Association rule extraction method and device, equipment and storage medium

Abstract

The application provides a correlation rule extraction method, device and equipment and a storage medium. The method comprises the following steps: dividing an original alarm data set into a plurality of original alarm data subsets according to different attribute values of a first preset alarm attribute; dividing a plurality of initial alarm data sets from each original alarm data subset according to a preset time window and a preset step length; modifying each preset alarm attribute in each initial alarm data set to a corresponding digital identifier according to a plurality of preset alarm attribute and digital identifier mapping relationships stored in advance, so as to obtain a plurality of identified alarm data sets of each original alarm data subset; using a preset correlation rule extraction algorithm to extract an alarm information combination with a correlation rule from the plurality of identified alarm data sets; and the alarm information combination is composed of two or three alarm information. The scheme of the application can reduce the calculation complexity of extracting the correlation rule and improve the efficiency of extracting the correlation rule.

Description

Technical Field

[0001] This application relates to communication technology, and more particularly to a method, apparatus, device, and storage medium for extracting association rules. Background Technology

[0002] Suppose I is a set of items, and database D contains multiple transactions, each of which is a non-empty subset of I. For an association rule that includes two items, its support in D is the probability that both items appear in a transaction in D, and its confidence in D is the probability that, if one item appears in a transaction, the other item will appear in the same transaction.

[0003] The value of association rules needs to be determined by their support and confidence scores. For carrier alarm information, valuable association rules can be used to provide early warnings or predictions of equipment failures. Calculating the support and confidence scores of association rules requires traversing the database to determine the frequency of each item and each association rule. Therefore, the larger the database, the higher the computational complexity and the lower the efficiency of extracting association rules. Furthermore, carrier alarm information has an average character length exceeding 60 characters and tens of thousands of categories. As the number and types of alarm information increase, existing servers struggle to extract valuable association rules from the alarm information.

[0004] In summary, existing association rule extraction methods suffer from high computational complexity and low computational efficiency, making it difficult to extract valuable association rules from alarm data. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for extracting association rules, in order to solve the problems of high computational complexity and low computational efficiency in existing association rule extraction methods, making it difficult to extract valuable association rules from alarm data.

[0006] According to a first aspect of this application, a method for extracting association rules is provided, comprising:

[0007] Based on the different attribute values ​​of the first preset alarm attribute, the original alarm dataset is divided into multiple original alarm data subsets;

[0008] Based on a preset time window and a preset step size, multiple initial alarm datasets are divided from each original alarm data subset; each initial alarm dataset includes multiple initial alarm information, and each initial alarm information includes multiple preset alarm attributes;

[0009] Based on the pre-stored mapping relationship between multiple preset alarm attributes and digital identifiers, each preset alarm attribute in each initial alarm dataset is modified to the corresponding digital identifier, thereby obtaining multiple identifierd alarm datasets for each original alarm data subset.

[0010] A preset association rule extraction algorithm is used to extract alarm information combinations with association rules from multiple identifiable alarm datasets; the alarm information combination consists of two or three alarm information.

[0011] As an optional implementation, the original alarm dataset includes multiple original alarm information, and the original alarm information includes multiple preset alarm attributes, wherein the first preset alarm attribute is one of the multiple preset alarm attributes;

[0012] The original alarm dataset is divided into multiple subsets of original alarm data based on different attribute values ​​of the first preset alarm attribute, including:

[0013] Original alarm information with the same attribute value of the first preset alarm attribute is divided into the same original alarm data subset.

[0014] As an optional implementation, the original alarm information may also include the alarm occurrence time and alarm cancellation time;

[0015] The process involves dividing the original alarm data sets into multiple initial alarm datasets based on preset time windows and preset step sizes, including:

[0016] According to the preset time window and preset step size, slide the window on each subset of original alarm data to divide multiple initial alarm time periods;

[0017] Within each initial alarm time period, the original alarm information that meets the preset conditions is determined as the initial alarm information in each initial alarm dataset; the preset conditions are that the alarm occurrence time is within the initial alarm time period and the alarm cancellation time is outside the initial alarm time period.

[0018] As an optional implementation, the mapping relationship between the multiple preset alarm attributes and digital identifiers includes: digital identifiers corresponding to multiple attribute values ​​of each preset alarm attribute;

[0019] The step involves modifying each preset alarm attribute in each initial alarm dataset to its corresponding digital identifier based on a pre-stored mapping relationship between multiple preset alarm attributes and digital identifiers, thereby obtaining multiple identifier-based alarm datasets for each subset of original alarm data, including:

[0020] For each preset alarm attribute of each initial alarm message, query the numerical identifier corresponding to the attribute value of the preset alarm attribute in the mapping relationship between the preset alarm attribute and the numerical identifier;

[0021] Modify the attribute value of the preset alarm attribute to the corresponding numeric identifier;

[0022] Iterate through the preset alarm attributes of each initial alarm message to obtain multiple identifiable alarm datasets for each original alarm data subset.

[0023] As an optional implementation, the identifierd alarm dataset includes multiple alarm identifiers, each of which consists of a digital identifier corresponding to a preset alarm attribute of the initial alarm information;

[0024] The method employs a preset association rule extraction algorithm to extract combinations of alarm information that exhibit association rules from multiple identifiable alarm datasets, including:

[0025] Calculate the merging frequency of each alarm identifier combination in each original alarm data subset; the merging frequency is the number of identifiable alarm datasets in each original alarm data subset that include each alarm identifier combination; the alarm identifier combination consists of two or three alarm identifiers;

[0026] Based on the combined frequency of each alarm identifier combination, the number of identifiable alarm datasets in each original alarm data subset, and the number of original alarm data subsets, calculate the association support of each alarm identifier combination in each original alarm data subset and the association confidence of each alarm identifier combination in the original alarm dataset.

[0027] Based on the association support and association confidence of each alarm identifier combination, determine the alarm identifier combinations with association rules.

[0028] Based on the mapping relationship between the multiple preset alarm attributes and digital identifiers, two or three alarm identifiers in the alarm identifier combination are modified to the corresponding alarm information to obtain an alarm information combination with association rules.

[0029] As an optional implementation, the calculation of the combined frequency of each alarm identifier combination includes:

[0030] Iterate through each alarm identifier in each identifiable alarm dataset to determine whether each combination of alarm identifiers appears in each identifiable alarm dataset;

[0031] If it is determined that the alarm identifier combination appears in the identifiable alarm dataset, then the combined frequency of the alarm identifier combination in the identifiable alarm dataset is set to 1; if it is determined that the alarm identifier combination does not appear in the identifiable alarm dataset, then the combined frequency of the alarm identifier combination in the identifiable alarm dataset is set to 0.

[0032] The sum of the combined frequencies of each alarm identifier combination in multiple identifiable alarm datasets belonging to the same original alarm data subset is determined as the combined frequency of each alarm identifier combination in each original alarm data subset.

[0033] As an optional implementation, the step of calculating the association support of each alarm identifier combination in each original alarm data subset and the association confidence of each alarm identifier combination in the original alarm dataset based on the merging frequency of each alarm identifier, the number of identifiable alarm datasets in each original alarm data subset, and the number of original alarm data subsets includes:

[0034] The ratio of the combined frequency of each alarm identifier combination in each original alarm data subset to the number of identifiable alarm datasets in each original alarm data subset is determined as the association support of each alarm identifier combination in each original alarm data subset.

[0035] The association confidence of each alarm identifier combination in the original alarm dataset is determined by the ratio of the number of non-zero merge frequencies of each alarm identifier combination in each original alarm data subset to the number of original alarm data subsets.

[0036] As an optional implementation, determining the alarm identifier combinations with associated rules based on the association support and association confidence of each alarm identifier combination includes:

[0037] Obtain the preset weights for each alarm flag combination;

[0038] The association support of each alarm identifier combination is calculated using a preset weight.

[0039] Alarm identifier combinations whose weighted association support is greater than or equal to a preset support and whose association confidence is greater than or equal to a preset confidence are determined as candidate identifier combinations.

[0040] The alarm flag combinations that have association rules are determined by sorting the candidate flags from highest to lowest according to the association confidence level.

[0041] As an optional implementation, after extracting alarm information combinations with associated rules from multiple identifiable alarm datasets using a preset association rule extraction algorithm, the method further includes:

[0042] Obtain real-time alarm information;

[0043] If it is determined that the real-time alarm information includes the first alarm information, then the second alarm information is given a warning. The first alarm information and the second alarm information are a combination of alarm information with association rules.

[0044] If it is determined that the real-time alarm information includes the third alarm information and the fourth alarm information, then the fifth alarm information will be given a warning. The third alarm information, the fourth alarm information and the fifth alarm information are a combination of alarm information with association rules.

[0045] According to a second aspect of this application, an association rule extraction apparatus is provided, comprising:

[0046] The first partitioning module is used to divide the original alarm dataset into multiple original alarm data subsets according to the different attribute values ​​of the first preset alarm attribute.

[0047] The second partitioning module is used to partition multiple initial alarm datasets from each original alarm data subset according to a preset time window and a preset step size; the initial alarm datasets include multiple initial alarm information, and the initial alarm information includes multiple preset alarm attributes;

[0048] The modification module is used to modify each preset alarm attribute in each initial alarm dataset to the corresponding digital identifier according to the pre-stored mapping relationship between multiple preset alarm attributes and digital identifiers, so as to obtain multiple identifierd alarm datasets for each original alarm data subset.

[0049] The extraction module is used to extract alarm information combinations that have association rules from multiple identifiable alarm datasets using a preset association rule extraction algorithm; the alarm information combination consists of two or three alarm information.

[0050] According to a third aspect of this application, an electronic device is provided, comprising: a processor and a memory communicatively connected to the processor;

[0051] The memory stores computer-executed instructions;

[0052] The processor executes computer execution instructions stored in the memory to implement the method as described in the first aspect.

[0053] According to a fourth aspect of this application, a computer-readable storage medium is provided, wherein computer-executable instructions are stored therein, which, when executed by a processor, are used to implement the method as described in the first aspect.

[0054] The association rule extraction method, apparatus, device, and storage medium provided in this application divide the original alarm dataset into multiple original alarm data subsets according to different attribute values ​​of a first preset alarm attribute; divide multiple initial alarm datasets from each original alarm data subset according to a preset time window and a preset step size; each initial alarm dataset includes multiple initial alarm information, and each initial alarm information includes multiple preset alarm attributes; modify each preset alarm attribute in each initial alarm dataset to a corresponding digital identifier according to a pre-stored mapping relationship between multiple preset alarm attributes and digital identifiers, thereby obtaining multiple identifierd alarm datasets for each original alarm data subset; and use a preset association rule extraction algorithm to extract alarm information combinations with association rules from the multiple identifierd alarm datasets; each alarm information combination consists of two or three alarm information. By dividing the original alarm dataset into multiple subsets based on different attribute values ​​of the first preset alarm attribute, and limiting the association rules to different attribute values ​​of the first preset alarm attribute, the space complexity of extracting association rules is reduced. Furthermore, by dividing the original alarm dataset into multiple initial alarm datasets based on preset time windows and preset step sizes, the time range of the association rules is limited, further reducing the time complexity of extracting association rules. Simultaneously, by modifying each preset alarm data in the alarm information to a corresponding numerical identifier, and using alarm identifiers to represent alarm information, the character length of each alarm message is reduced, thereby reducing the computational load of querying and comparison during association rule extraction. In summary, the solution of this application can reduce the computational complexity of extracting association rules and improve the efficiency of association rule extraction. Attached Figure Description

[0055] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0056] Figure 1 This is a network architecture diagram corresponding to the application scenario of the association rule extraction method provided in the embodiments of this application;

[0057] Figure 2 This is a flowchart illustrating the association rule extraction method provided in Embodiment 1 of this application;

[0058] Figure 3 This is a flowchart illustrating the association rule extraction method provided in Embodiment 2 of this application;

[0059] Figure 4 This is a flowchart illustrating the association rule extraction method provided in Embodiment 3 of this application;

[0060] Figure 5 This is a schematic diagram of the association rule extraction device provided in Embodiment 4 of this application;

[0061] Figure 6 This is a schematic diagram of the structure of an electronic device provided according to Embodiment 5 of this application.

[0062] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0063] The prior art involved in this application will be described in detail and analyzed below.

[0064] Suppose I is a set of items, and database D contains multiple transactions, each of which is a non-empty subset of I. For an association rule that includes items X and Y, its support in D is the probability that X and Y both appear in a transaction in D, and its confidence in D is the probability that Y appears in the same transaction after X has appeared in a transaction in D.

[0065] If the support of "X→Y" in D meets the preset support and the confidence level in D meets the preset confidence level, then "X→Y" is considered valuable. The preset support and preset confidence levels can be set based on the experience of the staff or business needs.

[0066] Alarm messages are information generated and sent to the operations support system by telecommunications operators' support equipment when a fault occurs. For example, when a switch experiences a link transmission failure, it will send an alarm message indicating the switch link transmission failure to the operator's support system. Alarm messages reflect the operational status of the support equipment, and thus, the operational status of the operator's network.

[0067] There are often correlation rules between different alarm messages. For example, when a switch experiences a link failure, it will also cause a router connected to the switch to experience a link failure, and both the switch and the router will generate alarm messages. In other words, there are correlation rules between alarm messages from switch link failures and alarm messages from router link failures.

[0068] By using the association rules between alarm information, early warnings can be given for faults in operator support equipment. Before a fault occurs, the equipment can be maintained or repaired to avoid failures in the operation support equipment and improve the stability of the operator's network.

[0069] For operator alarm data, each alarm message constitutes a transaction. With the development of communication technology, the number and types of alarm messages are increasing significantly. A single alarm message includes multiple alarm attributes, with an average character length exceeding 60 characters. Furthermore, there are tens of thousands of types of alarm messages. Therefore, extracting valuable association rules from alarm data involves unimaginable computational demands in traversal, comparison, and querying. As the number and types of alarm messages increase, existing servers struggle to extract valuable association rules from the database.

[0070] In summary, existing association rule extraction methods suffer from high computational complexity and low computational efficiency, making it difficult to extract valuable association rules from alarm data.

[0071] Therefore, when faced with the problems in the existing technology, the inventors, through creative research, have found that in order to improve the efficiency of extracting association rules from alarm information, the length of alarm information can be reduced, thereby reducing the amount of computation during traversal, comparison and query. At the same time, the correlation of alarm information is generally negatively correlated with the time interval, and the amount of computation can be further reduced by extracting association rules within a preset time window. Therefore, the inventors propose the following technical solution: The original alarm dataset is divided into multiple original alarm data subsets based on different attribute values ​​of a first preset alarm attribute; multiple initial alarm datasets are derived from each original alarm data subset based on a preset time window and a preset step size; each initial alarm dataset includes multiple initial alarm messages, and each initial alarm message includes multiple preset alarm attributes; based on a pre-stored mapping relationship between multiple preset alarm attributes and digital identifiers, each preset alarm attribute in each initial alarm dataset is modified to its corresponding digital identifier, resulting in multiple identifiable alarm datasets for each original alarm data subset; a preset association rule extraction algorithm is used to extract combinations of alarm messages with association rules from the multiple identifiable alarm datasets; each alarm message combination consists of two or three alarm messages. By dividing the original alarm dataset into multiple subsets based on different attribute values ​​of the first preset alarm attribute, and limiting the association rules to different attribute values ​​of the first preset alarm attribute, the space complexity of extracting association rules is reduced. Furthermore, by dividing the original alarm dataset into multiple initial alarm datasets based on preset time windows and preset step sizes, the time range of the association rules is limited, further reducing the time complexity of extracting association rules. Simultaneously, by modifying each preset alarm data in the alarm information to a corresponding numerical identifier, and using alarm identifiers to represent alarm information, the character length of each alarm message is reduced, thereby reducing the computational load of querying and comparison during association rule extraction. In summary, the solution of this application can reduce the computational complexity of extracting association rules and improve the efficiency of association rule extraction.

[0072] The association rule extraction method, apparatus, device, and storage medium provided in this application aim to solve the above-mentioned technical problems of the prior art. The technical solutions of this application and how they solve the aforementioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0073] The network architecture and application scenarios of the association rule extraction method provided in the embodiments of this application will be described below. When the following description refers to the accompanying drawings, unless otherwise indicated, the same data in different drawings represent the same or similar elements.

[0074] Figure 1 This is a network architecture diagram corresponding to the application scenario of the association rule extraction method provided in the embodiments of this application. For example... Figure 1 As shown, the network architecture corresponding to an application scenario provided in this application embodiment includes: electronic device 10, at least one operation support device 11, and operator support system 12.

[0075] When a fault occurs in any of the operation support devices 11, an alarm message is sent to the operation support system 12. The operation support system 13 receives the alarm message sent by each operation support device 11, forms the original alarm data, and stores it.

[0076] Electronic device 10 can obtain the original alarm dataset from operator support system 12, and divide the original alarm dataset into multiple original alarm dataset subsets according to different attribute values ​​of the first preset alarm attribute; according to preset time window and preset step size, multiple initial alarm datasets are divided from each original alarm dataset subset; the initial alarm dataset includes multiple initial alarm information, and the initial alarm information includes multiple preset alarm attributes; according to the pre-stored mapping relationship between multiple preset alarm attributes and digital identifiers, each preset alarm attribute in each initial alarm dataset is modified to the corresponding digital identifier, thereby obtaining multiple identifiable alarm datasets of each original alarm dataset subset; using a preset association rule extraction algorithm, alarm information combinations with association rules are extracted from the multiple identifiable alarm datasets; the alarm information combination consists of two or three alarm information.

[0077] The embodiments of this application will now be described with reference to the accompanying drawings. The embodiments described below do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0078] Example 1

[0079] Figure 2 This is a flowchart illustrating the association rule extraction method provided in Embodiment 1 of this application. Figure 2 As shown, the executing entity of this application is an association rule extraction device, which is located in an electronic device. The association rule extraction method provided in this embodiment includes steps 201 to 204.

[0080] Step 201: Divide the original alarm dataset into multiple original alarm data subsets according to the different attribute values ​​of the first preset alarm attribute.

[0081] In this embodiment, the association rules for alarm information are divided into association rules within the same professional category and association rules across different professional categories. Professional category is an alarm attribute in the alarm information; for example, the professional category could be wireless network.

[0082] When the association rules to be mined are of the same professional type, the first preset alarm attribute can be wireless network. The extraction scope of the association rules can be a subset of each original alarm data set. When the association rules to be mined are of different professional types, the first preset alarm attribute can be the data center name, and the extraction scope of the association rules can be the original alarm dataset.

[0083] In this embodiment, by dividing the original alarm dataset into multiple subsets, the extraction of association rules for both same-professional and cross-professional types can be satisfied. Furthermore, these multiple subsets can be distributed across different servers or computers for processing, improving efficiency.

[0084] Step 202: Based on the preset time window and preset step size, divide the original alarm data into multiple initial alarm datasets; the initial alarm datasets include multiple initial alarm information, and the initial alarm information includes multiple preset alarm attributes.

[0085] In this embodiment, since the correlation of alarm information is generally negatively correlated with the time interval, if the goal is to extract association rules that can be used to provide early warnings for support equipment failures, the preset time window needs to be longer than the early warning processing time. If a second alarm occurs shortly after the first alarm in the key rule, for example, within one minute, then even if early warnings for subsequent alarms can be issued based on the first alarm, there will not be enough time to perform maintenance and repairs on the support equipment based on the second alarm. Therefore, the preset time window can be set according to user needs.

[0086] The preset time window is used to limit the duration of the impact of the first alarm information on the second alarm information in the extracted association rules. Here, since the alarm information includes the occurrence time of the supporting equipment failure, the impact of the first alarm information on the second alarm information can be understood as how long the failure of the supporting equipment in the first alarm information will affect other supporting equipment.

[0087] The preset step size is used to divide the original alarm data subset into multiple initial alarm datasets with a preset time window length. A smaller preset step size results in a larger number of initial alarm datasets, increasing the computational cost of association rule extraction but making it easier to extract association rules. Conversely, a larger preset step size results in a smaller number of initial alarm datasets and reduces the computational cost of association rule extraction.

[0088] For example, if the original alarm data subset is a collection of alarm information with a length of 20 minutes, the preset time window is 10 minutes, and the preset step size is 1 minute, then 11 initial alarm datasets can be divided from the original alarm data subset, which are composed of minutes 0-10, 1-11, 2-12, 3-13, 4-14, 5-15, 6-16, 7-17, 8-18, 9-19, and 10-20 of the original alarm dataset.

[0089] Step 203: Based on the pre-stored mapping relationship between multiple preset alarm attributes and digital identifiers, modify each preset alarm attribute in each initial alarm dataset to the corresponding digital identifier, thereby obtaining multiple identifierd alarm datasets for each original alarm data subset.

[0090] In this embodiment, the preset alarm attributes are represented by text, and the numerical identifiers are represented by numbers. For example, for the equipment manufacturer in the alarm information, manufacturer A is mapped to numerical identifier 01, and manufacturer B is mapped to numerical identifier 02. For the alarm name in the alarm information, the synthesized input optical power is mapped to numerical identifier 1235, and the received line-side signal loss is mapped to numerical identifier 1004. Therefore, the numerical identifier 01 for equipment manufacturer A in the alarm information is modified, the numerical identifier 02 for equipment manufacturer B is modified, the numerical identifier 1235 is modified for low synthesized input optical power, and the numerical identifier 1004 is modified for received line-side signal loss.

[0091] In this embodiment, after modifying each preset alarm attribute in the initial alarm information to its corresponding numerical identifier, the initial alarm information can be represented by an alarm identifier, which includes multiple numerical identifiers. For example, in the alarm information, if the alarm type is wireless network, the data center name is Area A, Town A, aggregation data center, the equipment manufacturer is A, the equipment model is 10011, and the alarm name is "composite input optical power too low," then this alarm information can be represented by the alarm identifier as 08-19001-02-235-1235, where 08, 19001, 02, 235, and 1235 are the numerical identifiers corresponding to wireless network, Area A, Town A, aggregation data center, equipment manufacturer A, equipment model 10011, and composite input optical power too low, respectively.

[0092] This embodiment significantly reduces the character length of alarm information and improves the efficiency of alarm information retrieval by modifying each preset alarm attribute to a corresponding numerical identifier, with the alarm identifier representing the alarm information.

[0093] Step 204: Using a preset association rule extraction algorithm, extract alarm information combinations with association rules from multiple identifiable alarm datasets; the alarm information combination consists of two or three alarm information.

[0094] In this embodiment, the preset association rule extraction algorithm can be the FP-growth algorithm, the Ecalt algorithm, etc. After shortening the character length of the alarm message, the computational complexity of the association rule extraction algorithm in repeatedly querying, comparing, and scanning the alarm message when extracting association rules can be reduced.

[0095] In this embodiment, a preset association rule extraction algorithm is used to calculate the confidence and support of each association rule by querying, comparing, and scanning each alarm message in each identifiable alarm dataset. Furthermore, alarm message combinations whose confidence meets a preset confidence level and whose support meets a preset support level are identified as having association rules.

[0096] Optionally, the default association rule extraction algorithm is the Ecalt algorithm.

[0097] The association rule extraction method provided in this embodiment divides the original alarm dataset into multiple original alarm data subsets based on different attribute values ​​of a first preset alarm attribute; it then divides each original alarm data subset into multiple initial alarm datasets based on a preset time window and a preset step size; each initial alarm dataset includes multiple initial alarm messages, and each initial alarm message includes multiple preset alarm attributes; based on a pre-stored mapping relationship between multiple preset alarm attributes and digital identifiers, each preset alarm attribute in each initial alarm dataset is modified to its corresponding digital identifier, resulting in multiple identifierd alarm datasets for each original alarm data subset; a preset association rule extraction algorithm is used to extract combinations of alarm messages with association rules from the multiple identifierd alarm datasets; each alarm message combination consists of two or three alarm messages. Because multiple initial alarm data are divided from the original alarm data dataset based on a preset time window and a preset step size, the time range of the association rules is limited, enabling the extraction of only association rules within the preset time window, thus reducing the time complexity of association rule extraction. Meanwhile, by modifying the preset alarm attributes in the alarm information to corresponding numerical identifiers, using numbers to represent alarm attributes and alarm identifiers to represent alarm information, the character length of each alarm message can be reduced, thereby reducing the computational load during association rule extraction. In summary, the solution proposed in this application can reduce the computational complexity of extracting association rules and improve the efficiency of association rule extraction.

[0098] As an optional implementation, based on Embodiment 1, the original alarm dataset includes multiple original alarm information, the original alarm information includes multiple preset alarm attributes, the first preset alarm attribute is one of the multiple preset alarm attributes, and step 201 is further refined to include step 2011.

[0099] Step 2011: Divide the original alarm information with the same attribute value of the first preset alarm attribute into the same original alarm data subset.

[0100] In this embodiment, different attribute values ​​of the first preset alarm attribute can be used to distinguish alarm information sent by different types of devices. The original alarm information with the same attribute value of the first preset alarm attribute is divided into the same original alarm data subset, so that the data in an original alarm data subset are all of the same type of device, thereby improving the correlation of alarm information in the original alarm data subset.

[0101] The association rule extraction method provided in this embodiment uses an original alarm dataset that includes multiple original alarm messages. Each original alarm message includes multiple preset alarm attributes, with a first preset alarm attribute being one of these preset attributes. Original alarm messages with the same value for the first preset alarm attribute are grouped into the same subset of original alarm data. Because original alarm messages with the same value for the first preset alarm attribute are grouped into the same subset, the correlation between alarm messages within each subset of original alarm data can be improved, reducing the computational load for extracting association rules.

[0102] As an optional implementation, based on any of the above embodiments, the original alarm information also includes the alarm occurrence time and alarm cancellation time. Furthermore, if step 202 is refined, then step 202, "dividing multiple initial alarm datasets from each original alarm data subset according to a preset time window and a preset step size", is further refined to include steps 2021 to 2022.

[0103] Step 2021: According to the preset time window and preset step size, slide the window on each subset of original alarm data to divide it into multiple initial alarm time periods.

[0104] In this embodiment, the preset time window is the sliding window time length, and the preset step size is the sliding window time interval. By sliding the window on a subset of the original alarm data, multiple parallel alarm time periods can be divided from a subset of the original alarm data. The length of each initial alarm time period is the same as the preset time window.

[0105] Step 2022: Determine the original alarm information that meets the preset conditions within each initial alarm time period as the initial alarm information in each initial alarm dataset; the preset conditions are that the alarm occurrence time is within the initial alarm time period and the alarm cancellation time is outside the initial alarm time period.

[0106] In this embodiment, after a failure occurs in the operation support equipment, an alarm message is sent, which includes the alarm occurrence time. If the staff completes the repair of the operation support equipment failure, the alarm disappearance time is recorded in the alarm message. Alternatively, the operation support equipment failure message will also send an alarm message including the alarm cancellation time. Since alarm messages that have been cancelled or repaired within the time window are not very meaningful for extracting association rules, this embodiment only focuses on alarm messages that have occurred within a preset time period but have not yet been cancelled.

[0107] The association rule extraction method provided in this embodiment includes alarm occurrence time and alarm cancellation time in the original alarm information. It divides the original alarm data subset into multiple initial alarm time periods by applying a sliding window according to a preset time window and a preset step size. The original alarm information within each initial alarm time period that meets preset conditions is determined as the initial alarm information in each initial alarm dataset. The preset conditions are that the alarm occurrence time is within the initial alarm time period and the alarm cancellation time is outside the initial alarm time period. Because the original alarm information that meets the preset conditions is determined as the initial alarm information in each initial alarm dataset, the amount of data for extracting association rules is reduced, thereby reducing the computational load for extracting association rules.

[0108] As an optional implementation, based on any of the above embodiments, the mapping relationship between multiple preset alarm attributes and digital identifiers includes: digital identifiers corresponding to multiple attribute values ​​of each preset alarm attribute. Furthermore, if step 203 is refined, then step 203, "modifying each preset alarm attribute in each initial alarm dataset to its corresponding digital identifier according to the pre-stored mapping relationship between multiple preset alarm attributes and digital identifiers, and obtaining multiple identifiable alarm datasets of each original alarm data subset", is further refined to include steps 2031 to 2033.

[0109] Step 2031: For each preset alarm attribute of each initial alarm information, query the numerical identifier corresponding to the attribute value of the preset alarm attribute in the preset alarm attribute and numerical identifier mapping relationship.

[0110] In this embodiment, the alarm information includes multiple alarm attributes. The preset alarm attributes are those used to extract association rules from the alarm information. It is understood that some alarm attributes are of concern to the operator, while others are not. Therefore, association rules can be extracted from the attributes that the operator cares about.

[0111] In this embodiment, it is understood that each preset alarm attribute can include at least one attribute value. For example, the equipment manufacturer can be A, B, or C, and the data center name can be the name of a data center in a different location. However, the attribute values ​​of each preset alarm attribute can be exhaustively enumerated. Therefore, each attribute value of each preset alarm attribute can be pre-numbered or encoded so that each attribute value of each preset alarm attribute corresponds one-to-one with a numerical identifier. The attribute values ​​of each preset alarm attribute and their corresponding numerical identifiers are then stored to form multiple preset alarm attribute-numerical identifier mapping relationships.

[0112] Step 2032: Modify the attribute value of the preset alarm attribute to the corresponding numerical identifier.

[0113] In this embodiment, the numerical identifier corresponding to the attribute value of a preset alarm attribute can be queried in the preset alarm attribute and numerical identifier mapping relationship, and then modified to the corresponding numerical identifier. Since each attribute value of each preset alarm attribute corresponds one-to-one with a numerical identifier, the combination of each numerical identifier can also identify an alarm message.

[0114] Step 2033: Iterate through the preset alarm attributes of each initial alarm information to obtain multiple identifiable alarm datasets of each original alarm data subset.

[0115] In this embodiment, by modifying each preset alarm attribute of each initial alarm message to its corresponding numerical identifier, multiple identifiable alarm datasets can be obtained. Each identifiable alarm dataset includes multiple alarm identifiers, and each alarm identifier is composed of multiple numerical identifiers.

[0116] The association rule extraction method provided in this embodiment includes a mapping relationship between multiple preset alarm attributes and numerical identifiers, which includes numerical identifiers corresponding to multiple attribute values ​​of each preset alarm attribute. For each preset alarm attribute of each initial alarm information, the method queries the mapping relationship between preset alarm attributes and numerical identifiers to find the numerical identifier corresponding to the attribute value of the preset alarm attribute; modifies the attribute value of the preset alarm attribute to the corresponding numerical identifier; and iterates through each preset alarm attribute of each initial alarm information to obtain multiple identifiable alarm datasets for each original alarm data subset. Because modifying the attribute values ​​of preset alarm attributes to corresponding numerical identifiers reduces the character length of alarm information, it further reduces the computational load for extracting association rules.

[0117] Example 2

[0118] Figure 3 This is a flowchart illustrating the association rule extraction method provided in Embodiment 2 of this application. Figure 3As shown, the association rule extraction method provided in this embodiment, based on any of the above embodiments, includes multiple alarm identifiers in the identified alarm dataset. The alarm identifiers are composed of numerical identifiers corresponding to each preset alarm attribute of the initial alarm information. Furthermore, step 204 is refined to include steps 301 to 304.

[0119] Step 301: Calculate the merging frequency of each alarm identifier combination in each original alarm data subset; the merging frequency is the number of identifiable alarm datasets in each original alarm data subset that include each alarm identifier combination; the alarm identifier combination consists of two or three alarm identifiers.

[0120] As an optional implementation, step 301, "calculating the combined frequency of each alarm identifier combination", can be further refined to include steps 3011 to 3013.

[0121] Step 3011: Traverse each alarm identifier in each identifiable alarm dataset to determine whether each alarm identifier combination appears in each identifiable alarm dataset.

[0122] In this embodiment, since each alarm attribute in the alarm information is known, and the corresponding numerical identifier for each alarm attribute is also known, each alarm identifier is also known. Consequently, the combinations of alarm identifiers are also known and can be exhaustively enumerated. An alarm identifier combination consists of two or three alarm identifiers. By traversing all alarm identifiers in each identifiable alarm dataset, if all alarm identifiers in an alarm identifier combination appear in the identifiable alarm dataset, then that alarm identifier combination appears in that identifiable alarm dataset.

[0123] Step 3012: If it is determined that the alarm identifier combination appears in the identifierd alarm dataset, then the combined frequency of the alarm identifier combination in the identifierd alarm dataset is set to 1; if it is determined that the alarm identifier combination does not appear in the identifierd alarm dataset, then the combined frequency of the alarm identifier combination in the identifierd alarm dataset is set to 0.

[0124] In this embodiment, for any identifiable alarm dataset, if an alarm identifier combination appears in it, regardless of whether it appears once or multiple times, the combined frequency of the alarm identifier combination appearing in the identifiable alarm dataset is recorded as 1. If the alarm identifier combination does not appear in it, the combined frequency of the alarm identifier combination appearing in the identifiable alarm dataset is recorded as 0.

[0125] Step 3013: The sum of the combined frequencies of each alarm identifier combination in multiple identifiable alarm datasets belonging to the same original alarm data subset is determined as the combined frequency of each alarm identifier combination in each original alarm data subset.

[0126] In this embodiment, the frequency of alarm identifier combinations in the original alarm data subset is the number of times the alarm identifier appears in each identifiable alarm dataset in the original alarm data subset. Therefore, the frequency of alarm identifier combinations in multiple identifiable alarm datasets belonging to the same original alarm data subset can be summed to determine the frequency of alarm identifier combinations in the original alarm data subset.

[0127] In this embodiment, alarm identifier combinations appearing in each identifiable alarm dataset can be combined to form an alarm identifier combination list. Then, the alarm identifier combination lists formed from each identifiable alarm dataset are merged, and the merging frequency of each alarm identifier combination in each original alarm data subset is calculated.

[0128] The association rule extraction method provided in this embodiment determines whether each alarm identifier combination appears in each identifiable alarm dataset by traversing each alarm identifier in each identifiable alarm dataset. If it is determined that the alarm identifier combination appears in the identifiable alarm dataset, the combined frequency of the alarm identifier combination in the identifiable alarm dataset is set to 1. If it is determined that the alarm identifier combination does not appear in the identifiable alarm dataset, the combined frequency of the alarm identifier combination in the identifiable alarm dataset is set to 0. The sum of the combined frequencies of each alarm identifier combination in multiple identifiable alarm datasets belonging to the same original alarm data subset is determined as the combined frequency of each alarm identifier combination in each original alarm data subset. Since if it is determined that an alarm identifier combination appears in the identifiable alarm dataset, the combined frequency of the alarm identifier combination in the identifiable alarm dataset is set to 1, and if it is determined that an alarm identifier combination does not appear in the identifiable alarm dataset, the combined frequency of the alarm identifier combination in the identifiable alarm dataset is set to 0, the combined frequency of each alarm identifier combination in each identifiable alarm dataset can be calculated quickly.

[0129] Step 302: Based on the merging frequency of each alarm identifier combination, the number of identifiable alarm datasets in each original alarm data subset, and the number of original alarm data subsets, calculate the association support of each alarm identifier combination in each original alarm data subset and the association confidence of each alarm identifier combination in the original alarm dataset.

[0130] As an optional implementation, step 302 can be further refined to include steps 3021 to 3022, which are: "Calculate the association support of each alarm identifier combination in each original alarm data subset and the association confidence of each alarm identifier combination in the original alarm dataset based on the merging frequency of each alarm identifier, the number of identifiable alarm datasets in each original alarm data subset, and the number of original alarm data subsets".

[0131] Step 3021: The ratio of the combined frequency of each alarm identifier combination in each original alarm data subset to the number of identifiable alarm datasets in each original alarm data subset is determined as the association support of each alarm identifier combination in each original alarm data subset.

[0132] In this embodiment, the association support is the probability of an association rule appearing in the dataset. Therefore, the association support of an alarm identifier is the ratio of the combined frequency of each alarm identifier combination in each original alarm data subset to the number of identifiable alarm datasets in the original alarm data subset.

[0133] Step 3022: The ratio of the number of alarm identifier combinations whose combined frequency is not zero in each original alarm data subset to the number of original alarm data subsets is determined as the association confidence of each alarm identifier combination in the original alarm dataset.

[0134] In this embodiment, the first preset alarm attribute can be a data center. Therefore, the association confidence level reflects the frequency of alarm identifier combinations appearing in the data center. When the first preset alarm attribute is a professional type or other alarm attribute, the association confidence level reflects the frequency of alarm identifier combinations appearing on different first preset alarm attributes. The association confidence level avoids information bias caused by uneven equipment numbers or uneven equipment numbers within the data center. For example, some association rules may frequently appear in large data centers simply because there are more devices in large data centers. By using the first preset alarm attribute, the original alarm dataset is divided into multiple original alarm data subsets. The ratio of the number of alarm identifier combinations with a non-zero merge frequency in each original alarm data subset to the number of original alarm data subsets is determined as the association confidence level of each alarm identifier combination in the original alarm dataset. This reduces the likelihood of extracted association rules not conforming to reality due to information bias caused by uneven equipment numbers.

[0135] The association rule extraction method provided in this embodiment determines the association support of each alarm identifier combination in each original alarm data subset by the ratio of the merging frequency of each alarm identifier combination in each original alarm data subset to the number of identifiable alarm datasets in each original alarm data subset; and determines the association confidence of each alarm identifier combination in the original alarm data subset by the ratio of the number of non-zero merging frequencies of each alarm identifier combination in each original alarm data subset to the number of original alarm data subsets. Since the association confidence of each alarm identifier combination in the original alarm data subset is determined by the ratio of the number of non-zero merging frequencies of each alarm identifier combination in each original alarm data subset to the number of original alarm data subsets, and each original alarm data subset has the same attribute value on the first preset alarm attribute, the association confidence can be transformed from the probability of occurrence to which first preset alarm attributes it occurs on, thus redefining an association confidence that is more consistent with the operator's alarm data.

[0136] Step 303: Based on the association support of each alarm label combination and the association confidence of each alarm label combination, determine the alarm label combinations with association rules.

[0137] In this embodiment, alarm flag combinations with association support greater than a preset support threshold and confidence greater than a preset confidence threshold can be identified as alarm flag combinations with association rules.

[0138] Step 304: Based on the mapping relationship between multiple preset alarm attributes and digital identifiers, modify two or three alarm identifiers in the alarm identifier combination to the corresponding alarm information to obtain alarm information combinations with association rules.

[0139] In this embodiment, since there is a one-to-one correspondence between alarm identifiers and alarm information, the numerical identifier in the alarm identifier can be modified to the corresponding alarm attribute to obtain the alarm information corresponding to the alarm identifier, thus obtaining the alarm information combination with association rules.

[0140] In this embodiment, alarm information combinations with association rules can also be sorted according to the association confidence level, and a preset number of alarm information combinations with higher association confidence levels can be displayed to the user.

[0141] Optionally, the preset number can be 5, with the 5 most common alarm message combinations accounting for more than 98% of all associated rules.

[0142] The association rule extraction method provided in this embodiment involves: 1) A unique alarm dataset includes multiple alarm identifiers, each composed of a digital identifier corresponding to a preset alarm attribute of the initial alarm information; 2) Calculating the merging frequency of each alarm identifier combination in each original alarm data subset; 3) The merging frequency is the number of unique alarm datasets in each original alarm data subset that include each alarm identifier combination; 4) An alarm identifier combination consists of two or three alarm identifiers; 5) Calculating the association support and association confidence of each alarm identifier combination in each original alarm data subset based on the merging frequency, the number of unique alarm datasets in each original alarm data subset, and the number of original alarm data subsets; 6) Determining alarm identifier combinations with association rules based on the association support and association confidence of each alarm identifier combination; 7) Modifying two or three alarm identifiers in an alarm identifier combination to their corresponding alarm information based on the mapping relationship between multiple preset alarm attributes and digital identifiers, thereby obtaining alarm information combinations with association rules. Since alarm identifier combinations with associated rules are determined based on their association support and association confidence, it is possible to identify such combinations based on these correlations. Furthermore, by using multiple preset mapping relationships between alarm attributes and numerical identifiers, two or three alarm identifiers in an alarm identifier combination can be modified to their corresponding alarm information. Therefore, alarm identifiers can be transformed into their corresponding alarm information, and even after reducing the computational load of extracting association rules, combinations of alarm information with associated rules can still be obtained.

[0143] As an optional implementation, based on any of the above embodiments, step 303 can be further refined. Step 303, "determine the alarm identifier combination with association rules based on the association support of each alarm identifier combination and the association confidence of each alarm identifier combination", can be further refined to include steps 3031 to 3034.

[0144] Step 3031: Obtain the preset weights of each alarm flag combination.

[0145] In this embodiment, the preset weight of the alarm information combination can be determined as the preset weight of the corresponding alarm identifier combination. The preset weight of the alarm information combination can be pre-set. Since there are many types of operator alarm information, some alarm information has a significant impact, such as cell outage, which will affect the Internet experience of all users in the cell, while some alarm information has almost no impact, such as switch link transmission failure, which generally only affects the data of one transmission. Therefore, the importance of different alarm information combinations is also different, and the weights of different alarm information combinations can be pre-set according to the importance of the alarm information in the alarm information combination.

[0146] Step 3021: The association support of each alarm identifier combination is calculated using preset weights.

[0147] In this embodiment, a preset weight is used to calculate the association support of each alarm identifier combination, which can remove alarm identifier combinations that users do not care about or have low importance, while retaining alarm identifier combinations that users care about or have higher importance.

[0148] Step 3033: The alarm flag combination with a weighted calculated correlation support greater than or equal to the preset support and a correlation confidence greater than or equal to the preset confidence is determined as the candidate flag combination.

[0149] In this embodiment, preset support and preset reliability are the criteria for determining whether a combination of alarm identifiers has a correlation. The lower the values ​​of preset support and preset reliability, the more association rules are extracted, but the lower the correlation between the association rules; the higher the preset support and preset reliability, the fewer association rules are extracted, but the higher the correlation between the association rules.

[0150] Step 3034: Sort the candidate identifiers by association confidence from highest to lowest, and determine the preset number of candidate identifier combinations as alarm identifier combinations with association rules.

[0151] In this embodiment, when there are multiple candidate identifier combinations that meet the preset support and confidence requirements, the candidate identifier combinations can be sorted from highest to lowest association confidence, and the candidate identifier combinations with higher confidence are identified as alarm identifier combinations with association rules. Here, since the redefined association confidence is the frequency of occurrence of an alarm identifier combination under different attribute values ​​of the first preset attribute, alarm identifier combinations that appear under more attribute values ​​of the first preset attribute have smaller information bias and higher reliability. Identifying them as alarm identifier combinations with association rules is more consistent with the characteristics of operator alarm information.

[0152] The association rule extraction method provided in this embodiment obtains a preset weight for each alarm identifier combination; calculates the association support of each alarm identifier combination using the preset weight; determines alarm identifier combinations whose weighted association support is greater than or equal to the preset support and whose association confidence is greater than or equal to the preset confidence as candidate identifier combinations; and sorts the candidate identifier combinations from highest to lowest association confidence and determines a preset number of candidate identifier combinations as alarm identifier combinations with association rules. Because the association confidence is sorted from highest to lowest and a preset number of candidate identifier combinations are determined as alarm identifier combinations with association rules, alarm identifier combinations that better match the characteristics of operator alarm information can be selected.

[0153] Example 3

[0154] Figure 4 This is a flowchart illustrating the association rule extraction method provided in Embodiment 3 of this application. Figure 4 As shown, the association rule extraction method provided in this embodiment, based on any of the above embodiments, after step 204 "using a preset association rule extraction algorithm to extract alarm information combinations with association rules from multiple identifiable alarm datasets", also includes steps 401 to 403.

[0155] Step 401: Obtain real-time alarm information.

[0156] In this embodiment, real-time alarm information refers to alarm information sent from the operation support equipment to the operation support system in real time.

[0157] Step 402: If it is determined that the real-time alarm information includes the first alarm information, then issue a warning for the second alarm information. The first alarm information and the second alarm information are a combination of alarm information with association rules.

[0158] In this embodiment, alarm information combinations with associated rules are extracted and used for early warning. For example, a switch link transmission failure can trigger an early warning for cell outage. If the first alarm information is detected in the real-time alarm messages, an early warning can be issued for the second alarm information, allowing staff to check or maintain the equipment corresponding to the second alarm information in advance, avoiding large-scale impacts such as cell outages and improving the stability of the operator's network. The first and second alarm information are alarm information combinations with associated rules.

[0159] Step 403: If it is determined that the real-time alarm information includes the third alarm information and the fourth alarm information, then issue a warning for the fifth alarm information. The third alarm information, the fourth alarm information and the fifth alarm information are a combination of alarm information with association rules.

[0160] Similar to step 402, for an alarm information combination consisting of three alarm information, a warning can be issued for the fifth alarm information when the third alarm information and the fourth alarm information are detected simultaneously. The third alarm information, the fourth alarm information, and the fifth alarm information are alarm information combinations with associated rules.

[0161] The association rule extraction method provided in this embodiment obtains real-time alarm information; if it is determined that the real-time alarm information includes a first alarm, then a warning is issued for a second alarm, where the first and second alarms are a combination of alarms with association rules; if it is determined that the real-time alarm information includes a third and a fourth alarm, then a warning is issued for a fifth alarm, where the third, fourth, and fifth alarms are a combination of alarms with association rules. Because warnings are issued for potential alarms by obtaining real-time alarm information, maintenance and repair of operational support equipment can be performed in advance, improving the stability of the operator's network.

[0162] The technical solution of this application will be further illustrated by the following examples.

[0163] Example 1

[0164] Assume that n is the alarm type, with an order of magnitude of 10^4; N is the device type, with an order of magnitude of 10^2; m is the number of network elements of the same type, with an order of magnitude of 10^4; and M is the number of computer rooms, with an order of magnitude of 10^4.

[0165] The association rule extraction method in this application, when calculating association support and association confidence by merging frequencies, has computational complexity including the computational complexity of alarm combination generation. And the computational complexity of merging frequency .in, and This refers to the number of alarm message combinations consisting of two and three alarm messages, respectively. When the first preset alarm attribute is network element type, the number of network elements of the same type, *m*, is the number of subsets of the original alarm data. Overall time complexity: It is approximately o(10^15).

[0166] When calculating association support and association confidence without using frequency merging, the computational complexity includes the computational complexity of generating alarm combinations. And the computational complexity of merging frequency Overall time complexity: It is approximately o(10^18).

[0167] C1 and C2 are constant coefficients used in time complexity calculations.

[0168] The above analysis shows that the computational complexity of calculating association support and association confidence by merging frequency is three orders of magnitude lower than that of calculating association support and association confidence without merging frequency.

[0169] Example 2

[0170] Using 10 days of alarm information as the test dataset, and estimating an average of 350,000 alarm messages per day, the W-Eclat algorithm took approximately 180 seconds (on the order of 10^2) to extract association rules from one day's data; approximately 711 seconds (on the order of 10^3) ​​from two days' data; approximately 1553 seconds (on the order of 10^4) from three days' data; approximately 2447 seconds (on the order of 10^4) from four days' data; and approximately 4071 seconds (on the order of 10^4) from five days' data. The extraction time increases logarithmically with the data size n, increasing by nln(n). It is difficult to calculate the association relationships in alarm data exceeding 10 days.

[0171] Using the association rule extraction method of this application, it takes about 1 second to extract association rules from one day's data; about 20 seconds from two days' data; about 32 seconds from three days' data; about 41 seconds from four days' data; and about 49 seconds from five days' data.

[0172] The above comparison shows that, taking three days of alarm data as an example, it takes 1553 seconds to extract association rules using traditional algorithms, while the association rule extraction method of this application only takes 32.6 seconds.

[0173] Table 1 shows the number of association rules extracted using traditional algorithms and the number of association rules extracted using the association rule extraction method of this application. Where m is the number of network elements of the same type.

[0174] Table 1

[0175]

[0176] When the preset support and preset reliability of the association rule extraction method in this application are sufficiently low, the association rule results extracted by the two methods are completely consistent, and both can mine all alarm rules. However, at this time, the number of recommended rules will be very large, resulting in a low hit rate. Therefore, the association rule extraction method in this application has higher computational efficiency for mining alarm data of tens of millions.

[0177] Meanwhile, the method in this application modifies each preset alarm attribute in each initial alarm dataset to a corresponding numerical identifier. This reduces the character length of alarm information identified by a combination of five attributes from an average length of 61 to an average length of 15 for the alarm identifier. For example, "Wireless network, East Suburb Town Aggregation Room in Area A, Equipment Manufacturer A, 10011, Synthetic Input Optical Power Too Low" is transformed into "08-19001-02-235-1235", where "10011" is the equipment model and the corresponding numerical identifier is "235". This reduces the query comparison computation from 61^2 to 15^2, a difference of 16.5 times, further reducing the computational load of the basic operations for extracting association rules.

[0178] Example 4

[0179] Figure 5 This is a schematic diagram of the association rule extraction device provided in Embodiment 4 of this application. Figure 5 As shown, the association rule extraction device 50 provided in this embodiment includes: a first division module 51, a second division module 52, a modification module 53, and an extraction module 54.

[0180] The first partitioning module 51 is used to partition the original alarm dataset into multiple original alarm data subsets according to the different attribute values ​​of the first preset alarm attribute.

[0181] The second partitioning module 52 is used to partition multiple initial alarm datasets from each original alarm data subset according to a preset time window and a preset step size; the initial alarm datasets include multiple initial alarm information, and the initial alarm information includes multiple preset alarm attributes.

[0182] The third partitioning module 53 is used to modify each preset alarm attribute in each initial alarm dataset to the corresponding digital identifier according to the pre-stored mapping relationship between multiple preset alarm attributes and digital identifiers, so as to obtain multiple identifierd alarm datasets of each original alarm data subset.

[0183] The extraction module 54 is used to extract alarm information combinations with association rules from multiple identifiable alarm datasets using a preset association rule extraction algorithm; the alarm information combination consists of two or three alarm information.

[0184] As an optional implementation, the original alarm dataset includes multiple original alarm information, and the original alarm information includes multiple preset alarm attributes. The first preset alarm attribute is one of the multiple preset alarm attributes. The first partitioning module 51 is specifically used to partition the original alarm information with the same attribute value of the first preset alarm attribute into the same original alarm data subset.

[0185] As an optional implementation, the original alarm information also includes the alarm occurrence time and alarm cancellation time. The second division module 52 is specifically used to divide multiple initial alarm time periods by sliding a window on each subset of original alarm data according to a preset time window and a preset step size; and to determine the original alarm information that meets the preset conditions within each initial alarm time period as the initial alarm information in each initial alarm dataset; the preset conditions are that the alarm occurrence time is within the initial alarm time period and the alarm cancellation time is outside the initial alarm time period.

[0186] As an optional implementation, the mapping relationship between multiple preset alarm attributes and digital identifiers includes: digital identifiers corresponding to multiple attribute values ​​of each preset alarm attribute. The modification module 53 is specifically used to: for each preset alarm attribute of each initial alarm information, query the digital identifier corresponding to the attribute value of the preset alarm attribute in the mapping relationship between preset alarm attributes and digital identifiers; modify the attribute value of the preset alarm attribute to the corresponding digital identifier; traverse each preset alarm attribute of each initial alarm information to obtain multiple identifierd alarm datasets of each original alarm data subset.

[0187] As an optional implementation, the identifiable alarm dataset includes multiple alarm identifiers, each composed of a digital identifier corresponding to a preset alarm attribute of the initial alarm information. The extraction module 54 is specifically used to: calculate the merging frequency of each alarm identifier combination in each original alarm data subset; the merging frequency is the number of identifiable alarm datasets in each original alarm data subset that include each alarm identifier combination; each alarm identifier combination consists of two or three alarm identifiers; based on the merging frequency of each alarm identifier combination, the number of identifiable alarm datasets in each original alarm data subset, and the number of original alarm data subsets, calculate the association support of each alarm identifier combination in each original alarm data subset, and the association confidence of each alarm identifier combination in the original alarm dataset; based on the association support and association confidence of each alarm identifier combination, determine the alarm identifier combinations with association rules; and based on the mapping relationship between multiple preset alarm attributes and digital identifiers, modify two or three alarm identifiers in the alarm identifier combination to the corresponding alarm information to obtain alarm information combinations with association rules.

[0188] As an optional implementation, the extraction module 54 is specifically used to traverse each alarm identifier in each identifiable alarm dataset, determine whether each alarm identifier combination appears in each identifiable alarm dataset; if it is determined that the alarm identifier combination appears in the identifiable alarm dataset, then the combined frequency of the alarm identifier combination in the identifiable alarm dataset is determined to be 1; if it is determined that the alarm identifier combination does not appear in the identifiable alarm dataset, then the combined frequency of the alarm identifier combination in the identifiable alarm dataset is determined to be 0; the sum of the combined frequencies of each alarm identifier combination in multiple identifiable alarm datasets belonging to the same original alarm data subset is determined as the combined frequency of each alarm identifier combination in each original alarm data subset.

[0189] As an optional implementation, the extraction module 54 is further configured to: determine the association support of each alarm identifier combination in each original alarm data subset as the ratio of the merging frequency of each alarm identifier combination in each original alarm data subset to the number of identifiable alarm datasets in each original alarm data subset; and determine the association confidence of each alarm identifier combination in the original alarm dataset as the ratio of the number of non-zero merging frequencies of each alarm identifier combination in each original alarm data subset to the number of original alarm data subsets.

[0190] As an optional implementation, the extraction module 54 is further configured to: obtain the preset weight of each alarm identifier combination; perform weighted calculation on the correlation support of each alarm identifier combination using the preset weight; determine the alarm identifier combination whose weighted correlation support is greater than or equal to the preset support and whose correlation confidence is greater than or equal to the preset confidence as a candidate identifier combination; and determine the preset number of candidate identifier combinations as alarm identifier combinations with correlation rules according to the correlation confidence from largest to smallest.

[0191] As an optional implementation, the preset association rule extraction device 50 further includes an early warning module, which is used to: acquire real-time alarm information; if it is determined that the real-time alarm information includes a first alarm information, then issue an early warning for the second alarm information, wherein the first alarm information and the second alarm information are a combination of alarm information with association rules; if it is determined that the real-time alarm information includes a third alarm information and a fourth alarm information, then issue an early warning for the fifth alarm information, wherein the third alarm information, the fourth alarm information and the fifth alarm information are a combination of alarm information with association rules.

[0192] The association rule extraction device provided in this embodiment can execute the association rule extraction method provided in any of the above embodiments. The specific implementation and principle are similar, and will not be described again here.

[0193] Example 5

[0194] Figure 6This is a schematic diagram of the structure of an electronic device according to Embodiment 5 of this application. Figure 6 As shown, the electronic device 60 provided in this embodiment includes a memory 61 and a processor 62 that is communicatively connected to the memory 61.

[0195] Memory 61 stores computer-executed instructions.

[0196] Transceiver 63 is used for sending and receiving data.

[0197] The processor 62 executes the computer execution instructions stored in the memory 61 to implement the association rule extraction method provided in any of the above embodiments. The specific implementation method and principle are similar and will not be described again here.

[0198] Optionally, the electronic device 60 may also include a transceiver for sending and receiving data.

[0199] The memory 61, processor 62, and transceiver can communicate via a bus. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be categorized into address bus, data bus, control bus, etc. For ease of representation, Figure 6 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0200] The memory 61 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk, etc.

[0201] In an exemplary embodiment, the electronic device 60 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0202] Embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions. When executed by a processor, these instructions are used to implement the association rule extraction method provided in any of the above embodiments. Exemplarily, the computer-readable storage medium may be a read-only memory (ROM), random access memory (RAM), magnetic tape, floppy disk, or optical data storage device, etc.

[0203] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the module division in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple modules can be combined, or integrated into another system, or some features can be ignored or not executed.

[0204] Furthermore, unless otherwise specified, the functional modules in the various embodiments of this application can be integrated into one module, or each module can exist physically separately, or two or more modules can be integrated together. The integrated modules described above can be implemented in hardware or as software program modules.

[0205] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0206] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0207] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0208] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for extracting association rules, characterized in that, include: Based on the different attribute values ​​of the first preset alarm attribute, the original alarm dataset is divided into multiple original alarm data subsets; Based on a preset time window and a preset step size, multiple initial alarm datasets are divided from each original alarm data subset; each initial alarm dataset includes multiple initial alarm information, and each initial alarm information includes multiple preset alarm attributes; Based on the pre-stored mapping relationship between multiple preset alarm attributes and digital identifiers, each preset alarm attribute in each initial alarm dataset is modified to the corresponding digital identifier, thereby obtaining multiple identifierd alarm datasets for each original alarm data subset. A preset association rule extraction algorithm is used to extract alarm information combinations that have association rules from multiple identifiable alarm datasets; the alarm information combination consists of two or three alarm information. The identifiable alarm dataset includes multiple alarm identifiers, each of which consists of a numerical identifier corresponding to a preset alarm attribute of the initial alarm information. The method employs a preset association rule extraction algorithm to extract combinations of alarm information that exhibit association rules from multiple identifiable alarm datasets, including: Calculate the merging frequency of each alarm identifier combination in each original alarm data subset; the merging frequency is the number of identifiable alarm datasets in each original alarm data subset that include each alarm identifier combination; the alarm identifier combination consists of two or three alarm identifiers; Based on the combined frequency of each alarm identifier combination, the number of identifiable alarm datasets in each original alarm data subset, and the number of original alarm data subsets, calculate the association support of each alarm identifier combination in each original alarm data subset and the association confidence of each alarm identifier combination in the original alarm dataset. Based on the association support and association confidence of each alarm identifier combination, determine the alarm identifier combinations with association rules. Based on the mapping relationship between the multiple preset alarm attributes and digital identifiers, two or three alarm identifiers in the alarm identifier combination are modified to the corresponding alarm information to obtain an alarm information combination with association rules.

2. The method according to claim 1, characterized in that, The original alarm dataset includes multiple original alarm information, and the original alarm information includes multiple preset alarm attributes, wherein the first preset alarm attribute is one of the multiple preset alarm attributes; The original alarm dataset is divided into multiple subsets of original alarm data based on different attribute values ​​of the first preset alarm attribute, including: Original alarm information with the same attribute value of the first preset alarm attribute is divided into the same original alarm data subset.

3. The method according to claim 2, characterized in that, The original alarm information also includes the alarm occurrence time and alarm cancellation time; The process involves dividing the original alarm data sets into multiple initial alarm datasets based on preset time windows and preset step sizes, including: According to the preset time window and preset step size, slide the window on each subset of original alarm data to divide multiple initial alarm time periods; Within each initial alarm time period, the original alarm information that meets the preset conditions is determined as the initial alarm information in each initial alarm dataset; the preset conditions are that the alarm occurrence time is within the initial alarm time period and the alarm cancellation time is outside the initial alarm time period.

4. The method according to claim 1, characterized in that, The mapping relationship between the multiple preset alarm attributes and digital identifiers includes: digital identifiers corresponding to multiple attribute values ​​of each preset alarm attribute; The step involves modifying each preset alarm attribute in each initial alarm dataset to its corresponding digital identifier based on a pre-stored mapping relationship between multiple preset alarm attributes and digital identifiers, thereby obtaining multiple identifier-based alarm datasets for each subset of original alarm data, including: For each preset alarm attribute of each initial alarm message, query the numerical identifier corresponding to the attribute value of the preset alarm attribute in the mapping relationship between the preset alarm attribute and the numerical identifier; Modify the attribute value of the preset alarm attribute to the corresponding numeric identifier; Iterate through the preset alarm attributes of each initial alarm message to obtain multiple identifiable alarm datasets for each original alarm data subset.

5. The method according to claim 1, characterized in that, The calculation of the combined frequency of each alarm identifier combination includes: Iterate through each alarm identifier in each identifiable alarm dataset to determine whether each combination of alarm identifiers appears in each identifiable alarm dataset; If it is determined that the alarm identifier combination appears in the identifiable alarm dataset, then the combined frequency of the alarm identifier combination in the identifiable alarm dataset is set to 1; if it is determined that the alarm identifier combination does not appear in the identifiable alarm dataset, then the combined frequency of the alarm identifier combination in the identifiable alarm dataset is set to 0. The sum of the combined frequencies of each alarm identifier combination in multiple identifiable alarm datasets belonging to the same original alarm data subset is determined as the combined frequency of each alarm identifier combination in each original alarm data subset.

6. The method according to claim 1, characterized in that, The step of calculating the association support of each alarm identifier combination in each original alarm data subset and the association confidence of each alarm identifier combination in the original alarm dataset based on the combined frequency of each alarm identifier combination, the number of identifiable alarm datasets in each original alarm data subset, and the number of original alarm data subsets includes: The ratio of the combined frequency of each alarm identifier combination in each original alarm data subset to the number of identifiable alarm datasets in each original alarm data subset is determined as the association support of each alarm identifier combination in each original alarm data subset. The association confidence of each alarm identifier combination in the original alarm dataset is determined by the ratio of the number of non-zero merge frequencies of each alarm identifier combination in each original alarm data subset to the number of original alarm data subsets.

7. The method according to claim 1, characterized in that, The step of determining alarm identifier combinations with associated rules based on the association support and association confidence of each alarm identifier combination includes: Obtain the preset weights for each alarm flag combination; The association support of each alarm identifier combination is calculated by weighting it using preset weights; Alarm identifier combinations whose weighted association support is greater than or equal to a preset support and whose association confidence is greater than or equal to a preset confidence are determined as candidate identifier combinations. The alarm flag combinations are determined by sorting the association confidence levels from highest to lowest and selecting a preset number of candidate flag combinations as those with association rules.

8. The method according to claim 1, characterized in that, After extracting alarm information combinations with associated rules from multiple identifiable alarm datasets using a preset association rule extraction algorithm, the process further includes: Obtain real-time alarm information; If it is determined that the real-time alarm information includes the first alarm information, then the second alarm information is given a warning. The first alarm information and the second alarm information are a combination of alarm information with association rules. If it is determined that the real-time alarm information includes the third alarm information and the fourth alarm information, then the fifth alarm information will be given a warning. The third alarm information, the fourth alarm information and the fifth alarm information are a combination of alarm information with association rules.

9. An association rule extraction device, characterized in that, include: The first partitioning module is used to divide the original alarm dataset into multiple original alarm data subsets according to the different attribute values ​​of the first preset alarm attribute. The second partitioning module is used to partition multiple initial alarm datasets from each original alarm data subset according to a preset time window and a preset step size; the initial alarm datasets include multiple initial alarm information, and the initial alarm information includes multiple preset alarm attributes; The modification module is used to modify each preset alarm attribute in each initial alarm dataset to the corresponding digital identifier according to the pre-stored mapping relationship between multiple preset alarm attributes and digital identifiers, so as to obtain multiple identifierd alarm datasets for each original alarm data subset. The extraction module is used to extract alarm information combinations that have association rules from multiple identifiable alarm datasets using a preset association rule extraction algorithm; the alarm information combination consists of two or three alarm information pieces. The identifiable alarm dataset includes multiple alarm identifiers, each of which consists of a numerical identifier corresponding to a preset alarm attribute of the initial alarm information. The extraction module is specifically used to calculate the merging frequency of each alarm identifier combination in each original alarm data subset; the merging frequency is the number of identifiable alarm datasets in each original alarm data subset that include each alarm identifier combination; the alarm identifier combination consists of two or three alarm identifiers; Based on the combined frequency of each alarm identifier combination, the number of identifiable alarm datasets in each original alarm data subset, and the number of original alarm data subsets, calculate the association support of each alarm identifier combination in each original alarm data subset and the association confidence of each alarm identifier combination in the original alarm dataset. Based on the association support and association confidence of each alarm identifier combination, alarm identifier combinations with association rules are determined; based on the mapping relationship between the multiple preset alarm attributes and digital identifiers, two or three alarm identifiers in the alarm identifier combination are modified to the corresponding alarm information to obtain alarm information combinations with association rules.

10. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-8.

Images