Event correlation analysis method, apparatus, device, medium, and product
By performing non-overlapping sequence splitting on the events to be analyzed and recursively mining frequent events to generate association rules, the problem of existing technologies being unable to handle long sequence events is solved, and effective event association information learning and mining are realized in intelligent operation and maintenance scenarios.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHONGQING CHANGAN TECH CO LTD
- Filing Date
- 2023-03-13
- Publication Date
- 2026-06-02
AI Technical Summary
Existing technologies cannot effectively handle long sequence events, cannot learn frequent ordered event sets, cannot adapt to the learning and mining of event correlation information in intelligent operation and maintenance scenarios, and are highly complex.
By splitting the sequence of events to be analyzed into non-overlapping sequences, a two-dimensional event set is generated. Then, a recursive method is used to mine frequent events and generate association rules for analysis or prediction.
It effectively handles long sequence events, learns ordered event sets, and adapts to the learning and mining of event correlation information in intelligent operation and maintenance scenarios, thus reducing algorithm complexity.
Smart Images
Figure CN116467362B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, specifically to an event correlation analysis method, apparatus, device, medium, and product. Background Technology
[0002] Event association analysis (AAC) mines the relationships between events in historical data. The results represent the degree of association between events in the historical data, that is, the degree to which they frequently co-occur under certain rules. Common algorithms for AAC include Apriori, a hierarchical search algorithm that mines frequent itemsets through two stages: candidate set generation and downward closure detection of events, used to discover relationships between events / things; frequent itemset mining; and FP-Growth Tree, an algorithm that uses a tree structure to store and compute frequent patterns, also used to discover relationships between events / things.
[0003] Existing technologies rely on historical data to determine the frequency of simultaneous occurrences of events, learn the relationships between events, and identify frequent itemsets composed of events that frequently occur together.
[0004] Applying existing technologies in the field of AIOps (Algorithmic Intelligent Operations) has the following drawbacks:
[0005] The data applicable to existing technologies is a dataset composed of independent transactions. A transaction is a record, representing a set of naturally related ordered or unordered events or things, originating from a single order transaction in shopping. It is now abstracted as a set of naturally related events, such as a set of products purchased by each user. The combination of all users' sets of products is used as learning data. However, the typical scenario in the AIOps field is an event sequence, such as alarm logs or event logs, which is characterized by a large, time-ordered event sequence, making existing technologies unsuitable for the AIOps field.
[0006] Existing technologies mainly target frequent itemsets and do not consider temporal information, which will result in the loss of some causal information.
[0007] Existing technologies are highly complex;
[0008] Existing technologies cannot simultaneously address all three of the aforementioned drawbacks.
[0009] Another existing technology is the PrefixSpan algorithm, which is an algorithm for mining ordered frequent itemsets in a dataset composed of independent records. Its input data pattern is a set of transactions, and each transaction contains a set of ordered itemsets, thus the input data is represented as a two-dimensional database. For example, as shown in the table below;
[0010]
[0011]
[0012] B appears 3 times alone, C appears 4 times alone, and B->C together appear 3 times, resulting in a total of 4 transactions (records). If the absolute support threshold is 3, or the relative support threshold is 0.75, then B and C constitute an ordered frequent itemset, and B->C constitutes a binary ordered frequent itemset.
[0013] The PrefixSpan algorithm starts with a single-item itemset. In each round, the algorithm searches for frequent itemsets of the current length, i.e., it searches for one-item frequent itemsets, two-item frequent itemsets, three-item frequent itemsets, and so on. The search method is recursive. In each round, the algorithm continues to span forward from the position of the event that has been spanned (item-by-item expansion) in each transaction in the previous round, until the last item of each transaction is found. For example, if you find that A is a frequent one-item itemset, then the next round will start from the position of A in the previous round of each transaction and search forward for possible two-item ordered itemsets with A as a prefix that still meet the frequency threshold after spanning one item, such as A->B and A->C. This process continues recursively to search for three-item frequent ordered itemsets with A->B and A->C as prefixes.
[0014] The advantage of the PrefixSpan algorithm is that it only traverses the database once, recursively querying all possible frequent ordered itemsets by expanding the Span item by item. Each round compresses the search space, reduces algorithm complexity, and greatly speeds up the algorithm's speed and performance, making it excellent for large datasets.
[0015] While the Prefixspan algorithm can mine frequent ordered itemsets in Transactions, in the AIOps field, association analysis is mostly used for log event analysis, such as alarm log analysis and business log analysis. In these scenarios, the algorithm needs to learn from log data. Regardless of the type of log, it can ultimately extract a pattern of time-corresponding event tags, i.e., a long, ordered sequence of events. Within this sequence, events are ordered by their occurrence time or start time. The time dimension can be a single point in time or a time interval consisting of start and end times. Each event can thus be accompanied by its start and end times.
[0016] For example, (A,1,3),(B,2,5),(C,3,10)... indicates that event A starts at time 1 and ends at time 3, event B starts at time 2 and ends at time 5, and event C starts at time 3 and ends at time 10. Other event sequences in the text without specified times are for simplicity, only listing the order. In reality, each event contains underlying time information.
[0017] In these scenarios, the goal of association analysis is to find the relationships between events in historical data. However, existing frequent itemset mining algorithms have limitations in handling long event sequences in the input data, and they are also inadequate for ordered patterns. Specifically, they are not suitable for mining frequent ordered sets of events within a single long event sequence. Summary of the Invention
[0018] In view of the shortcomings of the prior art described above, the present invention provides an event correlation analysis method, apparatus, device, medium and product to solve the following technical problems: related technologies cannot effectively process long sequence events, cannot learn frequent episodes, that is, cannot learn ordered event sets, and cannot adapt to the learning and mining of event correlation information in intelligent operation and maintenance scenarios.
[0019] To address the aforementioned technical problems, this application provides an event correlation analysis method, including:
[0020] The sequence of events to be analyzed is split into non-overlapping sequences to obtain multiple rows of sub-sequence events. Each sub-sequence event consists of a starting event and other events that are different from the starting event. The multiple rows of sub-sequence events form a two-dimensional event set.
[0021] Mining the two-dimensional event set yields frequent events;
[0022] The frequent events are processed to generate association rules, which are then used to analyze or predict future events.
[0023] In one embodiment of this application, the sequence events to be analyzed are split into non-overlapping sequences to obtain a two-dimensional event set, including:
[0024] Iterate through the sequence of events to be analyzed;
[0025] Events with a frequency greater than or equal to a predetermined frequency threshold in the sequence of events to be analyzed are identified as target events. The positions of the target events in the sequence of events to be analyzed are recorded. Based on the positions, the sequence of events to be analyzed is split into non-overlapping sequences to obtain a two-dimensional event set.
[0026] In one embodiment of this application, the sequence events to be analyzed are split into non-overlapping sequences based on the location to obtain a two-dimensional event set, including:
[0027] The target event is moved from the position where it appears to the starting position of the subsequence event as the starting event of the subsequence event. The subsequence event consists of the starting event stored at the starting position and other events stored at other positions. The other events are one or more events that occur before the target event of the sequence event to be analyzed reappears.
[0028] The target event that reappears in the sequence of events to be analyzed is taken as the starting event of a new subsequence event. The events following the target event that reappears are traversed until the sequence of events to be analyzed is completely traversed, generating multiple rows of subsequence events with the target event as the starting event. The multiple rows of subsequence events form a two-dimensional event set.
[0029] In one embodiment of this application, a time limit is imposed when splitting the sequence events to be analyzed to prevent a certain row of the subsequence events from containing more than a threshold number of events.
[0030] In one embodiment of this application, a recursive method is used to mine the two-dimensional event set to obtain frequent events, including:
[0031] When the target event appears frequently as a plot in the sub-sequence events, the target event is identified as a frequent plot;
[0032] After the target event, recursively search for events in the subsequence events. When the target event and the recursively recursively recursively recursively appear frequently as plots in the subsequence events, the target event and the recursively ...
[0033] The frequent episodes are episodes that satisfy the support, and the episode is a combination of one or more events in a certain order. The support is the frequency of the episode appearing in the sequence of events to be analyzed.
[0034] In one embodiment of this application, the frequent occurrences are processed to generate association rules, including:
[0035] If the support of the target event as a frequent event is N1, and the support of the target event and the recursively occurring event as sub-frequent events is N2, then the probability of the recursively occurring event after the target event occurs is N2 / N1, which is the probability of the sub-frequent events occurring after the frequent event occurs, and the association rule is generated, wherein the frequent event is composed of each of the sub-frequent events.
[0036] On the one hand, this application also provides an event correlation analysis device, including:
[0037] The splitting module is used to split the sequence events to be analyzed into non-overlapping sequences to obtain multiple rows of sub-sequence events. Each sub-sequence event consists of a starting event and other events that are different from the starting event. The multiple rows of sub-sequence events form a two-dimensional event set.
[0038] The mining module mines the two-dimensional event set to obtain frequent events;
[0039] The processing module is used to process the frequent events and generate association rules.
[0040] On the one hand, this application also provides an electronic device, including a processor, a memory, and a communication bus;
[0041] The communication bus is used to connect the processor and the memory;
[0042] The processor is used to execute computer programs stored in the memory to implement the method described above.
[0043] In one aspect, this application also provides a computer-readable storage medium having a computer program stored thereon, the computer program being used to cause a computer to perform the methods described above.
[0044] On the one hand, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.
[0045] The beneficial effects of this application are as follows: This application performs non-overlapping sequence splitting on the sequence events to be analyzed, obtaining multiple rows of sub-sequence events. Each sub-sequence event consists of a starting event and other events different from the starting event, and the multiple rows of sub-sequence events form a two-dimensional event set. Mining is performed on the two-dimensional event set to obtain frequent events. The frequent events are processed to generate association rules, which are then used to analyze or predict future events. This application addresses the event association mining scenario in the AIOps intelligent operations and maintenance field. It effectively processes long-sequence events, learns frequent events (i.e., learns ordered event sets), and is more suitable for learning and mining event association information in intelligent operations and maintenance scenarios.
[0046] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description
[0047] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:
[0048] Figure 1 This is a flowchart of an event correlation analysis method provided in one embodiment of this application;
[0049] Figure 2 This is a schematic flowchart of a method for non-overlapping sequence splitting of sequence events to be analyzed, provided in one embodiment of this application;
[0050] Figure 3 This is a flowchart of a method for non-overlapping sequence splitting based on location of sequence events to be analyzed, provided in one embodiment of this application;
[0051] Figure 4 This is a schematic diagram of a process for mining the two-dimensional event set using a recursive method, provided in one embodiment of this application.
[0052] Figure 5 This is a framework diagram of an event correlation analysis device provided in one embodiment of this application;
[0053] Figure 6 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application. Detailed Implementation
[0054] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, unless otherwise specified, the following embodiments and features in the embodiments can be combined with each other.
[0055] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this application. Therefore, the drawings only show the components related to this application and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the shape, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.
[0056] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the present application. However, it will be apparent to those skilled in the art that embodiments of the present application may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the present application.
[0057] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.
[0058] First, it's important to clarify the concepts: An event refers to a specific or abstract event with a unique identifier, such as A, B, C, D, etc.; a frequent itemset is a collection of many items, where each event (thing) is considered an item; a frequent itemset is an itemset that meets a frequency threshold, meaning a set of items that appear together a certain number of times; a plot refers to a combination of one or more events in a certain order; a frequent plot is a set of items that occurs frequently in a sequence of events (i.e., meets a support threshold), meaning a frequent itemset with an order attribute is a frequent plot; support is the frequency / recurrence of an event occurring in the entire long-term sequence, which can be an absolute number or a relative proportion; a record represents naturally related ordered or unordered events (things), originating from a single order transaction in shopping, and is now abstracted as events with natural associations.
[0059] Please see Figure 1 This is a flowchart of an event correlation analysis method provided in one embodiment of this application.
[0060] like Figure 1 As shown, the event correlation analysis method includes the following steps:
[0061] Step S101: Perform non-overlapping sequence splitting on the sequence events to be analyzed to obtain multiple rows of sub-sequence events. Each sub-sequence event consists of a starting event and other events different from the starting event. The multiple rows of sub-sequence events form a two-dimensional event set.
[0062] This application presents an event correlation analysis method based on PFEM, which stands for PrefixSpan for EpisodeMining. PrefixSpan stands for Prefix SpanAlgorithm, used to mine the correlation between events (things). Span represents item-by-item expansion and is mainly used for log analysis, including event management, event relationship mining, and operation and maintenance knowledge base.
[0063] For each individual frequent event, a set of non-overlapping sub-sequence events, all starting from the same event, is extracted. Unlike the existing PrefixSpan algorithm where each transaction is completely independent and sub-sequence events with different starting events may overlap, this method uses a non-overlapping sequence splitting method to ensure that sub-sequence events with the same starting event do not overlap, and does not lose correlation information. Therefore, while ensuring that all possible frequent events are learned, performance is not significantly reduced. This application is more suitable for learning and mining event correlation information in intelligent operation and maintenance scenarios.
[0064] Step S102: Mining the two-dimensional event set to obtain frequent events;
[0065] The frequent plot mining process is performed on each subsequence event of the two-dimensional event set as a record until all subsequence events have been mined and all frequent plots have been mined. For example, after generating the two-dimensional event set, the PrefixSpan algorithm can be used to treat each row of the two-dimensional event set as a record and perform frequent plot mining.
[0066] Step S103: Process the frequent events to generate association rules, and analyze or predict future events based on the association rules.
[0067] By calculating the support of frequent events and their sub-frequent events, conditional probabilities are generated, and the probabilities of the occurrence of frequent events and each sub-frequent event are generated. Association rules are then generated, and the probabilities of association rules provide a more quantitative standard, which can be combined with other algorithms or rules to formulate better intelligent operation and maintenance solutions.
[0068] Please see Figure 2 This is a schematic diagram of a method for non-overlapping sequence splitting of sequence events to be analyzed, provided in one embodiment of this application.
[0069] like Figure 2 As shown, the steps involved in splitting the sequence of events to be analyzed into a non-overlapping sequence to obtain a two-dimensional event set are as follows:
[0070] Step S201: Traverse the sequence events to be analyzed; Step S202: Select events in the sequence events to be analyzed that have a frequency greater than or equal to a predetermined frequency threshold as target events, record the position of the target events in the sequence events to be analyzed, and perform non-overlapping sequence splitting on the sequence events to be analyzed based on the position to obtain a two-dimensional event set.
[0071] For a sequence of events to be analyzed, i.e., a long sequence of events, when considering association analysis algorithms, one situation to consider is that the association of an event may be chain-like, i.e., A->B->C may be A associated with B, B associated with C, rather than A directly associated with B and C. The non-overlapping sequence splitting method of this application, for each event, records its position in the sequence event each time it occurs, provided it meets a frequency threshold. Since each recurrence of an event can be considered as the restart of a new set of sub-sequence events, this solves the problem that segmenting long sequence events into segments according to a time window may result in the loss of a lot of information.
[0072] Please see Figure 3 This is a flowchart of a method for non-overlapping sequence splitting of sequence events to be analyzed based on location, provided in one embodiment of this application.
[0073] like Figure 3 As shown, the sequence of events to be analyzed is split into non-overlapping sequences based on the location to obtain a two-dimensional event set, including the following steps:
[0074] Step S301: Move the target event from its occurrence position to the starting position of the subsequence event as the starting event of the subsequence event. The subsequence event consists of the starting event stored at the starting position and other events stored at other positions. The other events are one or more events that occur before the target event reappears in the sequence event to be analyzed. Step S302: Take the target event that reappears in the sequence event to be analyzed as the starting event of a new subsequence event. Continue to traverse the events after the target event that reappears until the sequence event to be analyzed is completely traversed, generating multiple rows of subsequence events with the target event as the starting event. The multiple rows of subsequence events form a two-dimensional event set.
[0075] The events between each occurrence of an event can be separated into components of a subsequence of events. Analogous to a record, for each individual frequent event, a set of non-overlapping subsequence events, each starting from the same event, can be extracted.
[0076] You can make each subsequence of events a row, transforming a long sequence of events into a two-dimensional event set.
[0077] For example, when A, B, C, D, A, C, E, B, A, B, F, D, A, C, B, E are long sequence events (i.e., the sequence events to be analyzed), if the frequency support (the frequency of an event's occurrence) is 3, then A, B, and C will be selected as single frequent events. The above long sequence events can be broken down and transformed into a set of sub-sequence events as shown in the table below, where each row represents a frequent candidate sub-sequence event.
[0078] Start Event Split subsequence events A Start A, B, C, D A Start A, C, E, B A Start A, B, F, D A Start A, C, B, E B Start B, C, D, A, C, E B Start B, A, B Start B, F, D, A, C B Start B, E C start C, D, A C start C,E,B,A,B,F,D,A, C start C, B, E
[0079] The above splitting can be superimposed with time windows, so that the obtained subsequence events have certain time constraints, avoiding the occurrence of too many events in a certain row due to the long interval between the starting events. That is, time constraints are imposed when splitting the sequence events to be analyzed to prevent a certain row of the subsequence events from containing more than a threshold number of events.
[0080] Please see Figure 4 This is a schematic diagram of a process for mining the two-dimensional event set using a recursive method, provided in one embodiment of this application.
[0081] like Figure 4 As shown, the method for mining the two-dimensional event set using a recursive approach includes the following steps:
[0082] Step S401: When the target event appears frequently as a plot in the subsequence events, the target event is identified as a frequent plot. Step S402: After the target event, recursively search for events in the subsequence events. When the target event and the recursively searched events appear frequently as plots in the subsequence events, the target event and the recursively searched events are identified as frequent plots. This process continues until the two-dimensional event set is completely mined, resulting in one or more frequent plots. The frequent plot is a plot that satisfies support. The plot is a combination of one or more events in a certain order, and the support is the frequency of the plot appearing in the sequence events to be analyzed.
[0083] After generating the two-dimensional event set, since the generated two-dimensional event set conforms to the PrefixSpan database pattern, the PrefixSpan algorithm can be used to treat each row of the two-dimensional event set as a record and perform frequent events mining. A recursive method can be used for frequent events mining, thereby continuously compressing the search space and improving efficiency. For example, when event A is frequent, continue mining frequent events that start with A and have two events, such as A->B being frequent, and so on recursively, for example, mining A->B->C being frequent, until all subsequences have been mined, thus mining all frequent events.
[0084] Unlike the original PrefixSpan algorithm where each transaction is completely independent, PFEM allows for overlap between subsequence events (similar to transactions) with different starting events to avoid losing correlation information. However, due to the use of a non-overlapping sequence splitting method, it ensures that subsequence events with the same starting event will not repeat. Therefore, it learns all potentially frequent events without sacrificing too much performance. Secondly, the PFEM algorithm considers the time interval attribute of events, i.e., the start and end times of the events, as a constraint for mining correlations between events. Furthermore, the PFEM algorithm inherits the recursive method from PrefixSpan, continuously expanding and compressing the remaining search space as it mines. Each row continues mining from the unmined remaining portion, thus improving computational performance.
[0085] The frequent occurrences are processed to generate association rules, including:
[0086] If the support of the target event as a frequent event is N1, and the support of the target event and the recursively occurring event as sub-frequent events is N2, then the probability of the recursively occurring event after the target event occurs is N2 / N1. This is the probability of the sub-frequent events occurring after the frequent event occurs, which is used to generate the association rule. The frequent event is composed of the various sub-frequent events. N1 and N2 can be positive integers, such as 2, 3, 4, 5, 6, 7, etc.
[0087] In this application, support, i.e., the number of times an itemset or plot appears (absolute support) or the proportion (relative support), is used as the standard for frequent itemsets. In actual use, support greater than a certain threshold is considered frequent.
[0088] For frequently occurring events discovered, such as A->B->C->D, conditional probabilities can be calculated using the frequent support (occurrence frequency) of the frequent events and their sub-frequent events. This generates the probabilities of the frequent events and their respective sub-frequent events occurring sequentially, thus generating association rules. For example, if the support of A is 100 and the support of A->B is 75, then the probability of A->B is 0.75, meaning the probability of B occurring after A occurs is 0.75. Similarly, the probability of (A->B)->C is 0.8, meaning the probability of C occurring after A and B occur in that order, and so on.
[0089] When performing frequent episode mining on a single long historical sequence of events (the sequence of events to be analyzed), each episode represents a short, sequential sequence of events, such as A->B->C. The mined frequent episodes can serve as knowledge, providing valuable assistance in the analysis or prediction of future events.
[0090] To facilitate understanding, a specific application example is provided, which is a portion of the operation and maintenance alarm logs.
[0091] Alarm logs contain a wealth of information. Depending on the requirements, each alarm log entry can be extracted into an event A, along with its start and end times. Therefore, a historical alarm log can be extracted into a long sequence of alarm events. Based on different extraction rules, logs with appropriate differences can be extracted into the same event. Extraction methods include techniques such as log parsing.
[0092] By mining the correlation and rules using the method of this application, frequent events and their related probabilities in sequential alarm events can be obtained. This application can help to mine explanatory events, i.e., the correlation between events, and at the same time, it can learn certain causal information.
[0093] This application can learn multi-level relationships, extract complex relationships between events in historical data, and effectively learn frequent relationships between historical alarm events. The results can be applied to fault prediction and fault diagnosis, and can also be added to the operation and maintenance knowledge base for the establishment and use of operation and maintenance knowledge graphs.
[0094] By incorporating real-world event correlation mining in intelligent operations and maintenance (O&M), PFEM is better suited for learning and mining event correlation information in O&M scenarios than existing methods. Furthermore, the PFEM algorithm leverages the low time complexity of PrefixSpan through improved methods, continuously compressing the search space. Finally, PFEM also possesses sufficient flexibility, allowing for adjustments to the algorithm's sensitivity to meet different needs.
[0095] Frequent events in the PFEM results can be used to extract historical events, making it easier for operations and maintenance personnel to understand the possible relationships between alarm events and gain a deeper understanding of system operations and maintenance. Furthermore, the probabilities of association rules provide a more quantitative standard, which can be combined with other algorithms or rules to develop better intelligent operations and maintenance solutions.
[0096] The time performance of the PFEM algorithm depends on the number of event types, the length of the sequence of events, and the selection of corresponding parameters. The extreme case has a complexity of O(n²), while the average case is O(nlog(n)). In special cases, parameters can be controlled to limit the mining depth to ensure runtime efficiency.
[0097] The primary application scenario of this application is event correlation analysis, specifically, analyzing whether there is a correlation between events, where the correlation is a relationship of frequent co-occurrence. The data it targets is a typical type of data in the operations and maintenance (O&M) field: long event sequences. A long event sequence refers to an ordered sequence of multiple events over a relatively long period. This type of long event sequence is a natural O&M data, such as alarm logs. Long event sequences can be raw data or data obtained through abstraction and processing using other techniques. For example, an event sequence consisting of four events: A, B, C, and D.
[0098] A->B->C->D->B->C->A->D……
[0099] PFEM is mainly used to discover whether there are relationships between events in long event sequences, and if so, what rules govern these relationships.
[0100] This application solves the following technical problems in the prior art: for the event association mining scenario in the AIOps intelligent operation and maintenance field, in order to solve the problem that operation and maintenance event data is a long sequence of events and the need to retain the order relationship of the events to be mined, it can effectively process long sequence events and can learn frequent episodes, that is, ordered event sets.
[0101] Please see Figure 5 This is a framework diagram of an event correlation analysis device provided in one embodiment of this application.
[0102] like Figure 5 As shown, the event correlation analysis device 500 includes a splitting module 501, a mining module 502, and a processing module 503;
[0103] The splitting module 501 is used to split the sequence events to be analyzed into non-overlapping sequences to obtain multiple rows of sub-sequence events. Each sub-sequence event consists of a starting event and other events that are different from the starting event. The multiple rows of sub-sequence events form a two-dimensional event set.
[0104] The mining module 502 is used to mine the two-dimensional event set to obtain frequent events.
[0105] The processing module 503 is used to process the frequent events to generate association rules, so as to analyze or predict future events based on the association rules.
[0106] Split module 501 is configured as follows:
[0107] Iterate through the sequence of events to be analyzed;
[0108] Events with a frequency greater than or equal to a predetermined frequency threshold in the sequence of events to be analyzed are identified as target events. The positions of the target events in the sequence of events to be analyzed are recorded. Based on the positions, the sequence of events to be analyzed is split into non-overlapping sequences to obtain a two-dimensional event set.
[0109] The splitting module 501 is further configured to: move the target event from its occurrence position to the starting position of the sub-sequence event as the starting event of the sub-sequence event, wherein the sub-sequence event consists of the starting event stored at the starting position and other events stored at other positions, the other events being one or more events that occur before the target event reappears in the sequence event to be analyzed; take the target event that reappears in the sequence event to be analyzed as the starting event of a new sub-sequence event, continue to traverse the events after the target event that reappears, until the sequence event to be analyzed is completely traversed, generate multiple rows of sub-sequence events with the target event as the starting event, and the multiple rows of sub-sequence events form a two-dimensional event set.
[0110] The splitting module 501 also includes a limiting module, which is used to impose a time limit when splitting the sequence events to be analyzed, so as to prevent a certain row of the subsequence events from containing more than a threshold number of events.
[0111] The mining module 502 employs a recursive method when performing tasks. The mining module 502 is configured to: identify a target event as a frequent plot when it appears frequently in the subsequence events; recursively search for events after the target event, and then search the subsequence events again. When both the target event and the recursively searched events appear frequently in the subsequence events, they are identified as frequent plots, until the two-dimensional event set is completely mined, yielding one or more frequent plots. Here, a frequent plot is a plot that satisfies support; a plot is a combination of one or more events in a certain order; and support is the frequency of a plot appearing in the sequence of events to be analyzed.
[0112] The processing module 503 is configured to: if the support of the target event as a frequent event is N1, and the support of the target event and the recursive event as sub-frequent events is N2, then the probability of the recursive event occurring after the target event occurs is N2 / N1, that is, to generate the probability of the sub-frequent events occurring after the frequent event occurs, and to generate the association rule, wherein the frequent event is composed of each of the sub-frequent events.
[0113] In this embodiment, the event correlation analysis device 500 is essentially configured with multiple modules to execute the methods described in the above embodiments. The specific functions and technical effects can be referred to in the above method embodiments, and will not be repeated here.
[0114] Please see Figure 6 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application.
[0115] like Figure 6 As shown, this application embodiment also provides an electronic device 600, including a processor 601, a memory 602, and a communication bus 603;
[0116] Communication bus 603 is used to connect processor 601 and memory 602;
[0117] The processor 601 is used to execute a computer program stored in the memory 602 to implement one or more methods as described in Embodiment 1 above.
[0118] This application also provides a computer-readable storage medium having a computer program stored thereon, the computer program being used to cause a computer to perform any of the methods described in Embodiment 1 above.
[0119] This application also provides a non-volatile readable storage medium storing one or more modules (programs). When these modules are applied to a device, they enable the device to execute the instructions included in Embodiment 1 of this application.
[0120] It should be noted that the computer-readable medium described in this disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution device, apparatus, or device. In this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution device, apparatus, or apparatus. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.
[0121] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.
[0122] Computer program code for performing the operations of this disclosure can be written in one or more programming languages or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, and C++, and conventional procedural programming languages such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).
[0123] This application also provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various embodiments described above.
[0124] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using dedicated hardware-based means to perform the specified function or operation, or using a combination of dedicated hardware and computer instructions.
[0125] The above embodiments are merely illustrative of the principles and effects of this application and are not intended to limit this application. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of this application. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in this application should still be covered by the claims of this application.
Claims
1. An event correlation analysis method, characterized in that, The method includes: The sequence of events to be analyzed is split into non-overlapping sequences to obtain multiple rows of sub-sequence events. Each sub-sequence event consists of a starting event and other events that are different from the starting event. The multiple rows of sub-sequence events form a two-dimensional event set. Mining the two-dimensional event set yields frequent events; The frequent events are processed to generate association rules, which are then used to analyze or predict future events. The sequence of events to be analyzed is split into non-overlapping sequences to obtain a two-dimensional event set, including: Iterate through the sequence of events to be analyzed; Events with a frequency greater than or equal to a predetermined frequency threshold in the sequence of events to be analyzed are identified as target events. The positions of the target events in the sequence of events to be analyzed are recorded. Based on the positions, the sequence of events to be analyzed is split into non-overlapping sequences to obtain a two-dimensional event set. Based on the location, the sequence events to be analyzed are split into non-overlapping sequences to obtain a two-dimensional event set, including: The target event is moved from the position where it appears to the starting position of the subsequence event as the starting event of the subsequence event. The subsequence event consists of the starting event stored at the starting position and other events stored at other positions. The other events are one or more events that occur before the target event of the sequence event to be analyzed reappears. The target event that reappears in the sequence of events to be analyzed is taken as the starting event of a new sub-sequence event. The events after the target event that reappears are traversed until the sequence of events to be analyzed is completely traversed, generating multiple rows of sub-sequence events with the target event as the starting event. The multiple rows of sub-sequence events form a two-dimensional event set. The sequence events to be analyzed are those in the alarm log.
2. The method according to claim 1, characterized in that, A time limit is applied when splitting the sequence events to be analyzed to prevent a subsequence event from containing more than a threshold number of events in a certain row.
3. The method according to claim 2, characterized in that, A recursive method is used to mine the two-dimensional event set to obtain frequent events, including: When the target event occurs frequently as a plot in the sub-sequence events, the target event is identified as a frequent plot; After the target event, recursively search for events in the subsequence events. When the target event and the recursively recursively recursively recursively appear frequently as plots in the subsequence events, the target event and the recursively ... The frequent episodes are episodes that satisfy the support, and the episode is a combination of one or more events in a certain order. The support is the frequency of the episode appearing in the sequence of events to be analyzed.
4. The method according to claim 3, characterized in that, The frequent occurrences are processed to generate association rules, including: If the support of the target event as a frequent event is N1, and the support of the target event and the recursively occurring event as sub-frequent events is N2, then the probability of the recursively occurring event after the target event occurs is N2 / N1, which is the probability of the sub-frequent events occurring after the frequent event occurs, and the association rule is generated, wherein the frequent event is composed of each sub-frequent event.
5. An event correlation analysis device, characterized in that, include: The splitting module is used to split the sequence events to be analyzed into non-overlapping sequences to obtain multiple rows of sub-sequence events. Each sub-sequence event consists of a starting event and other events that are different from the starting event. The multiple rows of sub-sequence events form a two-dimensional event set. The process of splitting the sequence of events to be analyzed into a non-overlapping sequence to obtain a two-dimensional event set includes: traversing the sequence of events to be analyzed; identifying events in the sequence of events to be analyzed whose frequency is greater than or equal to a predetermined frequency threshold as target events, recording the position of the target events in the sequence of events to be analyzed, and splitting the sequence of events to be analyzed into a non-overlapping sequence based on the position to obtain a two-dimensional event set; and further splitting the sequence of events to be analyzed into a non-overlapping sequence based on the position to obtain a two-dimensional event set, including: moving the target events from their occurrence positions to the starting position of the sub-sequence events as the starting event of the sub-sequence events, wherein... The subsequence event consists of the starting event stored at the starting position and other events stored at other positions. The other events are one or more events that occur before the target event that reappears in the sequence event to be analyzed. The target event that reappears in the sequence event to be analyzed is taken as the starting event of a new subsequence event. The events after the target event that reappears are traversed until the sequence event to be analyzed is completely traversed, generating multiple rows of subsequence events with the target event as the starting event. The multiple rows of subsequence events form a two-dimensional event set. The sequence event to be analyzed is an event in the alarm log. The mining module mines the two-dimensional event set to obtain frequent events; The processing module is used to process the frequent events to generate association rules.
6. An electronic device, characterized in that, Includes processor, memory, and communication bus; The communication bus is used to connect the processor and the memory; The processor is used to execute a computer program stored in the memory to implement the method as described in any one of claims 1 to 4.
7. A computer-readable storage medium, characterized in that, It contains a computer program that enables the computer to perform the method as described in any one of claims 1 to 4.
8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 4.