Alarm association rule generation method and device, electronic equipment and storage medium

Abstract

The application relates to the technical field of wireless communication, and discloses an alarm association rule generation method and device, an electronic device and a storage medium. The method comprises the following steps: according to historical alarm slices, performing associated alarm analysis on each resource in a resource type relationship tree, obtaining associated alarms and the association times of the associated alarms; according to preset association strengths between the resources, obtaining the association times corresponding to the associated alarms; according to the association times and the association strengths, obtaining the association degrees of the associated alarms; and in the case that the association degrees are greater than a first preset threshold, generating alarm association rules according to the associated alarms. The generation of the alarm association rules is more targeted to the current network architecture, the complexity of the generation of the alarm association rules is simplified, the alarm association rules for the current network architecture can be generated concisely and efficiently, and the accuracy and efficiency during alarm association analysis by using the alarm association rules are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of mobile communication technology, and in particular to a method, device, electronic device, and storage medium for generating alarm association rules. Background Art

[0002] 5G networks, based on the core philosophy of Cloud Native, achieve customization, openness, and service-oriented networks through a service-based network architecture, combined with virtualization and cloud technologies. Virtualized networks implement the functions of traditional telecommunications equipment through software, running on general-purpose hardware devices and leveraging virtualization technology to enable shared hardware resources. Virtualized networks are divided into the hardware layer, virtual layer, and network element layer from bottom to top. Lower-layer resources are the foundation for the operation of upper-layer resources. Failures in physical layer resources often cause failures in virtual layer resources, which in turn can lead to network element failures, ultimately impacting normal service processing. Therefore, when an alarm occurs in a resource in a virtualized network, it often triggers failures in multiple virtual resources. As the scale of resources grows, the number of alarms increases rapidly. To effectively resolve resource alarms, analyzing the correlation between different resource alarms and identifying and resolving root alarms is particularly important in 5G networks.

[0003] Currently, two common methods for alarm correlation analysis are to predefine alarm correlation rules based on accumulated expert knowledge bases. When an alarm is reported, a rule engine is used to calculate the correlation of alarms within a certain time slice based on these existing rules. However, expert experience is difficult to accumulate, and the effectiveness of the generated alarm correlation rules is unstable. Another method is to systematically mine alarm correlation rules using machine learning and big data analysis. The alarm correlation rules generated by machine learning are less practical, and the large number of rules mined consumes a large amount of system resources. The alarm correlation rules generated by big data analysis are more effective, but the generation process is more complex. Therefore, how to concisely and efficiently establish alarm correlation rules that are adapted to current network structures remains an urgent problem. Summary of the Invention

[0004] The main purpose of the embodiments of the present application is to propose a method, device, electronic device and storage medium for generating alarm association rules, aiming to concisely and efficiently generate alarm association rules that can accurately identify the association relationship between alarms based on the current network architecture, thereby improving the efficiency and accuracy of alarm processing.

[0005] To achieve the above-mentioned purpose, an embodiment of the present application provides a method for generating alarm association rules, including: performing associated alarm analysis on each resource in the resource type relationship tree based on historical alarm slices, obtaining associated alarms and the number of associations of associated alarms; obtaining the association coefficient corresponding to the associated alarm based on the preset association strength between each resource; obtaining the degree of association of the associated alarm based on the number of associations and the association coefficient; and generating alarm association rules based on the associated alarm when the degree of association is greater than a first preset threshold.

[0006] To achieve the above-mentioned purpose, an embodiment of the present application also proposes an alarm association rule generation device, including: an acquisition module, used to perform association alarm analysis on each resource in the resource type relationship tree based on historical alarm slices, and obtain associated alarms and the number of associations of associated alarms; a calculation module, used to obtain the association coefficient corresponding to the associated alarm based on the preset association strength between each resource; a determination module, used to obtain the correlation degree of the associated alarm based on the number of associations and the correlation coefficient; a generation module, used to generate alarm association rules based on the associated alarm when the correlation degree is greater than a first preset threshold.

[0007] To achieve the above-mentioned purpose, an embodiment of the present application also proposes an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the alarm association rule generation method as described above.

[0008] To achieve the above-mentioned purpose, an embodiment of the present application further proposes a computer-readable storage medium storing a computer program, which implements the above-mentioned alarm association rule generation method when executed by a processor.

[0009] The alarm association rule generation method provided by the embodiment of the present application, after establishing a resource type relationship tree according to the resources that need to be associated with alarm analysis, generates a historical alarm slice based on the alarm information of each resource within a period of time, and then performs an associated alarm analysis on each resource based on the historical alarm slice, obtains the number of associations between the associated alarms and the associated alarms, combines the preset association strengths between the resources, obtains the association coefficient of the associated alarm, obtains the degree of association of the associated alarm based on the number of associations and the association coefficient, and generates an alarm association rule based on the associated alarm when the degree of association is greater than a first preset threshold. By combining the results of the associated alarm analysis of each resource using the historical alarm slice and the preset association strengths between the resources, the degree of association of the associated alarms is accurately measured, and then the alarm association rules are generated based on the associated alarms with a sufficiently high degree of association, making the generation of the alarm association rules more targeted. At the same time, it also simplifies the complexity of the alarm association rule generation, and can concisely and efficiently generate alarm association rules for the current network architecture, thereby improving the accuracy and efficiency of the alarm association analysis using the alarm association rules. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] One or more embodiments are exemplarily described by the figures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments.

[0011] Figure 1 This is a flow chart of the alarm association rule generation method in an embodiment of the present application;

[0012] Figure 2 This is a schematic diagram of the structure of the 5G virtualized network resource model in the embodiment of the present application;

[0013] Figure 3 It is a schematic diagram of the structure of the resource type relationship tree in the embodiment of the present application;

[0014] Figure 4 It is a schematic diagram of the structure of the resource instance relationship tree in the embodiment of the present application;

[0015] Figure 5 This is a flow chart of the alarm association rule mining and maintenance method in an embodiment of the present application;

[0016] Figure 6 This is a structural diagram of an alarm association rule mining and maintenance device in an embodiment of the present application;

[0017] Figure 7 This is a structural diagram of an alarm association rule generating device in another embodiment of the present application;

[0018] Figure 8 It is a structural diagram of an electronic device in another embodiment of the present application. DETAILED DESCRIPTION

[0019] As can be seen from the background technology, among the commonly used alarm association rule generation methods currently, when generating alarm association rules based on the accumulation of expert experience, expert experience is difficult to accumulate and the effectiveness of the generated alarm association rules is unstable; alarm association rules generated based on machine learning are less effective and require a large amount of system resources; when generating alarm association rules based on big data analysis, the rule generation process is relatively complex. Therefore, how to concisely and efficiently establish alarm association rules that are adapted to the current network structure and ensure the efficiency and accuracy of alarm association analysis is an issue that urgently needs to be addressed.

[0020] In order to solve the above problems, an embodiment of the present application provides a method for generating alarm association rules, including: performing associated alarm analysis on each resource in the resource type relationship tree based on historical alarm slices, obtaining associated alarms and the number of associations of associated alarms; obtaining the correlation coefficient corresponding to the associated alarm based on the preset correlation strength between each resource; obtaining the correlation degree of the associated alarm based on the correlation number and the correlation coefficient; and generating alarm association rules based on the associated alarm when the correlation degree is greater than a first preset threshold.

[0021] The alarm association rule generation method provided by the embodiment of the present application, after establishing a resource type relationship tree according to the resources that need to be associated with alarm analysis, generates a historical alarm slice based on the alarm information of each resource within a period of time, and then performs an associated alarm analysis on each resource based on the historical alarm slice, obtains the number of associations between the associated alarms and the associated alarms, combines the preset association strengths between the resources, obtains the association coefficient of the associated alarm, obtains the degree of association of the associated alarm based on the number of associations and the association coefficient, and generates an alarm association rule based on the associated alarm when the degree of association is greater than a first preset threshold. By combining the results of the associated alarm analysis of each resource using the historical alarm slice and the preset association strengths between the resources, the degree of association of the associated alarms is accurately measured, and then the alarm association rules are generated based on the associated alarms with a sufficiently high degree of association, making the generation of the alarm association rules more targeted. At the same time, it also simplifies the complexity of the alarm association rule generation, and can concisely and efficiently generate alarm association rules for the current network architecture, thereby improving the accuracy and efficiency of the alarm association analysis using the alarm association rules.

[0022] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, each embodiment of the present application will be described in detail below with reference to the accompanying drawings. However, it will be understood by those skilled in the art that in each embodiment of the present application, many technical details are proposed to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solutions claimed in the present application can be implemented. The division of the following embodiments is for convenience of description and should not constitute any limitation on the specific implementation of the present application. The various embodiments can be combined and referenced with each other under the premise of no contradiction.

[0023] The implementation details of the alarm association rule generation method recorded in this application will be specifically described below in conjunction with specific embodiments. The following content is only the implementation details provided for ease of understanding and is not necessary for implementing this solution.

[0024] The first aspect of the embodiment of the present application provides a method for generating alarm association rules. The specific process of the method for generating alarm association rules is shown in FIG. Figure 1 In some embodiments, the alarm association rule generation method is applied to an analysis control terminal with communication and analysis capabilities, such as a computer, tablet, mobile phone, or other electronic device. This embodiment is described using the application in a computer as an example, and includes at least but not limited to the following steps:

[0025] Step 101 : Based on the historical alarm slices, perform associated alarm analysis on each resource in the resource type relationship tree to obtain associated alarms and the number of associated alarms.

[0026] Specifically, before generating alarm correlation rules, the computer first defines the resource types requiring alarm correlation analysis based on the virtualized network architecture, organizes the correlation relationships between these resource types, and establishes a resource type relationship tree. It then obtains historical alarm information for each resource over a certain period of time, generates multiple historical alarm slices in chronological order, and establishes relationships between resource instances based on the resource type relationship tree, generating a resource instance relationship tree. Combined with the resource instance relationship tree and based on the historical alarm slices, it performs correlation alarm analysis on each resource in the resource type relationship tree, obtaining associated alarms with associated relationships and the number of associated alarms.

[0027] For example, a schematic diagram of a 5G virtualized network resource model is as follows: Figure 2As shown in the figure, the top network element layer includes business network elements and virtualized network functions. The virtual layer in the middle layer includes virtualized network resources such as hosts, virtual interactive machines, virtual databases, virtual networks, virtual hosts, virtual network cards, and virtual disks. The bottom hardware layer includes hardware facilities or ports such as servers, system servers, interactive servers, interactive system servers, switch ports, router ports, switches, and routers. Each resource communicates and connects based on business interactions or associations. The computer determines the scope of resources to be analyzed based on the network resource model, and after sorting out the hierarchical associations of resources, it establishes a resource type relationship tree as shown below. Figure 3 As shown in the figure, from top to bottom, they are service network elements, virtual hosts, hosts, servers, and, alongside the servers, disk arrays, switches, and routers. The generated resource type relationship tree can be stored in a graph database, with resource types stored as type tree nodes in the library and relationships between types as relationship edges between tree nodes.

[0028] The resource instance relationship tree generated by the computer based on the resource type relationship tree is as follows Figure 4 As shown, the resource instance relationship tree can also be stored in a graph database, with resource instances stored as instance tree nodes and relationships between instances stored as relationship edges between nodes. To enable quick subsequent relationship lookups, relationship edges between instances and types can be established and indexed using resource IDs. The overall structure of the resource instance relationship tree is that different routers are connected to at least one server through different switches, and the corresponding hosts are connected through the servers. Each host is then connected through its own connected virtual host and virtual network function. In addition, after the resource instance relationship tree is established, it needs to be synchronized with the resource library in real time to update the resource instance relationships in real time.

[0029] Before the computer generates the alarm correlation rule, the computer collects various resource data from an element management system (EMS), a virtualized infrastructure manager (VIM) and a physical infrastructure manager (PIM) through a resource probe and stores the resource data into a system resource library. Meanwhile, the computer collects alarms from the EMS, the VIM and the PIM through an alarm probe, formats the alarms and stores alarm information query snapshots into a current alarm library and a historical alarm library. After the resource instance relationship tree is generated, the computer reads historical alarm information of each resource contained in the resource type relationship tree in a certain time length from the historical alarm database, and divides the historical alarm information into multiple historical alarm slices according to a time sequence of alarm occurrence and a preset time granularity. The computer scans the historical alarm slices in the resource relationship instance relationship tree in a slice scanning manner, performs correlation alarm analysis on each resource in the resource type relationship tree, marks a group of alarms having resource correlation and time correlation as a correlation alarm, and counts a number of occurrences of the alarm set having time and resource correlation to obtain the correlation alarm having the correlation relationship and a correlation number of the correlation alarm.

[0030] The specific method for using historical alarm slices to perform correlated alarm analysis on a computer is as follows: In the generated resource instance relationship tree, starting with the earliest alarm slice among the acquired historical alarm slices, each historical alarm slice is played back one by one at a predetermined playback speed. Based on the alarm information in each alarm slice, the alarm status of each resource in the resource instance relationship tree is updated. When multiple resources experience alarm changes simultaneously, the resources experiencing alarm changes are extracted, and the resource instance relationship tree is queried to determine whether these resources are resource-dependent. For example, if resource A and resource B experience alarm changes simultaneously, and there is a relationship edge between resource A and resource B in the resource instance relationship tree, or a reachable path from resource A to resource B in the resource instance relationship tree, and no other resources along this path experience alarm changes in this slice, then the two alarms are determined to be resource-dependent. If the resources experiencing simultaneous alarm changes are resource-dependent, the alarm for the lower-level resource is set as a root alarm, and the alarm for the upper-level resource is set as a child alarm, based on the resource type and its hierarchy in the resource type relationship tree. Both are then set as correlated alarms. The key features of the associated alarms are extracted to generate associated tags. The main content of the tag is the resource type, alarm code and association number of the two alarms. For example, it is recorded as [(resource type 1, alarm code 1), (resource type 2, alarm code 2), association number n]. The initial value of the association number is 1. Each time the corresponding feature of the associated alarm is scanned, the association number is increased by 1. There may be multiple resources in a slice that have alarm changes at different times. For example, in a certain slice, the policy control function network element and virtual host 2, virtual host 3 and host 3, user plane data function network element and switch 3, server 7 and switch 3, switch 3 and switch 4 in the resource instance relationship tree. These resource combinations may have a directly connected relationship edge, or there is a reachable path in the resource instance relationship tree, and other resources on this path in this slice do not have alarm changes at the same time. At this time, it is considered that these alarms have time and resource correlation. In addition, the service discovery function network element and router 1 also generate alarm changes at the same time in this time slice, but there is no reachable path from this network element to router 1, so these two alarms have no correlation in this slice.

[0031] After the computer completes scanning the current historical alarm slice, it automatically scans the next historical alarm slice and updates the associated alarms until all historical alarm slices are scanned. This process obtains one or more associated alarms associated with each resource in the resource type relationship tree, along with the association count for each associated alarm. By analyzing the associated alarms for each resource in the resource type relationship tree based on the historical alarm slices, the system accurately obtains the associated alarms and their association counts from both the time and resource dimensions, facilitating the subsequent generation of alarm association rules.

[0032] Step 102: Obtain the correlation coefficient corresponding to the correlation alarm according to the preset correlation strength between the resources.

[0033] Specifically, after the computer obtains the associated alarms and the number of associations of the associated alarms based on the historical alarm slices, it obtains the corresponding correlation coefficient of the associated alarms when performing correlation degree analysis based on the type of resources where the associated alarms are located and the preset correlation strength between the resources.

[0034] In one example, a computer obtains a correlation coefficient corresponding to a correlation alarm based on a preset correlation strength between resources, including: obtaining a resource connection path between the resources where the correlation alarm is located; obtaining the preset alarm correlation strength between resources corresponding to each sub-path in the resource connection path based on the preset alarm correlation strength between resources; and obtaining the correlation coefficient corresponding to the correlation alarm based on the preset alarm correlation strength between resources corresponding to each sub-path. After obtaining the correlation alarm, the computer searches for the resource connection path between the resources where the correlation alarm is located in a resource instance relationship tree generated based on the resource type relationship tree. The resource connection path is then divided into multiple sub-paths based on the different resource nodes it passes through. The preset alarm correlation strength corresponding to each sub-path is obtained based on the preset alarm correlation strength between resources. The preset alarm correlation strength corresponding to each sub-path in the resource connection path is then combined to obtain the correlation coefficient corresponding to the alarm resource. By obtaining the correlation strength of each stage in the resource connection path based on the preset correlation strength between resources and accurately obtaining the correlation coefficient based on the correlation strength of each stage, the accuracy of the subsequent correlation degree assessment is ensured.

[0035] For example, after evaluating the alarm correlation strengths of different resource types based on the resource's business layer support relationships and accumulated expert experience, the computer pre-assigns the following alarm correlation strengths between each resource in the resource type relationship tree: service network element - virtual host: correlation strength 0.4; virtual host - host: correlation strength 0.8; virtual host - virtual switch: correlation strength 0.5; virtual host - disk array: correlation strength 0.6; host - server: correlation strength 1; server - switch: correlation strength 0.5; disk array - switch: correlation strength 0.5; switch - switch: correlation strength 0.5; switch - router: correlation strength 0.5. The alarm correlation strengths between resources can be manually set based on expert experience or calculated by the computer based on accumulated expert experience. The correlation strengths can be stored as attributes on the resource type relationship edges and stored in the graph database along with the resource type relationship tree for easy subsequent search and reference.

[0036] When the computer obtains the correlation coefficient corresponding to the associated alarm, it first obtains the specific resource where the associated alarm is located. For example, Figure 4In the resource instance relationship tree shown, the associated alarm is [(Switch 4, Ethernet protocol down), (User plane data function, Routing group unavailable)], and the resources associated with the associated alarm are switch 4 and the User plane data function. The computer then searches the resource connection path in the resource instance relationship tree and obtains the connection path between switch 4 and the User plane data function as: switch 4 - server 7 - host 7 - virtual host 6 - User plane data function. Based on the preset association strengths between the resources, the preset association strengths corresponding to each subpath are 0.5, 1, 0.8, and 0.4, respectively. Based on the preset association strengths corresponding to each subpath, the association coefficient corresponding to the resource connection path is obtained. For example, using the product of the preset association strengths of each subpath as the association coefficient, the association coefficient corresponding to the associated alarm [(Switch 4, Ethernet protocol down), (User plane data function, Routing group unavailable)] is (0.5 × 0.8 × 0.4 × 1) = 0.16.

[0037] Furthermore, the computer obtains the resource connection path between the resources where the associated alarm is located, including: obtaining the shortest resource connection path between the resources where the associated alarm is located. When the computer is acquiring the resource connection path, if it detects that there are multiple resource connection paths between the resources where the associated alarm is located, the computer selects the shortest resource connection path as the resource connection path for calculating the correlation coefficient corresponding to the associated alarm. In addition, the computer can also calculate the correlation coefficient corresponding to each resource connection path respectively, and select a resource connection path according to the size of the correlation coefficient, for example, the connection path with the largest or smallest corresponding correlation coefficient is selected as the selected resource connection path. By selecting the shortest resource connection path from multiple alternative resource connection paths as the resource connection path for calculating the correlation coefficient corresponding to the associated alarm, it is avoided that the subsequent correlation degree of the associated alarm is evaluated too low, resulting in the missed generation of alarm rules.

[0038] Step 103: Obtain the correlation degree of the correlated alarm according to the correlation number and the correlation coefficient.

[0039] Specifically, after obtaining the associated alarms, their correlation counts, and their corresponding correlation coefficients, the computer evaluates the specific correlation levels of the alarms contained in the associated alarms. For each associated alarm, the computer determines the correlation level based on the correlation count and correlation coefficient. By determining the correlation level of the associated alarms based on the correlation count and correlation coefficient, the computer conducts a comprehensive analysis of the correlation levels at both the alarm occurrence probability and alarm correlation probability levels, accurately determining the correlation level of the associated alarms.

[0040] For example, the computer can calculate the correlation value of the associated alarm based on the product of the correlation number of the associated alarm and the correlation coefficient corresponding to the associated alarm, and measure the correlation degree of the associated alarm by the correlation value. Figure 4 In the resource instance relationship tree shown, the associated alarm obtained is [(switch 4, Ethernet protocol down), (user plane data function, routing group unavailable)]. When the number of associations is 20, the association value of the associated alarm = 20 × 0.16 = 3.2. Therefore, the correlation degree corresponding to the associated alarm [(switch 4, Ethernet protocol down), (user plane data function, routing group unavailable)] is 3.2.

[0041] Step 104 : When the correlation degree is greater than a first preset threshold, generate an alarm correlation rule according to the correlated alarms.

[0042] Specifically, after obtaining the correlation degree of the associated alarms, the computer detects whether the obtained correlation degree meets the first preset threshold value. When the correlation degree of the associated alarms is greater than the first preset threshold value, it is determined that the correlation degree of the associated alarms is high enough and the correlation between the associated alarms is significant, and then an alarm correlation rule is generated based on the associated alarms.

[0043] In one example, a computer generates an alarm association rule based on associated alarms, including: obtaining a first alarm key feature corresponding to a root alarm and a second alarm key feature corresponding to a sub-alarm in the associated alarms; wherein the alarm key features include resource type and alarm code; generating an alarm association rule based on the first alarm key feature and the second alarm key feature; the alarm association rule including: upon detecting the presence of multiple alarms having the first alarm key feature and the second alarm key feature, marking the alarm having the first alarm key feature as a root alarm, marking the alarm having the second alarm key feature as a sub-alarm, and defining the root alarm and the sub-alarm as associated alarms. Upon detecting that the degree of association of the associated alarms exceeds a first preset threshold, the computer initiates an alarm association rule generation process, extracts alarm key features from the associated alarms, and obtains resource type 1 and alarm code 1 corresponding to the root alarm, and resource type 2 and alarm code 2 corresponding to the sub-alarm. Based on the acquired alarm key features, an alarm association rule is generated, which marks the alarm with the first alarm key feature as a root alarm, marks the alarm with the second alarm key feature as a sub-alarm, and the root alarm and the sub-alarm as associated alarms, when multiple alarms with the first alarm key feature and the second alarm key feature are detected. By extracting features, the alarm association rules corresponding to the associated alarms with a strong enough correlation are accurately generated, so that the associated alarms can be accurately identified using the alarm association rules in the future, thereby improving the efficiency and accuracy of the identification of associated alarms. In one example, after the computer generates the alarm association rules based on the associated alarms, the computer also includes: updating the effectiveness of the alarm association rules based on the real-time alarm messages or historical alarm slices; and taking effect when the effectiveness of the alarm association rules is greater than the second preset threshold. After the computer generates the alarm association rule, it can first store the generated initial alarm association rule in the seed alarm association rule set or set it as a seed alarm association rule, and then evaluate the effectiveness of the alarm association rule in the actual application process based on the real-time alarm message or the alarm information in the historical alarm slice, and update the effectiveness of the alarm association rule based on the evaluation result. Then, according to the preset time period or after each update of the effectiveness, whether the effectiveness of the alarm association rule is greater than the second preset threshold is detected. In the case of detecting that the effectiveness of the alarm association rule is greater than the second preset threshold, it will be set as a seed alarm association rule or the alarm association rule stored in the seed alarm association rule set, moved into the formal alarm association rule set or set as a formal alarm association rule, that is, the alarm association rule will take effect and begin to be used to perform associated alarm analysis on alarms occurring in the network architecture.

[0044] In another example, a computer updates the effectiveness of an alarm association rule based on a real-time alarm message or a historical alarm slice, including: determining an alarm whose alarm status has changed based on the alarm information in the real-time alarm message or the historical alarm slice; wherein the alarm status includes reported alarm and recovered alarm; if the alarm is a related alarm corresponding to the alarm association rule, detecting whether the alarm status change of the related alarm has been reported within a preset time interval; if the alarm status change of the related alarm has not been reported, lowering the effectiveness of the alarm association rule; if the alarm status change of the related alarm has been reported, adjusting the effectiveness of the alarm association rule based on the reporting order of the alarm status change of the related alarm. When adjusting the effectiveness of the alarm association rule, the computer obtains the alarm information in the real-time alarm message or the historical alarm slice, and obtains the resource and alarm code of the alarm that caused the reported alarm and / or recovered alarm by analyzing the alarm information. Detect whether the obtained alarm belongs to the associated alarm corresponding to the alarm association rule. If the obtained alarm belongs to the associated alarm corresponding to the alarm association rule, further detect whether the alarm status change of the associated alarm is reported within the preset time interval. That is, if the alarm report message is obtained, detect whether the associated alarm report occurs within a certain period of time before and after the alarm report message occurs; if the alarm recovery message is obtained, detect whether the associated alarm recovery occurs within a certain period of time before and after the alarm recovery message occurs. If it is detected that the alarm status change of the associated alarm is not reported within the preset time interval, lower the effectiveness of the alarm association rule; if it is detected that the alarm status change of the associated alarm is reported within the preset time interval, adjust the effectiveness of the alarm association rule according to the reporting order of the alarm status change of the associated alarm. By further verifying the effectiveness of alarm correlation rules using historical alarm slices or real-time alarm messages, we can accurately measure the applicability of alarm correlation rules to the current network architecture, so that after the alarm correlation rules take effect, the system can analyze the related alarms in the current network architecture in a timely and efficient manner.

[0045] When the computer measures the effectiveness of the alarm association rules, it can preset an effective score for each alarm association rule. One point is added each time the effectiveness is increased, and one point is subtracted each time the effectiveness is decreased. The preset effective score can be a fixed value or a score set according to the association degree of the associated alarms. The score adjustment step can also be set by yourself.

[0046] Furthermore, the computer adjusts the effectiveness of the alarm association rule based on the order in which the alarm status changes of the associated alarms are reported, including: if the order in which the alarm status changes in the associated alarms are reported is that the root alarm status change is reported first, followed by the sub-alarm status change, the effectiveness of the alarm association rule is increased; if the order in which the alarm status changes in the associated alarms are reported is that the root alarm status change is reported first, followed by the sub-alarm status change, the effectiveness of the alarm association rule is decreased. Upon detecting that the alarm status changes of the associated alarms are reported within a preset time window, the computer checks the order in which the alarm status changes are reported, and if it is detected that the order in which the alarm status changes are reported is that the root alarm status change is reported first, followed by the sub-alarm status change, the computer determines that the alarm association rule is effective and adjusts the effectiveness of the alarm association rule upward; if it is detected that the order in which the alarm status changes are reported is that the root alarm status change is reported first, followed by the sub-alarm status change, the computer determines that the alarm association rule is invalid and adjusts the effectiveness of the alarm association rule downward. By detecting the order of root alarm status changes and sub-alarm status changes in the associated alarms, the effectiveness of the alarm association rules can be accurately detected and adjusted, thereby accurately completing the verification of the effectiveness of the alarm association rules.

[0047] In another example, after the alarm association rule is validated, the computer further includes: updating the validity of the validated alarm association rule based on real-time alarm messages; and invalidating the alarm association rule if the validity of the alarm association rule is not greater than a second preset threshold. After the alarm association rule is validated, the computer uses a similar validation method as described above to update the validity of the validated alarm association rule in real time based on real-time alarm messages in the current network architecture. That is, the validity of the rules set as formal alarm association rules or stored in the formal alarm association rule set is updated. After each update or after a preset time interval, the computer checks the relationship between the validity of the valid alarm association rule and the second preset threshold. If the validity of the alarm association rule is not greater than the second preset threshold, the alarm association rule is invalidated, that is, the formal alarm association rule is set as an invalid rule, reset as a seed alarm association rule, or directly removed from the formal alarm association rule set. When the computer invalidates the alarm association rule, it can remove the alarm association rule from the valid rule set or set it to an invalid state, but this embodiment does not limit this. By updating the effectiveness and effectiveness status of alarm association rules in real time after applying them, we can avoid the existence of a large number of rules in the effective rules that are not applicable to the current network architecture, ensure that the effective alarm association rules can be better applied to the current network architecture, and ensure that the alarm association analysis is accurate and efficient.

[0048] In addition, after the alarm correlation rule is invalidated, the invalidated alarm correlation rule can be added to a storage set of the rest alarm analysis rules, such as a tidal business correlation alarm impact analysis, and the embodiment does not limit this.

[0049] In another example, after the computer updates the effective degree of the alarm correlation rule according to the real-time alarm message or the historical alarm slice, the computer further includes: deleting the alarm correlation rule in a case that the effective degree of the alarm correlation rule is less than a third preset threshold; and the third preset threshold is less than the second preset threshold. After the computer updates the effective degree of the alarm correlation rule, the computer further detects whether the effective degree of the alarm correlation rule meets the third preset threshold which is lower than the second preset threshold, and deletes the alarm correlation rule whose effective degree is lower than the third preset threshold. By setting a third preset threshold, a lower limit of the effectiveness of the alarm correlation rule is set. When the effectiveness of the alarm correlation rule is too low, the alarm correlation rule is determined to be completely unsuitable for the current network architecture, and is deleted, thereby avoiding the need to store and maintain too many useless alarm correlation rules and reducing the processing pressure.

[0050] In summary, the process of the computer performing alarm correlation rule mining and maintenance according to alarm information can refer to Figure 5 , and at least includes but is not limited to the following steps:

[0051] Step 101, performing correlation alarm analysis on each resource in the resource type relationship tree according to historical alarm slices, to obtain correlation alarms and correlation times of the correlation alarms.

[0052] Step 102, obtaining the correlation times corresponding to the correlation alarms according to preset correlation strengths between the resources.

[0053] Step 103, obtaining the correlation degrees of the correlation alarms according to the correlation times and the correlation times.

[0054] Step 104, generating an alarm correlation rule according to the correlation alarms in a case that the correlation degree is greater than a first preset threshold.

[0055] The specific implementation of the alarm correlation rule mining is similar to the alarm correlation rule generation method described above, and will not be described here.

[0056] Step 105, performing effective degree evaluation and update on the generated alarm correlation rule, and dynamically maintaining the generated alarm correlation rule according to the effective degree.

[0057] Specifically, after the computer discovers a series of alarm association rules, it stores the discovered alarm association rules in a pre-created alarm association rule library. For example, the newly discovered alarm association rules are stored as seed alarm association rules in the seed rule library. Then, based on historical alarm slices or real-time alarm messages, the effectiveness of the seed alarm association rules in the seed rule library is evaluated and updated. If the effectiveness of any seed alarm association rule exceeds a second preset threshold, it is set as a formal alarm association rule and added to the formal rule library that stores effective rules. If the effectiveness of any seed alarm association rule is less than a third preset threshold, it is directly deleted or removed from the seed rule library.

[0058] After the seed alarm association rules are activated, the effectiveness of the formal alarm association rules in effect will be evaluated and updated. If the effectiveness of any formal alarm association rule in effect is less than a second preset threshold, it will be set to an invalid state and removed from the formal rule base or directly deleted. By dynamically maintaining the generated alarm association rules and the effective alarm association rules based on real-time alarm messages or historical alarm information, the effectiveness of the effective alarm association rules is guaranteed. By promptly removing alarm association rules that are not suitable for the current network architecture, the resource usage of alarm association rule storage is reduced, and the number of alarm association rules that need to be traversed during the correlation alarm analysis process is reduced, thereby improving analysis efficiency.

[0059] In addition, a structural diagram of an alarm association rule mining and maintenance device for realizing the above alarm association rule mining and maintenance is shown in FIG. Figure 6 The system includes a relationship tree construction module 601, which is used to generate a resource type relationship tree based on predefined resource association relationships during system initialization, and set association coefficients on the relationship edges in the resource type relationship tree. By querying the resource library and monitoring resource library change messages, the complex resource relationships in the resource library are simplified, and only the instances of the resource types that need to be analyzed are extracted to organize the resource instance relationship tree used in the alarm association rule mining process.

[0060] The alarm slicing module 602 is used to obtain all historical alarm information that meets the resource association relationship in the alarm information of each resource in the resource instance relationship tree within a preset time, use the obtained historical alarm information set as an analysis sample, divide the analysis sample according to the alarm occurrence time, and generate continuous time slices containing alarm information.

[0061] The rule generation module 603 is used to scan and analyze the alarm slices using the association analysis algorithm, analyze the correlation and correlation degree of the alarms in time and resources, extract features from a set of associated alarms whose correlation degree meets the requirements, and generate alarm association rules for the initial state.

[0062] The rule maintenance module 604 is configured to dynamically maintain the generated alarm association rules. By monitoring real-time alarm messages or invoking historical alarm information, the validity of the initial seed alarm association rules is evaluated and updated. If the validity of any seed alarm association rule exceeds a second preset threshold, it is set as an effective formal alarm association rule. If the validity of any seed alarm association rule falls below a third preset threshold, it is deleted. Furthermore, the validity of effective formal alarm association rules is updated based on real-time alarm messages or historical alarm information, and dynamically maintained based on the updated validity. If the validity of any effective formal alarm association rule does not exceed the second preset threshold, it is set to an invalid state, removed from the formal rule base, or directly deleted.

[0063] Another aspect of the present invention relates to a device for generating alarm association rules. Figure 7 ,include:

[0064] The acquisition module 701 is used to perform associated alarm analysis on each resource in the resource type relationship tree according to the historical alarm slices, and obtain associated alarms and the number of associations of the associated alarms.

[0065] The calculation module 702 is used to obtain the correlation coefficient corresponding to the correlation alarm according to the preset correlation strength between the resources.

[0066] The determination module 703 is configured to obtain the correlation degree of the correlation alarm according to the correlation times and the correlation coefficient.

[0067] The generating module 704 is configured to generate an alarm association rule according to the associated alarm when the association degree is greater than a first preset threshold.

[0068] It is not difficult to find that this embodiment is an apparatus embodiment corresponding to the method embodiment, and this embodiment can be implemented in conjunction with the method embodiment. The relevant technical details mentioned in the method embodiment are still valid in this embodiment, and to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the method embodiment.

[0069] It is worth noting that all modules involved in this embodiment are logical modules. In actual applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, to highlight the innovations of the present invention, this embodiment does not include units that are not closely related to solving the technical problems proposed by the present invention. However, this does not mean that other units do not exist in this embodiment.

[0070] Another aspect of the present application embodiment further provides an electronic device, Figure 8 , including: at least one processor 801; and a memory 802 communicatively connected to the at least one processor 801; wherein the memory 802 stores instructions that can be executed by the at least one processor 801, and the instructions are executed by the at least one processor 801 to enable the at least one processor 801 to execute the alarm association rule generation method described in any of the above method embodiments.

[0071] The memory 802 and processor 801 are connected using a bus. The bus may include any number of interconnected buses and bridges, connecting various circuits of one or more processors 801 and memory 802. The bus may also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits. These are all well known in the art and are therefore not described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver may be a single component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor 801 is transmitted over a wireless medium via an antenna. Furthermore, the antenna receives data and transmits it to the processor 801.

[0072] The processor 801 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. The memory 802 can be used to store data used by the processor 801 when performing operations.

[0073] Another aspect of the present invention provides a computer-readable storage medium storing a computer program that implements the above method embodiment when executed by a processor.

[0074] That is, those skilled in the art will understand that all or part of the steps in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a program, which is stored in a storage medium and includes a number of instructions for causing a device (which may be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., various media that can store program code.

[0075] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and that in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A method for generating alarm association rules, characterized in that: include: According to the historical alarm slices divided by chronological order and preset time granularity, an associated alarm analysis is performed on each resource in the resource instance relationship tree corresponding to the resource type relationship tree. The associated alarm analysis includes determining whether the alarm has resource relevance and time relevance. The resource relevance is that the resource has a connection path in the resource instance relationship tree and other resources on the connection path in the historical alarm slice have no alarm changes. The time relevance is that the alarms belong to the same historical alarm slice. Acquire associated alarms having both the resource correlation and the time correlation and the number of associations of the associated alarms; Obtaining a correlation coefficient corresponding to the correlation alarm according to a preset correlation strength between the resources; Obtaining a correlation degree of the correlated alarm according to the correlation number and the correlation coefficient; In a case where the correlation degree is greater than a first preset threshold, an alarm correlation rule is generated according to the correlated alarm.

2. The alarm association rule generation method according to claim 1, characterized in that: The obtaining, according to the preset correlation strength between the resources, a correlation coefficient corresponding to the correlation alarm, includes: Obtaining a resource connection path between the resources where the associated alarm is located; According to the preset association strength between the resources, obtaining the preset association strength between the resources corresponding to each sub-path in the resource connection path; The correlation coefficient corresponding to the correlation alarm is obtained according to the preset correlation strength between the resources corresponding to the sub-paths.

3. The alarm association rule generation method according to claim 2, characterized in that: The obtaining of the resource connection path between the resources where the associated alarm is located includes: Obtain the shortest resource connection path between the resources where the associated alarm is located.

4. The alarm association rule generation method according to claim 1, characterized in that: After generating the alarm association rule according to the associated alarm, the method further includes: updating the effectiveness of the alarm association rule according to the real-time alarm message or the historical alarm slice; In a case where the effectiveness of the alarm association rule is greater than a second preset threshold, the alarm association rule is put into effect.

5. The method for generating alarm association rules according to claim 4, wherein: The updating of the effectiveness of the alarm association rule according to the real-time alarm message or the historical alarm slice includes: Determine, based on the real-time alarm message or the alarm information in the historical alarm slice, an alarm whose alarm status has changed; wherein the alarm status includes reporting an alarm and recovering an alarm; In the case where the alarm belongs to the associated alarm corresponding to the alarm association rule, detecting whether an alarm state change of the associated alarm is reported within a preset time interval; In the case where no alarm state change of the associated alarm is reported, lowering the effectiveness of the alarm association rule; In the case where the alarm status change of the associated alarm is reported, the effectiveness of the alarm association rule is adjusted according to the reporting order of the alarm status change of the associated alarm.

6. The alarm association rule generation method according to claim 5, characterized in that: The adjusting the effectiveness of the alarm association rule according to the reporting order of the alarm status changes of the associated alarms includes: In the case where the reporting order of the alarm status changes in the associated alarms is to report the root alarm status change first and then the sub-alarm status change, increasing the effectiveness of the alarm association rule; In a case where the order of reporting the alarm status changes in the associated alarms is to report the sub-alarm status change before reporting the root alarm status change, the effectiveness of the alarm association rule is lowered.

7. The alarm association rule generation method according to claim 4, characterized in that: After the alarm association rule is effective, the method further includes: updating the effectiveness of the effective alarm association rule according to the real-time alarm message; In a case where the effectiveness of the alarm association rule is not greater than the second preset threshold, the alarm association rule is invalidated.

8. The method for generating alarm association rules according to any one of claims 4 to 7, characterized in that: After updating the effectiveness of the alarm association rule according to the real-time alarm message or the historical alarm slice, the method further includes: When the effectiveness of the alarm association rule is less than a third preset threshold, the alarm association rule is deleted; wherein the third preset threshold is less than the second preset threshold.

9. The alarm association rule generation method according to claim 1, characterized in that: Generating an alarm association rule according to the associated alarms includes: Obtaining a first alarm key feature corresponding to the root alarm and a second alarm key feature corresponding to the sub-alarm in the associated alarm; wherein the alarm key feature includes a resource type and an alarm code; generating the alarm association rule according to the first alarm key feature and the second alarm key feature; The alarm association rule includes: when it is detected that there are multiple alarms whose alarm key characteristics are the first alarm key characteristics and the second alarm key characteristics, the alarm whose alarm key characteristics are the first alarm key characteristics is marked as the root alarm, and the alarm whose alarm key characteristics are the second alarm key characteristics is marked as the sub-alarm, and the root alarm and the sub-alarm are associated alarms.

10. An alarm association rule generating device, characterized in that: include: An acquisition module is used to perform associated alarm analysis on each resource in the resource instance relationship tree corresponding to the resource type relationship tree based on historical alarm slices divided in chronological order and at a preset time granularity, wherein the associated alarm analysis includes determining whether the alarm has resource correlation and time correlation, wherein the resource correlation is that a connection path exists for the resource in the resource instance relationship tree and no alarm changes occur to other resources on the connection path in the historical alarm slice, and the time correlation is that the alarms belong to the same historical alarm slice; and obtaining associated alarms that have both the resource correlation and the time correlation and the number of associations of the associated alarms. A calculation module, configured to obtain a correlation coefficient corresponding to the correlation alarm according to a preset correlation strength between the resources; A determination module, configured to obtain a correlation degree of the correlation alarm according to the correlation number and the correlation coefficient; A generating module is configured to generate an alarm association rule according to the associated alarm when the association degree is greater than a first preset threshold.

11. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the alarm association rule generating method according to any one of claims 1 to 9.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the alarm association rule generating method according to any one of claims 1 to 9 is implemented.

Images