Alarm association rule mining method and system, computer device and storage medium

Abstract

The application provides a kind of alarm association rule mining method, system, computer device and storage medium, it is related to data analysis processing field, the method comprises: by fusing resource relationship diagram and pre-stored alarm data to construct cross-domain alarm association analysis knowledge graph;Triplets are extracted from the knowledge graph to generate question and answer pair training samples;Association rule learning is carried out based on RNNLogic algorithm reinforced by graph neural network, and the final association rule is generated;Output the association rule with reasoning path explanation in the final association rule;Get new alarm data, filter the sub-knowledge graph and the final association rule related to the new alarm data, generate a weighted rule tree to reason the root alarm.The technical scheme provided by the application realizes alarm association by using knowledge graph, improves the explainability of the rule by using the rule mining algorithm with reasoning path, and solves the cross-domain knowledge representation problem by using graph neural network.

Description

Technical Field

[0001] This invention relates to the field of data analysis and processing, and in particular to an alarm association rule mining method, an alarm association rule mining system, a computer device, and a computer-readable storage medium. Background Technology

[0002] With the cloud-based deployment of cloud network platforms, the business application layer and physical resource layer are completely decoupled. Software-defined network elements run on common physical resources (including servers, storage, switches, etc.). During cloud network platform operation and maintenance, these physical resources are often shared by numerous network elements. These elements generate a large number of alarms daily, leading to unclear fault points and making cross-domain fault location difficult and time-consuming. However, cloud deployment technology, through necessary software programming, also brings new opportunities for intelligent network operation and maintenance. Operators can combine cutting-edge artificial intelligence technologies to achieve data mining, addressing the cross-domain troubleshooting challenges of cloud network platforms, thereby more flexibly and accurately identifying important root alarms (source alarms) from massive alarm data.

[0003] Previously, the industry primarily used traditional data mining algorithms based on Apriori or FP-growth for alarm correlation analysis. These algorithms aim to discover frequent alarm itemsets with support and confidence scores both exceeding a support threshold and a confidence threshold, and then generate alarm correlation rules based on these. However, due to the uneven distribution of alarms across different domains, these methods face challenges such as difficulty in setting thresholds and unclear transaction itemset partitioning, resulting in poor rule effectiveness. Current research introduces topological models as filtering conditions to optimize transaction itemset partitioning and rule generation, but the interpretability of the correlation rules still needs further improvement. Summary of the Invention

[0004] This invention was completed to at least partially solve the technical problems existing in the prior art, such as parameter sensitivity of frequent itemsets, poor rule interpretability, and inability to achieve complex cross-domain alarm correlation analysis.

[0005] According to one aspect of the present invention, an alarm association rule mining method is provided, the method comprising the following steps: S1, constructing a cross-domain alarm association analysis knowledge graph by fusing a resource relationship graph and pre-stored alarm data to generate triples, wherein the triples are denoted as (h, r, t), where h is the head entity, t is the tail entity, and r is the relation; S2, randomly extracting triples from the cross-domain alarm association analysis knowledge graph to generate question-answer pair training samples, wherein the query of the question-answer pair training samples is denoted as q = (h, r, ?), and the answer is denoted as a = t; S3, performing association rule learning on the knowledge question-answer pair training samples based on the RNNLogic algorithm reinforced by the graph neural network RGCN, and generating final association rules; S4, outputting explanatory association rules with reasoning path explanations in the final association rules; S5, acquiring new alarm data, filtering the cross-domain alarm association analysis sub-knowledge graph and final association rules related to the new alarm data, and generating a weighted rule tree for root alarm reasoning.

[0006] Optionally, in step S1: the triple includes resource relationships. Figure 3 The resource relationship consists of a tuple, an alarm data triple, and an alarm title triple. Figure 3 Tuples are generated based on the resource relationship graph, where the resource relationship... Figure 3 The head and tail entities in the tuple include service, cluster, physical machine, and logical host, respectively, and the resource relationships are... Figure 3 The relationships in the tuple include deployment, containment, ownership, and connection; the alarm data triple is generated based on the pre-stored alarm data and includes the following triples: alarm title-resource name-resource name value, alarm title-belonging business-business system, alarm title-originating region-regional center, and alarm title-belonging center-data center; the alarm title triple is generated as follows: the pre-stored alarm data is sorted in ascending order according to the alarm occurrence time, and another alarm in the pre-stored alarm data that is topologically connected to each alarm within two hops of that alarm is found, generating an alarm title-relationship-another alarm title triple; and the triple also includes the relationship with the resource. Figure 3 The relationship between the tuple, the alarm data triple, and the alarm title triple is a reverse triple, which is denoted as (h, r). -1 ,t), where r -1 It is an inverse relationship.

[0007] Optionally, the resource relationship graph is constructed using topological information.

[0008] Optionally, step S3 includes the following steps: S31. For each of the question-answer pair training samples, based on the query q = (h, r, ...), use a rule generator to generate association rules for answering the query; S32. Input the association rules into the causal inferencer to obtain candidate answers to the query and calculate the candidate answer scores of the candidate answers, and update the causal inferencer to obtain an updated causal inferencer; S33. Calculate the association rule score of each association rule based on the candidate answer scores, select K association rules from the association rules in descending order of the association rule scores, and update the rule generator using the K association rules to obtain an updated rule generator, where K is a positive integer, and the value of K ranges from 5 to 15 times the number of types of relations in the triplet; S34. Use the updated rule generator to generate new association rules, input the new association rules into the updated causal inferencer, and repeat steps S31 and S33 to obtain the final association rule, denoted as h→. r t.

[0009] Optionally, in step S31, the association rules are generated using a recurrent neural network LSTM.

[0010] Optionally, in step S32, the candidate answer score includes a rule score and a graph representation score, wherein the graph representation score is calculated based on the graph neural network RGCN.

[0011] Optionally, in step S4, the relationship of "causing" or "causing" is selected from the final association rules. -1 (i.e., the resulting inverse relationship), co-occurrence, and co-occurrence -1 The explanatory association rules are obtained by taking all association rules and their corresponding association rule scores for (i.e., the inverse relationship of co-occurrence).

[0012] Optionally, step S5 includes the following steps: S51, based on the new alarm data, filter out the final association rule h→ rS52. Based on the cross-domain alarm association analysis knowledge graph, using the alarm titles h and t of the new alarm data as initial nodes, insert edges between the initial nodes and the corresponding device names, services, and region nodes. Then, expand the corresponding neighbor nodes for the device names, services, and region nodes according to the relation names involved in the sub-association rules to obtain the cross-domain alarm association analysis sub-knowledge graph. S53. Take the number of paths that can be derived from h to t according to the sub-association rules on the cross-domain alarm association analysis sub-knowledge graph as the hit count of the sub-association rules, and calculate the sub-association rule h→ based on the hit count. r S54. Draw the alarm relationship to obtain the rule tree. The alarm with an in-degree of 0 in the rule tree is the root alarm, and the weighted out-degree of the root alarm is used as the weight of the root alarm.

[0013] According to another aspect of the present invention, an alarm association rule mining system is provided. The system includes: a cross-domain alarm association analysis knowledge graph construction module, which constructs a cross-domain alarm association analysis knowledge graph by fusing a resource relationship graph and pre-stored alarm data to generate triples, wherein the triples are denoted as (h, r, t), where h is the head entity, t is the tail entity, and r is a relation; and a question-answer pair training sample generation module, which randomly extracts triples from the cross-domain alarm association analysis knowledge graph to generate question-answer pair training samples, wherein the query of the question-answer pair training sample is denoted as q = (h, r, ?, and the answer...). Let a = t; the association rule learning module, which uses the RNNLogic algorithm reinforced by the graph neural network RGCN to learn association rules on the training samples for the knowledge question answering and generates the final association rules; the explanatory association rule output module, which outputs the explanatory association rules with inference path explanations in the final association rules; and the root alarm location module (root alarm location module), which, based on the acquired new alarm data, filters the cross-domain alarm association analysis sub-knowledge graph and the final association rules related to the new alarm data, and generates a weighted rule tree for root alarm inference.

[0014] According to another aspect of the present invention, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the aforementioned alarm association rule mining method.

[0015] According to another aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, wherein when the computer program is executed by a processor, the processor performs the aforementioned alarm association rule mining method.

[0016] The technical solution provided by this invention may include the following beneficial effects:

[0017] The alarm association rule mining method provided by this invention adopts emerging knowledge graph technology to fuse alarm data with resource knowledge to obtain a fault knowledge graph. It can fully leverage the natural graph structure advantages of the IT / CT industry. At the same time, it proposes a cross-domain alarm association method by combining graph neural network graph representation and RNNLogic-based graph rule learning, realizing alarm association rule mining with reasoning paths, improving the interpretability and structural flexibility of rules, and achieving the goal of improving the efficiency and accuracy of alarm root cause analysis.

[0018] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the description, claims, and drawings. Attached Figure Description

[0019] The accompanying drawings are provided to further understand the technical solutions of the present invention and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the technical solutions of the present invention, and do not constitute a limitation on the technical solutions of the present invention.

[0020] Figure 1 A schematic diagram of a resource relationship diagram provided in an embodiment of the present invention;

[0021] Figure 2 A flowchart illustrating the alarm association rule mining method provided in an embodiment of the present invention;

[0022] Figure 3 This is a schematic diagram of the alarm association rule mining system provided in an embodiment of the present invention;

[0023] Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the specific implementation methods of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific implementation methods described herein are for illustration and explanation only and are not intended to limit the present invention.

[0025] The cloud network platform's business systems are deployed on a resource pool. Linking resource pool alarms with professional network management alarms constitutes cross-domain association. The resource types that generate alarms can include switches, routers, physical machines, logical hosts, storage, services, clusters, services, processes, databases, middleware, etc. Resource data can include resource name, network address, function identifier, topology information, etc. Common business resource relationship diagrams (i.e., resource relationship diagrams) are as follows: Figure 1 As shown, it can be constructed using topology information. Alarm data may include alarm serial number, alarm title, alarm type, occurrence time, alarm level, occurrence count, business system, resource name, object IP, and region.

[0026] refer to Figure 2 This invention provides a method for mining alarm association rules, more specifically, an intelligent cloud network cross-domain alarm association rule mining method based on knowledge graphs. The method may include the following steps: S1, constructing a cross-domain alarm association analysis knowledge graph by fusing resource relationship graphs (resource association graph data) and pre-stored alarm data to generate triples. The triples are denoted as (h, r, t), where h is the head entity, t is the tail entity, and r is the relation (i.e., establishing a cross-domain alarm association analysis knowledge graph); S2, randomly selecting triples from the cross-domain alarm association analysis knowledge graph to generate question-answer pair training samples. The query of the question-answer pair training sample is denoted as q = (h, r, ?), and the answer is denoted as... a = t (i.e., generating knowledge question-answer pair training samples); S3, using the RNNLogic algorithm enhanced by Graph Neural Network RGCN to learn association rules for the knowledge question-answer pair training samples and generate the final association rules (i.e., association rule learning based on RNNLogic improved by RGCN); S4, outputting explanatory association rules with reasoning path explanations in the final association rules (i.e., outputting explanatory alarm association rules); S5, acquiring new alarm data, filtering the cross-domain alarm association analysis sub-knowledge graph and final association rules related to the new alarm data, and generating a weighted rule tree for root alarm reasoning (i.e., weighted root alarm localization).

[0027] The following is a detailed description of each of the above steps.

[0028] Establish a knowledge graph for cross-domain alarm correlation analysis (S1)

[0029] In step S1, the triple includes resource relationships. Figure 3 Tuples, alarm data triples, and alarm title triples.

[0030] Resource relationships Figure 3 Tuples are generated based on resource relationship graphs, resource relationships Figure 3 The head and tail entities in the tuple include business, cluster, physical machine, and logical host, respectively, and resource relationships. Figure 3The relationships within a tuple include deployment, containment, ownership, and connection. In other words, resource relationships. Figure 3 Tuples can be triples consisting of a "head entity (e.g., business, cluster, physical machine, logical host, etc.) - relationship (e.g., deployment, containment, ownership, connection, etc.) - tail entity (e.g., business, cluster, physical machine, logical host, etc.)". It should be understood that resource relationships... Figure 3 Tuples are not limited to the triples mentioned above, but may include other triples suitable for resource relationship graphs.

[0031] Alarm data triples are generated based on pre-stored alarm data and include the following triples: alarm title (header entity) - resource name (relationship) - resource name value (tail entity), alarm title - business - business system, alarm title - region - regional center, and alarm title - center - data center. It should be understood that alarm data triples are not limited to the above triples and may include other triples suitable for alarm data.

[0032] Alarm title triples are generated as follows: Pre-stored alarm data is sorted in ascending order of alarm occurrence time. For each alarm in the pre-stored alarm data, another alarm topologically connected within two hops of that alarm is found, generating a triple of "alarm title - relation - other alarm title". For example, sorting alarm data in ascending order of "alarm occurrence time", for each alarm A, searching backwards (e.g., up to 10 alarms) for alarm B topologically connected within two hops of alarm A, generating triples such as "alarm title of alarm A - causing - alarm title of alarm B", "alarm title of alarm A - co-occurrence - alarm title of alarm B", etc. Here, the topological connection can be obtained based on the topological information included in the resource relationship graph.

[0033] To enhance the training dataset, the above triples also include resource relationships. Figure 3 The relationships between the tuple, alarm data triple, and alarm title triple are inverse triples, denoted as (h, r). -1 ,t), where r -1 This is the inverse relation. For example, the inverse relation of "cause" can be represented as "cause". -1 Furthermore, the relation "co-occurrence" can be represented as "co-occurrence". -1 ".

[0034] A cross-domain alarm correlation analysis (or root cause analysis) knowledge graph is constructed from all training triples, denoted as .

[0035] Generate training samples for knowledge question-answering pairs (S2)

[0036] In step S2, the knowledge graph of cross-domain alarm association analysis is used. Randomly select triples (h, r, t) to form corresponding question-answering training samples. This is a knowledge graph for alarm associations that does not contain (h,r,t).

[0037] Association rule learning based on RGCN-improved RNNLogic (S3)

[0038] The knowledge reasoning algorithm RNNLogic is enhanced by leveraging the strong representational power of multi-relation graph convolutional neural network (RGCN) algorithm for graph data, thereby achieving interpretable logical rule learning. Specifically, this includes the following steps S31 to S34.

[0039] S31. For each of the question-answer pair training samples, based on the query q = (h, r, ?), use the rule generator p θ Generate association rules to answer the query.

[0040] More specifically, for each sample, the rule generator p is used. θ Generate rule set The combination rule is r←r1∧…∧r. l View as a relation sequence [r, r1, ..., r1, r END Here, N represents the number of rules.

[0041] N rules (association rules or logical rules) can be generated using the following recurrent neural network LSTM (Long Short-Term Memory) method:

[0042] (1) Initialize the hidden state:

[0043] h0=f(v r )

[0044] Among them, v r Let r be the parameter vector, f be the linear transformation, and h0 be the initial vector of r.

[0045] (2) Calculate the subsequent hidden state using LSTM:

[0046] h t =LSTM(h t-1 ,g([v r ,v rt ])

[0047] Among them, v rt It is r t The relevant parameter vector, g is a linear transformation, and [] denotes merging.

[0048] (3) Based on h t+1 r is generated according to the following formula. t+1

[0049] softmax(o(h t+1 ))

[0050] Where o is a linear transformation, transforming h t+1 Transform into dimensional vector, Given a set of relations, softmax is used to obtain the probability of each relation. Finally, r is generated based on the probability vector. t+1 .

[0051] S32. Input the association rules generated in step S31 into the causal inference engine p. ω The query retrieves candidate answers and calculates their scores. ω (e) and update the causal inferencer to obtain the updated causal inferencer.

[0052] More specifically, for each sample, based on the rule set Update causal inferencer p ω This maximizes the following expression:

[0053]

[0054] in, It is a set of logical rules generated by the rule generator. Given a query q = (h, r, ?), let... yes The set of candidate answers obtainable by the rules. For each candidate answer... The score for the candidate answer is calculated from both the rule score and the graph representation score. ω (e:

[0055]

[0056] Among them, v rule It is the representation vector of each rule. It represents the number of paths from h to e according to the rule. AGG is a PNA aggregator that will... Aggregation weights are used for aggregation. v in all rules rule The aggregation rule ratio representation vector is mapped to the rule score term 'e' using an MLP. Based on the graph neural network RGCN model, the graph representation score term RGCN(h,r,e) is calculated, where η is the weight of the graph score term.

[0057] Calculate the probability that e is the answer. And maximize the true value of each sample Probability is used to update the causal inference engine.

[0058]

[0059] S33. Update the rule generator p using the updated causal inference engine. θ Specifically, based on the candidate answer scores, an association rule score H(rule) is calculated for each association rule. K association rules are selected from the association rules in descending order of their association rule scores. These K association rules are then used to update the rule generator, resulting in an updated rule generator. Here, K is a positive integer, and its value is preferably 5 to 15 times the number of types of relation r in the triplet. This step is described in more detail below.

[0060] (1) From Select K high-quality rules to form a set. The probability of choosing each rule is:

[0061]

[0062] in

[0063]

[0064] yes The set of candidate answers obtainable by the rules, score ω (e|rule is the score of candidate answer e, RNN) θ (rule|r) is the prior probability of the rule rule generated from the query relation r.

[0065] (2) According to the high-quality rules Update rule generator p θ θ makes the following equation maximum:

[0066]

[0067] S34. Using the updated rule generator, generate new association rules. Input the new association rules into the updated causal inference engine. Repeat steps S31 and S33 above, iterating through the association rules until the final association rule is obtained. The final association rule is denoted as h→. r t.

[0068] Output alarm association rules with explanations (S4)

[0069] In step S4, the relationships "cause" and "cause" are filtered from the final association rules. -1 Co-occurrence and co-occurrence -1 We obtain interpretive association rules by analyzing all association rules and their corresponding scores.

[0070] More specifically, filter out relationships that are "cause" or "cause". -1"or co-occurrence" or "co-occurrence" -1 All rules R = {rule = r, r1, ..., r} l} and its existing score H(rule) for each rule, resulting in rules with inference path explanations, as shown in the table below:

[0071] Rule.left(relationship) Rule.right (explanation) Score Example: h → causes t <![CDATA[h → Device Name P → Deployment Q → Device Name -1 > 0.8

[0072] Weighted root alarm location (S5)

[0073] Step S5 includes the following steps:

[0074] S51. Filtering Rules: Based on the new alarm data, filter out the final correlation rule h→ r In t, h and t refer to all sub-association rules of the alarm title in the new alarm data and their association rule scores H(rule).

[0075] In other words, let the newly input alarm dataset M = {m} j |1≤j≤|M|}, select h,t∈{m j The set of all rules (i.e., association rules) for the alert title |1≤j≤|M|} is R={rule=r,r1,…,r l} and the existing score H(rule) of each rule.

[0076] S52. Extracting the sub-knowledge graph (cross-domain alarm association analysis sub-knowledge graph): Based on the cross-domain alarm association analysis knowledge graph, with the alarm titles h and t of the new alarm data as the initial nodes, insert edges between the initial nodes and the corresponding device names, services, and region nodes. Then, according to the relationship names involved in the sub-association rules, expand the corresponding neighbor nodes for the device names, services, and region nodes to obtain the cross-domain alarm association analysis sub-knowledge graph.

[0077] In other words, based on the cross-domain alarm association knowledge graph Using the newly collected alarm titles h,t as initial nodes, edges are inserted between the alarm title nodes and the corresponding device names, services, and region nodes. Then, based on the relationship names involved in the selected rules (e.g., r1,…,r…),… l Expand the corresponding neighbor nodes for device name, service, and region node to obtain a sub-graph.

[0078] When generating a subgraph, the explanatory association rules with inference path explanations generated in step S4 can be used to expand the corresponding nodes.

[0079] S53. Determine the rule hit count and calculate the weight: The number of paths from h to t on the cross-domain alarm association analysis sub-knowledge graph according to the sub-association rule is taken as the hit count of the sub-association rule, and the sub-association rule h→ is calculated based on the hit count. r The weight of t.

[0080] In other words, the sub-graph The number of paths from rule h to t is taken as the hit count of the rule, denoted as . Then, calculate h according to the following formula → r Weight of t:

[0081]

[0082] S54. Root Alarm Location: Draw alarm relationships (e.g., according to → r Sequence, → r-1 (Draw these alarm relationships in reverse order) to obtain a rule tree. The alarm with an in-degree of 0 in the rule tree is the root alarm, and the weighted out-degree of the root alarm is used as the weight of the root alarm.

[0083] See Figure 3 The present invention also provides an alarm association rule mining system 10, which includes: a cross-domain alarm association analysis knowledge graph construction module 11, which constructs a cross-domain alarm association analysis knowledge graph by integrating resource relationship graphs and pre-stored alarm data and generating triples, wherein the triples are denoted as (h, r, t), where h is the head entity, t is the tail entity and r is the relation; and a question-answer pair training sample generation module 12, which randomly extracts triples from the cross-domain alarm association analysis knowledge graph to generate question-answer pair training samples, wherein the query of the question-answer pair training sample is denoted as q = (h, r, ?, and the answer is...). The case is denoted as a = t; the association rule learning module 13, which uses the RNNLogic algorithm reinforced by the graph neural network RGCN to learn association rules on the training samples for knowledge question answering and generates the final association rules; the explanatory association rule output module 14, which outputs explanatory association rules with inference path explanations in the final association rules; and the root cause alarm location module 15, which, based on the acquired new alarm data, filters the cross-domain alarm association analysis sub-knowledge graph and the final association rules related to the new alarm data, and generates a weighted rule tree for root alarm inference.

[0084] Based on the same technical concept, this embodiment of the invention also provides a computer device 20, such as... Figure 4 As shown, the computer device 20 includes a memory 21 and a processor 22. The memory 21 stores a computer program. When the processor 22 runs the computer program stored in the memory 21, the processor 22 executes the aforementioned alarm association rule mining method.

[0085] Based on the same technical concept, the present invention also provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, the processor executes the aforementioned alarm association rule mining method.

[0086] In summary, the alarm association rule mining method, system, computer equipment, and storage medium provided in this invention can be used in cross-domain alarm root cause analysis scenarios such as cloud network resource pools, communication networks, and services. It effectively realizes alarm association rule mining with inference paths, improving the interpretability and structural flexibility of rules, thereby enhancing the efficiency and accuracy of alarm root cause analysis. By combining historical alarm data with a multi-layer topology model to establish a cross-domain root alarm association analysis knowledge graph, the goal of cross-domain knowledge fusion is achieved. In the knowledge graph-based inference algorithm RNNLogic, graph neural network technology is innovatively introduced to improve the graph element representation of the RNNLogic algorithm, thereby improving the quality of the generated rules. The improved RNNLogic algorithm is used to mine rules from the cross-domain graph, improving the interpretability of association rules. During real-time alarm data association analysis, a rule tree with graph path weights can be generated for root alarm inference, improving the reliability of root alarm location.

[0087] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0088] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for mining alarm association rules, characterized in that, Includes the following steps: S1. By integrating the resource relationship graph and the pre-stored alarm data, triples are generated to construct a cross-domain alarm association analysis knowledge graph. The triples are denoted as (h, r, t), where h is the head entity, t is the tail entity, and r is the relation. S2. Randomly extract triples from the cross-domain alarm association analysis knowledge graph to generate question-answer pair training samples. The query of the question-answer pair training sample is denoted as q = (h, r, ?), and the answer is denoted as a = t. S3. The RNNLogic algorithm based on the graph neural network RGCN reinforcement learns association rules for the training samples of the question and answer, and generates the final association rules. S4. Output the explanatory association rules with reasoning path explanations from the final association rules, wherein the explanatory association rules are selected from the final association rules by filtering out relations of cause, cause- 1 Co-occurrence and co-occurrence- 1 The association rules and their corresponding association rule scores are obtained by referring to the cause and the cause- 1 The relationship is inverse and the co-occurrence and the co-occurrence- 1 It is an inverse relationship; S5. Obtain new alarm data, filter the cross-domain alarm association analysis sub-knowledge graph and final association rules related to the new alarm data, and generate a weighted rule tree for root alarm reasoning.

2. The alarm association rule mining method according to claim 1, characterized in that, In step S1: The triplet includes a resource relationship graph triplet, an alarm data triplet, and an alarm title triplet. The resource relationship graph triples are generated based on the resource relationship graph. The head entity and tail entity in the resource relationship graph triples include business, cluster, physical machine, and logical host, respectively. The relationships in the resource relationship graph triples include deployment, containment, ownership, and connection. The alarm data triplet is generated based on the pre-stored alarm data and includes the following triplets: alarm title-resource name-resource name value, alarm title-belonging business-business system, alarm title-belonging region-regional center, and alarm title-belonging center-data center; The alarm title triplet is generated as follows: The pre-stored alarm data is sorted in ascending order of alarm occurrence time; for each alarm in the pre-stored alarm data, another alarm topologically connected to that alarm within two hops is found; and an alarm title-relationship-other alarm title triplet is generated. The triplet also includes a reverse triplet whose relationship with each of the resource relationship graph triplet, the alarm data triplet, and the alarm title triplet is the inverse of that relationship. The reverse triplet is denoted as (h, r). -1 ,t), where r -1 It is an inverse relationship.

3. The alarm association rule mining method according to claim 1 or 2, characterized in that, The resource relationship diagram is constructed using topological information.

4. The alarm association rule mining method according to claim 1 or 2, characterized in that, Step S3 includes the following steps: S31. For each of the training samples of the question-answer pair, based on the query q = (h, r, ?), use a rule generator to generate association rules for answering the query; S32. Input the association rule into the causal inferencer to obtain the candidate answers to the query and calculate the candidate answer scores of the candidate answers, and update the causal inferencer to obtain the updated causal inferencer; S33. Calculate the association rule score of each association rule based on the candidate answer score, select K association rules from the association rules in descending order of the association rule scores, update the rule generator using the K association rules, and obtain the updated rule generator. The value of K is 5 to 15 times the number of types of relations in the triple. S34. Using the updated rule generator, generate new association rules, input the new association rules into the updated causal inference engine, and repeat steps S31 and S33 to obtain the final association rule, denoted as h→. r t.

5. The alarm association rule mining method according to claim 4, characterized in that, In step S31, the association rules are generated using a recurrent neural network LSTM.

6. The alarm association rule mining method according to claim 4, characterized in that, In step S32, the candidate answer score includes a rule score and a graph representation score, wherein the graph representation score is calculated based on the graph neural network RGCN.

7. The alarm association rule mining method according to claim 4, characterized in that, Step S5 includes the following steps: S51. Based on the new alarm data, filter out the final association rule h→ r In t, h and t refer to all sub-association rules and their association rule scores for the alarm titles in the new alarm data; S52. Based on the cross-domain alarm association analysis knowledge graph, with the alarm titles h and t of the new alarm data as initial nodes, insert edges between the initial nodes and the corresponding device names, services, and regional nodes. Then, according to the relationship names involved in the sub-association rules, expand the corresponding neighbor nodes for the device names, services, and regional nodes to obtain the cross-domain alarm association analysis sub-knowledge graph. S53. The number of paths on the cross-domain alarm association analysis sub-knowledge graph that can be derived from h to t according to the sub-association rule is taken as the hit count of the sub-association rule, and the sub-association rule h→ is calculated based on the hit count. r The weight of t; S54. Draw the alarm relationships to obtain a rule tree. The alarm with an in-degree of 0 in the rule tree is the root alarm, and the weighted out-degree of the root alarm is used as the weight of the root alarm.

8. An alarm association rule mining system, characterized in that, include: The cross-domain alarm association analysis knowledge graph construction module generates triples to construct the cross-domain alarm association analysis knowledge graph by integrating resource relationship graphs and pre-stored alarm data. The triples are denoted as (h,r,t), where h is the head entity, t is the tail entity, and r is the relation. The question-answer pair training sample generation module randomly extracts triples from the cross-domain alarm association analysis knowledge graph to generate question-answer pair training samples. The query of the question-answer pair training sample is denoted as q = (h, r, ?), and the answer is denoted as a = t. The association rule learning module, based on the RNNLogic algorithm reinforced by the graph neural network RGCN, learns association rules for the training samples of the question and answer, and generates the final association rules. The explanatory association rule output module outputs explanatory association rules with inference path explanations from the final association rules. These explanatory association rules are selected from the final association rules based on the relationships "cause" and "cause-". 1 Co-occurrence and co-occurrence- 1 The association rules and their corresponding association rule scores are obtained by referring to the cause and the cause- 1 The relationship is inverse and the co-occurrence and the co-occurrence- 1 It is an inverse relationship; as well as The root cause alarm location module, based on the acquired new alarm data, filters the cross-domain alarm association analysis sub-knowledge graph and final association rules related to the new alarm data, and generates a weighted rule tree for root alarm inference.

9. A computer device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the alarm association rule mining method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, the processor performs the alarm association rule mining method according to any one of claims 1 to 7.

Images