A method, apparatus, device and storage medium for network fault alarm analysis

Abstract

This invention discloses a network fault alarm analysis method, apparatus, device, and storage medium. The method includes: when several alarm events are generated within several observation periods, extracting key fields of the alarm events and sorting them according to time series to obtain two-dimensional matrix data; extracting alarm data from the two-dimensional matrix data based on a sliding window determined by a sliding window adjustment strategy, and extracting spatiotemporal features from the extracted alarm transaction data to train a first fault type identification model; determining a first fault type through the updated first fault type identification model; using a sequence pattern mining algorithm to obtain several frequent sequences for each observation period and identifying a second fault type; when the first fault type matches any second fault type, determining the faulty device and its corresponding physical location based on the corresponding frequent sequence. This invention can cope with dynamic and ever-changing network attack behaviors and achieve accurate location of fault physical locations.

Description

Technical Field

[0001] This invention relates to the field of network management technology, and in particular to a network fault alarm analysis method, apparatus, terminal device, and computer-readable storage medium. Background Technology

[0002] As the scale of telecommunications networks continues to expand, the structure of the operation and maintenance support network within these networks becomes increasingly complex. When a fault occurs at one location within the operation and maintenance support network, a series of alarm events may be generated at other locations, resulting in a wide variety of redundant alarm events in a short period of time. Operation and maintenance personnel are usually unable to eliminate invalid alarm information in a short time, nor can they accurately locate the fault location. Therefore, it is necessary to propose a network fault alarm analysis method to achieve root cause analysis of faults.

[0003] Existing technologies typically analyze the correlation between historical alarm events and fault locations to achieve root cause analysis. However, due to the rapid update speed of alarm events, root cause analysis based on the correlation between historical alarm events and fault locations cannot cope with dynamic and ever-changing network attack behaviors. Summary of the Invention

[0004] This invention provides a network fault alarm analysis method, apparatus, device, and storage medium. When a new alarm event occurs, by using the spatiotemporal characteristics of the new alarm event to train a preset first fault type identification model, the generalization performance of the first fault type identification model can be improved, thereby effectively identifying the fault type of the new alarm event and responding to dynamic and ever-changing network attack behaviors. Furthermore, by using a sequence pattern mining algorithm to mine frequent sequences of alarm events, the physical location of the faulty device can be accurately located.

[0005] To address the aforementioned technical problems, a first aspect of the present invention provides a network fault alarm analysis method, comprising the following steps:

[0006] When several alarm events are generated within a certain preset observation period, key fields are extracted from the several alarm events, and alarm data corresponding to each alarm event is obtained based on the extracted key fields.

[0007] The alarm data within each observation period are sorted according to the time series to obtain the two-dimensional matrix data corresponding to each observation period;

[0008] Based on the sliding window corresponding to each observation period determined in advance according to the preset sliding window adjustment strategy, alarm data is extracted from the two-dimensional matrix data to obtain alarm transaction data corresponding to each observation period.

[0009] By using a convolutional neural network to extract features from several alarm transaction data, the spatiotemporal features of the alarms corresponding to each observation period are obtained.

[0010] The alarm spatiotemporal features are used to train a preset first fault type identification model to obtain a parameter-updated first fault type identification model. The parameter-updated first fault type identification model is then used to identify the fault type of several alarm transaction data to determine the first fault type corresponding to each observation period.

[0011] A sequence pattern mining algorithm is used to obtain several frequent sequences corresponding to each observation period, and fault type identification is performed on each frequent sequence to obtain a second fault type corresponding to each frequent sequence; wherein, the frequent sequence corresponds to one of the devices operating within the observation period;

[0012] The first fault type corresponding to each observation period is matched with several second fault types. When a target second fault type matching the first fault type exists within the observation period, the faulty device and its physical location are determined based on the frequent sequence corresponding to the target second fault type.

[0013] As a preferred embodiment, the step of training a preset first fault type identification model using the alarm spatiotemporal features to obtain a first fault type identification model with updated parameters specifically includes the following steps:

[0014] The alarm spatiotemporal features are used to train a preset first fault type identification model to obtain several updated model parameters.

[0015] The initial model parameters of the first fault type identification model are compared with the several updated model parameters to obtain several target updated model parameters that meet the preset parameter change range.

[0016] The first fault type identification model is updated with parameters based on the aforementioned target update model parameters to obtain the first fault type identification model with updated parameters.

[0017] As a preferred embodiment, the step of using a sequence pattern mining algorithm to obtain several frequent sequences corresponding to each observation period specifically includes the following steps:

[0018] Obtain the abnormal state sequence of each device within each observation period; wherein, the abnormal state sequence includes several abnormal state information;

[0019] Based on the time sequence of the occurrence of the aforementioned abnormal status information, several alarm items and the number of occurrences of each alarm item are determined; wherein, the alarm items include several abnormal status information items sorted by occurrence time;

[0020] Several frequent sequences corresponding to each observation period are determined by comparing the preset support threshold with the occurrence frequency.

[0021] As a preferred embodiment, the step of identifying the fault type for each frequent sequence to obtain the second fault type corresponding to each frequent sequence specifically includes the following steps:

[0022] By using a pre-defined second fault type identification model, based on the pre-defined mapping relationship between each frequent sequence and each fault type, fault type identification is performed on each frequent sequence to obtain the second fault type corresponding to each frequent sequence.

[0023] As a preferred embodiment, the method specifically determines the sliding window corresponding to each observation period in advance according to a preset sliding window adjustment strategy through the following steps:

[0024] Based on the physical location of the faulty equipment corresponding to the Tth observation period and the physical location of the faulty equipment corresponding to the (T+1)th observation period, the first fault location error corresponding to the Tth observation period is determined.

[0025] Based on the physical location of the faulty equipment corresponding to the (T+1)th observation period and the physical location of the faulty equipment corresponding to the (T+2)th observation period, the second fault location error corresponding to the (T+1)th observation period is determined.

[0026] Based on the first fault location error and the second fault location error, the cumulative error corresponding to the (T+2)th observation period is obtained;

[0027] When the cumulative error is not equal to the preset error threshold, the width change and step size change of the current sliding window are determined by the following expression:

[0028] Δw=C×w0

[0029]

[0030] Wherein, Δw represents the width change value; w0 represents the width of the current sliding window; and Δt represents the step size change value. This represents the step size of the current sliding window; C represents the variation coefficient, which is expressed as: k represents a preset constant. This represents the cumulative error;

[0031] The width and step size of the current sliding window are adjusted according to the width change value and the step size change value, respectively, and the adjusted sliding window is used as the sliding window corresponding to the T+3rd observation period;

[0032] Where T>0;

[0033] The sliding windows corresponding to the Tth observation period, the (T+1)th observation period, and the (T+2)th observation period are all the current sliding windows; the width of the current sliding window is a preset width, and the step size of the current sliding window is a preset step size.

[0034] As a preferred embodiment, the step of extracting alarm data from the two-dimensional matrix data based on the sliding window corresponding to each observation period, determined in advance according to a preset sliding window adjustment strategy, to obtain alarm transaction data corresponding to each observation period, specifically includes the following steps:

[0035] Based on the sliding window corresponding to each observation period, alarm data is extracted from the two-dimensional matrix data;

[0036] The extracted alarm data are arranged according to the sliding order of the sliding window to obtain the alarm data sample corresponding to each observation period;

[0037] Based on the alarm data samples corresponding to each observation period and the preset sample size, an alarm transaction database containing alarm transaction data corresponding to each observation period is constructed.

[0038] As a preferred embodiment, the alarm data corresponding to each alarm event shall include at least the alarm event code, alarm content, alarm location, and alarm level.

[0039] A second aspect of the present invention provides a network fault alarm analysis device, comprising:

[0040] The alarm data acquisition module is used to extract key fields from several alarm events that occur within a few preset observation periods, and obtain the alarm data corresponding to each alarm event based on the extracted key fields.

[0041] The two-dimensional matrix data acquisition module is used to sort several alarm data in each observation period according to the time series to obtain the two-dimensional matrix data corresponding to each observation period.

[0042] The alarm transaction data acquisition module is used to extract alarm data from the two-dimensional matrix data based on the sliding window corresponding to each observation period determined in advance according to the preset sliding window adjustment strategy, so as to obtain the alarm transaction data corresponding to each observation period.

[0043] The alarm spatiotemporal feature extraction module is used to extract features from several alarm transaction data through a convolutional neural network to obtain the alarm spatiotemporal features corresponding to each observation period.

[0044] The first fault type identification module is used to train a preset first fault type identification model using the alarm spatiotemporal features to obtain a first fault type identification model with updated parameters, and to identify the fault type of several alarm transaction data through the first fault type identification model with updated parameters to determine the first fault type corresponding to each observation period.

[0045] The second fault type identification module is used to obtain several frequent sequences corresponding to each observation period using a sequence pattern mining algorithm, and to identify the fault type of each frequent sequence to obtain the second fault type corresponding to each frequent sequence; wherein, the frequent sequence corresponds to one of the devices operating within the observation period;

[0046] The fault location module is used to match the first fault type corresponding to each observation period with several second fault types. When a target second fault type matching the first fault type exists within the observation period, the faulty device and its physical location are determined based on the frequent sequence corresponding to the target second fault type.

[0047] A third aspect of the present invention provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the network fault alarm analysis method as described in any of the first aspects.

[0048] A fourth aspect of the present invention provides a computer-readable storage medium comprising a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the network fault alarm analysis method as described in any of the first aspects.

[0049] Compared with the prior art, the beneficial effects of the embodiments of the present invention are that when a new alarm event occurs, by using the spatiotemporal characteristics of the new alarm event to train the preset first fault type identification model, the generalization performance of the first fault type identification model can be improved, thereby effectively identifying the fault type of the new alarm time and being able to cope with dynamic and ever-changing network attack behaviors; furthermore, by using a sequence pattern mining algorithm to mine the frequent sequences of alarm events, the physical location of the faulty device can be accurately located. Attached Figure Description

[0050] Figure 1This is a flowchart illustrating the network fault alarm analysis method in an embodiment of the present invention;

[0051] Figure 2 This is a schematic diagram of the alarm transaction database in an embodiment of the present invention;

[0052] Figure 3 This is a schematic diagram of the network fault alarm analysis device in an embodiment of the present invention. Detailed Implementation

[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] See Figure 1 The first aspect of this invention provides a network fault alarm analysis method, comprising the following steps S1 to S7:

[0055] Step S1: When several alarm events are generated within a few preset observation periods, key fields are extracted from the several alarm events, and alarm data corresponding to each alarm event is obtained based on the extracted key fields.

[0056] Step S2: Sort several alarm data in each observation period according to the time series to obtain the two-dimensional matrix data corresponding to each observation period;

[0057] Step S3: Based on the sliding window corresponding to each observation period determined in advance according to the preset sliding window adjustment strategy, alarm data is extracted from the two-dimensional matrix data to obtain alarm transaction data corresponding to each observation period.

[0058] Step S4: Extract features from several alarm transaction data using a convolutional neural network to obtain the alarm spatiotemporal features corresponding to each observation period;

[0059] Step S5: Use the alarm spatiotemporal features to train the preset first fault type identification model to obtain the first fault type identification model after parameter update, and use the first fault type identification model after parameter update to identify the fault type of several alarm transaction data to determine the first fault type corresponding to each observation period.

[0060] Step S6: Use a sequence pattern mining algorithm to obtain several frequent sequences corresponding to each observation period, and identify the fault type of each frequent sequence to obtain the second fault type corresponding to each frequent sequence; wherein, the frequent sequence corresponds to one of the devices operating within the observation period;

[0061] Step S7: Match the first fault type corresponding to each observation period with several second fault types. When a target second fault type matching the first fault type exists within the observation period, determine the faulty device and its physical location based on the frequent sequence corresponding to the target second fault type.

[0062] In step S1, when several alarm events are generated within a few preset observation periods, key fields are extracted from the alarm events to achieve preprocessing of the alarm events. It is worth noting that during the alarm event preprocessing process, it is necessary to extract key fields that affect the root cause analysis of the fault. Although each alarm event contains many alarm attributes, fault location only requires a few key attributes, such as: alarm event code, alarm content, alarm location, and alarm level.

[0063] In step S2, since the original alarm data cannot be directly used for subsequent spatiotemporal feature extraction, this embodiment sorts the original alarm data of each observation period according to the time series to construct a two-dimensional matrix data. For example, the alarm data S = {s, T} s ,T e Sort the alarms according to the time they occurred, where S represents the alarm data, [T s ,T e The value indicates the observation period for alarm data. In this embodiment, the time for each observation period is set to 1 hour. It is worth noting that alarm data may overlap as time progresses, and alarm data that occurred earlier may have a higher degree of overlap.

[0064] In step S3, considering the varying alarm scope and duration triggered by different alarm events, and drawing on practical network operation and maintenance experience, a sliding window adjustment strategy is adopted to determine the sliding window corresponding to each observation period, thereby achieving a strong temporal correlation between alarm events. Based on the sliding window corresponding to each observation period, alarm data is extracted from the two-dimensional matrix data to obtain the alarm transaction data corresponding to each observation period, which avoids the alarm transaction data containing too much redundant information.

[0065] In step S4, to extract multidimensional semantic features from alarm transaction data, this embodiment uses a convolutional neural network to extract features from several alarm transaction data sets, obtaining the spatiotemporal features of alarms corresponding to each observation period. Specifically, this embodiment uses a convolutional neural network with convolutional kernels of different sizes to extract features from the alarm transaction data, extracting temporal and spatial features from shallow to deep levels. Then, a fusion layer is used to fuse the semantic information of the shallow and deep data, realizing multidimensional semantic feature analysis of the alarm transaction data.

[0066] In step S5, this embodiment uses the spatiotemporal features of alarms to train a preset first fault type identification model, obtaining a first fault type identification model with updated parameters. By incrementally updating the first fault type identification model using the spatiotemporal features of new alarm events, the generalization performance of the model can be improved, thereby effectively identifying fault types for new alarm times and responding to dynamic and ever-changing network attack behaviors.

[0067] It is worth noting that the preset first fault type identification model is a model obtained by learning the spatiotemporal characteristics of historical alarm transaction data through a BP neural network model.

[0068] In step S6, since the attack process is a process with strong temporal sequence and correlation, and considering the close coupling relationship between the physical network topology and the information system transmission link, although there is redundancy in the alarm events, these alarm events have certain common patterns. By mining the frequent sequences of these alarm events, the fault type of the information system can be matched with the fault type caused by the abnormal operating state of each key device in the physical network, so as to achieve accurate location of the physical location of the fault.

[0069] In step S7, the first fault type corresponding to each observation period is matched with several second fault types. When there is a target second fault type that matches the first fault type within the observation period, the device corresponding to the frequent sequence of the target second fault type can be identified as the key object for investigation based on the frequent sequence. The physical location of the device can then be obtained to achieve accurate fault location.

[0070] As a preferred embodiment, the step of training a preset first fault type identification model using the alarm spatiotemporal features to obtain a first fault type identification model with updated parameters specifically includes the following steps:

[0071] The alarm spatiotemporal features are used to train a preset first fault type identification model to obtain several updated model parameters.

[0072] The initial model parameters of the first fault type identification model are compared with the several updated model parameters to obtain several target updated model parameters that meet the preset parameter change range.

[0073] The first fault type identification model is updated with parameters based on the aforementioned target update model parameters to obtain the first fault type identification model with updated parameters.

[0074] It is worth noting that, considering that the first fault type identification model after parameter update is trained using new alarm events, the model parameters of the first fault type identification model after parameter update may be more biased towards the new alarm transaction data. In order to prevent the neural network from forgetting the knowledge it has learned before, this embodiment selectively selects the model parameters of the neural network. Specifically, the initial model parameters of the first fault type identification model are compared with several updated model parameters to obtain several target updated model parameters that meet the preset parameter change range.

[0075] For example, in this embodiment, the preset parameter change range is 10%. Therefore, the updated model parameters with a parameter change range of less than 10% are selected as the target updated model parameters, while the updated model parameters with a parameter change range of more than 10% are discarded.

[0076] As a preferred embodiment, the step of using a sequence pattern mining algorithm to obtain several frequent sequences corresponding to each observation period specifically includes the following steps:

[0077] Obtain the abnormal state sequence of each device within each observation period; wherein, the abnormal state sequence includes several abnormal state information;

[0078] Based on the time sequence of the occurrence of the aforementioned abnormal status information, several alarm items and the number of occurrences of each alarm item are determined; wherein, the alarm items include several abnormal status information items sorted by occurrence time;

[0079] Several frequent sequences corresponding to each observation period are determined by comparing the preset support threshold with the occurrence frequency.

[0080] It is worth noting that S represents all abnormal status information of a certain device within an observation period. p (t j Sort the abnormal states of the equipment according to their occurrence time to form a sequence of abnormal states during operation: Q p (T)={S p (t1),S p (t2),...,S p (t j )}, where S p (tj ) represents the j-th abnormal state information generated by the device during the observation period.

[0081] Based on this, a sequence pattern mining algorithm is used to mine Q at time T. p Frequent sequences of (T). Assume an abnormal sequence pattern T. pi For a sequence to be considered a frequent sequence, it must satisfy the following condition: there is no sequence T in the set of frequent sequences. pj ,satisfy And support(T) pj )≥T pi The head node and other nodes are generated in descending order of the frequency of occurrence of each alarm item. A conditional pattern base is generated, and then the corresponding FP tree is constructed using the conditional pattern base. The corresponding frequent sequences are judged according to the preset support threshold.

[0082] It is worth noting that the support threshold is usually derived from personal experience or historical data of attack incidents.

[0083] For example, if the order of abnormal status information is: ABCBEABDCAB; then alarm item AB (meaning A occurs first, then B) occurs 3 times, alarm item ABC (meaning A occurs first, then B, then C) occurs 2 times, and alarm item ABD (meaning A occurs first, then B, then D) occurs 1 time. Assuming the support threshold is 2, alarm item ABD does not meet the support threshold, so alarm items AB and ABC are frequent sequences.

[0084] As a preferred embodiment, the step of identifying the fault type for each frequent sequence to obtain the second fault type corresponding to each frequent sequence specifically includes the following steps:

[0085] By using a pre-defined second fault type identification model, based on the pre-defined mapping relationship between each frequent sequence and each fault type, fault type identification is performed on each frequent sequence to obtain the second fault type corresponding to each frequent sequence.

[0086] Specifically, based on the acquisition of frequent sequences, a pattern recognition method is used to determine the fault type of the frequent sequence, and several fault types with higher probabilities are matched with the first fault type mentioned above. If the match is successful, the corresponding equipment is taken as the key object for investigation, so as to achieve accurate location of the physical location of the fault.

[0087] It is worth noting that pattern recognition methods typically utilize neural network models for identification. In this embodiment, a pre-set second fault type identification model is used to identify the fault type of each frequent sequence based on a pre-set mapping relationship between each frequent sequence and each fault type, thereby obtaining the second fault type corresponding to each frequent sequence. It can be understood that this embodiment pre-trains the neural network model using the mapping relationship between each frequent sequence and each fault type; for example, alarm item ABD corresponds to fault type 1, and alarm item ABC corresponds to fault type 2.

[0088] As a preferred embodiment, the method specifically determines the sliding window corresponding to each observation period in advance according to a preset sliding window adjustment strategy through the following steps:

[0089] Based on the physical location of the faulty equipment corresponding to the Tth observation period and the physical location of the faulty equipment corresponding to the (T+1)th observation period, the first fault location error corresponding to the Tth observation period is determined.

[0090] Based on the physical location of the faulty equipment corresponding to the (T+1)th observation period and the physical location of the faulty equipment corresponding to the (T+2)th observation period, the second fault location error corresponding to the (T+1)th observation period is determined.

[0091] Based on the first fault location error and the second fault location error, the cumulative error corresponding to the (T+2)th observation period is obtained;

[0092] When the cumulative error is not equal to the preset error threshold, the width change and step size change of the current sliding window are determined by the following expression:

[0093] Δw=C×w0

[0094]

[0095] Wherein, Δw represents the width change value; w0 represents the width of the current sliding window; and Δt represents the step size change value. This represents the step size of the current sliding window; C represents the variation coefficient, which is expressed as: k represents a preset constant. This represents the cumulative error;

[0096] The width and step size of the current sliding window are adjusted according to the width change value and the step size change value, respectively, and the adjusted sliding window is used as the sliding window corresponding to the T+3rd observation period;

[0097] Where T>0;

[0098] The sliding windows corresponding to the Tth observation period, the (T+1)th observation period, and the (T+2)th observation period are all the current sliding windows; the width of the current sliding window is a preset width, and the step size of the current sliding window is a preset step size.

[0099] It is worth noting that this embodiment employs a dynamic time window sliding method to achieve strong temporal correlation between alarm events. If the fault location accuracy of an alarm event is below a threshold, the width and step size of the sliding window are reduced; conversely, if the fault location accuracy of an alarm event is above the threshold, the width and step size of the sliding window are increased. In this way, the number of alarm events in the system can be adjusted according to the size of the sliding window, avoiding excessive redundant information in the alarm transaction data due to an excessively large window, which would hinder effective discovery of correlation rules. Simultaneously, the dynamic step size ensures the overlap between two sliding windows, preventing excessive overlap from artificially enhancing the correlation between the two sliding windows and increasing the complexity and interference of fault location.

[0100] Assume S w ={w,t s ,t e Let} be one of the sliding windows of sequence S, where w represents the window width and t e -t s This represents the sliding step size, which is smaller than the observation period. Alarm events within the same time window may be caused by the same network fault, and different alarm events may trigger alarms of varying scope and duration. Therefore, a strong temporal correlation between alarm events is achieved through a dynamic time window sliding method.

[0101] In this embodiment, based on the first fault location error and the second fault location error, the cumulative error corresponding to the (T+2)th observation period is obtained using the following expression:

[0102]

[0103] Among them, e T Indicates the first fault location error; e T+1 This indicates the second fault location error; This indicates the cumulative error.

[0104] Determine if the cumulative error exceeds a preset error threshold. If it does, reduce the width and step size of the current sliding window; otherwise, increase the width and step size. Adjust the width and step size of the current sliding window using the following expression:

[0105] w′=w0±Δw

[0106]

[0107] Where w′ represents the adjusted width; t′ e -t′ s This indicates the adjusted step size.

[0108] As a preferred embodiment, the step of extracting alarm data from the two-dimensional matrix data based on the sliding window corresponding to each observation period, determined in advance according to a preset sliding window adjustment strategy, to obtain alarm transaction data corresponding to each observation period, specifically includes the following steps:

[0109] Based on the sliding window corresponding to each observation period, alarm data is extracted from the two-dimensional matrix data;

[0110] The extracted alarm data are arranged according to the sliding order of the sliding window to obtain the alarm data sample corresponding to each observation period;

[0111] Based on the alarm data samples corresponding to each observation period and the preset sample size, an alarm transaction database containing alarm transaction data corresponding to each observation period is constructed.

[0112] It is worth noting that, in order to ensure that the alarm data sample size is consistent for each observation period, this embodiment constructs an alarm transaction database containing alarm transaction data corresponding to each observation period based on the alarm data sample and a preset sample size. For alarm data sample sizes smaller than the preset sample size after each slide, zeros are used for padding. Figure 2 As shown, an alarm transaction database of a specific size is finally constructed.

[0113] As a preferred embodiment, the alarm data corresponding to each alarm event shall include at least the alarm event code, alarm content, alarm location, and alarm level.

[0114] This invention provides a network fault alarm analysis method. When a new alarm event occurs, by using the spatiotemporal characteristics of the new alarm event to train a preset first fault type identification model, the generalization performance of the first fault type identification model can be improved, thereby effectively identifying the fault type of the new alarm event and responding to dynamic and ever-changing network attack behaviors. Furthermore, by using a sequence pattern mining algorithm to mine frequent sequences of alarm events, the physical location of the faulty device can be accurately located.

[0115] See Figure 3 A second aspect of the present invention provides a network fault alarm analysis device, comprising:

[0116] The alarm data acquisition module 301 is used to extract key fields from several alarm events when several alarm events are generated within several preset observation periods, and obtain alarm data corresponding to each alarm event based on the extracted key fields.

[0117] The two-dimensional matrix data acquisition module 302 is used to sort several alarm data in each observation period according to the time series to obtain the two-dimensional matrix data corresponding to each observation period.

[0118] The alarm transaction data acquisition module 303 is used to extract alarm data from the two-dimensional matrix data based on the sliding window corresponding to each observation period determined in advance according to the preset sliding window adjustment strategy, so as to obtain the alarm transaction data corresponding to each observation period.

[0119] The alarm spatiotemporal feature extraction module 304 is used to extract features from several alarm transaction data through a convolutional neural network to obtain the alarm spatiotemporal features corresponding to each observation period.

[0120] The first fault type identification module 305 is used to train a preset first fault type identification model using the alarm spatiotemporal features to obtain a first fault type identification model with updated parameters, and to identify the fault type of several alarm transaction data through the first fault type identification model with updated parameters to determine the first fault type corresponding to each observation period.

[0121] The second fault type identification module 306 is used to obtain several frequent sequences corresponding to each observation period using a sequence pattern mining algorithm, and to identify the fault type of each frequent sequence to obtain the second fault type corresponding to each frequent sequence; wherein, the frequent sequence corresponds to one of the devices operating within the observation period;

[0122] The fault location module 307 is used to match the first fault type corresponding to each observation period with a number of second fault types. When a target second fault type matching the first fault type exists within the observation period, the faulty device and its physical location are determined based on the frequent sequence corresponding to the target second fault type.

[0123] As a preferred embodiment, the first fault type identification module 305 is used to train a preset first fault type identification model using the alarm spatiotemporal features to obtain a first fault type identification model with updated parameters, specifically including:

[0124] The alarm spatiotemporal features are used to train a preset first fault type identification model to obtain several updated model parameters.

[0125] The initial model parameters of the first fault type identification model are compared with the several updated model parameters to obtain several target updated model parameters that meet the preset parameter change range.

[0126] The first fault type identification model is updated with parameters based on the aforementioned target update model parameters to obtain the first fault type identification model with updated parameters.

[0127] As a preferred embodiment, the second fault type identification module 306 is used to obtain several frequent sequences corresponding to each observation period using a sequence pattern mining algorithm, specifically including:

[0128] Obtain the abnormal state sequence of each device within each observation period; wherein, the abnormal state sequence includes several abnormal state information;

[0129] Based on the time sequence of the occurrence of the aforementioned abnormal status information, several alarm items and the number of occurrences of each alarm item are determined; wherein, the alarm items include several abnormal status information items sorted by occurrence time;

[0130] Several frequent sequences corresponding to each observation period are determined by comparing the preset support threshold with the occurrence frequency.

[0131] As a preferred embodiment, the second fault type identification module 306 is used to identify the fault type for each frequent sequence and obtain the second fault type corresponding to each frequent sequence, specifically including:

[0132] By using a pre-defined second fault type identification model, based on the pre-defined mapping relationship between each frequent sequence and each fault type, fault type identification is performed on each frequent sequence to obtain the second fault type corresponding to each frequent sequence.

[0133] As a preferred embodiment, the device further includes a sliding window adjustment module, used for:

[0134] Based on the physical location of the faulty equipment corresponding to the Tth observation period and the physical location of the faulty equipment corresponding to the (T+1)th observation period, the first fault location error corresponding to the Tth observation period is determined.

[0135] Based on the physical location of the faulty equipment corresponding to the (T+1)th observation period and the physical location of the faulty equipment corresponding to the (T+2)th observation period, the second fault location error corresponding to the (T+1)th observation period is determined.

[0136] Based on the first fault location error and the second fault location error, the cumulative error corresponding to the (T+2)th observation period is obtained;

[0137] When the cumulative error is not equal to the preset error threshold, the width change and step size change of the current sliding window are determined by the following expression:

[0138] Δw=C×w0

[0139]

[0140] Wherein, Δw represents the width change value; w0 represents the width of the current sliding window; and Δt represents the step size change value. This represents the step size of the current sliding window; C represents the variation coefficient, which is expressed as: k represents a preset constant. This represents the cumulative error;

[0141] The width and step size of the current sliding window are adjusted according to the width change value and the step size change value, respectively, and the adjusted sliding window is used as the sliding window corresponding to the T+3rd observation period;

[0142] Where T>0;

[0143] The sliding windows corresponding to the Tth observation period, the (T+1)th observation period, and the (T+2)th observation period are all the current sliding windows; the width of the current sliding window is a preset width, and the step size of the current sliding window is a preset step size.

[0144] As a preferred embodiment, the alarm transaction data acquisition module 303 is used to extract alarm data from the two-dimensional matrix data based on the sliding window corresponding to each observation period, which is determined in advance according to a preset sliding window adjustment strategy, to obtain alarm transaction data corresponding to each observation period, specifically including:

[0145] Based on the sliding window corresponding to each observation period, alarm data is extracted from the two-dimensional matrix data;

[0146] The extracted alarm data are arranged according to the sliding order of the sliding window to obtain the alarm data sample corresponding to each observation period;

[0147] Based on the alarm data samples corresponding to each observation period and the preset sample size, an alarm transaction database containing alarm transaction data corresponding to each observation period is constructed.

[0148] As a preferred embodiment, the alarm data corresponding to each alarm event shall include at least the alarm event code, alarm content, alarm location, and alarm level.

[0149] It should be noted that the network fault alarm analysis device provided in this embodiment of the invention can realize all the processes of the network fault alarm analysis method described in any of the above embodiments. The functions and technical effects of each module in the device are the same as the functions and technical effects of the network fault alarm analysis method described in the above embodiments, and will not be repeated here.

[0150] A third aspect of the present invention provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the network fault alarm analysis method as described in any embodiment of the first aspect.

[0151] The terminal device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor and memory. The terminal device may also include input / output devices, network access devices, buses, etc.

[0152] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting all parts of the terminal device via various interfaces and lines.

[0153] The memory can be used to store the computer programs and / or modules. The processor implements various functions of the terminal device by running or executing the computer programs and / or modules stored in the memory and by calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0154] A fourth aspect of the present invention provides a computer-readable storage medium comprising a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform a network fault alarm analysis method as described in any embodiment of the first aspect.

[0155] Through the above description of the embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus necessary hardware platforms, and of course, it can also be implemented entirely by hardware. Based on this understanding, all or part of the technical solution of the present invention that contributes to the background art can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of the present invention.

[0156] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A network fault alarm analysis method, characterized in that, Includes the following steps: When several alarm events are generated within a certain preset observation period, key fields are extracted from the several alarm events, and alarm data corresponding to each alarm event is obtained based on the extracted key fields. The alarm data within each observation period are sorted according to the time series to obtain the two-dimensional matrix data corresponding to each observation period; Based on the sliding window corresponding to each observation period determined in advance according to the preset sliding window adjustment strategy, alarm data is extracted from the two-dimensional matrix data to obtain alarm transaction data corresponding to each observation period. By using a convolutional neural network to extract features from several alarm transaction data, the spatiotemporal features of the alarms corresponding to each observation period are obtained. The alarm spatiotemporal features are used to train a preset first fault type identification model to obtain a parameter-updated first fault type identification model. The parameter-updated first fault type identification model is then used to identify the fault type of several alarm transaction data to determine the first fault type corresponding to each observation period. A sequence pattern mining algorithm is used to obtain several frequent sequences corresponding to each observation period, and fault type identification is performed on each frequent sequence to obtain a second fault type corresponding to each frequent sequence; wherein, the frequent sequence corresponds to one of the devices operating within the observation period; The first fault type corresponding to each observation period is matched with several second fault types. When a target second fault type matching the first fault type exists within the observation period, the faulty device and its physical location are determined based on the frequent sequence corresponding to the target second fault type. The step of training a preset first fault type identification model using the alarm spatiotemporal features to obtain a first fault type identification model with updated parameters specifically includes the following steps: The alarm spatiotemporal features are used to train a preset first fault type identification model to obtain several updated model parameters. The initial model parameters of the first fault type identification model are compared with the several updated model parameters to obtain several target updated model parameters that meet the preset parameter change range. Based on the aforementioned target update model parameters, the first fault type identification model is updated to obtain the first fault type identification model with updated parameters. The alarm spatiotemporal features are the spatiotemporal features of the new alarm time; the first fault type identification model after parameter update is trained using the new alarm event.

2. The network fault alarm analysis method as described in claim 1, characterized in that, The step of using a sequence pattern mining algorithm to obtain several frequent sequences corresponding to each observation period specifically includes the following steps: Obtain the abnormal state sequence of each device within each observation period; wherein, the abnormal state sequence includes several abnormal state information; Based on the time sequence of the occurrence of the aforementioned abnormal status information, several alarm items and the number of occurrences of each alarm item are determined; wherein, the alarm items include several abnormal status information items sorted by occurrence time; Several frequent sequences corresponding to each observation period are determined by comparing the preset support threshold with the occurrence frequency.

3. The network fault alarm analysis method as described in claim 1, characterized in that, The step of identifying the fault type for each frequent sequence to obtain the second fault type corresponding to each frequent sequence specifically includes the following steps: By using a pre-defined second fault type identification model, based on the pre-defined mapping relationship between each frequent sequence and each fault type, fault type identification is performed on each frequent sequence to obtain the second fault type corresponding to each frequent sequence.

4. The network fault alarm analysis method as described in claim 1, characterized in that, The method specifically determines the sliding window corresponding to each observation period in advance according to a preset sliding window adjustment strategy through the following steps: Based on the physical location of the faulty equipment corresponding to the Tth observation period and the physical location of the faulty equipment corresponding to the (T+1)th observation period, the first fault location error corresponding to the Tth observation period is determined. Based on the physical location of the faulty equipment corresponding to the (T+1)th observation period and the physical location of the faulty equipment corresponding to the (T+2)th observation period, the second fault location error corresponding to the (T+1)th observation period is determined. Based on the first fault location error and the second fault location error, the cumulative error corresponding to the (T+2)th observation period is obtained; When the cumulative error is not equal to the preset error threshold, the width change and step size change of the current sliding window are determined by the following expression: Δw=C×w0 Wherein, Δw represents the width change value; w0 represents the width of the current sliding window; and Δt represents the step size change value. This represents the step size of the current sliding window; C represents the variation coefficient, which is expressed as: k represents a preset constant. This represents the cumulative error; The width and step size of the current sliding window are adjusted according to the width change value and the step size change value, respectively, and the adjusted sliding window is used as the sliding window corresponding to the T+3rd observation period; Where T>0; The sliding windows corresponding to the Tth observation period, the (T+1)th observation period, and the (T+2)th observation period are all the current sliding windows; the width of the current sliding window is a preset width, and the step size of the current sliding window is a preset step size.

5. The network fault alarm analysis method as described in claim 1, characterized in that, The step of extracting alarm data from the two-dimensional matrix data based on the sliding window corresponding to each observation period, determined in advance according to a preset sliding window adjustment strategy, to obtain alarm transaction data corresponding to each observation period, specifically includes the following steps: Based on the sliding window corresponding to each observation period, alarm data is extracted from the two-dimensional matrix data; The extracted alarm data are arranged according to the sliding order of the sliding window to obtain the alarm data sample corresponding to each observation period; Based on the alarm data samples corresponding to each observation period and the preset sample size, an alarm transaction database containing alarm transaction data corresponding to each observation period is constructed.

6. The network fault alarm analysis method as described in claim 1, characterized in that, The alarm data corresponding to each alarm event includes at least the alarm event code, alarm content, alarm location, and alarm level.

7. A network fault alarm analysis device, characterized in that, include: The alarm data acquisition module is used to extract key fields from several alarm events when several alarm events are generated within several preset observation periods, and obtain alarm data corresponding to each alarm event based on the extracted key fields. The two-dimensional matrix data acquisition module is used to sort several alarm data in each observation period according to the time series to obtain the two-dimensional matrix data corresponding to each observation period. The alarm transaction data acquisition module is used to extract alarm data from the two-dimensional matrix data based on the sliding window corresponding to each observation period determined in advance according to the preset sliding window adjustment strategy, so as to obtain the alarm transaction data corresponding to each observation period. The alarm spatiotemporal feature extraction module is used to extract features from several alarm transaction data through a convolutional neural network to obtain the alarm spatiotemporal features corresponding to each observation period. The first fault type identification module is used to train a preset first fault type identification model using the alarm spatiotemporal features to obtain a first fault type identification model with updated parameters, and to identify the fault type of several alarm transaction data through the first fault type identification model with updated parameters to determine the first fault type corresponding to each observation period. The second fault type identification module is used to obtain several frequent sequences corresponding to each observation period using a sequence pattern mining algorithm, and to identify the fault type of each frequent sequence to obtain the second fault type corresponding to each frequent sequence; wherein, the frequent sequence corresponds to one of the devices operating within the observation period; The fault location module is used to match the first fault type corresponding to each observation period with several second fault types. When a target second fault type matching the first fault type exists within the observation period, the faulty device and its physical location are determined based on the frequent sequence corresponding to the target second fault type. The first fault type identification module is used to train a preset first fault type identification model using the alarm spatiotemporal features to obtain a first fault type identification model with updated parameters, specifically including: The alarm spatiotemporal features are used to train a preset first fault type identification model to obtain several updated model parameters. The initial model parameters of the first fault type identification model are compared with the several updated model parameters to obtain several target updated model parameters that meet the preset parameter change range. Based on the aforementioned target update model parameters, the first fault type identification model is updated to obtain the first fault type identification model with updated parameters. The alarm spatiotemporal features are the spatiotemporal features of the new alarm time; the first fault type identification model after parameter update is trained using the new alarm event.

8. A terminal device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the network fault alarm analysis method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the network fault alarm analysis method as described in any one of claims 1 to 6.

Images