Alarm analysis method, device, equipment, and computer storage medium

Abstract

Embodiments of the present invention relate to the field of computer data processing technology and disclose an alarm analysis method, apparatus, device, and computer storage medium. The method comprises: processing raw alarm data to obtain multiple alarm transaction items; each alarm transaction item includes at least one alarm item arranged in alarm time sequence; performing inverted indexing on the alarm transaction items based on the alarm items to obtain a data set to be analyzed; performing association analysis on the data set to be analyzed to obtain a frequent itemset; determining alarm sequence information for each alarm item in the frequent itemset; and determining the root cause relationship of the alarm items corresponding to the frequent itemset based on the alarm sequence information. Through the above-described approach, the embodiments of the present invention improve the efficiency of alarm analysis.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of computer data processing, and in particular to an alarm analysis method, apparatus, device, and computer storage medium. Background Art

[0002] When performing network maintenance, it is necessary to perform correlation analysis on massive amounts of alarm data to determine the root cause of the alarm, so as to solve the problem that caused the alarm in a targeted manner and improve network stability.

[0003] During the implementation of the present invention, the inventors found that current root cause alarm analysis generally relies on manual or expert analysis to formulate root cause alarm analysis rules, which has a large workload and high maintenance time cost, and cannot meet the needs of daily network maintenance. Summary of the Invention

[0004] In view of the above problems, an embodiment of the present invention provides an alarm analysis method to solve the problem of low alarm analysis efficiency in the prior art.

[0005] According to one aspect of an embodiment of the present invention, a method for analyzing an alarm is provided, the method comprising:

[0006] Processing the original alarm data to obtain a plurality of alarm transaction items; each of the alarm transaction items includes at least one alarm item arranged in alarm time sequence;

[0007] Performing inverted indexing on the alarm transaction items according to the alarm items to obtain a data set to be analyzed;

[0008] Performing association analysis on the data set to be analyzed to obtain frequent item sets;

[0009] Determining alarm sequence information of each alarm item in the frequent item set;

[0010] The root cause relationship of the alarm items corresponding to the frequent itemsets is determined according to the alarm sequence information.

[0011] In an optional manner, the method further includes:

[0012] Determine each of the warning items as each candidate frequent 1-item set of the data set to be analyzed;

[0013] Starting from k being 1, the candidate frequent k-item sets are screened according to the minimum support to obtain the frequent k-item sets of the alarm items; wherein k is a positive integer; the support of each candidate frequent k-item set is determined according to the length of the alarm transaction item set corresponding to the candidate frequent k-item set;

[0014] Performing an intersection operation on the alarm transaction item set corresponding to the frequent k-item set to obtain the alarm transaction item set corresponding to the candidate frequent k+1-item set;

[0015] k is iteratively updated until the frequent k+1 item set or the candidate frequent k+1 item set does not exist, and the frequent k item set is determined as the frequent item set.

[0016] In an optional manner, the method is based on a distributed stream data processing framework; the method further includes:

[0017] Determine the degree of computational parallelism;

[0018] According to the distributed stream data processing framework and the calculation parallelism, parallel association analysis is performed on the data set to be analyzed to obtain the frequent itemsets.

[0019] In an optional manner, the method further includes:

[0020] Determine the maximum frequent itemset among the frequent itemsets;

[0021] Determine a maximum set of alarm transaction items corresponding to the maximum frequent itemset according to the data set to be analyzed;

[0022] Determining the average order of each alarm item in the maximum frequent item set in the maximum alarm transaction item set according to the alarm order information;

[0023] determining, according to the average order, at least one candidate root alarm item and at least one candidate derived alarm item in the maximum frequent item set;

[0024] Calculating the improvement of each candidate root alarm item and each candidate derived alarm item;

[0025] The root alarm item and the derived alarm item in the maximum frequent item set are determined from each of the candidate root alarm items and each of the candidate derived alarm items according to the lift.

[0026] In an optional manner, the method further includes:

[0027] Determining the alarm items whose average order is greater than an order threshold as the candidate root cause alarm items;

[0028] The remaining warning items in the maximum frequent item set are determined as the candidate derived warning items.

[0029] In an optional manner, the method further includes:

[0030] respectively determining the number of occurrences of the candidate root alarm item and the candidate derived alarm item in each alarm transaction item of the maximum alarm transaction item set;

[0031] Determining the number of simultaneous occurrences of the candidate root alarm item and the candidate derived alarm item according to the number of occurrences;

[0032] The improvement is determined according to the number of simultaneous occurrences and the number of occurrences of the candidate derived alarm items.

[0033] In an optional manner, the method further includes:

[0034] Obtaining the original alarm data;

[0035] Extracting features from the original alarm data to obtain candidate alarm transaction data; the candidate alarm transaction data includes a plurality of the alarm items;

[0036] The candidate alarm transaction data is processed according to the sliding time window and the sliding step size to obtain the multiple alarm transaction items.

[0037] According to another aspect of an embodiment of the present invention, there is provided an alarm analysis device, comprising:

[0038] A first processing module is configured to process the original alarm data to obtain a plurality of alarm transaction items; each of the alarm transaction items includes at least one alarm item arranged in alarm time sequence;

[0039] A second processing module is configured to perform inverted indexing on the alarm transaction items according to the alarm items to obtain a data set to be analyzed;

[0040] An analysis module, configured to perform association analysis on the data set to be analyzed to obtain frequent itemsets;

[0041] A first determining module, configured to determine the alarm order information of each alarm item in the frequent item set;

[0042] The second determining module is configured to determine the root cause relationship of the alarm items corresponding to the frequent itemsets according to the alarm order information.

[0043] According to another aspect of an embodiment of the present invention, an alarm analysis device is provided, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations as described in the alarm analysis method.

[0044] According to another aspect of the embodiments of the present invention, a computer-readable storage medium is provided, wherein the storage medium stores at least one executable instruction, and the executable instruction enables an alarm analysis device to perform the operations of the alarm analysis method.

[0045] The embodiment of the present invention first processes original alarm data to obtain multiple alarm transaction items; each of the alarm transaction items includes at least one alarm item arranged in alarm time sequence; the alarm transaction items are inverted indexed according to the alarm items to obtain a data set to be analyzed; thereby improving the efficiency of determining frequent item sets, then performing association analysis on the data set to be analyzed to obtain frequent item sets, and finally determining alarm sequence information of each alarm item in the frequent item sets; and determining the root cause relationship of the alarm items corresponding to the frequent item sets based on the alarm sequence information.

[0046] Different from the existing technology that performs root cause analysis based on artificially formulated rules and has the problem of low alarm analysis efficiency, the embodiments of the present invention extract transaction information and perform inverted index processing on the original alarm data, then perform frequent item set mining, and then perform root cause analysis based on the alarm order information of the alarm items in the frequent item set, thereby improving the efficiency of alarm analysis.

[0047] The above description is only an overview of the technical solutions of the embodiments of the present invention. In order to more clearly understand the technical means of the embodiments of the present invention, they can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiments of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings are only used to illustrate the embodiments and are not to be considered as limiting the present invention. In addition, the same reference symbols are used to represent the same components throughout the drawings. In the drawings:

[0049] Figure 1 A schematic diagram showing a flow chart of an alarm analysis method provided by an embodiment of the present invention is shown;

[0050] Figure 2 A schematic diagram of sliding window processing in the alarm analysis method provided by an embodiment of the present invention is shown;

[0051] Figure 3 A performance diagram of the alarm analysis method provided by an embodiment of the present invention is shown;

[0052] Figure 4 A schematic diagram showing the structure of an alarm analysis device provided by an embodiment of the present invention is shown;

[0053] Figure 5 A schematic structural diagram of an alarm analysis device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0054] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0055] Figure 1 The flowchart of the alarm analysis method provided by the embodiment of the present invention is shown, and the method is executed by a computer processing device. The computer processing device may include a mobile phone, a laptop computer, etc. Figure 1 As shown, the method includes the following steps:

[0056] Step 10: Process the original alarm data to obtain multiple alarm transaction items.

[0057] In one embodiment of the present invention, the original alarm data is first preprocessed, and feature extraction is performed on the preprocessed data to extract the alarm data information field. Then, the alarm data feature field related to the association rule analysis is selected from the alarm data information field, and the alarm data feature field and the corresponding field value are determined as an alarm item.

[0058] In one embodiment of the present invention, each alarm event item includes at least one alarm item arranged in an alarm time sequence, wherein the alarm time sequence refers to the time sequence of occurrence of each alarm item.

[0059] For example, the alarm transaction item T may be {a}, {a, b} or {b, c}, where a, b, and c are each an alarm item, and the occurrence time of a, b, and c gradually approaches the current time.

[0060] Considering that the data in the original alarm data is relatively discrete, there is a lot of information redundancy and lacks transaction features, it is necessary to extract transaction features from the original alarm data. In order to improve the efficiency of transaction feature extraction, the original alarm data can be preprocessed first to extract the alarm item information related to correlation analysis included in the original alarm data.

[0061] Therefore, in another embodiment of the present invention, step 10 further includes: step 101: obtaining the original alarm data.

[0062] In one embodiment of the present invention, the original alarm data may be acquired periodically, and the original alarm data may be in the form of a discrete data stream.

[0063] Step 102: extracting features from the original alarm data to obtain candidate alarm transaction data; the candidate alarm transaction data includes a plurality of the alarm items.

[0064] In one embodiment of the present invention, the original alarm data is preprocessed and feature extracted to extract the alarm data information field, and then the alarm data feature field related to the association rule analysis is selected from the alarm data information field, and the alarm data feature field and the corresponding field value are determined as an alarm item.

[0065] The alarm data information field may include an alarm identifier, resource identifier, resource object identifier, alarm title, alarm suggestion, alarm location, alarm level, alarm type, alarm status, and alarm time, etc. The alarm data feature field may be an alarm identifier, which is used to specifically identify an alarm. Based on the alarm identifier, other alarm data information fields such as the associated alarm title, alarm level, and alarm suggestion can be found.

[0066] Step 103: Process the candidate alarm transaction data according to the sliding time window and the sliding step size to obtain the multiple alarm transaction items.

[0067] In one embodiment of the present invention, reference Figure 2 The sliding window processing diagram shown slides a sliding time window of a preset length on the candidate alarm transaction data, determines an alarm item within a sliding time window as an alarm transaction item, and thus extracts multiple alarm transaction items.

[0068] The time starting point of the sliding time window is the alarm occurrence time of the first alarm item, and the sliding step size ( Figure 2 s) slides in sequence; if the interval between alarm items exceeds the window length of the sliding window ( Figure 2 w in), reset the starting point of the sliding time window, and slide the sliding time window again with the alarm time of the next alarm item as the starting point.

[0069] In another embodiment of the present invention, the window length of the sliding time window affects the number of alarm items in each alarm transaction item, that is, the length of the alarm transaction item, and the sliding step is related to the number of alarm transaction items in the alarm transaction data. Specifically, the sliding time window length can be 40s, and the sliding step can be 20s.

[0070] In another embodiment of the present invention, each alarm item within the same sliding time window is deduplicated to form an alarm item set, while ignoring empty sets and single-element sets. Each processed alarm item set is an alarm transaction item T.

[0071] In one embodiment of the present invention, the data format of the obtained alarm transaction item can refer to Table 1.

[0072]

[0073]

[0074] Table 1

[0075] Step 20: Perform inverted indexing on the alarm transaction items according to the alarm items to obtain a data set to be analyzed.

[0076] Considering that in the existing technology, when mining association rules for alarm data, the Apriori algorithm and the FP-Growth algorithm are generally used to mine the association rules of the alarm data and determine the root cause relationship.

[0077] Among them, the Apriori algorithm needs to scan the data alarm transaction database multiple times. When faced with massive alarm data, the Apriori algorithm's method of finding frequent item sets is too violent, resulting in frequent I / O operations, low connection efficiency, and high computational overhead.

[0078] The FP-Growth algorithm mines frequent itemsets without generating candidate item sets by generating an FP-Tree. Although this algorithm only needs to scan the data alarm transaction database twice, it has certain advantages over the Apriori algorithm in terms of efficiency. However, the construction of the FP-Tree usually consumes a lot of memory space. At the same time, as the FP-Tree grows, traversing the FP-Tree will also consume a lot of time.

[0079] Therefore, in one embodiment of the present invention, the association rules between alarm items are mined using the Eclat (Equivalence Class Transformation) algorithm. Therefore, an inverted index is first performed on the alarm transaction items based on the alarm items to obtain a dataset to be analyzed. In conjunction with the above example, the dataset to be analyzed, which is obtained by inverting the alarm transaction items in Table 1, can be seen in Table 2.

[0080]

[0081]

[0082] Table 2

[0083] Step 30: Perform association analysis on the data set to be analyzed to obtain frequent item sets.

[0084] Considering that most of the current root cause alarm rule mining algorithms use a centralized architecture and serial computing mode, they cannot meet the processing requirements of massive alarm data, thus limiting the use of traditional root cause alarm mining algorithms in big data scenarios.

[0085] In order to solve the problem of low efficiency in mining root cause alarm rules in big data scenarios, existing technologies use root cause alarm mining algorithms based on distributed computing frameworks such as Hadoop to improve the mining efficiency of root cause alarm rules by constructing block indexes of data sets and using the divide-and-conquer idea. However, when the amount of updated data is large, these methods still generate a large number of I / O operations, which in turn affects the operating efficiency.

[0086] Therefore, in another embodiment of the present invention, the method is based on a distributed stream data processing framework; wherein the distributed stream data processing framework can be the Apache Flink framework. The Apache Flink distributed computing framework is an open source computing platform for distributed data stream processing and batch processing, providing support for both stream processing and batch processing. On the Flink platform, data can be processed as bounded streams and unbounded streams, corresponding to batch processing and stream processing, respectively. The Flink platform treats batch processing as a special case of stream processing, solving batch processing problems with the concept of stream processing, thereby further improving data processing efficiency on the basis of distributed computing.

[0087] Step 30 also includes at least: Step 301: determining the computational parallelism.

[0088] In one embodiment of the present invention, the computation parallelism may be determined based on the amount of alarm data, and specifically based on the number of alarm items.

[0089] Step 302: performing parallel association analysis on the data set to be analyzed according to the distributed stream data processing framework and the computational parallelism to obtain the frequent itemsets.

[0090] In one embodiment of the present invention, the computation parallelism may be set by calling the setParallelism method in Flink.

[0091] After setting the computational parallelism, Flink performs parallel association analysis on the dataset to be analyzed based on the Eclat algorithm to obtain frequent item sets.

[0092] In one embodiment of the present invention, step 30 further includes:

[0093] Step 303: Determine each of the warning items as a candidate frequent 1-item set of the data set to be analyzed.

[0094] Step 304: Starting from k being 1, the candidate frequent k-item sets are screened according to the minimum support to obtain the frequent k-item sets of the alarm items; wherein k is a positive integer; the support of each candidate frequent k-item set is determined according to the length of the alarm transaction item set corresponding to the candidate frequent k-item set.

[0095] In one embodiment of the present invention, the filter operator in Flink can be called to screen candidate frequent k-item sets and delete candidate frequent k-item sets with a number of occurrences less than the minimum support to obtain a frequent k-item set. The minimum support can be 2. The length of the alarm transaction item set refers to the number of corresponding alarm transaction items.

[0096] Step 305: performing an intersection operation on the alarm transaction item set corresponding to the frequent k-item set to obtain the alarm transaction item set corresponding to the candidate frequent k+1-item set.

[0097] In one embodiment of the present invention, considering that a large number of intersection operations are required when mining frequent itemsets according to the Eclat algorithm, the Cross operator of the Flink platform can be called to increase the parallelism of the algorithm while reducing the system burden brought by the intersection operation, thereby further improving the efficiency of alarm analysis.

[0098] In one embodiment of the present invention, the union of each pair of frequent 1-itemsets obtained from the preceding steps is calculated to obtain candidate frequent 2-itemsets. Simultaneously, the intersection of each pair of corresponding alarm transaction item identifiers is calculated, and a set operation on the frequent itemsets is performed using the cross operator. The cross operator is used to construct the Cartesian product of two inputs. In Flink cluster mode, it can efficiently perform computationally intensive cross product operations, further improving the efficiency of association mining.

[0099] Step 306: iteratively update k until the frequent k+1 itemset or the candidate frequent k+1 itemset does not exist, and determine the frequent k itemset as the frequent itemset.

[0100] In one embodiment of the present invention, the Eclat algorithm adopted in steps 301-306 only needs to scan the alarm transaction item database once and obtain candidate frequent item sets through set intersection operation. Specifically, the comparison of the mining performance of frequent item sets of different algorithms in the prior art and the embodiment of the present invention can be referred to. Figure 3 .

[0101] Figure 3 The figure shows the performance comparison between the alarm analysis method provided by the embodiment of the present invention and the prior art. Figure 3 It can be seen that compared with the traditional Apriori algorithm and FP-Growth algorithm for association rule mining and the Eclat algorithm used alone, the efficiency of mining association rules based on the Flink framework and the Eclat algorithm adopted in the embodiment of the present invention is significantly improved, thereby improving the efficiency of alarm analysis.

[0102] Step 40: Determine the alarm sequence information of each alarm item in the frequent item set.

[0103] In one embodiment of the present invention, the alarm sequence information is the order in which each alarm item appears in the alarm transaction item containing it. For example, for alarm item c in the frequent item set {b, c, d}, according to Table 2, the alarm transaction items containing alarm item c are 2 and 3, while according to Table 1, the alarm sequence information of alarm item c is that it appears second in alarm transaction item 2 and first in alarm transaction item 2.

[0104] Step 50: Determine the root cause relationship of the alarm items corresponding to the frequent itemsets according to the alarm order information.

[0105] In one embodiment of the present invention, the root cause relationship of alarm items refers to the association and causal relationship between alarm items. That is, when some alarm items occur simultaneously, the occurrence of one or more alarm items causes other secondary alarm items. Because the alarm items in the alarm transaction items shown in Table 1 retain a certain degree of alarm order relationship, this provides a basis for subsequent mining of alarm root cause relationships. Therefore, based on the alarm order information, the average order of each alarm item in each frequent item set within the alarm transaction item containing it is determined. This average order is used to represent the general pattern of the alarm item's occurrence location. Based on this average order, the root cause relationship between the alarm items is analyzed.

[0106] Therefore, in yet another embodiment of the present invention, step 50 further includes:

[0107] Step 501: Determine the maximum frequent itemset among the frequent itemsets.

[0108] In one embodiment of the present invention, a frequent itemset that satisfies the non-inclusion relationship is determined as the maximum frequent itemset. That is, if all supersets of a frequent itemset L are non-frequent itemsets, then L is determined as the maximum frequent itemset. For example, the maximum frequent itemset may be {b, c, d, f, e}.

[0109] Step 502: Determine the maximum alarm transaction item set corresponding to the maximum frequent item set according to the data set to be analyzed.

[0110] In one embodiment of the present invention, based on the dataset to be analyzed as shown in Table 2, the alarm transaction items corresponding to each alarm item in the maximum frequent item set are determined, and the alarm transaction items corresponding to all alarm items are unioned to obtain the maximum alarm transaction item set. For example, based on Table 2, the maximum alarm transaction item set corresponding to {b, c, d, f, e} can be determined to be {1, 2, 3, 4}.

[0111] Step 503: Determine the average order of each alarm item in the maximum frequent item set in the maximum alarm transaction item set according to the alarm order information.

[0112] In one embodiment of the present invention, the order of occurrence of each alarm item in the maximum frequent item set within each alarm transaction item included in the maximum alarm transaction item set is determined based on the association relationship between alarm transaction items and alarm items shown in Table 1. For example, if alarm item b is associated with alarm transaction items 1 and 2 in the maximum alarm transaction item set, the average order corresponding to b is determined based on the order of b in alarm transaction items 1 and 2, respectively.

[0113] Step 504: Determine at least one candidate root alarm item and at least one candidate derived alarm item in the maximum frequent item set according to the average order.

[0114] In one embodiment of the present invention, the average order is screened according to an order threshold, and alarm items with an order greater than the order threshold are determined as candidate root alarm items and at least one candidate derived alarm item.

[0115] Therefore, in one embodiment of the present invention, step 504 further includes:

[0116] Step 5041: Determine the alarm item whose average order is greater than the order threshold as the candidate root alarm item.

[0117] Considering that an alarm is generally a root alarm that causes some related alarms, and the related alarms appear after the root alarm, the alarm that always appears first in time is more likely to be the root alarm item. Therefore, in one embodiment of the present invention, the order threshold is used to characterize the median value of the order of appearance of the alarm items. When the average order of an alarm item is greater than the order threshold, it indicates that the alarm item always appears first compared to other alarm items, and it is determined as a candidate root alarm item.

[0118] Step 5042: Determine the remaining alarm items in the maximum frequent item set as the candidate derived alarm items.

[0119] Step 505: Calculate the lift of each candidate root alarm item and each candidate derived alarm item.

[0120] In one embodiment of the present invention, lift represents the ratio of the probability of a candidate root alarm item also containing a candidate derivative alarm item to the probability of the candidate derivative alarm item occurring alone. Lift reflects the correlation between the candidate root alarm item and the candidate derivative alarm item in the association rule. A lift greater than 1 indicates a higher positive correlation, a lift less than 1 indicates a higher negative correlation, and a lift equal to 1 indicates no correlation, i.e., independence.

[0121] Therefore, in one embodiment of the present invention, step 505 further includes:

[0122] Step 5051: Determine the number of occurrences of the candidate root alarm item and the candidate derived alarm item in each alarm transaction item of the maximum alarm transaction item set.

[0123] In yet another embodiment of the present invention, when implemented based on the Flink framework, the map operator in the Flink framework may be used to respectively calculate the number of occurrences of the candidate root cause alarm item and the candidate derived alarm item.

[0124] Step 5052: Determine the number of simultaneous occurrences of the candidate root alarm item and the candidate derived alarm item according to the number of occurrences.

[0125] In one embodiment of the present invention, the number of times that the candidate root alarm item and the candidate derived alarm item appear in the same alarm transaction item is counted as the number of simultaneous occurrences.

[0126] Step 5053: Determine the degree of improvement based on the number of simultaneous occurrences and the number of occurrences of the candidate derived alarm items.

[0127] In one embodiment of the present invention, the ratio of the number of simultaneous occurrences of candidate root alarm item X and candidate root alarm item Y to the number of occurrences of candidate derived alarm item Y is determined as the lift between X and Y.

[0128] Step 506: Determine the root alarm item and the derived alarm item in the maximum frequent item set from each of the candidate root alarm items and each of the candidate derived alarm items according to the lift.

[0129] In one embodiment of the present invention, candidate root alarm items and corresponding candidate derived alarm items whose elevation is greater than a preset elevation threshold are determined as the root alarm item and the corresponding derived alarm item. The preset elevation threshold may be 1. The root alarm item is the alarm item that causes the derived alarm item.

[0130] Different from the existing technology that performs root cause analysis based on artificially formulated rules and has the problem of low alarm analysis efficiency, the alarm analysis method provided by the embodiment of the present invention extracts transaction information and performs inverted index processing on the original alarm data, then performs frequent item set mining, and then performs root cause analysis based on the alarm order information of the alarm items in the frequent item set, thereby improving the efficiency of alarm analysis.

[0131] Figure 4 FIG. 1 shows a schematic diagram of the structure of the alarm analysis device provided by an embodiment of the present invention. Figure 4As shown, the apparatus 600 includes: a first processing module 601, a second processing module 602, an analysis module 603, a first determination module 604 and a second determination module 605, wherein:

[0132] The first processing module 601 is used to process the original alarm data to obtain multiple alarm transaction items; each of the alarm transaction items includes at least one alarm item arranged in alarm time sequence;

[0133] The second processing module 602 is configured to: perform inverted indexing on the alarm transaction items according to the alarm items to obtain a data set to be analyzed;

[0134] The analysis module 603 is used to: perform association analysis on the data set to be analyzed to obtain frequent item sets;

[0135] The first determining module 604 is used to: determine the alarm order information of each alarm item in the frequent item set;

[0136] The second determining module 605 is configured to determine the root cause relationship of the alarm items corresponding to the frequent itemsets according to the alarm order information.

[0137] In an optional manner, the analysis module 603 is further configured to:

[0138] Determine each of the warning items as each candidate frequent 1-item set of the data set to be analyzed;

[0139] Starting from k being 1, the candidate frequent k-item sets are screened according to the minimum support to obtain the frequent k-item sets of the alarm items; wherein k is a positive integer; the support of each candidate frequent k-item set is determined according to the length of the alarm transaction item set corresponding to the candidate frequent k-item set;

[0140] Performing an intersection operation on the alarm transaction item set corresponding to the frequent k-item set to obtain the alarm transaction item set corresponding to the candidate frequent k+1-item set;

[0141] k is iteratively updated until the frequent k+1 item set or the candidate frequent k+1 item set does not exist, and the frequent k item set is determined as the frequent item set.

[0142] In an optional manner, the apparatus is based on a distributed stream data processing framework; the analysis module 603 is further configured to:

[0143] Determine the degree of computational parallelism;

[0144] According to the distributed stream data processing framework and the calculation parallelism, parallel association analysis is performed on the data set to be analyzed to obtain the frequent itemsets.

[0145] In an optional manner, the second determining module 605 is further configured to:

[0146] Determine the maximum frequent itemset among the frequent itemsets;

[0147] Determine a maximum set of alarm transaction items corresponding to the maximum frequent itemset according to the data set to be analyzed;

[0148] Determining the average order of each alarm item in the maximum frequent item set in the maximum alarm transaction item set according to the alarm order information;

[0149] determining, according to the average order, at least one candidate root alarm item and at least one candidate derived alarm item in the maximum frequent item set;

[0150] Calculating the improvement of each candidate root alarm item and each candidate derived alarm item;

[0151] The root alarm item and the derived alarm item in the maximum frequent item set are determined from each of the candidate root alarm items and each of the candidate derived alarm items according to the lift.

[0152] In an optional manner, the second determining module 605 is further configured to:

[0153] Determining the alarm items whose average order is greater than an order threshold as the candidate root cause alarm items;

[0154] The remaining warning items in the maximum frequent item set are determined as the candidate derived warning items.

[0155] In an optional manner, the second determining module 605 is further configured to:

[0156] respectively determining the number of occurrences of the candidate root alarm item and the candidate derived alarm item in each alarm transaction item of the maximum alarm transaction item set;

[0157] Determining the number of simultaneous occurrences of the candidate root alarm item and the candidate derived alarm item according to the number of occurrences;

[0158] The improvement is determined according to the number of simultaneous occurrences and the number of occurrences of the candidate derived alarm items.

[0159] In an optional manner, the first processing module 601 is further configured to:

[0160] Obtaining the original alarm data;

[0161] Extracting features from the original alarm data to obtain candidate alarm transaction data; the candidate alarm transaction data includes a plurality of the alarm items;

[0162] The candidate alarm transaction data is processed according to the sliding time window and the sliding step size to obtain the multiple alarm transaction items.

[0163] Different from the existing technology that performs root cause analysis based on artificially formulated rules and has the problem of low alarm analysis efficiency, the alarm analysis device provided by the embodiment of the present invention extracts transaction information and performs inverted index processing on the original alarm data, then performs frequent item set mining, and then performs root cause analysis based on the alarm order information of the alarm items in the frequent item set, thereby improving the efficiency of alarm analysis.

[0164] Figure 5 The diagram shows the structure of the alarm analysis device provided by the embodiment of the present invention. The specific embodiment of the present invention does not limit the specific implementation of the alarm analysis device.

[0165] like Figure 5 As shown, the alarm analysis device may include: a processor (processor) 702 , a communication interface (Communications Interface) 704 , a memory (memory) 706 , and a communication bus 708 .

[0166] Processor 702, communication interface 704, and memory 706 communicate with each other via communication bus 708. Communication interface 704 is used to communicate with other devices, such as clients or other server network elements. Processor 702 is used to execute program 710, which may specifically perform the steps described in the above-mentioned embodiment of the alarm analysis method.

[0167] Specifically, the program 710 may include program code including computer-executable instructions.

[0168] Processor 702 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The one or more processors included in the alarm analysis device may be processors of the same type, such as one or more CPUs, or processors of different types, such as one or more CPUs and one or more ASICs.

[0169] The memory 706 is used to store the program 710. The memory 706 may include a high-speed RAM memory, and may also include a non-volatile memory (nonvolatile memory), such as at least one disk memory.

[0170] Program 710 may be specifically called by processor 702 to enable the alarm analysis device to perform the following operations:

[0171] Processing the original alarm data to obtain a plurality of alarm transaction items; each of the alarm transaction items includes at least one alarm item arranged in alarm time sequence;

[0172] Performing inverted indexing on the alarm transaction items according to the alarm items to obtain a data set to be analyzed;

[0173] Performing association analysis on the data set to be analyzed to obtain frequent item sets;

[0174] Determining alarm sequence information of each alarm item in the frequent item set;

[0175] The root cause relationship of the alarm items corresponding to the frequent itemsets is determined according to the alarm sequence information.

[0176] In an optional manner, the program 710 is called by the processor 702 to enable the alarm analysis device to perform the following operations:

[0177] Determine each of the warning items as each candidate frequent 1-item set of the data set to be analyzed;

[0178] Starting from k being 1, the candidate frequent k-item sets are screened according to the minimum support to obtain the frequent k-item sets of the alarm items; wherein k is a positive integer; the support of each candidate frequent k-item set is determined according to the length of the alarm transaction item set corresponding to the candidate frequent k-item set;

[0179] Performing an intersection operation on the alarm transaction item set corresponding to the frequent k-item set to obtain the alarm transaction item set corresponding to the candidate frequent k+1-item set;

[0180] k is iteratively updated until the frequent k+1 item set or the candidate frequent k+1 item set does not exist, and the frequent k item set is determined as the frequent item set.

[0181] In an optional manner, the program 710 is called by the processor 702 to enable the alarm analysis device to perform the following operations:

[0182] Determine the degree of computational parallelism;

[0183] According to the distributed stream data processing framework and the calculation parallelism, parallel association analysis is performed on the data set to be analyzed to obtain the frequent itemsets.

[0184] In an optional manner, the program 710 is called by the processor 702 to enable the alarm analysis device to perform the following operations:

[0185] Determine the maximum frequent itemset among the frequent itemsets;

[0186] Determine a maximum set of alarm transaction items corresponding to the maximum frequent itemset according to the data set to be analyzed;

[0187] Determining the average order of each alarm item in the maximum frequent item set in the maximum alarm transaction item set according to the alarm order information;

[0188] determining, according to the average order, at least one candidate root alarm item and at least one candidate derived alarm item in the maximum frequent item set;

[0189] Calculating the improvement of each candidate root alarm item and each candidate derived alarm item;

[0190] The root alarm item and the derived alarm item in the maximum frequent item set are determined from each of the candidate root alarm items and each of the candidate derived alarm items according to the lift.

[0191] In an optional manner, the program 710 is called by the processor 702 to enable the alarm analysis device to perform the following operations:

[0192] Determining the alarm items whose average order is greater than an order threshold as the candidate root cause alarm items;

[0193] The remaining warning items in the maximum frequent item set are determined as the candidate derived warning items.

[0194] In an optional manner, the program 710 is called by the processor 702 to enable the alarm analysis device to perform the following operations:

[0195] respectively determining the number of occurrences of the candidate root alarm item and the candidate derived alarm item in each alarm transaction item of the maximum alarm transaction item set;

[0196] Determining the number of simultaneous occurrences of the candidate root alarm item and the candidate derived alarm item according to the number of occurrences;

[0197] The improvement is determined according to the number of simultaneous occurrences and the number of occurrences of the candidate derived alarm items.

[0198] In an optional manner, the program 710 is called by the processor 702 to enable the alarm analysis device to perform the following operations:

[0199] Obtaining the original alarm data;

[0200] Extracting features from the original alarm data to obtain candidate alarm transaction data; the candidate alarm transaction data includes a plurality of the alarm items;

[0201] The candidate alarm transaction data is processed according to the sliding time window and the sliding step size to obtain the multiple alarm transaction items.

[0202] Different from the existing technology that performs root cause analysis based on artificially formulated rules and has the problem of low alarm analysis efficiency, the alarm analysis device provided by the embodiment of the present invention extracts transaction information and performs inverted index processing on the original alarm data, then performs frequent item set mining, and then performs root cause analysis based on the alarm order information of the alarm items in the frequent item set, thereby improving the efficiency of alarm analysis.

[0203] An embodiment of the present invention provides a computer-readable storage medium storing at least one executable instruction. When the executable instruction is executed on an alarm analysis device, the alarm analysis device executes the alarm analysis method in any of the above method embodiments.

[0204] The executable instructions can be used to enable the alarm analysis device to perform the following operations:

[0205] Processing the original alarm data to obtain a plurality of alarm transaction items; each of the alarm transaction items includes at least one alarm item arranged in alarm time sequence;

[0206] Performing inverted indexing on the alarm transaction items according to the alarm items to obtain a data set to be analyzed;

[0207] Performing association analysis on the data set to be analyzed to obtain frequent item sets;

[0208] Determining alarm sequence information of each alarm item in the frequent item set;

[0209] The root cause relationship of the alarm items corresponding to the frequent itemsets is determined according to the alarm sequence information.

[0210] In an optional manner, the executable instruction causes the alarm analysis device to perform the following operations:

[0211] Determine each of the warning items as each candidate frequent 1-item set of the data set to be analyzed;

[0212] Starting from k being 1, the candidate frequent k-item sets are screened according to the minimum support to obtain the frequent k-item sets of the alarm items; wherein k is a positive integer; the support of each candidate frequent k-item set is determined according to the length of the alarm transaction item set corresponding to the candidate frequent k-item set;

[0213] Performing an intersection operation on the alarm transaction item set corresponding to the frequent k-item set to obtain the alarm transaction item set corresponding to the candidate frequent k+1-item set;

[0214] k is iteratively updated until the frequent k+1 item set or the candidate frequent k+1 item set does not exist, and the frequent k item set is determined as the frequent item set.

[0215] In an optional manner, the executable instruction causes the alarm analysis device to perform the following operations:

[0216] Determine the degree of computational parallelism;

[0217] According to the distributed stream data processing framework and the calculation parallelism, parallel association analysis is performed on the data set to be analyzed to obtain the frequent itemsets.

[0218] In an optional manner, the executable instruction causes the alarm analysis device to perform the following operations:

[0219] Determine the maximum frequent itemset among the frequent itemsets;

[0220] Determine a maximum set of alarm transaction items corresponding to the maximum frequent itemset according to the data set to be analyzed;

[0221] Determining the average order of each alarm item in the maximum frequent item set in the maximum alarm transaction item set according to the alarm order information;

[0222] determining, according to the average order, at least one candidate root alarm item and at least one candidate derived alarm item in the maximum frequent item set;

[0223] Calculating the improvement of each candidate root alarm item and each candidate derived alarm item;

[0224] The root alarm item and the derived alarm item in the maximum frequent item set are determined from each of the candidate root alarm items and each of the candidate derived alarm items according to the lift.

[0225] In an optional manner, the executable instruction causes the alarm analysis device to perform the following operations:

[0226] Determining the alarm items whose average order is greater than an order threshold as the candidate root cause alarm items;

[0227] The remaining warning items in the maximum frequent item set are determined as the candidate derived warning items.

[0228] In an optional manner, the executable instruction causes the alarm analysis device to perform the following operations:

[0229] respectively determining the number of occurrences of the candidate root alarm item and the candidate derived alarm item in each alarm transaction item of the maximum alarm transaction item set;

[0230] Determining the number of simultaneous occurrences of the candidate root alarm item and the candidate derived alarm item according to the number of occurrences;

[0231] The improvement is determined according to the number of simultaneous occurrences and the number of occurrences of the candidate derived alarm items.

[0232] In an optional manner, the executable instruction causes the alarm analysis device to perform the following operations:

[0233] Obtaining the original alarm data;

[0234] Extracting features from the original alarm data to obtain candidate alarm transaction data; the candidate alarm transaction data includes a plurality of the alarm items;

[0235] The candidate alarm transaction data is processed according to the sliding time window and the sliding step size to obtain the multiple alarm transaction items.

[0236] Different from the existing technology that performs root cause analysis based on manually formulated rules and has the problem of low alarm analysis efficiency, the computer storage medium provided by the embodiment of the present invention extracts transaction information and performs inverted index processing on the original alarm data, then performs frequent item set mining, and then performs root cause analysis based on the alarm order information of the alarm items in the frequent item set, thereby improving the efficiency of alarm analysis.

[0237] An embodiment of the present invention provides an alarm analysis device for executing the above-mentioned alarm analysis method.

[0238] An embodiment of the present invention provides a computer program, which can be called by a processor to enable an alarm analysis device to execute the alarm analysis method in any of the above method embodiments.

[0239] An embodiment of the present invention provides a computer program product, which includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are run on a computer, the computer executes the alarm analysis method in any of the above method embodiments.

[0240] The algorithm or demonstration provided herein are not inherently relevant to any particular computer, virtual system or other equipment. Various general-purpose systems may also be used together with the teachings based on this. According to the above description, it is apparent that the structure required for constructing this type of system. In addition, the embodiment of the present invention is not directed to any specific programming language yet. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0241] In the description provided herein, numerous specific details are described. However, it is understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0242] Similarly, it should be understood that in order to streamline the present invention and facilitate understanding of one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the embodiments of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this method of disclosure should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim.

[0243] Those skilled in the art will appreciate that the modules in the devices in the embodiments can be adaptively changed and set in one or more devices different from the embodiments. The modules or units or components in the embodiments can be combined into one module or unit or component, and can be divided into multiple sub-modules or sub-units or sub-components. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed so far can be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) can be replaced by an alternative feature that provides the same, equivalent or similar purpose.

[0244] It should be noted that the above embodiments illustrate rather than limit the invention, and that alternative embodiments may be devised by a person skilled in the art without departing from the scope of the appended claims. In the claims, any reference signs placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising several different elements and by means of appropriately programmed computers. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments should not be understood as limiting the order of execution unless otherwise specified.

Claims

1. An alarm analysis method, characterized in that: The method comprises: Processing the original alarm data to obtain a plurality of alarm transaction items; each of the alarm transaction items includes at least one alarm item arranged in alarm time sequence; Performing inverted indexing on the alarm transaction items according to the alarm items to obtain a data set to be analyzed; Performing association analysis on the data set to be analyzed to obtain frequent item sets; Determining alarm sequence information of each alarm item in the frequent item set; Determine the root cause relationship of the alarm items corresponding to the frequent item sets according to the alarm order information; wherein, determine the average order of each alarm item in each frequent item set in the alarm transaction item containing it according to the alarm order information, and analyze the root cause relationship between each alarm item according to the average order.

2. The method according to claim 1, characterized in that The performing association analysis on the data set to be analyzed to obtain frequent item sets includes: Determine each of the warning items as a candidate frequent 1-item set of the data set to be analyzed; Starting from k being 1, the candidate frequent k-item sets are screened according to the minimum support to obtain the frequent k-item sets of the alarm items; wherein k is a positive integer; the support of each candidate frequent k-item set is determined according to the length of the alarm transaction item set corresponding to the candidate frequent k-item set; Performing an intersection operation on the alarm transaction item set corresponding to the frequent k-item set to obtain the alarm transaction item set corresponding to the candidate frequent k+1-item set; k is iteratively updated until the frequent k+1 item set or the candidate frequent k+1 item set does not exist, and the frequent k item set is determined as the frequent item set.

3. The method according to claim 1, characterized in that The method is based on a distributed stream data processing framework; performing association analysis on the data set to be analyzed to obtain frequent itemsets includes: Determine the degree of computational parallelism; According to the distributed stream data processing framework and the calculation parallelism, parallel association analysis is performed on the data set to be analyzed to obtain the frequent itemsets.

4. The method according to claim 1, wherein The determining, according to the alarm order information, the root cause relationship of the alarm items corresponding to the frequent itemsets includes: Determine the maximum frequent itemset among the frequent itemsets; Determine a maximum set of alarm transaction items corresponding to the maximum frequent itemset according to the data set to be analyzed; Determining the average order of each alarm item in the maximum frequent item set in the maximum alarm transaction item set according to the alarm order information; determining, according to the average order, at least one candidate root alarm item and at least one candidate derived alarm item in the maximum frequent item set; Calculating the improvement of each candidate root alarm item and each candidate derived alarm item; The root alarm item and the derived alarm item in the maximum frequent item set are determined from each of the candidate root alarm items and each of the candidate derived alarm items according to the lift.

5. The method according to claim 4, characterized in that The step of determining, according to the average order, candidate root cause alarm items and candidate derived alarm items in the maximum frequent item set includes: Determining the alarm items whose average order is greater than an order threshold as the candidate root cause alarm items; The remaining warning items in the maximum frequent item set are determined as the candidate derived warning items.

6. The method according to claim 4, characterized in that The calculating of the improvement degree of each candidate root alarm item and each candidate derived alarm item includes: respectively determining the number of occurrences of the candidate root alarm item and the candidate derived alarm item in each alarm transaction item of the maximum alarm transaction item set; Determining the number of simultaneous occurrences of the candidate root alarm item and the candidate derived alarm item according to the number of occurrences; The improvement is determined according to the number of simultaneous occurrences and the number of occurrences of the candidate derived alarm items.

7. The method according to claim 1, characterized in that The original alarm data is processed to obtain multiple alarm transaction items; including: Obtaining the original alarm data; Extracting features from the original alarm data to obtain candidate alarm transaction data; the candidate alarm transaction data includes a plurality of the alarm items; The candidate alarm transaction data is processed according to the sliding time window and the sliding step size to obtain the multiple alarm transaction items.

8. An alarm analysis device, characterized in that: The device comprises: A first processing module is configured to process the original alarm data to obtain a plurality of alarm transaction items; each of the alarm transaction items includes at least one alarm item arranged in alarm time sequence; A second processing module is configured to perform inverted indexing on the alarm transaction items according to the alarm items to obtain a data set to be analyzed; An analysis module, configured to perform association analysis on the data set to be analyzed to obtain frequent itemsets; A first determining module, configured to determine the alarm order information of each alarm item in the frequent item set; The second determination module is used to determine the root cause relationship of the alarm items corresponding to the frequent item sets according to the alarm order information; wherein, the average order of each alarm item in each frequent item set in the alarm transaction item containing it is determined according to the alarm order information, and the root cause relationship between each alarm item is analyzed according to the average order.

9. An alarm analysis device, characterized in that: include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform the operation of the alarm analysis method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The storage medium stores at least one executable instruction. When the executable instruction is executed on the alarm analysis device, the alarm analysis device performs the operation of the alarm analysis method according to any one of claims 1 to 7.

Images