Method and apparatus for locating a faulty device

Abstract

The application discloses a kind of positioning method and device of fault equipment, wherein, method includes: using fault work order to carry out reverse association alarm information extraction, obtain first set;According to the horizontal and vertical topological relationship between network elements, the first set is preprocessed, and second set is obtained;According to the alarm in second set, the second set is classified and handled according to network element name, and the alarm set corresponding to each network element name is obtained;The fusion feature value of each network element name corresponding alarm set is calculated by multidimensional feature fusion, and the matching alarm set is determined according to the fusion feature value;According to the network element name of matching alarm set and horizontal and vertical topological relationship, the associated alarm of matching alarm set is analyzed, and the fault equipment is obtained.The application reduces the redundancy of invalid data;Eliminate the invalid pseudo-association alarm in the actual scene of algorithm effective;Avoid the error generated by single feature data, improve the correlation of alarm.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of fault positioning, and in particular to a fault device positioning method and device, a computing device, and a computer storage medium. BACKGROUND

[0002] With the rapid development of scientific information technology, the network architecture of communication equipment is becoming increasingly complex, and the alarms generated by communication network faults are also showing a massive growth. Fault root cause positioning technology, as the core of communication network management, has always been a research hotspot. Due to the interconnection and correlation between communication networks, a root cause fault can generate multiple related alarms, and the alarm events (such as order assignment) generated by related alarms are associated with each other. Therefore, in a large communication network topology system, when a fault occurs in a certain node machine, it often leads to abnormal failure of other nodes connected to it, and thus a large number of non-root cause faults are generated, so it is impossible to locate the fault root cause from the numerous alarm information in time. At present, the alarm fault root cause positioning method is usually based on artificial experience to identify the root cause and analyze the root cause of the problem. Therefore, it has the disadvantages of low efficiency in identifying fault root cause and high cost of work order maintenance.

[0003] There are mainly two kinds of existing fault positioning technologies: one is to obtain alarms in a certain time period, analyze the characteristics of the events, and use a correlation classification method for classification algorithm processing to determine whether it is a root cause alarm. For example, in the prior art of "a fault root cause analysis method and device", the following method for determining the fault root cause is disclosed: obtaining a first alarm event set, extracting a feature vector in the set, applying the feature vector to a pre-set classification model to determine the fault root cause.

[0004] The other is based on a large number of existing fault reason logs for data mining and machine learning, to find out the rules of the occurrence of root cause logs, and to find out the appropriate mathematical analysis method for regular matching analysis of the logs near the online log fault point, so as to determine whether it is a root cause. For example, in the prior art of "a fault root cause method and analysis device", the following method for determining the fault root cause is disclosed: determining a fault time point of a network device; obtaining a first log information set generated by the network device in a first time period; analyzing each type of log information in the M-type log information according to a pre-set analysis strategy, and obtaining N-type root cause logs in the M-type log information; and determining the cause of the fault of the network device according to the N-type root cause logs.

[0005] However, both of the above methods need to rely on preset conditions, and the generation of the preset conditions is based on a large amount of existing alarm-related information, so the accuracy of fault analysis is greatly dependent on the accuracy of the preset conditions. The accuracy of fault analysis is affected by the accuracy of the preset conditions, and the accuracy of fault analysis will fluctuate, for example: the accuracy of fault analysis in the first prior art depends on the accuracy of the extracted feature set and the accuracy of the classification algorithm used in machine learning, and the accuracy of fault analysis in the second prior art depends on the experience of obtaining the fault log from the existing fault log and the accuracy of matching the related log subsequently.

[0006] Secondly, the fault event basic set data volume is relatively large, invalid data is not removed, the data processing efficiency is low, the fault data is not pre-processed, so as to reduce invalid data or data with small correlation, therefore, the data volume is too large, which leads to low operation efficiency.

[0007] Thirdly, the alarm feature set and the alarm event lack correlation, the features are not associated with the alarm events caused by the root cause, the event impact of the actual alarm is not taken as a condition for judging the fault root cause, only the root cause is inferred according to the generated alarm, and the correlation reliability is lack. SUMMARY

[0008] In view of the above problems, the present application is proposed in order to provide a fault device positioning method and device, a computing device and a computer storage medium which overcome the above problems or at least partially solve the above problems.

[0009] According to one aspect of the present application, a fault device positioning method is provided, comprising:

[0010] extracting alarm information by reverse correlation of fault work orders to obtain a first set containing a current alarm and at least one associated alarm of the current alarm;

[0011] preprocessing the first set according to horizontal and vertical topological relationships between network elements to obtain a second set after preprocessing;

[0012] classifying the alarms in the second set according to network element names to obtain an alarm set corresponding to each network element name;

[0013] calculating a fusion feature value of the alarm set corresponding to each network element name through multi-dimensional feature fusion, and determining a matching alarm set according to the fusion feature value;

[0014] analyzing the associated alarms of the matching alarm set according to the network element names of the matching alarm set and the horizontal and vertical topological relationships to obtain a fault device.

[0015] Further, the reverse correlation alarm information extraction using the fault work order further comprises:

[0016] extracting first alarm information of the current alarm from work order data of the fault work order; the first alarm information of the current alarm comprises an alarm serial number, an alarm occurrence time, an alarm title, and / or a network element name;

[0017] obtaining complete information of the current alarm using the alarm serial number and / or the alarm occurrence time of the first alarm information;

[0018] standardizing the complete information of the current alarm to obtain second alarm information of the current alarm; the second alarm information of the current alarm comprises a network management alarm ID and an IP address;

[0019] querying at least one associated alarm of the current alarm within a preset time period using a network element name equal to the network element name of the current alarm or a network management alarm ID equal to the network management alarm ID of the current alarm as a query condition;

[0020] obtaining a first set according to the current alarm and the at least one associated alarm.

[0021] Further, the preprocessing of the first set according to a horizontal and vertical topological relationship between network elements to obtain a second set after preprocessing further comprises:

[0022] generating the horizontal and vertical topological relationship between network elements in combination with cloud network resources;

[0023] traversing each associated alarm in the first set to determine whether there is a path between a node of the associated alarm in the horizontal and vertical topological relationship and a node of the current alarm in the horizontal and vertical topological relationship, if there is a path, the associated alarm is retained, and if there is no path, the associated alarm is removed, to obtain the second set after preprocessing.

[0024] Further, the calculation of a fusion feature value of an alarm set corresponding to each network element name through multi-dimensional feature fusion and the determination of a matching alarm set according to the fusion feature value further comprises:

[0025] calculating a fusion feature similarity between any two alarms in the alarm set corresponding to each network element name;

[0026] calculating a fusion feature value of the alarm set according to the fusion feature similarity between any two alarms in the alarm set and the number of alarms in the alarm set;

[0027] According to the fusion feature values of the alarm set corresponding to each network element name, the alarm set with the maximum fusion feature value is determined as a matched alarm set.

[0028] Further, the calculation of the fusion feature similarity between any two alarms in the alarm set corresponding to each network element name further comprises:

[0029] The alarm title similarity, the network management alarm ID similarity, the IP address similarity, the topological adjacency between nodes where the two alarms are located, and the alarm occurrence time similarity between any two alarms in the alarm set corresponding to each network element name are calculated respectively.

[0030] According to the alarm title similarity, the network management alarm ID similarity, the IP address similarity, the topological adjacency between nodes where the two alarms are located, and the alarm occurrence time similarity between the two alarms, the fusion feature similarity between the two alarms is calculated.

[0031] Further, the analysis of the associated alarms in the matched alarm set according to the network element name of the matched alarm set and the horizontal and vertical topological relationship to obtain the faulty device further comprises:

[0032] According to the network element name of the matched alarm set and the vertical topological relationship between network elements, the network element name of the lower-layer connected node of the network element name is obtained.

[0033] According to the network element name of the matched alarm set and the horizontal topological relationship between network elements, the network element name of the same-layer connected node of the network element name is obtained.

[0034] It is judged whether the network element name of the lower-layer connected node and the network element name of the same-layer connected node have corresponding alarm sets of the connected node, and the faulty device is obtained according to the network element name of the same-layer connected node, specifically:

[0035] If the network element name of the lower-layer connected node has a corresponding alarm set, attribute analysis is performed on all associated alarms in the alarm set to generate a text analysis set, the IP address is analyzed according to the text analysis set, and the faulty device is obtained according to the analyzed IP address.

[0036] If the network element name of the same-layer connected node has a corresponding alarm set, the faulty device is obtained according to the network element name of the same-layer connected node.

[0037] According to another aspect of the present application, a fault device positioning device is provided, comprising:

[0038] The reverse correlation module is configured to perform reverse correlation alarm information extraction using the fault work order to obtain a first set containing a current alarm and at least one associated alarm of the current alarm;

[0039] The preprocessing module is configured to preprocess the first set according to horizontal and vertical topological relations between network elements to obtain a second set after preprocessing;

[0040] The classification processing module is configured to perform classification processing on the alarms in the second set according to network element names to obtain alarm sets corresponding to each network element name;

[0041] The matching alarm set determination module is configured to calculate a fusion feature value of the alarm set corresponding to each network element name through multi-dimensional feature fusion, and determine a matching alarm set according to the fusion feature value;

[0042] The analysis module is configured to analyze the associated alarms of the matching alarm set according to the network element names of the matching alarm set and the horizontal and vertical topological relations to obtain a fault device.

[0043] According to another aspect of the present application, a computing device is provided, comprising a processor, a memory, a communication interface and a communication bus, the processor, the memory and the communication interface complete communication with each other through the communication bus;

[0044] The memory is configured to store at least one executable instruction, and the executable instruction causes the processor to perform operations corresponding to the fault device positioning method.

[0045] According to still another aspect of the present application, a computer storage medium is provided, and the storage medium stores at least one executable instruction, and the executable instruction causes the processor to perform operations corresponding to the fault device positioning method.

[0046] According to the fault device positioning method and device, the following beneficial effects are achieved:

[0047] Based on the one-way nature of alarms and alarm events, the fault work order and the alarm information are associated, the effectiveness of the first set data is improved, and the redundancy of invalid data is reduced. Based on the horizontal topological relation / vertical topological relation between network elements, the first set is preprocessed to eliminate invalid pseudo-associated alarms in the actual scene of the algorithm. Through multi-dimensional feature fusion calculation, errors caused by single feature data are avoided, and the correlation of alarms is improved.

[0048] According to the present application, the alarm information is obtained according to the fault work order, and the fault device is obtained by processing, so that the application does not need to depend on other preset conditions, and overcomes the problem that the result of fault analysis is inaccurate due to the dependence on preset conditions in the prior art.

[0049] The above description is only a summary of the technical scheme of the present application. In order to make the technical means of the present application more clearly understood and implemented according to the content of the specification, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the following specific embodiments of the present application are described. BRIEF DESCRIPTION OF DRAWINGS

[0050] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of the preferred embodiments and are not meant to limit the present application. Furthermore, the same reference numerals are used throughout the several views to denote the same or similar parts. In the drawings:

[0051] Figure 1 A flowchart of a method for locating a faulty device is shown;

[0052] Figure 2 A flowchart of a method for locating a faulty device is shown;

[0053] Figure 3 A longitudinal cloudification network topology diagram is shown;

[0054] Figure 4 A NFV horizontal cloudification network topology diagram is shown;

[0055] Figure 5 A horizontal topology relationship diagram determined by taking a 5GC network element as an example is shown;

[0056] Figure 6 A diagram showing the nodes of current alarms and associated alarms in a topology relationship is shown;

[0057] Figure 7 A diagram showing the nodes in a horizontal and longitudinal topology relationship is shown;

[0058] Figure 8 A diagram of a device for locating a faulty device is shown;

[0059] Figure 9 A structure diagram of a computing device is shown. DETAILED DESCRIPTION

[0060] Exemplary embodiments of the present application will be described herein below with reference to the accompanying drawings. While exemplary embodiments of the present application are shown in the drawings, it is understood that the present application can be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present application to those skilled in the art.

[0061] Figure 1 A flow chart of a method for locating a faulty device of the present application is shown, which is applied in a computing device. The computing device comprises a processor, a memory, a communication interface and a communication bus, the processor, the memory and the communication interface accomplish communication with each other through the communication bus; the memory is used to store at least one executable instruction, which makes the processor execute the operation corresponding to the method for locating a faulty device. As shown in the figure, the method comprises the following steps: Figure 1

[0062] Step 110: reverse correlation alarm information extraction is performed by using a fault work order, to obtain a first set S1 containing a current alarm and at least one associated alarm of the current alarm;

[0063] Wherein, the forward correlation adopts alarm-based inference of generated events, i.e. reason-based inference of results, which is actually invalid for fault location analysis. The reverse correlation adopts event-based inference of alarms, because there are many alarms generated in the system, but only a certain type of alarm is often focused on, selective extraction of events of this type of alarm can improve the effectiveness of the system and the timeliness of fault processing analysis, and ignore the impact caused by the variety of alarms.

[0064] Step 120: pre-processing is performed on the first set according to the horizontal and vertical topological relationship between network elements, to obtain a second set S2 after pre-processing;

[0065] Wherein, the horizontal and vertical topological relationship generation refers to the correlation representation of horizontal and vertical cloud network topology in the network element model. The horizontal and vertical topological relationship includes horizontal topological relationship and vertical topological relationship. The horizontal topological relationship describes the connection between network elements, different network elements are connected through specific ports, and the failure of a certain network element may cause the failure of other network elements connected thereto. The vertical topological relationship describes the connection between different network element levels, the network elements between the upper and lower levels having a connection, and the failure of a lower network element will cause the failure of an upper network element.

[0066] Step 130: classified processing is performed on the alarms in the second set according to the network element name, to obtain an alarm set corresponding to each network element name;

[0067] ​The network element name can correspond to a node on the horizontal and vertical topology relationship. The network element names in the alarm information generated due to failure of a node are the same, and the alarms have great relevance. Failure of a node adjacent to a layer can cause another node to generate a failure alarm. Failure of a lower layer node will certainly cause a failure alarm of an upper layer adjacent node.

[0068] In a specific implementation, the second set S2 is classified according to the network element names, and classified into S2-1 {alarm 1-1, alarm 1-2,...}... S2-n {alarm n-1, alarm n-2,...}, where n represents the number of different network element names, and n≥1.

[0069] In step 140, a fusion feature value of the alarm set corresponding to each network element name is calculated through multi-dimensional feature fusion, and a matched alarm set is determined according to the fusion feature value.

[0070] The three close relationships between multiple alarms caused by failure of a node in a network (NFV network) of a network function virtualization architecture are as follows. Relationship one: The proportion of similar alarm title fields of the multiple alarms is extremely high. For example, the alarm title of alarm 1 is link disconnection, the alarm title of alarm 2 is link disconnection, the network management alarm ID of alarm 1 is equal to the network management alarm ID of alarm 2, and the IP address of alarm 1 is equal to the IP address of alarm 2. Relationship two: The time interval between the alarms caused by the failure is extremely short. In a NFV network management system with a delay of seconds, the shorter the time interval between the failure and the alarm, the more it reflects the relevance. The alarms with a long time interval can be ignored in relation to the failure cause. Relationship three: In the network topology relationship, the probability of influence between adjacent nodes is relatively large, and the probability of mutual influence between non-adjacent nodes can be ignored. Non-adjacent nodes can be discussed and calculated as adjacent nodes.

[0071] Therefore, through multi-dimensional feature fusion calculation, multi-feature extraction of fusion of alarm time, alarm title, and topology features is realized, and errors caused by single feature extraction are avoided.

[0072] In step 150, the associated alarms of the matched alarm set are analyzed according to the network element names of the matched alarm set and the horizontal and vertical topology relationship, and a failure device is obtained.

[0073] In this optional mode, as Figure 2As shown, the fault event backtracking using the fault work order obtains a first set composed of alarm information and at least one associated alarm, the first set is preprocessed using the generated horizontal and vertical topology relationship to obtain a second set after preprocessing, the second set is classified according to the network element name to obtain a classified set corresponding to each network element name, and the classified set is calculated according to multi-dimensional feature fusion to obtain a matched alarm set. The associated alarm in the matched alarm set can be obtained by full-text analysis of the fault device.

[0074] In an optional manner, the step 110 uses the fault work order to extract the reverse associated alarm information, and the first set containing the current alarm and at least one associated alarm of the current alarm further comprises:

[0075] The first alarm information of the current alarm is extracted from the work order data of the fault work order; the first alarm information of the current alarm includes an alarm serial number, an alarm occurrence time, an alarm title and / or a network element name;

[0076] The alarm serial number and / or the alarm occurrence time of the first alarm information are used to obtain complete information of the current alarm;

[0077] The complete information of the current alarm is standardized to obtain second alarm information of the current alarm; the second alarm information of the current alarm contains a network management alarm ID and an IP address;

[0078] Within a preset time period, at least one associated alarm of the current alarm is queried as a query condition with the network element name equal to the network element name of the current alarm or the network management alarm ID equal to the network management alarm ID of the current alarm;

[0079] The first set is obtained according to the current alarm and the at least one associated alarm.

[0080] Specifically, the work order data of the fault work order contains work order topics, work order numbers, work order descriptions, work order assignment times, work order acceptance time limits, network element names, alarm serial numbers, acceptors, acceptance times, acceptance explanations, fault provinces and fault cities, etc. The alarm serial number is one-to-one corresponding to the alarm, and the alarm information can be obtained by reverse association using the work order attributes of the fault work order, for example: according to the one-to-one correspondence between the alarm serial number and the alarm, the alarm is reversely associated using the alarm serial number, and other alarm information of the alarm is obtained according to the alarm.

[0081] The following alarm information can be extracted from the above work order data, for example, the alarm occurrence time is “2021-07-26 14:50:51”, the network element name is “OMC”, the fault province is “Jiangsu Province”, the fault city is “Suzhou City”, the alarm serial number is “00000001111”, and the alarm title is “link disconnection”.

[0082] The alarm occurrence time and / or the alarm serial number in the extracted alarm information can be used to obtain complete alarm information of the current alarm.

[0083] The alarm information in the existing network management alarm includes hundreds of items, such as manufacturer alarm unique identifier, alarm occurrence time, specialty, manufacturer, device type, alarm object type, alarm title, alarm type, and the like, as shown in Table 1.

[0084] Table 1: Display table of part of alarm information in the existing network management alarm

[0085]

[0086]

[0087] Therefore, the complete information of the current alarm needs to be standardized. Each current alarm has a network management alarm ID attribute after standardization. The network management alarm ID refers to a unified code of the standardized alarm of a manufacturer. The code can determine a type of alarm, such as the same alarm in specialty, manufacturer, device type, alarm title, manufacturer alarm level, and the like. The alarm standardized by the network management alarm ID has standard alarm name, alarm level, alarm explanation, and the like. The alarm information after standardization is shown in Table 2.

[0088] Table 2: Alarm information after standardization

[0089]

[0090] The current alarm is simplified by the above standardization to include the following alarm information: alarm serial number, alarm occurrence time, network management alarm ID, network element name, alarm title, alarm province, alarm city, and IP address.

[0091] According to the network element name or the network management alarm ID of the current alarm, an associated alarm can be queried. Specifically, the delay of the network management alarm is in seconds. For example, when the associated alarm is extracted, the time period is set to 20 min, the query condition is that the network element name is equal to the network element name of the current alarm or the network management alarm ID is equal to the network management alarm ID of the current alarm, and the query time period is [alarm occurrence time-10 min, alarm occurrence time+10 min], so that at least one associated alarm of the current alarm in the preset time period can be queried.

[0092] According to the current alarm and the at least one associated alarm, a first set S1 can be obtained, S1={current alarm, List{all associated alarms queried}}.

[0093] In an alternative manner, step 120 pre-processes the first set according to the horizontal and vertical topological relationship between network elements to obtain a pre-processed second set further comprising:

[0094] combining the cloudified network resources to generate the horizontal and vertical topological relationship between network elements;

[0095] traversing each associated alarm in the first set to determine whether there is a path between the node of the associated alarm in the horizontal and vertical topological relationship and the node of the current alarm in the horizontal and vertical topological relationship, if there is a path, the associated alarm is retained, if there is no path, the associated alarm is removed, to obtain the pre-processed second set.

[0096] Specifically, combining the cloudified network resources to generate the horizontal and vertical topological relationship between network elements includes combining the cloudified network resources to generate a vertical cloudified network topology graph, and combining the cloudified network resources to generate an NFV horizontal cloudified network topology graph; wherein the vertical cloudified network topology graph includes multiple layers of topological connection relationships such as network element layer, virtual layer, host layer, TOR layer, EOR layer, routing layer, as shown in Figure 3 , the network element layer nodes correspond to a plurality of virtual machine layer nodes, each virtual machine layer node corresponds to a host layer node, each TOR layer node corresponds to a plurality of host layer nodes, the EOR layer includes a plurality of nodes, and each TOR layer node corresponds to an EOR layer node, and one EOR layer node corresponds to a routing layer node; in the NFV horizontal cloudified network topology graph, all basic network elements are hung on a bus, which is convenient for overall overview of the network elements, as shown in Figure 4 , the horizontal line in the figure represents the bus, and the nodes below represent the basic network element nodes; specifically, taking 5GC network elements as an example, the determined horizontal topological relationship is as shown in Figure 5 , wherein DRA, MME, SAEGW, MGW, SGSN, MSC SERVER, PGW, SGW, and PCRF represent each node, taking DRA and MME nodes as examples, the DRA node refers to a routing agent node, and the MME node refers to a key control node of a 3GPP protocol LTE access network, the DRA node has a horizontal topological relationship with the MME node through the interconnected MME host domain name, and the MME node has a horizontal topological relationship with the DRA node through the interconnected DRA host domain name.

[0097] combining the horizontal and vertical topological relationship in the cloudified network resources, and constantly polling all associated alarms found in the first set S1, as shown in Figure 6As shown, assuming that the current alarm is node A in the topology relationship, and the queried associated alarm is node B, there is a path between A and B in the horizontal and vertical topology relationship, i.e., V(A->B)=V(B->A)=1, the associated alarm corresponding to the node B is retained; V(A->D)=V(D->A)=0, the associated alarm corresponding to the node D is removed.

[0098] In an optional manner, step 140 calculates the fusion feature value of the alarm set corresponding to each network element name through multi-dimensional feature fusion, and determining the matched alarm set according to the fusion feature value further includes:

[0099] For the alarm set corresponding to each network element name, the fusion feature similarity between any two alarms in the alarm set is calculated.

[0100] According to the fusion feature similarity between any two alarms in the alarm set and the number of alarms in the alarm set, the fusion feature value of the alarm set is calculated.

[0101] According to the fusion feature value of the alarm set corresponding to each network element name, the alarm set with the largest fusion feature value is determined as the matched alarm set.

[0102] For the alarm set corresponding to each network element name, the fusion feature similarity between any two alarms in the alarm set is calculated further including:

[0103] For the alarm set corresponding to each network element name, the alarm title similarity, the network management alarm ID similarity, the IP address similarity, the topology adjacency between the nodes where the two alarms are located, and the alarm occurrence time similarity between any two alarms in the alarm set are calculated respectively.

[0104] According to the alarm title similarity, the network management alarm ID similarity, the IP address similarity, the topology adjacency between the nodes where the two alarms are located, and the alarm occurrence time similarity between the two alarms, the fusion feature similarity between the two alarms is calculated.

[0105] Specifically, for any one network element name (the i-th) corresponding alarm set S2-i{alarm i-1... alarm i-j... alarm i-m} (m represents the number of alarms in the alarm set S2-i, 1≤j≤m) attribute feature extraction can be carried out, and the attribute value set corresponding to each alarm can be obtained {A1, A2, A3... Aj... Am}, wherein Aj represents the attribute value set corresponding to the j-th alarm "alarm i-j" in the alarm set S2-i, Aj={a1... ak... an} (n represents the number of attribute values in the attribute value set Aj, 1≤k≤n), ak represents a certain attribute value corresponding to the j-th alarm "alarm i-j" in the alarm set S2-i, according to the description of the foregoing relationship one, some attributes of the associated alarms have great text similarity, according to the analysis of the NFV network management alarm, the alarm title (rough cause of failure), the network management alarm ID (device related attribute), the IP address (geographical location), and the alarm occurrence time are selected as the attribute features of the alarm; according to the description of the foregoing relationship two, the time characteristics and the failure also have strong correlation, therefore, the alarm occurrence time is selected as the attribute feature of the alarm; according to the description of the foregoing relationship three, the nodes in the network topology relationship and the failure also have strong correlation, therefore, the topological adjacency between the nodes where the two alarms are located is selected as the attribute feature of the alarm.

[0106] The alarm title similarity between two alarms is calculated by using the Jaro distance (text similarity between the strings of two alarm titles), and the calculation formula of the alarm title similarity between alarm i and alarm j is as follows:

[0107]

[0108] Wherein, Simji represents the alarm title similarity between alarm i and alarm j, S i represents the string length of alarm i, S j represents the string length of alarm j, m represents the number of matched characters, the greater the value of the alarm title similarity Simji between alarm i and alarm j, the higher the alarm title similarity between alarm i and alarm j.

[0109] The calculation formula of the network management alarm ID similarity between two alarms is as follows:

[0110]

[0111] Wherein, Vimji represents the network management alarm ID similarity between alarm i and alarm j, IDi represents the network management alarm ID of alarm i, IDj represents the network management alarm ID of alarm j, when the network management alarm ID of alarm i is equal to the network management alarm ID of alarm j, the value of the network management alarm ID similarity Vimji between alarm i and alarm j is equal to 1, otherwise the value of the network management alarm ID similarity Vimji between alarm i and alarm j is equal to 0.

[0112] The calculation formula of the IP address similarity between two alarms is as follows:

[0113]

[0114] Wherein, Limji represents the IP address similarity between alarm i and alarm j, L is the distance between the longitude and latitude of two specific positions calculated by calling the GIS interface provided by the map after converting the IP address of alarm i and the IP address of alarm j into the longitude and latitude of the specific geographic position, the greater the value of the IP address similarity Limji between alarm i and alarm j, the higher the IP address similarity between two alarms.

[0115] Based on the aforementioned horizontal and vertical topological relationship, the adjacent topological path N(i, j, k) (k≠0) between the nodes where two alarms are located is determined, wherein i represents the level, j represents the interval node in the same layer, and k represents the maximum value of the number of optional paths passing through all nodes on the path between the two nodes. When calculating the topological adjacency between the nodes where two alarms are located, the topological path between the nodes where two alarms are located needs to be calculated first, and then the topological adjacency between the nodes where two alarms are located is calculated according to the path; as shown in the following formula (3), the topological path between A and B is described as N(0, 1, 2), the topological path between D and E is described as N(1, 0, 2), and the topological path between D and G is described as N(1, 1, 2). Figure 7

[0116] Specifically, the calculation formula of the topological adjacency between the nodes where two alarms are located is as follows:

[0117]

[0118] Wherein, Toimji represents the topological adjacency between the nodes where alarm i and alarm j are located, the greater the value of the topological adjacency Toimji between the nodes where two alarms are located, the higher the adjacency of the nodes.

[0119] The calculation formula of the alarm occurrence time similarity between two alarms is as follows:

[0120]

[0121] ​Wherein, Timji represents the alarm occurrence time similarity between alarm i and alarm j, Dura represents the difference between alarm occurrence time of alarm i and alarm j after converting alarm occurrence time into seconds, when the difference between alarm occurrence time of alarm i and alarm j is within 1 second, the alarm occurrence time similarity between alarm i and alarm j is equal to 1, otherwise, the alarm occurrence time similarity between alarm i and alarm j is equal to the reciprocal of the difference between alarm occurrence time of alarm i and alarm j, wherein the greater the value of alarm occurrence time similarity Timji between alarm i and alarm j, the higher the alarm occurrence time similarity between alarm i and alarm j.

[0122] According to the alarm title similarity Simji, the network alarm ID similarity Vimji, the IP address similarity Limji, the topological adjacency Toimji between the nodes where the two alarms are located and the alarm occurrence time similarity Timji between the two alarms calculated above, the fusion feature similarity Sim between the two alarms can be calculated by the formula as follows

[0123]

[0124] That is, the fusion feature similarity Sim between alarm i and alarm j is equal to the average value of the alarm title similarity Simji, the network alarm ID similarity Vimji, the IP address similarity Limji, the topological adjacency Toimji between the nodes where the two alarms are located and the alarm occurrence time similarity Timji between the two alarms.

[0125] For any alarm set S2-i corresponding to a network element name {alarm i-1, alarm i-2... alarm i-m} (m represents the number of alarms in the alarm set S2-i), the fusion feature similarity Sim between any two alarms in the alarm set can be obtained by the above calculation, so that the fusion feature value T of the alarm set can be obtained by calculation according to the fusion feature similarity between any two alarms in the alarm set and the number of alarms in the alarm set. i The calculation formula is as follows:

[0126]

[0127] In the above formula, T i represents the fusion feature value of the alarm set S2-i, and m represents the number of alarms in the alarm set S2-i.

[0128] According to the above calculation formula, the fusion feature value T i of each alarm set can be calculated, so that the alarm set with the maximum fusion feature value T i can be obtained. iThe largest alarm set is the matched alarm set, so the matched alarm set can be determined.

[0129] In an optional mode, step 150 further comprises:

[0130] According to the network element name of the matched alarm set and the vertical topology relationship between network elements, the network element name of the lower-layer connection node of the network element name is obtained.

[0131] According to the network element name of the matched alarm set and the horizontal topology relationship between network elements, the network element name of the same-layer connection node of the network element name is obtained.

[0132] It is judged whether the network element name of the lower-layer connection node and the network element name of the same-layer connection node have corresponding alarm sets.

[0133] If the network element name of the lower-layer connection node has a corresponding alarm set, the IP address of the fault device is obtained according to the associated alarm in the corresponding alarm set of the network element name of the lower-layer connection node, and if the network element name of the same-layer connection node has a corresponding alarm set, the fault device is obtained according to the network element name of the same-layer connection node.

[0134] According to the matched alarm set and the horizontal and vertical topology relationship, the network element name of the lower-layer connection node and the same-layer connection node corresponding to the network element name can be obtained, so that the alarm set corresponding to the network element name of the lower-layer connection node or the alarm set corresponding to the network element name of the same-layer connection node can be determined according to the specific scene of the live network, so that the fault device can be found according to the determined alarm set, thereby having the advantages of small data processing amount and being able to directly find the fault root cause.

[0135] Specifically, if the matching alarm set is set as the alarm set S2-k corresponding to the network element name k, i.e., S2-k = {alarm k-1, alarm k-2,..., alarm k-m} (m represents the number of alarms in the alarm set S2-k), and the corresponding attribute value set is {A1, A2, A3,..., Am}, then the network element name of the lower-layer connected node of the network element name can be found by combining the network element name of the set S2-k and the vertical topology relationship, and the network element name of the same-layer connected node of the network element name can be found by combining the network element name of the set S2-k and the horizontal topology relationship, thereby the set Match(neName-1, neName-2) {S2-k} can be constructed. However, in the existing network scenario, the above set only has two cases: the set Match(neName-1) {S2-k} corresponding to the upper-layer and lower-layer devices or the set Match(neName-2) {S2-k} corresponding to the same-layer devices.

[0136] Secondly, according to the constructed set Match(neName-1, neName-2) {S2-k}, it is determined whether the network element name neName-1 and the network element name neName-2 have a corresponding alarm set in the second set S2:

[0137] If the network element name neName-1 of the lower-layer connected node of the network element name has a corresponding alarm set S2-i in the second set S2, the set Match(neName-1, neName-2) {S2-k} can be specifically represented as Match(neName-1) {S2-i}, and the fault device can be obtained according to the IP addresses parsed from all the associated alarms in the set Match(neName-1) {S2-i}.

[0138] If the network element name neName-2 of the same-layer connected node of the network element name has a corresponding alarm set S2-j in the second set S2, the set Match(neName-1, neName-2) {S2-k} can be specifically represented as Match(neName-2) {S2-j}, and the fault device can be obtained according to the network element name neName-2 of the same-layer connected node.

[0139] In an optional manner, if the network element name of the lower-layer connected node has a corresponding alarm set, the fault device is obtained according to the IP addresses parsed from the associated alarms in the alarm set corresponding to the network element name of the lower-layer connected node, and if the network element name of the same-layer connected node has a corresponding alarm set, the fault device is obtained according to the network element name of the same-layer connected node, specifically as follows:

[0140] If the network element name of the lower-layer connection node has a corresponding alarm set, attribute analysis is performed on all associated alarms in the alarm set to generate a text analysis set, an IP address is analyzed according to the text analysis set, and a fault device is obtained according to the analyzed IP address; specifically, attribute alarm text (alarm-text) analysis is performed on all associated alarms in the set Match (neName-1) {S2-i}, a text analysis set is generated, and if the set contains a peer between upper and lower layers, a subsequent IP address is analyzed, and the corresponding fault device is obtained by using the IP address.

[0141] If the network element name of the same-layer connection node has a corresponding alarm set, a fault device is obtained according to the network element name of the same-layer connection node.

[0142] By determining the fault device in different ways under two different conditions, the root cause of the fault can be found.

[0143] As described above, the positioning method of the fault device of the present application is based on the one-way nature of the alarm and the alarm event, and a method of inversely deducing the alarm based on the fault work order is proposed, the alarm event is associated with the alarm to obtain a first set, and the first set is independently extracted to reduce the coupling problem caused by the dependence on the preset condition.

[0144] Secondly, based on the alarm and the horizontal / vertical topology relationship, a method of preprocessing the first set through the horizontal / vertical topology relationship is proposed to obtain a second set, the horizontal / vertical topology relationship depends on the actual network relationship, and invalid data or data with small correlation degree are excluded, thereby avoiding the problem of low operation efficiency caused by too large amount of redundant data.

[0145] Thirdly, a multi-feature fusion calculation method based on alarm features, topology features and time features is proposed to improve the correlation of extracted alarms and avoid errors caused by single feature extraction.

[0146] Figure 8 A schematic diagram of an embodiment of a fault device positioning apparatus of the present application is shown. As shown in the figure, the apparatus comprises a reverse association module 210, a preprocessing module 220, a classification processing module 230, a matching alarm set determination module 240 and an analysis module 250. Figure 8

[0147] The reverse association module 210 is used for reverse association alarm information extraction by using a fault work order to obtain a first set containing a current alarm and at least one associated alarm of the current alarm.

[0148] The preprocessing module 220 is used for preprocessing the first set according to the horizontal / vertical topology relationship between network elements to obtain a second set after preprocessing.​

[0149] The categorization processing module 230 is configured to perform categorization processing on the alarms in the second set according to network element names, to obtain an alarm set corresponding to each network element name;

[0150] The matching alarm set determination module 240 is configured to calculate a fusion feature value of the alarm set corresponding to each network element name through multi-dimensional feature fusion, and determine a matching alarm set according to the fusion feature value;

[0151] The analysis module 250 is configured to analyze associated alarms of the matching alarm set according to a network element name of the matching alarm set and the horizontal-vertical topology relationship, to obtain a fault device.

[0152] In an optional manner, the reverse association module 210 extracts reverse association alarm information by using a fault work order, to obtain a first set containing a current alarm and at least one associated alarm of the current alarm, and the first set further includes:

[0153] The reverse association module 210 extracts first alarm information of the current alarm from work order data of the fault work order; the first alarm information of the current alarm includes an alarm serial number, an alarm occurrence time, an alarm title, and / or a network element name;

[0154] The reverse association module 210 obtains complete information of the current alarm by using the alarm serial number and / or the alarm occurrence time of the first alarm information;

[0155] The reverse association module 210 performs standardization processing on the complete information of the current alarm, to obtain second alarm information of the current alarm; the second alarm information of the current alarm contains a network management alarm ID and an IP address;

[0156] The reverse association module 210 queries at least one associated alarm of the current alarm by taking, as a query condition, a network element name equal to a network element name of the current alarm or a network management alarm ID equal to a network management alarm ID of the current alarm within a preset time period;

[0157] And the reverse association module 210 obtains the first set according to the current alarm and the at least one associated alarm.

[0158] In an optional manner, the preprocessing module 220 pre-processes the first set according to a horizontal-vertical topology relationship between network elements, to obtain a second set after preprocessing, and the preprocessing further includes:

[0159] The preprocessing module 220 generates the horizontal-vertical topology relationship between network elements in combination with cloudified network resources;

[0160] The preprocessing module 220 traverses each of the associated alarms in the first set, judges whether there is a path between the node of the associated alarm in the horizontal-vertical topology relationship and the node of the current alarm in the horizontal-vertical topology relationship, if there is a path, the associated alarm is retained, if there is no path, the associated alarm is removed, and a second set after preprocessing is obtained.

[0161] In an optional manner, the matching alarm set determination module 240 calculates the fusion feature value of the alarm set corresponding to each network element name through multi-dimensional feature fusion, and the determining of the matching alarm set further comprises:

[0162] For the alarm set corresponding to each network element name, the matching alarm set determination module 240 calculates the fusion feature similarity between any two alarms in the alarm set;

[0163] The matching alarm set determination module 240 calculates the fusion feature value of the alarm set according to the fusion feature similarity between any two alarms in the alarm set and the number of alarms in the alarm set;

[0164] The matching alarm set determination module 240 determines the alarm set with the largest fusion feature value as the matching alarm set according to the fusion feature value of the alarm set corresponding to each network element name.

[0165] For the alarm set corresponding to each network element name, the matching alarm set determination module 240 calculates the fusion feature similarity between any two alarms in the alarm set further comprises:

[0166] For the alarm set corresponding to each network element name, the matching alarm set determination module 240 respectively calculates the alarm title similarity, the network management alarm ID similarity, the IP address similarity, the topological adjacency between the nodes where the two alarms are located, and the alarm occurrence time similarity between any two alarms in the alarm set;

[0167] According to the alarm title similarity, the network management alarm ID similarity, the IP address similarity, the topological adjacency between the nodes where the two alarms are located, and the alarm occurrence time similarity between the two alarms, the matching alarm set determination module 240 calculates the fusion feature similarity between the two alarms.

[0168] In an optional manner, the parsing module 250 parses the associated alarms of the matching alarm set according to the network element name of the matching alarm set and the horizontal-vertical topology relationship, and obtains the fault equipment further comprising:

[0169] The analysis module 250 obtains the network element name of the lower-layer connection node of the network element name according to the network element name of the matched alarm set and the longitudinal topological relationship between the network elements;

[0170] The analysis module 250 obtains the network element name of the same-layer connection node of the network element name according to the network element name of the matched alarm set and the transverse topological relationship between the network elements;

[0171] The analysis module 250 judges whether the network element name of the lower-layer connection node and the network element name of the same-layer connection node have corresponding alarm sets;

[0172] If the network element name of the lower-layer connection node has a corresponding alarm set, the analysis module 250 obtains the fault device according to the IP address after the associated alarm in the corresponding alarm set of the network element name of the lower-layer connection node is analyzed; if the network element name of the same-layer connection node has a corresponding alarm set, the analysis module 250 obtains the fault device according to the network element name of the same-layer connection node.

[0173] In an optional mode, if the network element name of the lower-layer connection node has a corresponding alarm set, the analysis module 250 obtains the fault device according to the IP address after the associated alarm in the corresponding alarm set of the network element name of the lower-layer connection node is analyzed; if the network element name of the same-layer connection node has a corresponding alarm set, the analysis module 250 obtains the fault device according to the network element name of the same-layer connection node.

[0174] If the network element name of the lower-layer connection node has a corresponding alarm set, the analysis module 250 performs attribute analysis on all associated alarms in the alarm set to generate a text analysis set, analyzes the IP address according to the text analysis set, and obtains the fault device according to the analyzed IP address;

[0175] If the network element name of the same-layer connection node has a corresponding alarm set, the analysis module 250 obtains the fault device according to the network element name of the same-layer connection node.

[0176] In summary, the positioning device of the fault device is based on the one-way nature of the alarm and the alarm event, proposes a method of inversely deducing the alarm based on the fault work order, associates the alarm event with the alarm to obtain a first set, and independently extracts the first set to reduce the coupling problem caused by the dependence on the preset condition.

[0177] Secondly, based on the alarm and the transverse topological relationship / longitudinal topological relationship, a method of preprocessing the first set through the transverse topological relationship / longitudinal topological relationship is proposed to obtain a second set. The transverse topological relationship / longitudinal topological relationship depends on the actual network relationship, excludes invalid data or data with small correlation degree, and avoids the problem of low operation efficiency caused by too large redundant data.

[0178] Again, a multi-feature fusion calculation method based on alarm features, topology features and time features is proposed, which improves the correlation of extracted alarms and avoids errors caused by single feature extraction.

[0179] The embodiment of the application provides a non-volatile computer storage medium, which stores at least one executable instruction, and the computer executable instruction can execute the positioning method of the fault device in any method embodiment.

[0180] Figure 9 The structure schematic diagram of the computing device embodiment of the application is shown, and the specific implementation of the computing device is not limited in the specific embodiment of the application.

[0181] As shown in Figure 9 The computing device can include a processor 402, a communications interface 404, a memory 406, and a communications bus 408.

[0182] The processor 402, the communications interface 404, and the memory 406 can communicate with each other through the communications bus 408. The communications interface 404 is used to communicate with network elements such as clients or other servers. The processor 402 is used to execute the program 410, and can execute the related steps in the positioning method of the fault device for the computing device.

[0183] Specifically, the program 410 can include program code, and the program code includes computer operation instructions.

[0184] The processor 402 can be a central processing unit CPU, or an application specific integrated circuit ASIC, or one or more integrated circuits configured to implement the embodiments of the application. The one or more processors included in the fault device positioning device can be the same type of processor, such as one or more CPUs, or different types of processors, such as one or more CPUs and one or more ASICs.

[0185] The memory 406 is used to store the program 410. The memory 406 can include a high-speed RAM memory, and can also include a non-volatile memory, such as at least one disk memory.

[0186] The program 410 can be specifically used to enable the processor 402 to execute the positioning method of the fault device in any method embodiment.

[0187] The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other apparatus. Various general purpose systems can be used with programs in accordance with the teachings herein, or it can prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will be apparent from the description above. In addition, the present embodiments are not described with reference to any particular programming language. It will be appreciated that a variety of programming languages can be used to implement the teachings of the application as described herein, and any references below to specific languages are provided for disclosure of enablement only.

[0188] In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the application can be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been described in detail in order not to obscure the understanding of this description.

[0189] Similarly, it is to be understood that the mechanical details of the application that have been set forth in the description above of exemplary embodiments of the application are intended to be illustrative only. As such, the scope of the application is not to be construed as being limited to such preferred embodiments. In other instances, well-known structures and techniques have not been described in detail in order to avoid obscuring aspects of the present application.

[0190] It will be appreciated by those skilled in the art that the modules in the device of the embodiments can be adapted and placed in one or more devices other than the device of the embodiments. The modules or units or components in the embodiments can be combined into one module or unit or component and further can be divided into sub-modules or sub-units or sub-components. Except that at least some of such features and / or processes or units are mutually exclusive, any combination of all the features disclosed in the specification (including the accompanying claims, abstract and drawings), and all processes or units of any methods or apparatuses disclosed so far can be adopted. Unless explicitly stated otherwise, each feature disclosed in the specification (including the accompanying claims, abstract and drawings) can be replaced by alternative features that provide the same, equivalent or similar functionality.

[0191] Furthermore, those skilled in the art will recognize that, while certain embodiments described herein include certain features that are not included in other embodiments, combinations of features of the different embodiments are meant to be within the scope of the application and form different embodiments. For example, in the claims below, any of the claimed embodiments can be used in any combination.

[0192] Various component embodiments of the application can be implemented in hardware, or as software modules running in one or more processors, or in combinations thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all of the functionality of some or all of the components according to embodiments of the application. The application can also be implemented as a program of instructions for performing part or all of the methods described herein, e.g., a computer program and a computer program product. Such program of the application can be stored on a computer readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, or provided on a carrier medium, or in any other form.

[0193] It should be noted that the above-mentioned embodiments illustrate rather than limit the application, and that one skilled in the art will be able to design many alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word 'comprising' does not exclude the presence of elements or steps other than those listed in a claim. The word 'a' or 'an' preceding an element does not exclude the presence of a plurality of such elements. The application can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unitary claim, several devices, apparatuses or means can be listed, comprising means for performing a certain function. The means performed by one device, apparatus or means can also be performed by one or more of the other devices, apparatuses or means. The word 'processor' should be construed to cover any hardware component, and meanwhile one or more processors in a processing system. The word 'processor' can also cover a plurality of processors, e.g., in a multi-processor system. The embodiments were chosen and described in order to explain the principles of the application and the practical application thereof, and to allow others skilled in the art to understand the application for various embodiments with various modifications that are suited to the particular use contemplated.

Claims

1. A method of locating a faulty device, characterized by, The method comprises the following steps: extracting alarm information by reverse correlation using a fault work order to obtain a first set containing a current alarm and at least one associated alarm of the current alarm; preprocessing the first set according to horizontal and vertical topological relations between network elements to obtain a second set after preprocessing; classifying alarms in the second set according to network element names to obtain alarm sets corresponding to each network element name; calculating fusion feature values of the alarm sets corresponding to each network element name through multi-dimensional feature fusion, and determining a matching alarm set according to the fusion feature values; analyzing associated alarms of the matching alarm set according to network element names of the matching alarm set and the horizontal and vertical topological relations to obtain a fault device; The step of analyzing associated alarms of the matching alarm set according to network element names of the matching alarm set and the horizontal and vertical topological relations to obtain a fault device further comprises the following steps: obtaining network element names of lower-layer connection nodes of the network element name according to the network element names of the matching alarm set and vertical topological relations between network elements; obtaining network element names of same-layer connection nodes of the network element name according to the network element names of the matching alarm set and horizontal topological relations between network elements; determining whether the network element names of the lower-layer connection nodes and the network element names of the same-layer connection nodes have corresponding alarm sets; if the network element names of the lower-layer connection nodes have corresponding alarm sets, obtaining the fault device according to IP addresses of associated alarms after analysis of the corresponding alarm sets of the network element names of the lower-layer connection nodes, and if the network element names of the same-layer connection nodes have corresponding alarm sets, obtaining the fault device according to the network element names of the same-layer connection nodes.

2. The method of claim 1, wherein, The step of extracting alarm information by reverse correlation using a fault work order to obtain a first set containing a current alarm and at least one associated alarm of the current alarm further comprises the following steps: extracting first alarm information of the current alarm from work order data of the fault work order; the first alarm information of the current alarm includes an alarm serial number, an alarm occurrence time, an alarm title and / or a network element name; obtaining complete information of the current alarm using the alarm serial number and / or the alarm occurrence time of the first alarm information; standardizing the complete information of the current alarm to obtain second alarm information of the current alarm; the second alarm information of the current alarm contains a network management alarm ID and an IP address; querying at least one associated alarm of the current alarm within a preset time period using a network element name equal to the network element name of the current alarm or a network management alarm ID equal to the network management alarm ID of the current alarm as a query condition; obtaining a first set according to the current alarm and the at least one associated alarm.

3. The method of claim 1, wherein, The step of preprocessing the first set according to horizontal and vertical topological relations between network elements to obtain a second set after preprocessing further comprises the following steps: generating horizontal and vertical topological relations between network elements in combination with cloudified network resources; Traverse each associated alarm in the first set, judge whether there is a path between the node of the associated alarm in the horizontal and vertical topology relationship and the node of the current alarm in the horizontal and vertical topology relationship, if there is a path, keep the associated alarm, if there is no path, remove the associated alarm, obtain a second set after preprocessing.

4. The method of claim 1, wherein, The calculating the fusion feature value of the alarm set corresponding to each network element name by multi-dimensional feature fusion further comprises: For the alarm set corresponding to each network element name, the fusion feature similarity between any two alarms in the alarm set is calculated; According to the fusion feature similarity between any two alarms in the alarm set and the number of alarms in the alarm set, the fusion feature value of the alarm set is calculated; According to the fusion feature value of the alarm set corresponding to each network element name, the alarm set with the largest fusion feature value is determined as the matching alarm set.

5. The method of claim 4, wherein, The calculating the fusion feature similarity between any two alarms in the alarm set further comprises: For the alarm set corresponding to each network element name, the alarm title similarity, network management alarm ID similarity, IP address similarity, topology adjacency between the nodes where the two alarms are located, and alarm occurrence time similarity between any two alarms in the alarm set are calculated respectively; According to the alarm title similarity, network management alarm ID similarity, IP address similarity, topology adjacency between the nodes where the two alarms are located, and alarm occurrence time similarity between the two alarms, the fusion feature similarity between the two alarms is calculated.

6. The method of claim 1, wherein, If the network element name of the lower layer connection node has a corresponding alarm set, the fault device is obtained according to the parsed IP address of the associated alarm in the alarm set corresponding to the network element name of the lower layer connection node, and if the network element name of the same layer connection node has a corresponding alarm set, the fault device is obtained according to the network element name of the same layer connection node. If the network element name of the lower layer connection node has a corresponding alarm set, attribute analysis is performed on all associated alarms in the alarm set to generate a text analysis set, the IP address is parsed according to the text analysis set, and the fault device is obtained according to the parsed IP address; If the network element name of the same layer connection node has a corresponding alarm set, the fault device is obtained according to the network element name of the same layer connection node.

7. An apparatus for locating a faulted device, the apparatus comprising: It comprises: The reverse association module is used for extracting associated alarm information by using the fault work order to obtain a first set containing a current alarm and at least one associated alarm of the current alarm; The preprocessing module is used for preprocessing the first set according to the horizontal and vertical topology relationship between network elements to obtain a second set after preprocessing; The classification processing module is used for classifying the alarms in the second set according to network element names to obtain an alarm set corresponding to each network element name; The matching alarm set determination module is configured to calculate a fusion feature value of an alarm set corresponding to each network element name through multi-dimensional feature fusion, and determine a matching alarm set according to the fusion feature value; The analysis module is configured to analyze associated alarms of the matching alarm set according to the network element name of the matching alarm set and the horizontal-vertical topology relationship, and obtain a faulty device; The analysis module is further configured to: obtain a network element name of a lower-layer connection node of the network element name according to the network element name of the matching alarm set and a vertical topology relationship between network elements; obtain a network element name of a same-layer connection node of the network element name according to the network element name of the matching alarm set and a horizontal topology relationship between network elements; determine whether the network element name of the lower-layer connection node and the network element name of the same-layer connection node have corresponding alarm sets; if the network element name of the lower-layer connection node has a corresponding alarm set, obtain a faulty device according to an IP address obtained by analyzing associated alarms in the corresponding alarm set of the network element name of the lower-layer connection node, and if the network element name of the same-layer connection node has a corresponding alarm set, obtain a faulty device according to the network element name of the same-layer connection node.

8. A computing device comprising: a processor, a memory, a communication interface, and a communication bus, the processor, the memory, and the communication interface being in communication with each other through the communication bus; The memory is configured to store at least one executable instruction, and the executable instruction causes the processor to perform operations corresponding to the fault device positioning method in any one of claims 1-6.

9. A computer storage medium, the storage medium storing at least one executable instruction, the executable instruction causing a processor to perform operations corresponding to the fault device positioning method in any one of claims 1-6.

Images