A method and device for handling network equipment failure, and electronic equipment

Abstract

The embodiment of the present invention provides a method, device and electronic device for handling faults of network equipment, the method comprising: obtaining alarm information of a target network equipment, and determining a target alarm relationship from an alarm relationship set; wherein the target network equipment is a preset associated network equipment, and the alarm relationship in the alarm relationship set is used to indicate alarm information with a dependency relationship; according to the alarm information, a fault prediction result under the target alarm relationship is obtained through a fault prediction model corresponding to the target alarm relationship; wherein the fault prediction model is obtained by training with the alarm training message corresponding to the target alarm relationship as a sample. Through the embodiment of the present invention, it is possible to quickly locate the root cause of the fault and give timely warnings to possible faults or alarms, and provide other faults that may occur to the operation and maintenance management personnel.

Description

Technical Field

[0001] The present invention relates to the technical field of network equipment, and in particular to a method and device for handling faults of network equipment, and electronic equipment. Background Art

[0002] In the existing process of alarm monitoring of network equipment, fault management is in the middle of fault operation and maintenance. Its main task is to collect various types of alarm information and fill in the alarm information with business and operation and maintenance standards. At the same time, the alarms are subjected to correlation analysis, preprocessing operations, message notifications, fault dispatching and other operations. The current alarm is presented in the form of an alarm flow window. Alarm filters are selected, and the alarm flow supports further viewing of alarm details and dispatch status and other information.

[0003] After receiving a fault dispatch, the operation and maintenance personnel spend a lot of time locating the root cause of the fault. Traditional fault pre-processing rules are based on experience and driven by demand, which is limited by the manufacturer's development capabilities, construction cycle, etc. With the advent of 5G networks, the coexistence of multiple networks will make the network structure more complex, which puts higher requirements on the ability of operation and maintenance personnel, making it impossible to quickly locate the root cause of the fault and issue timely warnings for the fault. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a method, device and electronic device for handling a fault of a network device, so as to solve the problem that the root cause of the fault cannot be quickly located and the fault cannot be warned in time.

[0005] In order to solve the above technical problems, the embodiment of the present invention is implemented as follows:

[0006] In a first aspect, an embodiment of the present invention provides a method for handling a fault of a network device, comprising:

[0007] Acquire alarm information of a target network device, and determine a target alarm relationship from an alarm relationship set; wherein the target network device is a preset associated network device, and the alarm relationship in the alarm relationship set is used to indicate alarm information with a dependent relationship;

[0008] According to the alarm information, a fault prediction result under the target alarm relationship is obtained through a fault prediction model corresponding to the target alarm relationship; wherein the fault prediction model is obtained by training with the alarm training message corresponding to the target alarm relationship as a sample.

[0009] In a second aspect, an embodiment of the present invention provides a fault handling device for a network device, comprising:

[0010] A collection module, used to obtain alarm information of a target network device, and determine a target alarm relationship from an alarm relationship set; wherein the target network device is a preset associated network device, and the alarm relationship in the alarm relationship set is used to indicate alarm information with a dependent relationship;

[0011] An execution module is used to obtain a fault prediction result under the target alarm relationship based on the alarm information through a fault prediction model corresponding to the target alarm relationship; wherein the fault prediction model is obtained by training with the alarm training message corresponding to the target alarm relationship as a sample.

[0012] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus; wherein the processor, the communication interface and the memory communicate with each other through a bus; the memory is used to store computer programs; and the processor is used to execute the programs stored in the memory to implement the steps of the fault handling method of the network device as described in the first aspect.

[0013] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the fault handling method of the network device as described in the first aspect are implemented.

[0014] It can be seen from the technical solution provided by the above embodiments of the present invention that the embodiments of the present invention obtain the alarm information of the target network device and determine the target alarm relationship from the alarm relationship set; wherein the target network device is a preset associated network device, and the alarm relationship in the alarm relationship set is used to indicate the alarm information with a dependency relationship; according to the alarm information, a fault prediction result under the target alarm relationship is obtained through a fault prediction model corresponding to the target alarm relationship; wherein the fault prediction model is obtained by training with the alarm training message corresponding to the target alarm relationship as a sample. Through the embodiments of the present invention, it is possible to quickly locate the root cause of the fault and give timely warnings to possible faults or alarms, and provide other possible faults to the operation and maintenance management personnel. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0016] Figure 1 A schematic diagram of a flow chart of a method for troubleshooting a network device provided by an embodiment of the present invention;

[0017] Figure 2 Another schematic diagram of a flow chart of a method for troubleshooting a network device provided by an embodiment of the present invention;

[0018] Figure 3 Another flowchart of a method for troubleshooting a network device provided by an embodiment of the present invention

[0019] Figure 4 A schematic diagram of the structure of a fault handling device for a network device provided by an embodiment of the present invention;

[0020] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0021] The embodiments of the present invention provide a method and device for handling a fault of a network device and an electronic device.

[0022] In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0023] like Figure 1 As shown, an embodiment of the present invention provides a method for handling a fault of a network device, and the execution subject of the method may be a server, wherein the server may be an independent server or a server cluster composed of multiple servers, and the server may be a data processing platform capable of performing network operation processing, etc. The method may specifically include the following steps:

[0024] Step S110, obtaining alarm information of a target network device, and determining a target alarm relationship from an alarm relationship set; wherein the target network device is a preset associated network device, and the alarm relationship in the alarm relationship set is used to indicate alarm information with a dependent relationship.

[0025] The server can obtain the alarm information of each network device in real time, and determine the alarm information of the target network device from it.

[0026] The target network device may be a network device selected in advance through settings, or may be determined based on a network device corresponding to alarm information obtained in real time. For example, the target network device may be determined based on a network device corresponding to alarm information obtained within a preset time window and associated network devices.

[0027] The server pre-stores an alarm relationship set, which can be expressed as R = {r1, r2, ..., r n}, where r i is the alarm relationship, and n is the number of alarm relationships.

[0028] The alarm relationship is used to indicate alarm information with dependency, and can be specifically associated through the title or alarm type of the alarm information. In one implementation, the alarm relationship can be an alarm relationship between specific network devices, or an alarm relationship for all network devices.

[0029] The target network relationship may be a network relationship selected in advance through settings, or may be determined based on alarm information obtained in real time. For example, a suitable target network relationship may be screened out from an alarm relationship set based on the title or alarm type of alarm information obtained within a preset time window.

[0030] Step S120: According to the alarm information, a fault prediction result under the target alarm relationship is obtained through a fault prediction model corresponding to the target alarm relationship; wherein the fault prediction model is obtained by training with the alarm training message corresponding to the target alarm relationship as a sample.

[0031] The server pre-builds and trains a fault prediction model, which can be applicable to all network devices and all alarm relationships, and can also be respectively applicable to different network devices or different alarm relationships.

[0032] It should be understood that the fault prediction model can be managed through a model design platform, such as an artificial intelligence (AI) platform, and the AI ​​platform includes data processing, data training, data labeling, model output and other capabilities. The AI ​​platform is used to perform data training, data labeling, model output and model testing on the fault prediction model, and the model publishing work is completed through the design state. After the AI ​​platform completes the training of the fault prediction model, the server can synchronize the information of the fault prediction model to the model management module of the server through the interface provided by the AI ​​platform. In the running state, rules are formulated according to business needs through the model management module. Through the real-time monitoring module or the historical alarm information module, fault warning and analysis are performed according to the fault prediction model.

[0033] It should be understood that the management of the fault prediction model can perform multi-dimensional retrieval functions of the model according to different conditions, such as model name, model type, profession, creator, whether it is enabled, etc., and provide details, modification, and deletion functions of each fault prediction model. Fault prediction model information can include model number, model name, model classification, model description, profession, whether it is verified, whether it is released, version, creator, creation time, and update time.

[0034] It should be understood that the verification of the fault prediction model can use sample data and verification methods to verify the accuracy of the imported fault prediction model. The fault expert can manually confirm the verification results based on the verification results, and the model that has passed the verification can be released. Among them, the sample data can be selected according to actual needs. By querying specific sample data, appropriate sample data can be selected to verify the fault prediction model, and the sample data details can be viewed, and deletion operations are supported. The verification method can verify the error of the data through generalization error. After selecting the sample data, you can select appropriate verification methods according to different fault prediction models, such as generalization error, ROC curve, KS test, etc., to evaluate and verify the accuracy of the model.

[0035] The server inputs the alarm information obtained in real time into the fault preset model called according to the target alarm relationship. The output fault prediction results may include the most likely alarm and other possible alarms under the target alarm relationship, as well as the probability of each alarm occurring, etc., thereby providing the operation and maintenance management personnel with other possible faults that may occur, and further pushing fault handling opinions and suggestions.

[0036] It can be seen from the technical solution provided by the above embodiments of the present invention that the embodiments of the present invention obtain the alarm information of the target network device and determine the target alarm relationship from the alarm relationship set; wherein the target network device is a preset associated network device, and the alarm relationship in the alarm relationship set is used to indicate the alarm information with a dependency relationship; according to the alarm information, a fault prediction result under the target alarm relationship is obtained through a fault prediction model corresponding to the target alarm relationship; wherein the fault prediction model is obtained by training with the alarm training message corresponding to the target alarm relationship as a sample. Through the embodiments of the present invention, it is possible to quickly locate the root cause of the fault and give timely warnings to possible faults or alarms, and provide other possible faults to the operation and maintenance management personnel.

[0037] Based on the above embodiment, further, Figure 2 As shown, before step S110, there are many methods for training the fault prediction model, and the embodiment of the present application only provides one implementation method thereof.

[0038] Step S101: the target alarm relationship r i The alarm training messages under are sorted by time to obtain the sequence set A of the alarm training messages i ={a i1 ,a i2 ,…,a im},i=1,2,…,n. Among them, a ij is the target warning relation r i The alarm information at the next time j, the alarm information may include the corresponding network device, for example, a i1 is the warning information at time 1, a i2 The alarm information at time 2, and time 1 is not later than time 2, and so on, thus forming sequence set A i .

[0039] Step S102: By setting the window value w=2, 3, ..., the sequence set A i The warning training messages in are divided into multiple training groups to form a new sequence set A i ′, and use the last alarm training message in each training group as a label and other alarm training messages as samples to train the fault prediction model of the target alarm relationship.

[0040] Take w=3 as an example for the sequence set A i Grouping to form a new sequence set A′ i ={(a i1 ,a i2 ,a i3 ),(a i2 ,a i3 ,a i4 )…,(a im-2 ,a im-1 ,a im )}, that is, each group is a triple. In this way, a fault prediction model is constructed, and the first two alarm training messages of each triple are used as the model input samples, and the last alarm training message is used as the label to train the fault prediction model. There are many specific training methods, such as Bayesian training, which can obtain the alarm relationship r i The set of fault prediction models trained under different window values ​​w is M = {m1,m2,…,m k},k=1,2,…。

[0041] Step S103: According to a preset evaluation method, the fault prediction models of the target alarm relationship trained under each window value are compared, and the fault prediction model of the target alarm relationship is determined according to the comparison result.

[0042] There are many ways to evaluate the fault prediction model, and this embodiment of the application only provides one of the evaluation methods. According to 10-fold cross-validation, the best model m is selected from the set M of fault prediction models using the same evaluation method. best As an alarm relation i The fault prediction model.

[0043] In one implementation, the alarm relationship r i Next, we evaluate different window values ​​w to obtain a model m. best As an alarm relation i The fault prediction model corresponding to the window value w is downloaded, and when the fault prediction model is applied to perform fault prediction, the fault prediction model is called according to the target alarm relationship and the selected window value to perform fault prediction.

[0044] It should be understood that the 10-fold cross-validation is to divide the sample data set into ten parts, and take 9 of them as training data and 1 part as test data in turn for testing. Each test will result in a corresponding accuracy (or error rate). The average of the accuracy (or error rate) of the 10 results is used as an estimate of the accuracy of the algorithm. Generally, multiple 10-fold cross-validations are required, such as 10 10-fold cross-validations, and then the average is calculated as an estimate of the accuracy of the algorithm.

[0045] It can be seen from the technical solution provided by the above embodiment of the present invention that the embodiment of the present invention obtains a sequence set of alarm training messages by sorting the alarm training messages under the target alarm relationship according to time; divides the alarm training messages in the sequence set into multiple training groups by setting a window value, and uses the last alarm training message in each training group as a label and other alarm training messages as samples to train the fault prediction model of the target alarm relationship; compares the fault prediction models of the target alarm relationship trained under each window value according to a preset evaluation method, and determines the fault prediction model of the target alarm relationship according to the comparison result. Through the embodiment of the present invention, the training of fault prediction models under different alarm relationships is realized, so that faults can be flexibly and accurately predicted according to actual conditions.

[0046] Based on the above embodiment, further, Figure 3 As shown, before step S101, the method further includes:

[0047] Step S1001: Determine associated network devices and target alarm types, as well as alarm information corresponding to the associated network devices.

[0048] There are many methods for determining the association relationship of each network device. In one embodiment, the confirmation can be made based on the base station, and the network devices connected to the same base station are regarded as associated network devices. In the actual application process, the number of network devices corresponding to each base station can be counted first, and a suitable base station can be selected from them, and then the network devices corresponding to the base station can be determined as associated network devices. For example, a base station whose number of corresponding network devices exceeds a preset threshold or whose number of corresponding network devices in a certain area ranks first can be selected as a suitable base station.

[0049] It should be understood that the target alarm type can be a plurality of alarm types confirmed based on the alarm information generated by the associated network device. In one embodiment, the alarm types of all alarm information generated by the associated network device can be counted first, so as to filter out the alarm types that need to be processed, for example, the alarm type with the largest number of corresponding alarm information, or the alarm type that is the same as or related to the preset main alarm type, is filtered out. For example, the target alarm type is the following 10 alarm types: {BBUCPRI interface abnormality alarm, NR cell unavailable alarm, RF unit maintenance link abnormality alarm, RF unit temperature abnormality alarm, RF unit DC power failure alarm, network element connection interruption, RF unit hardware failure alarm, RF unit optical interface performance deterioration alarm, RF unit CPRI interface abnormality alarm, cell unavailable alarm}.

[0050] Step S1002: according to a preset cycle, in the alarm information corresponding to the associated network devices in each cycle, the number of alarm information corresponding to each target alarm type is counted to obtain a statistical vector of each cycle, and the statistical vectors are combined into a statistical matrix.

[0051] First, all the alarm information is preprocessed, the time mark INSERTTIME is unified in format, and invalid alarm information is removed. The unified time mark can be expressed as "%Y-%m-%d%H:%M:%S".

[0052] According to the time mark, the alarms are sorted in order of occurrence time, and according to the preset period, for example, every 5 minutes, the number of alarm information corresponding to each target alarm type is counted to obtain the statistical vector of each period. Then, each statistical vector is merged according to time to obtain a statistical matrix, and saved as an npy matrix. The npy matrix is ​​exemplified as follows:

[0053]

[0054] The npy matrix shown above includes 22044 statistical vectors.

[0055] Step S1003: Obtain a directed acyclic graph (DAG) between target alarm types according to the statistical matrix.

[0056] The statistical vectors in the statistical matrix are sorted in chronological order. After a network device generates a certain alarm information, it may cause other related network devices to generate another alarm information. Therefore, according to the time order of occurrence of each target alarm type indicated by the statistical matrix, a directed acyclic graph between each target alarm type can be generated. For example, according to the 10 target alarm types involved in the npy matrix shown above, a directed acyclic graph with 10 nodes can be obtained, and thus the dependency relationship between each target alarm type can be obtained according to the directed acyclic graph. For example, if there is a connection in the directed acyclic graph from the node where the network element connection is interrupted to the node where the radio unit maintains a link abnormality alarm, it indicates that the network element connection interruption may cause the radio unit to maintain a link abnormality alarm.

[0057] Step S1004: Based on a preset scoring method, a causal relationship graph is trained according to each directed acyclic graph; wherein the causal relationship graph is used to indicate the dependency relationship between each alarm type and to generate the alarm relationship.

[0058] There are many ways to score a directed acyclic graph. For example, it can be scored using the formula shown below.

[0059]

[0060] By controlling the upper and lower limits of the score, continuously adjusting the parameters, and imposing acyclic constraints on the results, we can eventually obtain a d×d adjacency matrix, where d is the number of target alarm types, which is the final causal relationship diagram.

[0061] The causal relationship graphs of different target alarm types can be merged to obtain the causal relationship graph of the entire network.

[0062] By analyzing the cause-effect relationship diagram, the alarm relationship can be obtained, thereby forming an alarm relationship set for training the fault prediction model under each alarm relationship.

[0063] It can be seen from the technical solution provided by the above embodiments of the present invention that the embodiments of the present invention determine the associated network devices and target alarm types, as well as the alarm information corresponding to the associated network devices; according to a preset period, in the alarm information corresponding to the associated network devices in each period, the number of alarm information corresponding to each target alarm type is counted to obtain the statistical vector of each period, and merged into a statistical matrix; according to the statistical matrix, a directed acyclic graph between the target alarm types is obtained; based on the preset scoring method, a causal relationship graph is trained according to each directed acyclic graph; wherein the causal relationship graph is used to indicate the dependency relationship between the alarm types, and is used to generate the alarm relationship. Through the embodiments of the present invention, the mining of alarm association rules is realized, and the dependency relationship between the associated types and the alarm relationship set are obtained, which are used to train the fault prediction model, thereby improving the accuracy of fault prediction.

[0064] Based on the above embodiment, further, the method also includes:

[0065] The resource data, performance data and alarm information of each network device are associated and presented through a visualization system.

[0066] The resource data may specifically be device information and connection relationship information of network devices, such as manufacturer information, region information, network element information, computer room location information, etc.

[0067] The performance data may specifically be an indicator for measuring the operating performance of the network device, such as connection rate, call drop rate, uplink / downlink rate, latency, CPU utilization, etc.

[0068] The alarm information may specifically be an alarm information given by the monitoring unit according to the fault level when a network element fails, and sent to the monitoring center. The alarm information may include: occurrence time, device type, network element name, specialty, alarm title, alarm level, alarm message body, etc.

[0069] There are many ways to associate the resource data, performance data and alarm information. In one embodiment, the resource data, performance data and alarm information can be associated through the identifier of the network device, such as the network element name of the network device. The specific location of the fault can be located through association and visualized on a Geographic Information System (GIS) map, which is convenient for operation and maintenance personnel to quickly find the fault location and eliminate the fault.

[0070] In one embodiment, the association between the alarm information and resource data can be performed through a resource management system to fill in relevant resource attributes. For some alarm information that cannot directly locate resources, the resource data association is filled in through methods such as associating the alarm with a static table of resource data and extracting the alarm text.

[0071] In one embodiment, the association between the alarm information and the performance data can be achieved by accessing a real-time performance data file through a network management system. The performance data file may include but is not limited to wireless, core, and transmission-related real-time performance data, and the performance data is aggregated at the original network element granularity. The associated resource data is supplemented with relevant resource attributes and stored in the database, and provided to the visualization system.

[0072] In one implementation, the alarm information may be associated with the complaint information, and by accessing the network complaint data of the entire network and combining the real-time alarm information, a preliminary correlation analysis may be performed on the related faults of the related complaint numbers and complaint location information.

[0073] The visualization system can provide a GIS view function for the sandbox application, presenting the distribution of base stations according to the overall city, and highlighting the boundaries of cities. By default, only faulty and offline base stations are presented. The GIS view location query supports the search function according to address, longitude and latitude, and quickly locates the search location.

[0074] The visualization system supports resource topology viewing. By overlaying real-time information such as alarm information and performance data on the network topology map, the real-time network operation information is presented based on the network networking structure, which can help operation and maintenance managers analyze and locate the cause of the fault.

[0075] Furthermore, the method further comprises:

[0076] In the visualization system, according to the alarm level of the received alarm information, the network devices and / or the connections between the network devices corresponding to the alarm information are rendered.

[0077] Render the nodes in the topology map according to the alarm information. The alarm information may include device alarm information and performance alarm information. The alarm range may be configured according to the alarm level, alarm title, etc., and the configuration requirements are the same as the filter settings of the alarm monitoring specification. In one embodiment, the visualization system pre-sets the alarm level that needs to be rendered. For example, the nodes of the network devices corresponding to the first and second level alarms may be rendered by default, and the nodes of each network device are rendered according to their highest level alarm information. The filter of the alarm monitoring specification is used to filter out alarm messages of lower alarm levels, for example, filtering out the third and fourth level alarm information that has no impact on the business, thereby avoiding the rendering of a large number of network device nodes on the topology map. By retaining higher-level alarm information that has a greater impact on the network and will cause business interruption or a decrease in business quality, such as the first and second level emergency and important alarm information, the operation and maintenance management personnel can focus on it.

[0078] In one embodiment, the connection between nodes in the visualization system can support rendering corresponding colors according to whether the relevant performance indicators exceed the threshold. For example, the visualization system supports four thresholds, and the rendering color standard is the same as the alarm rendering color. When a connection is an aggregated connection, such as a local connection, it is rendered according to the highest congestion of all the connections contained in the connection.

[0079] The circuit topology data is queried according to the circuit code and presented, and the sections where the alarm information appears and the nodes of the network equipment are rendered.

[0080] Furthermore, the method further comprises:

[0081] At least one of the following information of each network device is displayed in the visualization system:

[0082] Performance change trends;

[0083] An associated alarm list, wherein the associated alarm list includes alarm information having a dependency relationship within a preset time window;

[0084] Life cycle management information of alarm information;

[0085] Historical alarm information.

[0086] Based on the alarm information, relevant base stations and network devices can be retrieved and filtered, and their current real-time performance indicators and change trends can be summarized and recorded for decision makers to analyze. It supports the comparison of performance trend graphs of different objects with the same indicator and the same time granularity, such as the comparison between different cities and different network devices. The time span can be modified to present a more macro or detailed indicator change trend.

[0087] The associated alarm list can include a group of alarm information with dependencies within a preset window time, thereby supporting alarm location analysis. By associating the alarm list, compressed dispatch can be performed to reduce the workload of operation and maintenance management personnel in handling work orders.

[0088] The associated alarm list can be presented in various ways. In one embodiment, the associated alarm list can be presented in a tree structure, and only the main alarm and derived alarm are listed by default. Click the "+" sign in front of the main alarm and derived alarm to expand and list the secondary alarms and derived alarms. Click the "-" sign in front of the main alarm and derived alarm to collapse the associated alarms.

[0089] Through the life cycle management information of alarm information, the whole process of each alarm information from base station to internal alarm processing of Operation and Maintenance Center (OMC) and group is visible. Among them, the internal alarm processing link of OMC includes data collection, alarm generation, standardization, engineering annotation, fault location, and correlation, which can be fully visualized to achieve closed-loop monitoring capability of faults.

[0090] The server can also provide a query function for historical alarm information. Based on the relevance of historical alarm information, it can predict and judge the possible impact of the current alarm information processing status, and can warn of alarms that may occur in the future, thereby realizing intelligent prediction of faults.

[0091] It can be seen from the technical solutions provided by the above embodiments of the present invention that the embodiments of the present invention associate resource data, performance data and alarm information of each network device and present them through a visualization system. Through the embodiments of the present invention, a full range of image presentation of network devices and alarm information is achieved, which helps to improve the accurate location of faults.

[0092] Corresponding to the network device fault handling method provided in the above embodiment, based on the same technical concept, the embodiment of the present invention also provides a network device fault handling device, Figure 4 A schematic diagram of the module composition of a fault handling device for a network device provided in an embodiment of the present invention, wherein the fault handling device for a network device is used to perform Figures 1 to 3 Describes the troubleshooting methods for network devices, such as Figure 4 As shown, the fault handling device of the network device includes: a collection module 401 and an execution module 402.

[0093] The acquisition module 401 is used to obtain the alarm information of the target network device and determine the target alarm relationship from the alarm relationship set; wherein, the target network device is a preset associated network device, and the alarm relationship in the alarm relationship set is used to indicate the alarm information with a dependency relationship; the execution module 402 is used to obtain a fault prediction result under the target alarm relationship based on the alarm information through a fault prediction model corresponding to the target alarm relationship; wherein, the fault prediction model is obtained by training with the alarm training message corresponding to the target alarm relationship as a sample.

[0094] It can be seen from the technical solution provided by the above embodiments of the present invention that the embodiments of the present invention obtain the alarm information of the target network device and determine the target alarm relationship from the alarm relationship set; wherein the target network device is a preset associated network device, and the alarm relationship in the alarm relationship set is used to indicate the alarm information with a dependency relationship; according to the alarm information, a fault prediction result under the target alarm relationship is obtained through a fault prediction model corresponding to the target alarm relationship; wherein the fault prediction model is obtained by training with the alarm training message corresponding to the target alarm relationship as a sample. Through the embodiments of the present invention, it is possible to quickly locate the root cause of the fault and give timely warnings to possible faults or alarms, and provide other possible faults to the operation and maintenance management personnel.

[0095] Based on the above embodiment, further, the execution module is also used for:

[0096] Sorting the warning training messages under the target warning relationship according to time to obtain a sequence set of warning training messages;

[0097] The alarm training messages in the sequence set are divided into multiple training groups by setting a window value, and the last alarm training message in each training group is used as a label and other alarm training messages are used as samples to train the fault prediction model of the target alarm relationship;

[0098] According to a preset evaluation method, the fault prediction models of the target alarm relationship trained under each window value are compared, and the fault prediction model of the target alarm relationship is determined according to the comparison result.

[0099] It can be seen from the technical solution provided by the above embodiment of the present invention that the embodiment of the present invention sorts the alarm training messages under the target alarm relationship according to time to obtain a sequence set of alarm training messages; divides the alarm training messages in the sequence set into multiple training groups by setting a window value, and uses the last alarm training message in each training group as a label and other alarm training messages as samples to train the fault prediction model of the target alarm relationship; according to a preset evaluation method, the fault prediction models of the target alarm relationship trained under each window value are compared, and the fault prediction model of the target alarm relationship is determined according to the comparison result. Through the embodiment of the present invention, the training of fault prediction models under different alarm relationships is realized, so that faults can be flexibly and accurately predicted according to actual conditions.

[0100] Based on the above embodiment, further, the execution module is also used to

[0101] Determine the associated network devices and target alarm types, and the alarm information corresponding to the associated network devices;

[0102] According to a preset cycle, in the alarm information corresponding to the associated network devices in each cycle, the number of alarm information corresponding to each target alarm type is counted to obtain a statistical vector of each cycle, and the statistical vectors are combined into a statistical matrix;

[0103] According to the statistical matrix, a directed acyclic graph between target warning types is obtained;

[0104] Based on a preset scoring method, a causal relationship graph is trained according to each directed acyclic graph; wherein the causal relationship graph is used to indicate the dependency relationship between each alarm type and to generate the alarm relationship.

[0105] It can be seen from the technical solution provided by the above embodiments of the present invention that the embodiments of the present invention determine the associated network devices and target alarm types, as well as the alarm information corresponding to the associated network devices; according to a preset period, in the alarm information corresponding to the associated network devices in each period, the number of alarm information corresponding to each target alarm type is counted to obtain the statistical vector of each period, and merged into a statistical matrix; according to the statistical matrix, a directed acyclic graph between the target alarm types is obtained; based on the preset scoring method, a causal relationship graph is trained according to each directed acyclic graph; wherein the causal relationship graph is used to indicate the dependency relationship between the alarm types, and is used to generate the alarm relationship. Through the embodiments of the present invention, the mining of alarm association rules is realized, and the dependency relationship between the associated types and the alarm relationship set are obtained, which are used to train the fault prediction model, thereby improving the accuracy of fault prediction.

[0106] Based on the above embodiment, further, the execution module is also used to associate the resource data, performance data and alarm information of each network device, and present them through a visualization system.

[0107] Furthermore, the execution module is also used to render, in the visualization system, the network devices and / or the connections between the network devices corresponding to the alarm information according to the alarm level of the received alarm information.

[0108] Furthermore, the execution module is further configured to display at least one of the following information of each network device in the visualization system:

[0109] Performance change trends;

[0110] An associated alarm list, wherein the associated alarm list includes alarm information having a dependency relationship within a preset time window;

[0111] Life cycle management information of alarm information;

[0112] Historical alarm information.

[0113] It can be seen from the technical solutions provided by the above embodiments of the present invention that the embodiments of the present invention associate resource data, performance data and alarm information of each network device and present them through a visualization system. Through the embodiments of the present invention, a full range of image presentation of network devices and alarm information is achieved, which helps to improve the accurate location of faults.

[0114] The fault handling device for a network device provided in an embodiment of the present invention can implement each process in the embodiment corresponding to the fault handling method for the above-mentioned network device, and will not be described again here to avoid repetition.

[0115] It should be noted that the fault handling device of the network device provided in the embodiment of the present invention and the fault handling method of the network device provided in the embodiment of the present invention are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the implementation of the fault handling method of the aforementioned network device, and the repeated parts will not be repeated.

[0116] Corresponding to the fault handling method of the network device provided in the above embodiment, based on the same technical concept, an embodiment of the present invention further provides an electronic device, which is used to execute the fault handling method of the network device. Figure 5 A schematic diagram of the structure of an electronic device for implementing various embodiments of the present invention is shown in FIG. Figure 5As shown. The electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors 501 and memory 502, and the memory 502 may store one or more storage applications or data. Among them, the memory 502 can be a temporary storage or a permanent storage. The application stored in the memory 502 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the electronic device. Furthermore, the processor 501 can be configured to communicate with the memory 502 to execute a series of computer executable instructions in the memory 502 on the electronic device. The electronic device may also include one or more power supplies 503, one or more wired or wireless network interfaces 504, one or more input and output interfaces 505, and one or more keyboards 506.

[0117] Specifically in this embodiment, the electronic device includes a processor, a communication interface, a memory and a communication bus; wherein the processor, the communication interface and the memory communicate with each other through the bus; the memory is used to store a computer program; the processor is used to execute the program stored in the memory to implement the following method steps:

[0118] Acquire alarm information of a target network device, and determine a target alarm relationship from an alarm relationship set; wherein the target network device is a preset associated network device, and the alarm relationship in the alarm relationship set is used to indicate alarm information with a dependent relationship;

[0119] According to the alarm information, a fault prediction result under the target alarm relationship is obtained through a fault prediction model corresponding to the target alarm relationship; wherein the fault prediction model is obtained by training with the alarm training message corresponding to the target alarm relationship as a sample.

[0120] The present application also provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the following method steps are implemented:

[0121] Acquire alarm information of a target network device, and determine a target alarm relationship from an alarm relationship set; wherein the target network device is a preset associated network device, and the alarm relationship in the alarm relationship set is used to indicate alarm information with a dependent relationship;

[0122] According to the alarm information, a fault prediction result under the target alarm relationship is obtained through a fault prediction model corresponding to the target alarm relationship; wherein the fault prediction model is obtained by training with the alarm training message corresponding to the target alarm relationship as a sample.

[0123] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0124] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0125] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0126] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0127] In a typical configuration, an electronic device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0128] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0129] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0130] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0131] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0132] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for handling a fault of a network device, characterized in that: The method comprises: Acquire alarm information of a target network device, and determine a target alarm relationship from an alarm relationship set; wherein the target network device is a preset associated network device, and the alarm relationship in the alarm relationship set is used to indicate alarm information with a dependent relationship; According to the alarm information, a fault prediction result under the target alarm relationship is obtained through a fault prediction model corresponding to the target alarm relationship; wherein the fault prediction model is obtained by training with the alarm training message corresponding to the target alarm relationship as a sample; Before obtaining the alarm information of the target network device, the method further includes: Determine the associated network devices and target alarm types, and the alarm information corresponding to the associated network devices; According to a preset cycle, in the alarm information corresponding to the associated network devices in each cycle, the number of alarm information corresponding to each target alarm type is counted to obtain a statistical vector of each cycle, and the statistical vectors are combined into a statistical matrix; According to the statistical matrix, a directed acyclic graph between target warning types is obtained; Based on a preset scoring method, a causal relationship graph is trained according to each directed acyclic graph; wherein the causal relationship graph is used to indicate the dependency relationship between each alarm type and to generate the alarm relationship.

2. The method according to claim 1, characterized in that Before obtaining the alarm information of the target network device, the method further includes: Sorting the warning training messages under the target warning relationship according to time to obtain a sequence set of warning training messages; The alarm training messages in the sequence set are divided into multiple training groups by setting a window value, and the last alarm training message in each training group is used as a label and other alarm training messages are used as samples to train the fault prediction model of the target alarm relationship; According to a preset evaluation method, the fault prediction models of the target alarm relationship trained under each window value are compared, and the fault prediction model of the target alarm relationship is determined according to the comparison result.

3. The method according to any one of claims 1-2, characterized in that: The method further comprises: The resource data, performance data and alarm information of each network device are associated and presented through a visualization system.

4. The method according to claim 3, characterized in that The method further comprises: In the visualization system, according to the alarm level of the received alarm information, the network devices and / or the connections between the network devices corresponding to the alarm information are rendered.

5. The method according to claim 3, characterized in that: The method further comprises: At least one of the following information of each network device is displayed in the visualization system: Performance change trends; An associated alarm list, wherein the associated alarm list includes alarm information having a dependency relationship within a preset time window; Life cycle management information of alarm information; Historical alarm information.

6. A fault handling device for a network device, characterized in that: The device comprises: A collection module, used to obtain alarm information of a target network device, and determine a target alarm relationship from an alarm relationship set; wherein the target network device is a preset associated network device, and the alarm relationship in the alarm relationship set is used to indicate alarm information with a dependent relationship; An execution module, configured to obtain a fault prediction result under the target alarm relationship according to the alarm information through a fault prediction model corresponding to the target alarm relationship; wherein the fault prediction model is obtained by training with the alarm training message corresponding to the target alarm relationship as a sample; Before obtaining the alarm information of the target network device, the fault handling device is further used to: Determine the associated network devices and target alarm types, and the alarm information corresponding to the associated network devices; According to a preset cycle, in the alarm information corresponding to the associated network devices in each cycle, the number of alarm information corresponding to each target alarm type is counted to obtain a statistical vector of each cycle, and the statistical vectors are combined into a statistical matrix; According to the statistical matrix, a directed acyclic graph between target warning types is obtained; Based on a preset scoring method, a causal relationship graph is trained according to each directed acyclic graph; wherein the causal relationship graph is used to indicate the dependency relationship between each alarm type and to generate the alarm relationship.

7. The device according to claim 6, characterized in that The execution module is also used for: Sorting the warning training messages under the target warning relationship according to time to obtain a sequence set of warning training messages; The alarm training messages in the sequence set are divided into multiple training groups by setting a window value, and the last alarm training message in each training group is used as a label and other alarm training messages are used as samples to train the fault prediction model of the target alarm relationship; According to a preset evaluation method, the fault prediction models of the target alarm relationship trained under each window value are compared, and the fault prediction model of the target alarm relationship is determined according to the comparison result.

8. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus; wherein the processor, the communication interface and the memory communicate with each other through the bus; the memory is used to store computer programs; the processor is used to execute the programs stored in the memory to implement the steps of the fault handling method of the network device as described in any one of claims 1-5.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the steps of the method for handling a fault of a network device according to any one of claims 1 to 5 are implemented.

Images