A network alarm correlation big data intelligent learning and execution system

Abstract

This invention proposes a network alarm correlation big data intelligent learning and execution system, applied to operator network management systems and relating to the field of network communication. The system includes a learning engine and an execution engine. The learning engine comprises a data acquisition module, a data analysis module, and a result processing module, used for correlation analysis and prediction of alarm data to generate alarm rules. The execution engine includes a network management fusion module, a real-time processing module, an alarm splicing module, a rule start / stop module, and a performance monitoring module, used for executing the alarm rules generated by the learning engine and for self-control of performance. The learning engine generates various rule files from alarm and routing data provided by the network management system. The execution engine receives real-time alarms, matches and marks root-derived alarms according to the various rules generated by the learning engine, and returns the matching results of root alarm and derived alarm combinations in real time.

Description

Technical Field

[0001] This invention relates to the field of network communication, and in particular to a network alarm correlation big data intelligent learning and execution system. Background Technology

[0002] With the increasing maturity of 5G communication technology and the ever-expanding scale of transmission networks, a massive number of alarms are generated daily. The majority of these are invalid, derivative alarms resulting from faults, while the truly relevant and useful root cause alarms are lost in the noise. This leads to a large number of invalid maintenance work orders in the operator's integrated network management system, significantly impacting frontline operational efficiency. Against this backdrop, operators have set alarm reduction targets, hoping to reduce the number of work orders while accurately pinpointing the root causes of problems and improving processing efficiency through intelligent alarm analysis. The goal is to reduce the number of work orders and increase processing speed.

[0003] Chinese patent CN112491593B, "Network Element Alarm Processing Method and Device," discloses a network element alarm processing method and device in the field of communications. Based on the original alarm OID and original alarm device IP address corresponding to multiple original alarm messages, at least one target alarm message is determined according to a first rule for processing network element alarms. This patent can process network element alarms and supports alarm processing in large-scale networks. However, it lacks the functions of judging the root relationship of alarm data, performance monitoring, and alarm splicing. It cannot self-regulate in the case of too many alarms and sudden large data volumes, which may lead to downtime. Summary of the Invention

[0004] In view of this, the present invention proposes a network alarm correlation big data intelligent learning and execution system, which realizes the correlation and derivation of alarm data, distinguishes between invalid alarms and valid alarms, and performs self-regulation of performance.

[0005] The technical solution of the present invention is implemented as follows: The present invention provides a network alarm correlation big data intelligent learning and execution system, which is applied to the operator network management system. The system includes a learning engine and an execution engine.

[0006] The learning engine is used to perform correlation analysis and prediction on alarm data to generate alarm rules;

[0007] The execution engine is used to execute the alarm rules generated by the learning engine;

[0008] The system uses an association algorithm to determine the root-derivative relationship between each alarm data, and determines whether the alarm data is a valid alarm or an invalid alarm based on the root-derivative relationship.

[0009] The learning engine is used to perform correlation analysis and prediction on alarm data, and the steps for generating alarm rules include:

[0010] S1, Obtain historical alarm data provided by the preprocessing module;

[0011] S2 is the algorithm for reading the associations configured in the configuration file.

[0012] S3, extract the attributes required by the correlation algorithm. The extracted attributes include alarm feature values ​​and alarm occurrence time. Group the alarm objects according to the alarm feature values ​​and count the number of alarms at the corresponding time granularity according to the alarm occurrence time.

[0013] S4 involves processing the correlation algorithm, calculating the correlation coefficient between each pair of alarms based on the number of alarm occurrences at corresponding times using a correlation formula.

[0014]

[0015] Where X represents the number of times alarm A occurs at the current time granularity, Y represents the number of times alarm B occurs at the current time granularity, N represents the total number of alarm granularities, and ρ X，Y This represents the correlation coefficient between alarm A and alarm B;

[0016] S5 integrates and processes the algorithm calculation results, filters out those whose correlation coefficients and occurrence counts do not meet the thresholds, and configures the thresholds for coefficients and occurrence counts.

[0017] S6. Determine the association list between the alarm data and the alarm feature value based on the association coefficient and the configuration coefficient, and generate alarm rules.

[0018] Preferably, the learning engine is used to perform correlation analysis and prediction on alarm data, and the step of generating alarm rules further includes:

[0019] Create blacklists, whitelists, and special lists;

[0020] Alarm rules are output by combining two alarm objects with a list of associated relationships. The steps for outputting alarm rules include:

[0021] S100. Filter and replace the initial rules according to the blacklist, whitelist, and special list. Delete the object group that is both a blacklist object and a whitelist object. Output the root alarm data of a single whitelist object, a single blacklist object, or a special list derived alarm data that can be determined to have a root-derived relationship to rule table 1. Output the data that cannot be determined to have a root-derived relationship to the pending processing table.

[0022] S200: Adjust the position of the root and derivative in the relationship according to the alarm level and the circuit level, and output rule tables two and three. Rules that cannot be distinguished are output to the indistinguishable table.

[0023] S300. Merge rule tables 1, 2, and 3 into a new rule;

[0024] S400. Calculate the union of the new rule and the original rule, update the rule training time, delete the rules that were trained more than six months ago, and output the remaining rules to the rule file in the specified directory. The resulting rule file is the alarm rule.

[0025] Preferably, the learning engine includes a data acquisition module;

[0026] The data acquisition module is used to: periodically read historical alarm data from the network management system offline, extract key fields to form alarm objects, slice by time, and count the frequency of occurrence of each alarm object within the corresponding slice time period.

[0027] Preferably, the learning engine further includes a data analysis module;

[0028] The data analysis module is used to: calculate the occurrence trend of each alarm object within a statistical time period using a correlation algorithm, and determine the root-derived relationship.

[0029] Preferably, the learning engine further includes a result processing module;

[0030] The result processing module is used to: extract highly correlated analysis results, use the business model of the relevant network, determine the root and derivative relationships between alarm objects from the high and low, source and sink pointing relationships of the network, and generate alarm rules.

[0031] Preferably, the execution engine includes a network management fusion module;

[0032] The network management integration module is used to integrate into the network management system as a plug-in, and the network management integration module can be started and stopped independently or started and stopped together with the network management system.

[0033] Preferably, the execution engine further includes a real-time processing module;

[0034] The real-time processing module is used for: the learning engine to read historical alarm data to generate alarm rules, the execution engine to read the alarm rules generated by the learning engine, to analyze the alarms sent by the network management system in real time, and to return the analysis results to the network management system immediately.

[0035] Preferably, the execution engine further includes an alarm splicing module;

[0036] The alarm splicing module is used to splice the relevant alarm results when there are multiple root-derived relationships between alarms, output a final root alarm, and other derived alarms.

[0037] Preferably, the execution engine further includes a rule start / stop module;

[0038] The rule start / stop module is used to enable and disable alarm rules in real time, and has the ability to modify and apply them in real time according to the on-site situation.

[0039] Preferably, the execution engine further includes a performance monitoring module;

[0040] The performance monitoring module is used to monitor the operation status of the network management system in real time, including the memory usage, CPU usage, and hard disk capacity of the processes themselves.

[0041] The network alarm correlation big data intelligent learning and execution system of the present invention has the following advantages over the prior art:

[0042] (1) The learning engine generates various rule files from alarm and routing data provided by the network management system. The execution engine receives real-time alarms, matches and marks the root derivatives of alarms according to the various rules generated by the learning engine, and returns the matching results of the root alarm and derived alarm combination in real time. It receives, collects, learns, analyzes and processes network management data, deeply explores the potential value of transmission network data, realizes accurate alarm fault root derivative analysis function, and helps operation and maintenance personnel quickly locate the cause of faults.

[0043] (2) The alarm data of the network management system is analyzed regularly through the data acquisition module, data analysis module and result processing module of the learning engine to achieve correlation and derivation;

[0044] (3) Through the network management fusion module, real-time processing module, alarm splicing module, rule start / stop module and performance monitoring module of the execution engine. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 This is a structural diagram of a network alarm correlation big data intelligent learning and execution system according to the present invention;

[0047] Figure 2This is a flowchart of the correlation analysis algorithm calculation for a network alarm correlation big data intelligent learning and execution system according to the present invention;

[0048] Figure 3 This is an example diagram of the Fiberhome routing configuration file according to Embodiment 1 of the present invention;

[0049] Figure 4 This is an example diagram of the circuit tree configuration according to Embodiment 1 of the present invention;

[0050] Figure 5 This is a schematic diagram illustrating the learning engine rules of Embodiment 2 of the present invention;

[0051] Figure 6 This is a schematic diagram of the processing logic of the alarm group judgment process in Embodiment 3 of the present invention;

[0052] Figure 7 This is a schematic diagram showing the current alarm status of the execution engine in Embodiment 3 of the present invention;

[0053] Figure 8 This is a schematic diagram showing the historical alarms of the execution engine in Embodiment 3 of the present invention;

[0054] Figure 9 This is a schematic diagram of the execution engine filtering alarm process in Embodiment 3 of the present invention;

[0055] Figure 10 This is a schematic diagram illustrating the process of querying existing alarm relevance rules and performing fuzzy queries by the execution engine in Embodiment 3 of the present invention. Detailed Implementation

[0056] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0057] This system provides intelligent learning and execution capabilities for network alarm correlation big data, offering alarm big data analysis and compression for backbone networks with distinct network layers and high communication frequencies. It is applied to operator network management systems, such as... Figure 1 As shown, the network management system includes a learning engine and an execution engine.

[0058] The learning engine includes a data acquisition module, a data analysis module, and a result processing module, which are used to perform correlation analysis and prediction on alarm data and generate alarm rules.

[0059] The execution engine includes a network management fusion module, a real-time processing module, an alarm splicing module, a rule start / stop module, and a performance monitoring module, which are used to execute alarm rules generated by the learning engine and to self-control performance.

[0060] The system uses an association algorithm to determine the root-derivative relationship between each alarm data, and determines whether the alarm data is a valid alarm or an invalid alarm based on the root-derivative relationship.

[0061] Example 1

[0062] For learning engines;

[0063] Data acquisition module: Reads alarm data from the network management system offline on a regular schedule, extracts key fields to form alarm objects, and segments them by time to count the number of times each alarm object occurs within the corresponding time period.

[0064] Data Analysis Module: Uses correlation algorithms to calculate the occurrence trend of each alarm object within a statistical period. The higher the similarity, the stronger the correlation, and the more likely two alarm objects are to have a root-derived relationship.

[0065] Results processing module: Extracts highly relevant analysis results, uses the business model of the relevant network, judges the root and derivative relationships between alarm objects from the level of network hierarchy and source-sink relationship, and finally generates pure alarm rules.

[0066] Alarm correlation analysis relies on the line number (port) and alarm code where the alarm occurred, combined with alarm correlation rules, business paths, and port models. It analyzes the root-cause relationships between alarms based on business-related and business-independent rules. This allows for direct identification of the root cause of the fault during alarm troubleshooting.

[0067] The learning engine can periodically calculate correlations based on historical alarm data, routing configuration data, and the basic transmission network layer model, generating various correlation rules for use by the diagnostic engine. The amount of data calculated and the rule generation cycle are dynamically configurable (e.g., 1 million historical alarm data entries each time, and a generation cycle of once a week). The following example uses historical alarm data from Fiberhome, Fiberhome U2000 periodically outputting historical alarm files in CSV format, and the LE (learning engine) inputting the file by reading it.

[0068] The Fiberhome U2000 periodically outputs routing configuration log files. These log files contain all circuits managed by the U2000 and related routing information. Each circuit has the following attributes: circuit ID (a unique identifier for the circuit), circuit type (the layer within the OTN (Optical Transport Network) where the circuit resides), circuit name (including the circuit's detailed location), service layer circuit ID (the ID of the related circuits served by this circuit), customer layer circuit ID (the circuit ID providing service to this circuit), working path 1 (a useless field), and forward and reverse routes (the locations traversed in both directions by the route). Each attribute in the file must occupy a single line; multiple attributes cannot exist on a single line (otherwise, file parsing will be affected).

[0069] Example of function:

[0070] (1) Perform data volume control and filtering on the historical data of the beacon alarm. Data volume control refers to a period of one month. The time parameter is configurable. The required fields for filtering include serial number, circuit number, occurrence time, chassis number, port number, alarm type, etc. The filtering removes alarm data with empty required fields (fields include serial number, occurrence time, chassis number, alarm type, etc.).

[0071] (2) Convert the Fiberhome routing configuration file into a circuit tree that LE can recognize. Each circuit in the original routing configuration file generates a record.

[0072] The Fiberhome routing configuration file is as follows: Figure 2 As shown, the transformed circuit tree is as follows: Figure 3 As shown.

[0073] Each row is defined as a tree. The first column is the circuit ID, the second column is the level of the circuit, and the third column is all the sub-level circuits of the circuit from this level to the OTN_CLIENT level, separated by commas. For example, if the circuit is a circuit of the OTS (Optical Transport Section) level, then the third column is all the circuits of the circuit from the OMS (Optical Multiplex Section) level to the OTN_CLIENT level. If the circuit is a circuit of the OCH (Optical Channel) level, then the sub-circuits are all the circuits from the OTUk level to the OTN_CLIENT level, and so on.

[0074] The OTN network structure is layered as follows, with the levels arranged from lowest to highest: OTS, OMS, OCH, OTUK, ODUK, and OTN_client. Each circuit number in the routing table and alarm messages belongs to a specific level.

[0075] (3) Based on the circuit number carried in each alarm message, the highest-level circuit number is identified by analyzing the alarm data after screening and filtering in step (1). The analysis method is as follows:

[0076] Based on the circuit information carried by the alarm, the highest-level circuit is extracted from the routing tree generated in step (2) above (if it cannot be found, the first circuit number is taken as the highest-level circuit by default).

[0077] The difference here is that when an OMS layer circuit exists in the circuit, the OMS circuit is selected; otherwise, the corresponding circuit is selected according to the model's hierarchy. (This is because although OTS is the highest level in terms of hierarchy, in actual data, it has been found that multiple OTS circuits generally belong to the same OMS circuit, and a failure in one OMS circuit will affect multiple OTS circuits. Therefore, OMS is defaulted to the highest level circuit in the alarm circuit selection.)

[0078] Example 2

[0079] like Figure 4 As shown, the alarm correlation analysis steps are as follows, taking the correlation algorithm as an example:

[0080] S1, Obtain historical alarm data provided by the preprocessing module;

[0081] S2 is the algorithm for reading the associations configured in the configuration file.

[0082] S3, extract the attributes required for the correlation algorithm (taking the correlation algorithm as an example, the extracted attributes include: alarm feature value and alarm occurrence time; group alarm objects according to alarm feature value, and count the number of alarms at the corresponding time granularity according to alarm occurrence time);

[0083] S4, perform the correlation algorithm process (taking the correlation algorithm as an example, the correlation formula is calculated based on the number of alarms occurring at corresponding times between each pair of alarms, and the corresponding correlation coefficient is obtained).

[0084]

[0085] X represents the number of times alarm A occurs at the current time granularity, Y represents the number of times alarm B occurs at the current time granularity, N represents the total number of alarm granularities, and ρ represents the correlation coefficient between alarm A and alarm B.

[0086] S5, integrate and process the algorithm calculation results (taking the correlation algorithm as an example, filter out the correlation coefficients and occurrence times of 3-3 and 3-2 that do not meet the thresholds, and the thresholds for both coefficients and occurrence times can be configured);

[0087] S6 outputs the association results in a unified format to obtain a list of associations.

[0088] Create blacklists, whitelists, and special lists, and further output the data by combining them with a list of related relationships:

[0089] 1. First, filter and replace the rules based on the blacklist, whitelist, and special list (all of which can be configured). Delete invalid rules (black-black, white-white). Output the root-derived relationships that can be determined (single white, single black, special root-special derivative) to rule table 1. Output the rules that cannot be determined to the pending processing table.

[0090] 2. Process the table to be processed based on the alarm location hierarchy table and circuit tree. Adjust the position of the root and derivative in the relationship according to the alarm level and circuit level and output rule tables two and three. The indistinguishable rules are output to the indistinguishable table. The indistinguishable table merges the AB and BA format relationships.

[0091] 3. Merge rule tables 1, 2, and 3 into a new rule.

[0092] 4. Calculate the union of the new rules and the previous version of the rules, update the training time of the rules, delete the rules that were trained more than six months ago (configurable), and output the remaining rules to the rule file in the specified directory. The resulting rule file is the alarm rules.

[0093] The rules of the learning engine are shown as follows: Figure 5 As shown.

[0094] The root alarm refers to one or more true root cause alarms in the OTN network that will trigger a series of alarms. These alarms usually carry important information about the occurrence of the fault. The derived alarm refers to the alarm generated due to the root alarm. Root and derived are relative concepts. The blacklist is the list of alarms that are absolutely derived alarms. The whitelist is the list of alarms that are absolutely root alarms. The special alarm list is the alarm matching rules determined by expert knowledge, which can be directly applied.

[0095] Example 3

[0096] For the execution engine;

[0097] Network management integration: It can be integrated into the network management system as a plug-in, and can start and stop at the same time as the network management system without occupying too much additional hardware resources.

[0098] Real-time processing: Read the alarm-related rules and on-site network structure generated by the learning engine, analyze the alarms sent by the network management system in real time, and return the analysis results to the network management system.

[0099] Alarm concatenation: If there are multiple root-derived relationships between alarms, the execution engine will concatenate the relevant alarm results, and the final output will be a final root alarm, as well as other derived alarms derived from it.

[0100] Rule start / stop: The execution engine can enable and disable rules in real time according to the needs of on-site users without restarting the system.

[0101] Performance monitoring: The execution engine can monitor the system's operating status in real time, including memory, CPU usage, and hard disk capacity, and can control performance itself, so as not to consume too many resources even under sudden large data volume.

[0102] The execution engine can process alarm information received from the interface in real time, use the alarm rules of the learning engine to mark the root derivative alarms, and combine them into alarm groups and return them to U2000.

[0103] The alarm group's decision-making process includes:

[0104] A new alarm group concatenation module is added to report alarm pairs to U2000 in the form of alarm groups (a, b, c, d...) (where a is the root alarm of all other alarms in this group, and b, c, d... are the corresponding derived alarms). The specific logic is as follows: Suppose that there are already several alarm groups in the cache (a1, b1, c1, d1...), (a2, b2, c2, d2...), (a3, b3, c3, d3...). Each alarm group will wait for its own root alarm and its own alarm pair (a1, a1), (a2, a2), (a3, a3)... to appear, and then remove it from the cache.

[0105] If the alarm group splicing module receives a new pair of alarms (a, b), the processing logic is as follows: Figure 6 As shown.

[0106] The execution engine supports processing 10,000 alarm storm data per second for up to 15 minutes.

[0107] The learning engine supports calculating 10 million data points per day and outputting the results;

[0108] The execution and learning engine has a memory usage limit of 8GB.

[0109] The execution engine displays the current alarm as follows: Figure 7 As shown, when the execution engine displays historical alarms, it does so as follows: Figure 8 As shown, the process of filtering alarms by the execution engine is as follows: Figure 9 As shown, the execution engine queries existing alarm relevance rules and performs fuzzy queries as follows: Figure 10 As shown.

[0110] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0111] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0112] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0113] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0114] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0115] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.

[0116] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0117] The above provides a detailed description of the network alarm correlation big data intelligent learning and execution system provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A network alarm correlation big data intelligent learning and execution system, applied to an operator's network management system, characterized in that, The system includes a learning engine and an execution engine; The learning engine includes a data acquisition module, a data analysis module, and a result processing module, which are used to perform correlation analysis and prediction on alarm data and generate alarm rules. The execution engine includes a network management fusion module, a real-time processing module, an alarm splicing module, a rule start / stop module, and a performance monitoring module, which are used to execute the alarm rules generated by the learning engine. The system uses an association algorithm to determine the root-derivative relationship between each alarm data, and determines whether the alarm data is a valid alarm or an invalid alarm based on the root-derivative relationship. The learning engine is used to perform correlation analysis and prediction on alarm data, and the steps for generating alarm rules include: S1, Obtain historical alarm data provided by the preprocessing module; S2 is the algorithm for reading the associations configured in the configuration file. S3, extract the attributes required by the correlation algorithm. The extracted attributes include alarm feature values ​​and alarm occurrence time. Group the alarm objects according to the alarm feature values ​​and count the number of alarms at the corresponding time granularity according to the alarm occurrence time. S4 involves processing the correlation algorithm, calculating the correlation coefficient between each pair of alarms based on the number of alarm occurrences at corresponding times using a correlation formula. ； Where X represents the number of times alarm A occurs at the current time granularity, Y represents the number of times alarm B occurs at the current time granularity, and N represents the total number of alarm granularities. This represents the correlation coefficient between alarm A and alarm B; S5 integrates and processes the algorithm calculation results, filters out those whose correlation coefficients and occurrence counts do not meet the thresholds, and configures the thresholds for coefficients and occurrence counts. S6, determine the association list between the alarm data and the alarm feature value based on the association coefficient and the configuration coefficient, and generate alarm rules; The learning engine is used to perform correlation analysis and prediction on alarm data, and the step of generating alarm rules further includes: Create blacklists, whitelists, and special lists; Alarm rules are output by combining two alarm objects with a list of associated relationships. The steps for outputting alarm rules include: S100. Filter and replace the initial rules according to the blacklist, whitelist, and special list. Delete the object group that is both a blacklist object and a whitelist object. Output the root alarm data of a single whitelist object, a single blacklist object, or a special list derived alarm data that can be determined to have a root-derived relationship to rule table 1. Output the data that cannot be determined to have a root-derived relationship to the pending processing table. S200: Adjust the position of the root and derivative in the relationship according to the alarm level and the circuit level, and output rule tables two and three. Rules that cannot be distinguished are output to the indistinguishable table. S300. Merge rule tables 1, 2, and 3 into a new rule; S400. Calculate the union of the new rule and the original rule, update the rule training time, delete the rules that were trained more than six months ago, and output the remaining rules to the rule file in the specified directory. The resulting rule file is the alarm rule.

2. The network alarm correlation big data intelligent learning and execution system as described in claim 1, characterized in that, The data acquisition module is used to: periodically read historical alarm data from the network management system offline, extract key fields to form alarm objects, slice by time, and count the frequency of occurrence of each alarm object within the corresponding slice time period.

3. The network alarm correlation big data intelligent learning and execution system as described in claim 1, characterized in that, The data analysis module is used to: calculate the occurrence trend of each alarm object within a statistical time period using a correlation algorithm, and determine the root-derived relationship.

4. The network alarm correlation big data intelligent learning and execution system as described in claim 1, characterized in that, The result processing module is used to: extract highly correlated analysis results, use the business model of the relevant network, determine the root and derivative relationships between alarm objects from the high and low, source and sink pointing relationships of the network, and generate alarm rules.

5. The network alarm correlation big data intelligent learning and execution system as described in claim 1, characterized in that, The network management integration module is used to integrate into the network management system as a plug-in, and the network management integration module can be started and stopped independently or started and stopped together with the network management system.

6. The network alarm correlation big data intelligent learning and execution system as described in claim 1, characterized in that, The real-time processing module is used for: the learning engine to read historical alarm data to generate alarm rules, the execution engine to read the alarm rules generated by the learning engine, to analyze the alarms sent by the network management system in real time, and to return the analysis results to the network management system immediately.

7. The network alarm correlation big data intelligent learning and execution system as described in claim 6, characterized in that, The alarm splicing module is used to splice the relevant alarm results when there are multiple root-derived relationships between alarms, output a final root alarm, and other derived alarms.

8. The network alarm correlation big data intelligent learning and execution system as described in claim 7, characterized in that, The rule start / stop module is used to enable and disable alarm rules in real time, and has the ability to modify and apply them in real time according to the on-site situation.

9. The network alarm correlation big data intelligent learning and execution system as described in claim 8, characterized in that, The performance monitoring module is used to monitor the operation status of the network management system in real time, including the memory usage, CPU usage, and hard disk capacity of the processes themselves.

Images