owned by the cloud service provider. For example, the cloud platform is deployed with computing resources, storage resources, and network resources, and the computing resources can be a large number of computer devices (such as servers). Then, the first device 01 can be implemented through the computing resources in the cloud platform. Figure 3 As shown, the event analysis method provided in the embodiment of the present application can be abstracted into an analysis cloud service by the cloud service provider on the cloud platform and provided to users. After the user purchases the analysis cloud service on the cloud platform, the cloud platform can use the computing resources in the cloud platform to provide the analysis cloud service to the user.

[0068] Optionally, in an embodiment of the present application, the cloud platform can be a cloud platform of a central cloud, or a cloud platform of an edge cloud. Moreover, when the first device 01 is deployed in a distributed deployment manner, the cloud platform can also be a cloud platform including a central cloud and an edge cloud. At this time, the first device 01 can be partially deployed in the cloud platform of the edge cloud and partially deployed in the cloud platform of the central cloud, and the embodiment of the present application does not make specific limitations on it. In addition, the above first device 01, the second device 02 and the third device 03 can be independent devices, or they can be a device cluster composed of independent devices. The implementation form of each computer device can be determined according to the application requirements, and the embodiment of the present application does not make specific limitations on it.

[0069] It should be understood that the above content is an illustrative description of the application scenarios of the event analysis method provided in the embodiments of the present application, and does not constitute a limitation on the application scenarios of the event analysis method. A person of ordinary skill in the art can know that as business needs change, its application scenarios can be adjusted according to application needs, and the embodiments of the present application do not list them one by one.

[0070] The following is a description of the implementation process of an event analysis method provided in an embodiment of the present application. Figure 4 As shown, the implementation process may include the following steps:

[0071] Step 401: A first device obtains a query message of a first event, where the query message is used to query target information of a second event.

[0072] Among them, the second event is triggered by the first event. The first event is an event that has occurred at the first time. The second event is a predicted event that has not occurred at the first time. The first time is less than or equal to the time when the query message is obtained, that is, the first time is not later than the time when the query message is obtained. It can be seen that the query message is used to query the target information of the second event that can be triggered by the first event and has not yet occurred.

[0073] The target information includes the event identifier, trigger probability and / or predicted occurrence time (also called trigger time) of the second event. When the target information includes the event identifier of the second event, the target information is used to indicate a specific event that can be triggered by the first time and has not yet occurred. And the event identifier can indicate the event itself, for example, indicating that the name of the event is an Ethernet loss fault ETH_APS_LOST_0_Opt. Alternatively, the event identifier can indicate the type of event, for example, indicating that the event is a network disconnection fault, a packet loss fault, or a clock alarm. The trigger probability of the second event refers to the probability of the second event being triggered by the first event. The predicted occurrence time of the second event refers to the estimated occurrence time of the second event triggered by the first event.

[0074] In addition, in order to facilitate a more comprehensive understanding of the situation in which the first event triggers the second event, the target information may also include one or more of the following information: the total number of times the second event is triggered by the first event, the probability distribution of the probability of the first event and the second event occurring naturally changing over time, and the probability of the second event occurring late after the first event triggers the second event (i.e., the delay probability). Among them, the probability of any event occurring naturally refers to the probability of the event occurring when it is not affected by other events. In an embodiment of the present application, the probability distribution of the probability of an event occurring naturally may be a Poisson distribution or a normal distribution, etc.

[0075] The expression of Poisson distribution is: Then the probability distribution of events that satisfy the Poisson distribution can be expressed by the parameter λ in this expression. The expression for the normal distribution is: Then the probability distribution of events that satisfy the normal distribution can be expressed by the parameters σ and μ in this expression.

[0076] Optionally, the query message may further include a screening condition, and the query message including the screening condition is used to query the target information that meets the screening condition. In some implementations, the screening condition includes one or more of the following: a time condition, a probability condition, and a device condition. The device condition is used to indicate a device associated with the occurrence of the second event.

[0077] The query message including the time condition is used to query the target information of the second event whose occurrence time meets the time condition. For example, the query message including the time condition is used to query the target information of the second event triggered by the first event and triggered within one hour after the first event occurs.

[0078] The query message including the probability condition is used to query the target information of the second event triggered by the first event whose trigger probability meets the probability condition. For example, the query message including the probability condition is used to query the target information of the second event triggered by the first event and whose trigger probability is greater than or equal to the specified probability threshold (such as 50%).

[0079] The query message including the device condition is used to query the target information of the second event caused by the device that meets the device condition. In an implementable manner, the device condition includes one or more of the following device attributes: device identification, device location, device type, network topology structure where the device is located, device manufacturer and device user. When the device condition is used to indicate the device identification, the query message is used to query the target information of the second event triggered by the first event and caused by the device indicated by the device identification. When the device condition is used to indicate the device location, the query message is used to query the target information of the second event triggered by the first event and caused by the device deployed in the area where the device is located. When the device condition is used to indicate the device type, the query message is used to query the target information of the second event triggered by the first event and caused by the device belonging to the device type. When the device condition is used to indicate the network topology structure where the device is located, the query message is used to query the target information of the second event triggered by the first event and caused by the device deployed in the network topology structure. When the device condition is used to indicate the manufacturer of the device, the query message is used to query the target information of the second event triggered by the first event and caused by the device produced by the manufacturer. When the device condition is used to indicate a user of a device, the query message is used to query target information of a second event that is triggered by a first event and caused by a device used by the user.

[0080] As an implementation method of the query message, the query message can be obtained based on the query parameters input by the user in the query interface, or based on the interface components selected by the user in the query interface, or obtained from a third-party system through an application program interface (API).

[0081] The query interface may be a graphical user interface (GUI) of an application program that provides users with an analysis of events with correlation. Figure 5 As shown, the graphical user interface is provided with an input box for the query object, and the user can enter the first event to be queried in the input box (such as Figure 5 The name of the preceding event in the query is provided to indicate the event to be queried. The graphical user interface is also provided with an input box for filter conditions. When the user needs to query target information that meets the filter conditions, the filter conditions can be entered in the input box for the filter conditions, such as time conditions and probability conditions. In addition, the graphical user interface is also provided with buttons for adding and deleting filter conditions, so that the user can add or delete filter conditions according to the query requirements.

[0082] Alternatively, the graphical user interface may be provided with an interface component for selecting query objects. Figure 6As shown, a selection list of query objects can be provided at the input box of the query object (such as Figure 6 The drop-down selection list shown in the figure) can be expanded by clicking the triangle at the input box. The drop-down selection list of the input box can be expanded. The selection list includes multiple interface components. After the user selects any of the multiple interface components, he can indicate to query the events indicated by the interface component. In addition, the graphical user interface can also be provided with an interface component for selecting filter conditions. For example, a selection list for selecting filter conditions is provided at the input box of the filter conditions. The selection list includes multiple interface components. After the user selects any of the multiple interface components, he can indicate to query the events that meet the filter conditions indicated by the interface component. In addition, the graphical user interface is also provided with buttons for adding and deleting filter conditions, so that the user can add or delete filter conditions according to the query requirements.

[0083] In addition, the query object and filtering conditions indicated by the query message may also be obtained by a third-party system. In this case, the first device may obtain the query object and filtering conditions from the third-party system through an application programming interface. In one achievable method, the third-party system may provide a user with a query interface for setting query objects and filtering conditions. After the user sets the query object and filtering conditions in the query interface, the third-party system may obtain the query object and filtering conditions. The implementation method for setting the query object and filtering conditions in the third-party system may refer to the implementation method for setting the query object and filtering conditions in the graphical user interface of an application program that analyzes events with correlation, and will not be described in detail here.

[0084] Step 402: The first device obtains first historical data of events that have occurred at a first time among events managed by the first device.

[0085] The first device can analyze the historical data of the events that have occurred, obtain the temporal connection between different events that have occurred, and predict the correlation between different events based on the temporal connection, so as to analyze the events with correlation. Therefore, before the first device obtains the target information of the second event based on the query message, it needs to first obtain the first historical data of the events that have occurred at the first time in the events managed by the first device.

[0086] Furthermore, since the first time is less than or equal to the time when the query message is obtained, the step of obtaining the first historical data can be executed before obtaining the query message or after obtaining the query message, and the execution order can be determined according to the application requirements. For example, when it is specified (such as manually specified) that no matter when the query message is obtained, the target information is obtained based on the first historical data of the event that has occurred at a fixed first time, the step of obtaining the first historical data can be executed before or after receiving the query message. For another example, when it is specified that when the query message is obtained, the target information needs to be obtained based on all historical data of the events that have occurred in the events managed by the first device before the query message is obtained, then the first time can be equal to the time when the query message is obtained, and the step of obtaining the first historical data needs to be executed after obtaining the query message.

[0087] In addition, when the first historical data is all historical data of events that have occurred among the events managed by the first device before the query message is obtained, since the accuracy of the connection between the acquired events is positively correlated with the amount of historical data used for analysis, the more historical data there is, the more comprehensively it can reflect the connection between different events that have occurred, and the accuracy of the connection between different events that have occurred obtained by the first device can be effectively guaranteed, thereby improving the accuracy of the analysis of time correlation.

[0088] Among them, the first historical data includes: the identifier of the event that has occurred and the time when the event has occurred. In addition, since the query message is used to query the target information of the second event triggered by the first event, the first historical data needs to include the historical data of the first event and the historical data of the third event, so as to obtain the connection between the first event and the second event. The third event is an event with the same identifier as the second event among the events that have occurred at the first time. That is, the third event and the second event are actually the same event, but the third event has occurred at the first time, and the second event has not occurred at the first time. For example, the second event and the third event are network failures at the same network location, but the third event has occurred at the first time, and the second event has not occurred at the first time.

[0089] Optionally, the first historical data may also include: optional information such as the device region, device type, and network topology structure of the device associated with the event that has occurred. When the first historical data also includes the above optional information, it can provide more reference information for analyzing the connection between the events that have occurred, and can further improve the accuracy of the connection between the events obtained by the first device.

[0090] From the above, it can be seen that in the event analysis method provided in the embodiment of the present application, the necessary information in the first historical data is the identifier of the event that has occurred and the time when the event has occurred. Compared with other related technologies for analyzing the correlation between events, the requirements for the data referenced by the analysis are reduced, and the generalization ability of the analysis can be improved.

[0091] In addition, the acquisition operation of step 402 may include a process of acquiring the first historical data from other devices (such as from a second device) and reading the first historical data into the memory of the first device, or a process of reading the first historical data from a persistent storage medium of the first device into the memory. The embodiment of the present application does not make any specific limitation on this, as long as the result of the acquisition operation enables the first device to perform analysis based on the first historical data.

[0092] Step 403: The first device analyzes the first historical data based on the query message to obtain target information.

[0093] After the first device receives the query message, it can analyze the first historical data based on the query message to obtain the target information. Optionally, the process of analyzing the first historical data can be implemented through an analysis model. That is, the implementation process of step 403 includes: obtaining the target information based on the first historical data and the analysis model. In addition, since the second event is triggered by the first event, when the analysis model is used to obtain the target information, analysis indication information can also be input into the analysis model to indicate the relationship between the first event and the second event, such as indicating that the first event is used as a pre-event to trigger the second event. That is, the implementation process includes: obtaining the target information based on the first historical data, analysis indication information and analysis model. It should be noted that when using the analysis model for analysis, the analysis indication information may not be input into the analysis model. At this time, the content indicated by the analysis indication information can be obtained by analyzing the first historical data by the analysis model.

[0094] Furthermore, the second event associated with the first event may include one or more. At this time, the target information to be acquired includes the target information of each second time in the one or more second events. Accordingly, when performing the analysis, the first event and any second event in the one or more second events may be analyzed respectively to obtain the target information of the any second event. The implementation process of step 403 is described below by taking a second event as an example. As an implementable method, the implementation process includes:

[0095] Step 4031: The first device pre-screens the first historical data to obtain historical data of the first event and historical data of any third event, where any third event is an event that has occurred at the first time and has the same identifier as any second event.

[0096] Since when analyzing an event associated with the first event, the first event and any second event can be analyzed separately, and the first historical data is the historical data of all events that have occurred at the first time in the events managed by the first device, the first historical data can be pre-screened before analysis to obtain the historical data of the first event and the historical data of any third event. Then, analysis is performed based on the historical data of the first event and the historical data of any third event to obtain the target information of the second event with the same identifier as the any third event. In order to improve the readability of the embodiment, the any third event is referred to as the third event in the description of the following steps.

[0097] It should be noted that the pre-screening process can be executed in the first device, but is not limited to being executed in the first device. The execution subject of the pre-screening process can be adjusted according to application requirements, and the embodiment of the present application does not specifically limit it. For example, a device (such as Figure 1 In the second device), the historical data can also be filtered first, and then the filtered historical data is provided to the first device, which can reduce the load of the first device.

[0098] In addition, when actually analyzing the events with correlation, the first historical data may not be pre-screened, such as directly inputting the first historical data into the analysis model. However, pre-screening the first historical data and providing the pre-screened data to the analysis model can reduce the amount of data that the analysis model needs to process and ensure the speed of the analysis model.

[0099] Further, after pre-screening the first historical data, the first device can also perform statistics on the first historical data, and provide the statistically obtained data to the analysis model, so that the analysis model performs analysis based on the statistically obtained data to reduce the amount of data that the analysis model needs to process for analysis. In addition, when the process of pre-screening the first historical data is performed on other devices, the statistical process can be performed on the first device or on other devices, and the embodiment of the present application does not specifically limit it. In an implementable manner, the implementation process of performing statistics on the first historical data may include: according to the historical data of the third event, recording the occurrence time of the third event, and in the historical data of the first event, taking the occurrence time of the third event as the starting point, along the direction of time reversal, counting the occurrence time of the first event before the occurrence of the third event each time, obtaining the corresponding time difference between the occurrence time of the third event and the first event, and respectively counting the total number of occurrences of different time differences. In addition, in order to ensure the validity of the data, when performing statistics, it is also possible to limit the statistics to the occurrence time of the first event within a specified time window before the occurrence of the third event each time. For example, the occurrence time of the first event within one minute before the occurrence of the third event can be limited each time.

[0100] Step 4032: The first device inputs the historical data of the first event and the historical data of any third event into the analysis model to obtain target information of any second event corresponding to any third event triggered by the first event output by the analysis model.

[0101] The analysis model can analyze the rule of the first event causing the third event to occur based on the historical data of the first event and the historical data of the third event, and then obtain the target information of the first event triggering any second event based on the rule. Optionally, when it is necessary to indicate the relationship between the first event and the second event to the analysis model, it is also necessary to input analysis indication information to the analysis model.

[0102] Among them, the probability distribution of the trigger probability, predicted occurrence time and the probability of the first event and the second event occurring naturally changing over time in the target information can be obtained by analyzing the historical data through the analysis model. The total number of times the second event in the target information is triggered by the first event can be obtained by statistics based on the analysis results of the analysis model. For example, when the target information includes 5 predicted occurrence times, it can be determined that the total number of times the second event is triggered by the first event is 5. The delay probability in the target information can be obtained based on the delay probability of the third event being delayed after the first event triggers the third event reflected in the historical data. For example, according to the historical data, the delay probability of the third event occurring with a delay of 1 second is 0.8, and the delay probability of the third event occurring with a delay of 2 seconds is 0.8×0.8=0.64, then the delay probability of the second event occurring with a delay of 1 second is 0.8, and the delay probability of the second event occurring with a delay of 2 seconds is 0.8×0.8=0.64. When a waveform graph is used to represent the trigger probability of the third event when the first event occurs, the influence of the delay probability on the waveform graph is manifested as: the descending slope of the waveform graph at the position near the local peak becomes slower, and it is no longer a peak with a large ascending slope and descending slope.

[0103] It should be noted that the analysis model may include an artificial intelligence (AI) model or other types of models. And the analysis model may be a pre-trained model, which can obtain the target information of any second event corresponding to the third event triggered by the first event based on the historical data of the first event and the historical data of the third event. Therefore, before using the analysis model to obtain the target information, the analysis model needs to be trained. To improve the readability of the embodiment, the process of training the analysis model is described in steps 901 to 903 below. In addition, the target information obtained by analyzing the historical data of the first event and the historical data of the third event can also be used to train the analysis model to further improve the model performance of the analysis model.

[0104] Step 404: The first device displays the target information to the user.

[0105] After the first device obtains the target information based on the query message, it can display the target information to the user. According to the previous description, the target information includes one or more pieces of information, and part or all of the one or more pieces of information can be displayed to the user during the display. Among them, the display method may include a method of displaying through text information, or may include a method of displaying a waveform graph showing the probability of the second event being triggered by the first event changing over time to the user. In addition, when displaying the target information, the maximum trigger probability, minimum trigger probability, mean trigger probability, and identification of the first event of the second event being triggered by the first event and other information can also be displayed, so that the user has a more comprehensive understanding of the situation in which the first event triggers the second event. Among them, the maximum trigger probability, minimum trigger probability, and mean trigger probability of the second event being triggered by the first event can be obtained by statistics based on the analysis results of the analysis model, such as by statistics based on the waveform graph of the probability of the second event being triggered by the first event output by the analysis model changing over time.

[0106] For example, it is assumed that the query message includes a time condition, and the time condition indicates to obtain target information of a second event within four minutes after the query message is obtained. Figure 7 The present application provides a waveform diagram of the triggering frequency of a second event at different times when a first event occurs. The horizontal axis of the waveform diagram represents time in seconds, and the vertical axis of the waveform diagram represents the triggering probability of the second event when the first event occurs. Figure 7 As shown, when the first event occurs, the triggering probability of the second event has four larger values ​​within the time period restricted by the time condition. The four larger values ​​appear at the 7th second (i.e. 0'07"), the 48th second (i.e. 0'48"), the 1st minute and 55 seconds (i.e. 1'55") and the 2nd minute and 45 seconds (i.e. 2'45") after the query message is obtained, that is, the predicted occurrence time of the second event is the 7th second, the 48th second, the 1st minute and 55 seconds and the 2nd minute and 45 seconds after the query message is obtained. The four larger values ​​are 49%, 65%, 86% and 27% respectively, that is, the triggering probability of the second event at the above four predicted occurrence times is 49%, 65%, 86% and 27% respectively.

[0107] Table 1 is a target information displayed in a text message manner provided by an embodiment of the present application, and Figure 7Based on the waveform shown, Table 1 also shows the maximum trigger probability, minimum trigger probability, mean trigger probability and the identification of the first event of the second event being triggered by the first event. According to Table 1, it can be seen that the identification of the first event indicates that its name is ETH_LOS_0_Opt, and the identification number (ID) is 1, and the identification of the second event indicates that its name is ETH_APS_LOST_0_Opt, and the identification number (ID) is 34. The maximum trigger probability, minimum trigger probability and mean trigger probability of the second event being triggered by the first event are 86%, 1% and 28% respectively, and the total number of large probability values ​​is 4. The occurrence times of the four large probability values ​​are 0'07", 0'48", 1'55" and 2'45" respectively, and the four large probability values ​​are 49%, 65%, 86% and 27% respectively. The probability distribution of the probability of the first event and the second event occurring naturally changing with time is Poisson distribution, and the parameters λ are 0.1 and 0.005 respectively.

[0108] Table 1

[0109] Information Name The value of information First Event ETH_LOS_0_Opt(ID=1) Second incident ETH_APS_LOST_0_Opt(ID=34) The maximum probability of the second event being triggered by the first event 86％ The minimum probability of the second event being triggered by the first event 1％ The mean probability of the second event being triggered by the first event 28％ The total number of values ​​with higher probability 4 The time when the value with a higher probability appears 0′07″, 0′48″, 1′55″ and 2′45″ Trigger probability 49%, 65%, 86% and 27% The parameter λ of the probability distribution of the first event 0.1 The parameter λ of the probability distribution of the second event 0.005

[0110] From the above, it can be seen that in the event analysis method provided in the embodiment of the present application, since the method can predict the second event that is triggered by the first event and has not occurred, and predict at least one of the triggering probability and the predicted occurrence time of the second event, compared with the related art, it is not only possible to analyze whether there is a correlation between events, but also possible to analyze at least one of the triggering probability and the predicted occurrence time of the triggered event in the correlated events. The analysis results intuitively reflect the analysis results of the correlated events and are highly interpretable, thereby realizing diverse analysis of the correlation between events and enriching the analysis function of correlated events.

[0111] Moreover, this method actually counts the rules of one event causing another event based on the historical data of the event, and analyzes the correlation between the events based on the rules. Compared with the related technology of analyzing the correlation of events based on the rules obtained from expert experience, it can analyze the correlation between events in more situations, ensuring the scope of application of this method without the need to inject expert experience. And because this method is not analyzed based on the rules obtained from expert experience, it does not need to synchronize the rules according to the expansion of the network, which will not affect the efficiency of development and operation and maintenance, nor will it cause an increase in implementation costs and bit error rates.

[0112] In addition, since this method does not require feature extraction based on historical data, and the necessary information in the historical data is the identification of the event that has occurred and the time when the event has occurred, compared with other related technologies for analyzing the correlation between events, it reduces the requirements for the data used for analysis, can improve the generalization ability of the analysis, and improve the stability of the analysis results.

[0113] In order to prove the effectiveness of the event analysis method provided in the embodiment of the present application, the embodiment of the present application also provides a schematic diagram comparing the actual waveform diagram of the frequency of the second event occurring at different times when the first event occurs and the simulation waveform diagram obtained by the analysis model analysis. Figure 8 As shown, Figure 8 The middle curve 1 is the actual waveform obtained based on historical data. Figure 8 Curve 2 in the middle is a simulation waveform obtained based on historical data analysis. Figure 8 It can be seen that Figure 8 The changing trend of the simulation waveform graph in the embodiment can better fit the changing trend of the actual waveform graph. Therefore, it can be determined that the method provided in the embodiment of the present application can effectively analyze the events with correlation.

[0114] It should be noted that, although the above description takes the prediction of the correlation between network failures as an example to illustrate the event analysis method provided in the embodiment of the present application, it is not limited to the method being used only for predicting the correlation between network failures. In addition, since the method analyzes the temporal connection between events based on the historical data of the events and predicts the correlation between different events based on the temporal connection, the method can be applied to the prediction scenarios between all events that are temporally correlated.

[0115] The following is an explanation of the process of training the analysis model. According to the previous description, due to the different correlations between different events, the analysis model used to analyze the correlation between two events needs to be trained using the historical data of the two events. The following uses the historical data of the first event and a third event (the third event below) to train the analysis model as an example to explain the training process of the analysis model. Fig. 9 As shown in Figure 1, the training process of the analysis model includes:

[0116] Step 901: Based on historical data of a first event and historical data of a third event, obtain reference data of the probability of the first event triggering the third event changing over time.

[0117] The implementation process of step 901 is actually to calculate the probability of the second event being triggered by the first event at different times after each occurrence of the first event by using a statistical method based on the historical data of the first event and any third time. The result obtained by calculation is the reference data of the probability of the first event triggering the third event changing with time. For example, according to the historical data, the first total number of occurrences of the third event after the specified time length after the occurrence of the first event and the second total number of non-occurrences can be counted, and the conditional probability of the third event occurring after the specified time length after the occurrence of the first event can be obtained based on the first total number and the second total number, and the reference data of the probability of the first event triggering the third event changing with time can be obtained by analogy. Among them, the reference data can be represented by a waveform graph, the horizontal axis of the waveform graph represents time in seconds, and the vertical axis of the waveform graph represents the probability of the third event occurring when the first event occurs.

[0118] Step 902: Obtain initialization data on the time-varying probability of a first event triggering a third event.

[0119] The initialization data can be obtained by initializing the occurrence probabilities of the first event and the third event. In one possible implementation, Fig.10 As shown, the implementation process of step 902 includes:

[0120] Step 9021: Based on the historical data of the first event and the historical data of the third event, count the total number of times the third event occurs after the first event occurs for a specified period of time.

[0121] In one achievable method, the time of occurrence of the third event can be recorded based on the historical data of the third event, and in the historical data of the first event, the time of occurrence of the first event before the third event is counted each time in the reverse direction of time, starting from the time of occurrence of the third event, to obtain the time difference between the corresponding time of occurrence of the third event and the first event, and to count the total number of occurrences of different time differences. In the description of "the third event occurs after a specified time period of occurrence of the first event", the specified time period is equal to the time difference, and when there are multiple time differences between the occurrence of the first event and the occurrence of the third event before the third event, the total number of occurrences of the third event after multiple specified time periods of occurrence of the first event can be obtained, and the multiple time differences correspond to the multiple specified time periods. For example, assuming that the statistical results indicate that the total number of times the first event occurs 10 seconds before the third event occurs is 100, and the total number of times the first event occurs 13 seconds before the third event occurs is 150, then corresponding to the time difference of 10 seconds, it can be obtained that the total number of times the third event occurs 10 seconds after the first event occurs is 100, and corresponding to the time difference of 13 seconds, it can be obtained that the total number of times the third event occurs 13 seconds after the first event occurs is 150. In addition, to ensure the validity of the data, when performing statistics, it is also possible to limit the statistics to the time when the first event occurs within a specified time window before the third event occurs each time. For example, it is possible to limit the time when the first event occurs within one minute before the third event occurs each time.

[0122] Step 9022: acquiring time feature points based on the total number of times, the first historical data indicating that the probability of the first event triggering the third event at the time feature point is greater than or equal to a reference probability threshold.

[0123] After the total number of times is obtained, the time feature points reflecting the greater connection between the first event and the third event in terms of the time of occurrence can be obtained based on the total number of times. And in order to ensure the accuracy of the connection between the first event and the third event in terms of the time of occurrence, some acquisition principles can be set for the time feature points. For example, the acquisition principle needs to ensure that the probability of the first event triggering the third event at the time feature point is greater than or equal to the reference probability threshold. When the probability of the first event triggering the third event at the time feature point is greater than or equal to the reference probability threshold, the occurrence of the first event can effectively trigger the third event. Among them, the reference probability threshold can be determined according to the application requirements. For example, the reference probability threshold can be set to 50%, and the embodiments of the present application do not specifically limit it.

[0124] There are many ways to obtain time feature points. The embodiments of the present application take the following three ways as examples to illustrate the implementation methods.

[0125] In a first possible implementation, a time feature point can be obtained based on the total number of times and the change in the total number of times. For example, the total number of times the third event occurs after the first event occurs for a specified time period t1, t1+1, and t1-1 can be obtained respectively, and the first change gradient of the total number of times the third event occurs after the first event occurs for a specified time period t1-1 relative to the total number of times the third event occurs after the specified time period t1 is obtained, and the second change gradient of the total number of times the third event occurs after the first event occurs for a specified time period t1 relative to the total number of times the third event occurs after the specified time period t1+1 is obtained, and when the total number of times the third event occurs after the first event occurs for a specified time period t1 is greater than the total number of times the third event occurs after the first event occurs for a specified time period t1-1 and t1+1, respectively, and when both the first change gradient and the second change gradient are greater than the specified gradient threshold, the specified time period t1 is determined as a time feature point. Among them, when the time feature points are obtained in this way, when the first event occurs, in the waveform diagram of the probability of the third event occurring at different times, the probability of the third event occurring at the time feature point is expressed as a local peak, that is, at the time feature point, the occurrence of the third event has a greater connection with the occurrence of the first event.

[0126] In a second possible implementation, a sliding window method can be used to obtain time feature points in the generation time period of the historical data of the first event and the historical data of the third event. The implementation process includes: setting a time window with a certain length and a sliding step length of the time window in the generation time period, controlling the time window to slide along the development direction of the generation time period according to the sliding step length from the starting point of the time period, and when the time window slides to a position, in the sub-time period of the generation time period covered by the time window, the first total number of occurrences of the third event at all time points in the sub-time period after the first event occurs for a specified time period is counted, and the second total number of occurrences of the third event at all time points in the generation time period after the first event occurs for a specified time period is counted, and when the percentage of the first total number of occurrences to the second total number of occurrences reaches a percentage threshold, the time center point of the sub-time period is determined as the time feature point.

[0127] In a third possible implementation method, the maximum total number of times the third event occurs after a specified period of time has passed since the first event occurred can be determined based on the historical data of the first event and the historical data of the third event, and a jitter threshold for the maximum value can be set. Then, in the time period when the historical data of the first event and the historical data of the third event are generated, time points within the jitter threshold range when the total number of times the third event occurs after a specified period of time has passed since the first event occurred can be screened, and the screened time points can be determined as time feature points.

[0128] Step 9023: Perform a first initialization on the probability of the first event triggering the third event at the time feature point.

[0129] The first initialization process is essentially to initialize the conditional probability that the third event occurs after the duration indicated by the time feature point when the first event occurs. In addition, the conditional probability can be initialized randomly, for example, the conditional probability can be initialized to 0 or 0.5.

[0130] Step 9024: Perform a second initialization on the probability of the first event and the third event occurring in the specified time period.

[0131] The essence of the second initialization process is to initialize the probability distribution of the first event and the third event whose probability of natural occurrence changes over time. For example, it can be assumed that the probability distribution of the first event and the third event are both Poisson distributions, and the parameter λ of the Poisson distribution of the first event is λ1, and the parameter λ of the Poisson distribution of the third event is λ2. In addition, the probability distribution of the first event and the third event can also be randomly initialized for the second time, and the probability distribution of the first event and the third event can be initialized to any distribution mode.

[0132] Step 9025: Based on the result of the first initialization and the result of the second initialization, obtain initialization data of the probability of the first event triggering the third event changing with time.

[0133] After the first initialization and the second initialization, the data of the probability of the first event triggering the third event changing with time can be determined based on the results of the first initialization and the second initialization. Among them, at any time feature point, the probability of the first event triggering the third event can be obtained based on the probability of the third event occurring naturally, and the conditional probability of the third event occurring after the time indicated by the time feature point after the first event occurs. At any time point that is not a time feature point, the probability of the third event occurring at this time point can be obtained based on the probability of the third event occurring naturally. In addition, the probability of the third event occurring naturally can be obtained based on the probability distribution of the third event, and the conditional probability of the third event occurring after the time indicated by the time feature point after the first event occurs can be obtained based on the probability distribution of the third event and the probability distribution of the first event.

[0134] It should be noted that when the historical data of the first event and the historical data of the third event reflect that the third event has a delay probability, the delay probability needs to be thirdly initialized in step 902, and accordingly, the initialization data also needs to reflect the result of the third initialization. In one implementable method, the delay probability can be initialized randomly. For example, the delay probability can be initialized to 0.7 or 0.8, etc. When it is determined based on historical data that the third event has a delay probability, by performing a third initialization on the delay probability, the probability of the first event triggering the third event obtained according to the initialization data changing over time can be better fitted to the probability of the first event triggering the third event obtained according to the historical data changing over time, so that the training result of the analysis model is better and the performance of the analysis model is guaranteed.

[0135] Step 903: Train the analysis model based on the reference data and the initialization data.

[0136] The process of training the analysis model is to iteratively adjust the parameters of the analysis model according to the reference data and different initialization data until the training cutoff condition is reached. Among them, in different initialization processes, when at least one of the results of the first initialization and the results of the second initialization changes relative to the results of the first initialization and the second initialization in the last initialization process, it can be considered that the initialization data obtained this time has changed relative to the initialization data obtained last time. In addition, the first initialization result that makes the training process reach the training cutoff condition can be regarded as the optimal conditional probability that the first event triggers the third event, and the second initialization result reached can be regarded as the optimal probability distribution of the probability of the first event and the third event occurring naturally. When the initialization data is also obtained based on the third initialization, the third initialization result that makes the training process reach the training cutoff condition can be regarded as the optimal delay probability of the third event.

[0137] The following is an example of the process of training the analysis model based on reference data and a set of initialization data, where the set of initialization data is the initialization data obtained by performing a first initialization and a second initialization. Since both the reference data and the initialization data are data showing that the probability of the first event triggering the third event changes over time, the similarity between the reference data and the initialization data can be obtained, and then the loss function for adjusting the parameters of the analysis model can be obtained based on the similarity, and then the gradient for adjusting the parameters of the analysis model can be obtained based on the loss function, and then the parameters of the analysis model can be adjusted based on the gradient, and then the parameters of the analysis model can be adjusted based on the gradient, and whether the training process is completed can be determined based on whether the training cutoff condition is met.

[0138] Wherein, both the reference data and the initialization data can be represented by waveforms. Then the implementation process of obtaining the similarity between the reference data and the initialization data may include: according to the first waveform used to represent the reference data and the second waveform used to represent the initialization data, respectively determine the difference between the amplitudes of the first waveform and the second waveform at each time point, and then determine the waveform similarity of the first waveform and the second waveform according to the difference between the amplitudes of the first waveform and the second waveform at different time points, and the waveform similarity is the similarity between the reference data and the initialization data. Optionally, the implementation principle of obtaining the waveform similarity of the first waveform and the second waveform according to the difference in amplitude can refer to the principles of technologies such as mean square error (MSE), cosine similarity, dynamic time warping (DTW) distance and mean absolute percentage error (MAPE), which will not be repeated here.

[0139] The loss function used as a reference for adjusting the parameters of the analysis model can be a function about similarity. After obtaining the similarity, the similarity can be substituted into the functional expression of the loss function to obtain the value of the loss function, and then the gradient for adjusting the parameters of the analysis model can be determined based on the value of the loss function.

[0140] In the embodiments of the present application, the analysis model may be an artificial intelligence model or other types of models, which are not specifically limited in the embodiments of the present application. When the analysis model is an AI model, it may be a neural network model, and the parameters of the analysis model may be parameters such as the weights of neurons in the neural network.

[0141] It should be noted that the sequence of steps of the event analysis method provided in the embodiment of the present application can be adjusted appropriately, and the steps can be increased or decreased accordingly according to the situation. Any technician familiar with the technical field can easily think of a method of change within the technical scope disclosed in this application, which should be included in the protection scope of this application, so it will not be repeated.

[0142] The present application also provides a program debugging device. Fig.11 ,like Fig.11 As shown, the event analysis device 110 includes:

[0143] Interaction module 1101 is used to obtain a query message for a first event, where the query message is used to query target information of a second event, where the second event is triggered by the first event, where the first event is an event that has occurred at a first time, and where the second event is a predicted event that has not occurred at the first time, and where the first time is less than or equal to the time when the query message is obtained.

[0144] The obtaining module 1102 is used to obtain target information based on the query message, where the target information includes an event identifier, a trigger probability and / or a predicted occurrence time of the second event.

[0145] Optionally, the query message includes a filtering condition, and the query message including the filtering condition is used to query target information that meets the filtering condition, and the filtering condition includes one or more of the following: a time condition, a probability condition, and a device condition.

[0146] The device condition includes one or more of the following device attributes: device identification, device location, device type, network topology of the device, device manufacturer and device user. The device condition is used to indicate a device associated with the occurrence of the second event.

[0147] Optionally, the query message is obtained based on query parameters input by the user in the query interface, or based on an interface component selected by the user in the query interface, or obtained from a third-party system through an application programming interface.

[0148] Optionally, the acquisition module 1102 is also used to: obtain first historical data of an event that has occurred at a first time among the events managed by the event analysis device 110, the first historical data including: an identifier of the event that has occurred and an occurrence time of the event that has occurred, the first historical data including historical data of the first event and historical data of a third event, the third event being an event that has the same identifier as the second event among the events that have occurred at the first time.

[0149] Correspondingly, the obtaining module 1102 is specifically used to: analyze the first historical data to obtain target information.

[0150] Optionally, the acquisition module 1102 is specifically used to obtain target information based on the first historical data and the analysis model, and the analysis model is an artificial intelligence model.

[0151] Optionally, the acquisition module 1102 is specifically used to: obtain target information based on the first historical data, analysis indication information and the analysis model, wherein the analysis indication information is used to indicate that the first event is used as a preceding event that triggers the occurrence of the second event.

[0152] Optionally, the second event associated with the first event includes one or more, and the acquisition module 1102 is specifically used to: pre-screen the first historical data to obtain the historical data of the first event and the historical data of any third event, and any third event is an event that has the same identifier as any second event among the events that have occurred at the first time; input the analysis indication information, the historical data of the first event and the historical data of any third event into the analysis model to obtain the target information of any second event output by the analysis model.

[0153] Alternatively, if Fig.12 As shown, the device 110 also includes: a training module 1103, the training module 1103 is used to: based on the historical data of the first event and the historical data of any third event, obtain reference data of the probability of the first event triggering any third event changing over time, the second event associated with the first event includes one or more, and any third event is an event that has the same identifier as any second event among the events that have occurred at the first time; obtain initialization data of the probability of the first event triggering any third event changing over time, the initialization data is obtained by initializing the occurrence probabilities of the first event and any third event; based on the reference data and the initialization data, train the analysis model.

[0154] Optionally, the training module 1103 is specifically used to: based on the historical data of the first event and the historical data of any third event, count the total number of times any third event occurs after a specified period of time from the occurrence of the first event; obtain time feature points based on the total number of times, the first historical data indicating that the probability of the first event triggering any third event at the time feature point is greater than or equal to a reference probability threshold; perform a first initialization on the probability of the first event triggering any third event at the time feature point; perform a second initialization on the probabilities of the first event and any third event occurring in a specified time period, respectively; based on the results of the first initialization and the results of the second initialization, obtain initialization data on the probability of the first event triggering any third event that changes with time.

[0155] To summarize, in the event analysis device provided in the embodiment of the present application, since the acquisition module can predict the second event that is triggered by the first event and has not occurred, and predict at least one of the triggering probability and the predicted occurrence time of the second event, compared with the related art, it is not only possible to analyze whether there is a correlation between events, but also possible to analyze at least one of the triggering probability and the predicted occurrence time of the triggered event in the correlated events. The analysis results intuitively reflect the analysis results of the correlated events and are highly interpretable, thereby realizing diverse analysis of the correlation between events and enriching the analysis function of correlated events.

[0156] Moreover, the device actually counts the rules of one event causing another event based on the historical data of the event, and analyzes the correlation between the events based on the rules. Compared with the related technology of analyzing the correlation of events based on the rules obtained by expert experience, it can analyze the correlation between events in more situations, ensuring the scope of application of the device without the need to inject expert experience. And because the device does not analyze based on the rules obtained by expert experience, it does not need to synchronize the rules according to the expansion of the network, which will not affect the efficiency of development and operation and maintenance, nor will it cause an increase in implementation costs and bit error rates.

[0157] In addition, since the device does not need to extract features based on historical data, and the necessary information in the historical data is the identification of the event that has occurred and the time when the event has occurred, compared with other related technologies for determining the correlation between events, the requirements for data used for analysis are reduced, the generalization ability of the analysis can be improved, and the stability of the analysis results is improved.

[0158] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding contents in the aforementioned method embodiments and will not be repeated here.

[0159] Fig.13 is a schematic diagram of the structure of an analysis device provided in an embodiment of the present application. The analysis device can be the aforementioned Figure 1 and Figure 2 The first device 01 described above, and the analysis device may specifically be a computer device. When the analysis device is a computer device, such as Fig.13 As shown, the computer device 130 includes a memory 1301, a processor 1302, a communication interface 1303 and a bus 1304. The memory 1301, the processor 1302 and the communication interface 1303 are connected to each other through the bus 1304. In addition, the computer device 130 may include multiple processors 1302, so that the functions of the above-mentioned different functional modules can be realized through different processors.

[0160] The memory 1301 may be a read-only memory (ROM), a static storage device, a dynamic storage device or a random access memory (RAM). The memory 1301 may store executable code sequences. When the executable code stored in the memory 1301 is executed by the processor 1302, the processor 1302 and the communication interface 1303 are used to execute the event analysis method provided in the embodiment of the present application. The memory 1301 may also include software modules and data required for other running processes such as an operating system. The operating system may be LINUX TM ,UNIX TM ,WINDOWS TM wait.

[0161] The processor 1302 may be a general-purpose central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), a graphics processing unit (GPU), or one or more integrated circuits.

[0162] The processor 1302 may also be an integrated circuit chip with signal processing capabilities. In the implementation process, some or all of the functions of the event analysis method of the present application may be completed by the hardware integrated logic circuit or software instructions in the processor 1302. The above-mentioned processor 1302 may also be a general-purpose processor, a digital signal processor (digital signal processing, DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in a decoding processor. The software module may be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 1301, and the processor 1302 reads the information in the memory 1301 and completes the event analysis method of the embodiment of the present application in combination with its hardware.

[0163] The communication interface 1303 uses a transceiver module such as, but not limited to, a transceiver to implement communication between the computer device 130 and other devices or a communication network. For example, the communication interface 1303 can be any one or any combination of the following devices: a network interface (such as an Ethernet interface), a wireless network card, and other devices with network access functions.

[0164] The bus 1304 may include a path for transmitting information between various components of the computer device 130 (eg, the memory 1301 , the processor 1302 , and the communication interface 1303 ).

[0165] It should be noted that, when the computer device is a terminal, the computer device also includes a display screen, and the display screen is used to display the graphical user interface of the program development platform.

[0166] A communication path is established between each of the above-mentioned computer devices 130 through a communication network. Each computer device 130 is used to implement part of the functions of the event analysis method provided in the embodiment of the present application. Any computer device 130 can be a computer device (e.g., a server) in a cloud data center, or a computer device in an edge data center, etc.

[0167] The descriptions of the processes corresponding to the above-mentioned figures have different emphases. For parts that are not described in detail in a certain process, please refer to the relevant descriptions of other processes.

[0168] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product providing a program development platform includes one or more computer instructions, and when these computer program instructions are loaded and executed on a computer device, the process or function of the event analysis method provided in the embodiment of the present application is implemented in whole or in part.

[0169] The computer device may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium stores computer program instructions that provide a program development platform.

[0170] The embodiment of the present application also provides a storage medium, which is a non-volatile computer-readable storage medium. When the instructions in the storage medium are executed by the processor, the event analysis method provided in the embodiment of the present application is implemented.

[0171] The embodiment of the present application also provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the event analysis method provided by the embodiment of the present application.

[0172] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0173] In the embodiments of the present application, the terms "first", "second" and "third" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance. The term "at least one" means one or more, and the term "plurality" means two or more, unless otherwise expressly defined.

[0174] The term "and / or" in this application is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0175] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the concept and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method of event analysis, It is characterized in that The method is applied to a communication device, and the method comprises: Obtain a query message of a first event, where the query message is used to query target information of a second event, where the second event is triggered by the first event, where the first event is an event that has occurred at a first time, where the second event is a predicted event that has not occurred at the first time, and where the first time is less than or equal to a time when the query message is obtained; Acquire first historical data of an event that has occurred at the first time among events managed by the communication device, the first historical data comprising: an identifier of the event that has occurred and an occurrence time of the event that has occurred, the first historical data comprising historical data of the first event and historical data of a third event, the third event being an event that has occurred at the first time and has the same identifier as the second event; Based on the query message, the first historical data is analyzed to obtain the temporal connection between different events that have occurred, and the correlation between different events is predicted based on the temporal connection. Based on the correlation between the different events, the target information is obtained, and the target information includes the event identifier, trigger probability and / or predicted occurrence time of the second event.

2. The method according to claim 1, It is characterized in that The query message includes a screening condition, and the query message including the screening condition is used to query target information that meets the screening condition, and the screening condition includes one or more of the following: a time condition, a probability condition, and a device condition; The device condition includes one or more of the following device attributes: device identification, device location, device type, network topology of the device, device manufacturer and device user. The device condition is used to indicate a device associated with the occurrence of the second event.

3. The method according to claim 1 or 2, It is characterized in that The query message is obtained based on the query parameters input by the user in the query interface, or based on the interface component selected by the user in the query interface, or obtained from a third-party system through an application programming interface API.

4. The method according to claim 1, It is characterized in that The analyzing the first historical data to obtain the target information includes: The target information is obtained based on the first historical data and the analysis model, and the analysis model is an artificial intelligence model.

5. The method according to claim 4, It is characterized in that The obtaining the target information based on the first historical data and the analysis model includes: The target information is obtained based on the first historical data, analysis indication information and an analysis model, wherein the analysis indication information is used to indicate that the first event is used as a preceding event that triggers the occurrence of the second event.

6. The method according to claim 5, It is characterized in that The second event associated with the first event includes one or more, and the obtaining of the target information based on the first historical data, the analysis indication information and the analysis model includes: Pre-screening the first historical data to obtain historical data of the first event and historical data of any third event, where any third event is an event that has occurred at the first time and has the same identifier as any second event; The analysis instruction information, the historical data of the first event and the historical data of any third event are input into the analysis model to obtain the target information of any second event output by the analysis model.

7. The method according to claim 5 or 6, It is characterized in that Before obtaining the target information based on the first historical data, the analysis instruction information and the analysis model, the method further includes: Based on the historical data of the first event and the historical data of any third event, obtaining reference data of the probability of the first event triggering any third event changing over time, wherein the second event associated with the first event includes one or more, and any third event is an event that has occurred at the first time and has the same identifier as any second event; Acquire initialization data of the probability of the first event triggering any of the third events changing over time, wherein the initialization data is obtained by initializing the occurrence probabilities of the first event and any of the third events; The analysis model is trained based on the reference data and the initialization data.

8. The method according to claim 7, It is characterized in that The obtaining of initialization data indicating that the probability of the first event triggering any third event varies with time includes: Based on the historical data of the first event and the historical data of any third event, counting the total number of times any third event occurs after the first event occurs for a specified period of time; Acquiring a time feature point based on the total number of times, the first historical data indicating that a probability of the first event triggering any third event at the time feature point is greater than or equal to a reference probability threshold; Performing a first initialization on the probability of the first event triggering any third event at the time feature point; Performing a second initialization on the probability of the first event and any third event occurring in a specified time period respectively; Based on the result of the first initialization and the result of the second initialization, initialization data of the probability of the first event triggering the occurrence of any third event varying with time is obtained.

9. A device for event analysis, It is characterized in that The device comprises: an interaction module, configured to obtain a query message of a first event, wherein the query message is used to query target information of a second event, wherein the second event is triggered by the first event, wherein the first event is an event that has occurred at a first time, and the second event is a predicted event that has not occurred at the first time, and wherein the first time is less than or equal to a time when the query message is obtained; The obtaining module is further used to: obtain first historical data of an event that has occurred at the first time among the events managed by the device, the first historical data including: an identifier of the event that has occurred and an occurrence time of the event that has occurred, the first historical data including historical data of the first event and historical data of a third event, the third event being an event that has occurred at the first time and has the same identifier as the second event; The acquisition module is also used to analyze the first historical data based on the query message, obtain the time series connection between different events that have occurred, and predict the correlation between different events based on the time series connection, and obtain the target information based on the correlation between the different events. The target information includes the event identifier, trigger probability and / or predicted occurrence time of the second event.

10. The device according to claim 9, It is characterized in that The query message includes a screening condition, and the query message including the screening condition is used to query target information that meets the screening condition, and the screening condition includes one or more of the following: a time condition, a probability condition, and a device condition; The device condition includes one or more of the following device attributes: device identification, device location, device type, network topology of the device, device manufacturer and device user. The device condition is used to indicate a device associated with the occurrence of the second event.

11. The device according to claim 9 or 10, It is characterized in that The query message is obtained based on the query parameters input by the user in the query interface, or based on the interface component selected by the user in the query interface, or obtained from a third-party system through an application programming interface API.

12. The device according to claim 9, It is characterized in that The obtaining module is specifically used for: The target information is obtained based on the first historical data and the analysis model, and the analysis model is an artificial intelligence model.

13. The device according to claim 12, It is characterized in that The obtaining module is specifically used for: The target information is obtained based on the first historical data, analysis indication information and an analysis model, wherein the analysis indication information is used to indicate that the first event is used as a preceding event that triggers the occurrence of the second event.

14. The device according to claim 13, It is characterized in that The second event associated with the first event includes one or more, and the obtaining module is specifically used to: Pre-screening the first historical data to obtain historical data of the first event and historical data of any third event, where any third event is an event that has occurred at the first time and has the same identifier as any second event; The analysis instruction information, the historical data of the first event and the historical data of any third event are input into the analysis model to obtain the target information of any second event output by the analysis model.

15. The device according to claim 13 or 14, It is characterized in that The device further comprises: a training module, wherein the training module is used for: Based on the historical data of the first event and the historical data of any third event, obtaining reference data of the probability of the first event triggering any third event changing over time, wherein the second event associated with the first event includes one or more, and any third event is an event that has occurred at the first time and has the same identifier as any second event; Acquire initialization data of the probability of the first event triggering any of the third events changing over time, wherein the initialization data is obtained by initializing the occurrence probabilities of the first event and any of the third events; The analysis model is trained based on the reference data and the initialization data.

16. The device according to claim 15, It is characterized in that The training module is specifically used for: Based on the historical data of the first event and the historical data of any third event, counting the total number of times any third event occurs after the first event occurs for a specified period of time; Acquiring a time feature point based on the total number of times, the first historical data indicating that a probability of the first event triggering any third event at the time feature point is greater than or equal to a reference probability threshold; Performing a first initialization on the probability of the first event triggering any third event at the time feature point; Performing a second initialization on the probability of the first event and any third event occurring in a specified time period respectively; Based on the result of the first initialization and the result of the second initialization, initialization data of the probability of the first event triggering the occurrence of any third event varying with time is obtained.

17. An analytical device, It is characterized in that The analysis device comprises: a processor and a memory, wherein a computer program is stored in the memory; when the processor executes the computer program, the analysis device implements the method according to any one of claims 1 to 8.

18. A non-transitory computer-readable storage medium, It is characterized in that When the instructions in the computer-readable storage medium are executed by a processor, the processor performs the method according to any one of claims 1 to 8.

19. A computer program product comprising instructions, It is characterized in that When the instructions in the computer program product are executed on a computer, the computer executes the method according to any one of claims 1 to 8.

Images