Alarm failure prediction method, device, equipment and storage medium

Abstract

The application provides an alarm fault prediction method and device, equipment and a storage medium, and relates to the technical field of network communication. The method comprises the following steps: constructing a recommendation model according to the strength of an alarm topology relationship and the correlation of time sequence indexes; and performing fault prediction on a target index according to the recommendation model. The strength of the alarm topology relationship is obtained by performing topology relationship mining on historical alarm data, and the correlation of the time sequence indexes is obtained by performing time sequence correlation analysis on historical time sequence index data. By introducing the strength of the alarm topology relationship and the correlation of the time sequence indexes to construct a recommendation model for fault prediction and sensing on the basis of fusing an alarm template triggering relationship and a time sequence prediction algorithm, the possibility of failure of a data center is reduced, the operation and maintenance cost is effectively reduced, and the operation and maintenance efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and more specifically, to an alarm fault prediction method, apparatus, device, and storage medium. Background Technology

[0002] As businesses grow and their overall architecture becomes increasingly complex, more and more companies (such as those in the financial and manufacturing industries) are recognizing the value of data. Data centers are one of the most effective means for enterprises to manage IT equipment and data. Data centers host the products and services of the enterprise, and to ensure a good user experience and business continuity, maintenance becomes more challenging. When the maintenance system detects an alarm in the data center, the highest priority for the entire enterprise is not root cause analysis, but rather predicting whether a more serious failure will occur—that is, fault detection. Existing fault detection methods generally fall into four categories: 1. Based on engineers' experience; 2. Using business-related call chains for reasoning; 3. Using alarm template triggering relationships for reasoning; 4. Fault prediction based on time-series prediction algorithms.

[0003] Currently, compared to traditional methods that are more limited by experience and call chains, intelligent operation and maintenance technology based on alarm template triggering relationships and time-series prediction algorithms is suitable for big data environments and reduces the uncertainty of prediction. However, the reasoning method based on the triggering relationship between alarm templates lacks consideration of the impact of topological relationships, and the fault prediction based on time-series prediction algorithms lacks impact analysis of related indicators and lacks coverage of monitoring indicators, which reduces the fault perception effect of data centers. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide an alarm fault prediction method, apparatus, device and storage medium. By integrating alarm template triggering relationship and time-series prediction algorithm, a recommendation model is constructed based on the strength of alarm topology relationship and the correlation of time-series indicators to perform fault prediction and perception. This fault perception method is applicable in scenarios where the topology relationship is clear or unclear. It can effectively improve the ability of the operation and maintenance system to perceive and discover faults, reduce the possibility of data center failures, effectively reduce operation and maintenance costs, improve operation and maintenance efficiency and enhance business continuity.

[0005] In a first aspect, embodiments of this application provide an alarm fault prediction method, the method comprising: constructing a recommendation model based on the strength of alarm topology relationships and the correlation of time-series indicators; and performing fault prediction on the target indicator based on the recommendation model; wherein the strength of alarm topology relationships is obtained by topology relationship mining of historical alarm data; and the correlation of time-series indicators is obtained by time-series correlation analysis of historical time-series indicator data.

[0006] In the above implementation process, by integrating alarm template-based triggering relationship and time-series prediction algorithms, a recommendation model is constructed based on the strength of alarm topology relationships and the correlation of time-series indicators to perform fault prediction and perception. This fault perception method is applicable in scenarios where the topology relationship is clear or unclear, effectively improving the operation and maintenance system's ability to perceive and discover faults, reducing the possibility of data center failures, while effectively reducing costs, improving operation and maintenance efficiency, and enhancing business continuity.

[0007] Optionally, the step of performing topological relationship mining on historical alarm data includes: effectively dividing the historical alarm data using a sliding window to obtain an initial alarm dataset; wherein the length of the sliding window is the effective time between related alarms; filtering and excluding alarm data in the initial alarm dataset based on the resolution time of the alarm data to obtain a fully valid alarm dataset; and performing topological relationship mining on the fully valid alarm dataset to obtain the strength of the alarm topological relationships.

[0008] In the above implementation process, by using the effective time of triggering between related alarms as a reference in the reasoning method based on the triggering relationship between alarm templates, the degree of influence of topological relationship is considered, and the strength of the topological relationship is accurate, thereby improving the reasoning effect.

[0009] Optionally, the step of performing topological relationship mining based on the full valid alarm dataset to obtain the strength of the alarm topological relationship includes: calculating the co-occurrence frequency of alarm combinations with related relationships based on the full valid alarm dataset; if it is determined that the co-occurrence frequency of the alarm combination is greater than or equal to the minimum absolute support, then constructing an alarm topological relationship library based on the alarm combination; and calculating and normalizing the co-occurrence frequency of the topological relationship based on the alarm topological relationship library to obtain the strength of the alarm topological relationship.

[0010] In the above implementation process, by setting a threshold in the reasoning method based on the triggering relationship between alarm templates to determine how many times the alarm templates co-occur before IT devices are considered to have a correlation, the influence of topological relationships is considered, and the strength of the topological relationship is precisely measured, thereby improving the reasoning effect.

[0011] Optionally, the alarm topology database is updated periodically based on historical alarm data sources.

[0012] In the above implementation process, the applicability of the fault prediction method is expanded by periodically updating the constructed alarm topology relationship library.

[0013] Optionally, the step of performing time-series correlation analysis on historical time-series indicator data includes: selecting any two time-series indicators from the historical time-series indicator data; and calculating the data correlation of the two time-series indicators at the macro-time granularity and micro-time granularity according to a preset algorithm to obtain the correlation of the time-series indicators.

[0014] In the above implementation process, by calculating the correlation between two indicators based on historical time series data in the fault prediction method based on time series prediction algorithm, the degree of influence of potentially related indicators is analyzed, thereby improving the accuracy of fault perception.

[0015] Optionally, the step of constructing a recommendation model based on the strength of alarm topology relationships and the correlation of time-series indicators includes: judging and estimating whether an abnormal alarm has occurred in the target indicator before a preset time period, and obtaining the influence coefficient of auxiliary rules; and constructing a recommendation model based on the influence coefficient of auxiliary rules, the strength of alarm topology relationships, and the correlation of time-series indicators.

[0016] In the above implementation process, by introducing the strength of topological relationships, the correlation of time series indicators at the macro and micro time granularities, and auxiliary rules combined with the needs of actual scenarios, a decision-making basis for the entire operation and maintenance system to perceive faults is provided in a recommended manner, which greatly improves the coverage and accuracy of fault perception.

[0017] Optionally, the step of constructing a recommendation model based on the influence coefficient of the auxiliary rule, the strength of the alarm topology relationship, and the correlation of time-series indicators includes: weighted summing of the coefficients of the influence coefficient of the auxiliary rule, the strength of the alarm topology relationship, the correlation of time-series indicators, the probability of triggering between alarm templates, and whether the target indicator will have an alarm in the future, to obtain the recommendation model.

[0018] In the above implementation process, by integrating the triggering relationship of alarm templates and the predictability of time series data, static and dynamic data features are combined to realize a fusion mechanism that takes into account both alarms and time series data. When considering the correlation of time series indicators, the influence of macro and micro time granularity is considered at the same time. Furthermore, with the support of auxiliary rules that are combined with scenario requirements, the accuracy can be greatly improved.

[0019] Secondly, embodiments of this application provide an alarm fault prediction device, the device comprising: a model building module and a prediction module; the model building module is used to build a recommendation model based on the strength of alarm topology relationships and the correlation of time-series indicators; the prediction module is used to predict the fault of the target indicator based on the recommendation model; wherein, the strength of alarm topology relationships is obtained by topology relationship mining of historical alarm data; and the correlation of time-series indicators is obtained by time-series correlation analysis of historical time-series indicator data.

[0020] Thirdly, embodiments of this application also provide an electronic device, including: a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the machine-readable instructions are executed by the processor to perform the steps of the above-described method.

[0021] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the above-described method.

[0022] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, specific embodiments are described below in conjunction with the accompanying drawings. Attached Figure Description

[0023] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 A flowchart of an alarm fault prediction method provided in an embodiment of this application;

[0025] Figure 2 An example diagram illustrating an alarm fault prediction method provided in an embodiment of this application;

[0026] Figure 3 This is a schematic diagram of the functional modules of the alarm and fault device provided in the embodiments of this application;

[0027] Figure 4 A block diagram of an electronic device that provides an alarm fault device according to an embodiment of this application.

[0028] Icons: 210-Model building module; 220-Prediction module; 300-Electronic device; 311-Memory; 312-Memory controller; 313-Processor; 314-Peripheral interface; 315-Input / output unit; 316-Display unit. Detailed Implementation

[0029] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0030] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. The terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0031] The inventors of this application have noted that intelligent operations and maintenance (O&M) is based on a monitoring system and has been improved by incorporating artificial intelligence technology to maximize business continuity. Problem perception, as the most significant difference between intelligent O&M and traditional O&M, is one of the most urgently needed functions for data centers. When the O&M system detects an alarm in the data center, the highest priority for the entire enterprise is not root cause analysis, but rather predicting whether a more serious failure will occur next—that is, fault perception. The results of fault perception are used to assist in judging the severity level of the alarm, thereby more effectively assessing the current situation, effectively controlling losses, saving manpower and resources, and improving overall O&M efficiency. Existing fault perception methods generally fall into four categories:

[0032] (1) Based on engineers' own experience. Traditional manual operation and maintenance, and fault perception mainly rely on experienced engineers. This method is effective for the operation and maintenance of IT equipment in small-scale enterprises, but it is no longer effective for data centers with tens of thousands of devices. Instead, it may be necessary to partition the data center and assign multiple experienced engineers to perform "one-on-one" operation and maintenance. Although this method is relatively stable, the cost will increase significantly, and the training of engineers also requires cost, which is not conducive to cost reduction and efficiency improvement.

[0033] (2) Reasoning based on business-related call chains. Impact assessment based on call chains is the opposite of root cause analysis. It assumes that when a parent node (the called node) has a problem, it will continue to search for child nodes (the calling nodes), checking how many child nodes the parent node has. Therefore, the impact assessment can only reach the next level of child nodes, and it's impossible to determine whether the impact will continue downwards. Since the call chain is a manifestation of specific business logic, impact assessment based on the call chain is limited by the actual business. That is, different business processes or changes in business will affect the original call chain. Therefore, impact assessment requires reviewing the call chain to ensure it is up-to-date each time, which undoubtedly reduces the overall efficiency of operations and maintenance.

[0034] (3) Reasoning based on alarm template triggering relationships. This method leverages intelligent O&M technology to mine the triggering relationships between alarm templates (image propagation model). Using logic opposite to root cause analysis, it calculates the probability that the alarm template corresponding to the current alarm will trigger alarms corresponding to other alarm templates. By comparing and recommending these probabilities, the O&M system's ability to perceive potential faults is improved. This method has strong applicability, enabling not only impact assessment but also alarm merging and root cause analysis, making it a customer-recognized method in the current O&M field.

[0035] (4) Fault prediction based on time-series prediction algorithms. This includes box plot methods that use statistical analysis of the distribution of data within the same time period in historical data to judge actual data based on calculated confidence intervals, and anomaly detection algorithms based on machine learning and deep learning such as Prophet and ARIMA. The latter works by using historical data over a continuous period as input, employing unsupervised learning algorithms to learn the behavior and characteristics of the data, outputting a prediction model, and then using this model to predict values ​​and upper and lower bounds for subsequent periods, thus achieving fault prediction.

[0036] Compared to the first two methods, which are more limited by experience and call chains, intelligent O&M technology based on alarm template triggering relationships and time-series prediction algorithms is adaptable to big data environments and reduces prediction uncertainty. However: 1. The reasoning method based on the triggering relationships between alarm templates lacks consideration of the impact of topological relationships. Topological relationships, i.e., the topological structural relationships between IT devices, are a necessary factor to consider in achieving fault perception. Existing fault perception methods only consider the presence or absence of topological relationships, without specifying how many (strong or weak) they are, thus leaving room for improvement in reasoning effectiveness. 2. Fault prediction based on time-series prediction algorithms lacks analysis of the impact on related indicators. This method basically only predicts faults for the target indicator itself, lacking coverage of monitoring indicators. However, the most important aspect of fault perception is analyzing the degree of impact on potentially related indicators, thereby improving the overall fault perception effect of the data center. In view of this, this application provides an alarm fault prediction method as described below.

[0037] Please see Figure 1 , Figure 1 This is a flowchart illustrating an alarm fault prediction method provided in an embodiment of this application. The embodiments of this application are explained in detail below. The method includes steps 100 and 120.

[0038] Step 100: Construct a recommendation model based on the strength of alarm topology relationships and the correlation of time-series metrics;

[0039] Step 120: Predict faults in the target indicators based on the recommendation model;

[0040] Among them, the strength of alarm topology relationships is obtained by mining topology relationships from historical alarm data; and the correlation of time-series indicators is obtained by performing time-series correlation analysis on historical time-series indicator data.

[0041] For example, topological relationships can be: interconnections between IT devices in a data center, calls between enterprise businesses and services, and deployment relationships between devices, which are one of the powerful bases for fault detection. The strength of alarm topological relationships can be determined by mining and analyzing historical alarm data to obtain the strength of topological relationships formed by combinations of related alarm templates. For example, the effective time or co-occurrence time of related alarms can be used to segment effective alarm data, and then a threshold can be set to determine how many times alarm templates co-occur before a relationship is considered to exist between IT devices, thereby constructing a topological relationship library to determine the strength of topological relationships. The correlation of time-series indicators can be determined by calculating the correlation magnitude based on the historical indicator values ​​of the target time-series indicator at multiple sampling times within a specified historical period, thereby determining the data correlation between time-series indicators. The recommendation model can be constructed based on the determined strength of alarm topological relationships and coefficients such as the correlation of time-series indicators, to predict potential faults after an alarm or fault occurs.

[0042] Optionally, such as Figure 2 The diagram illustrates an example of a fault detection method. First, it mines alarm template relationships from historical alarm data to build an alarm template relationship library. Then, it further mines topological relationships to build a topological relationship library, calculating and determining the strength of alarm topological relationships. This allows for the analysis of the strength of topological relationships in scenarios where the topological structure relationships between IT devices in a data center are explicit or implicit. Next, it uses time-series prediction algorithms to assess historical time-series indicator data, further performing time-series correlation analysis to calculate and determine the correlation between time-series indicators, thus analyzing the degree of impact of potentially related indicators. Auxiliary rules can be introduced to improve the accuracy of the constructed recommendation model's fault prediction. Based on the recommendation model, fault prediction is performed on the target indicator to be predicted, thereby predicting indicators that may experience faults in the entire data center within a future period.

[0043] By integrating alarm template-based relationship and time-series prediction algorithms, and introducing a recommendation model based on the strength of alarm topology relationships and the correlation of time-series indicators, this fault perception method is applicable to scenarios with clear or unclear topology relationships. It effectively improves the ability of the operation and maintenance system to perceive and discover faults, reduces the possibility of data center failures, and effectively reduces costs and improves operation and maintenance efficiency.

[0044] In one embodiment, the strength of alarm topology relationships in step 100 is obtained by performing topology relationship mining on historical alarm data. The mining method may include steps 101, 102, and 103.

[0045] Step 101: Effectively divide historical alarm data using a sliding window to obtain an initial alarm dataset; where the length of the sliding window is the effective time for triggering related alarms.

[0046] Step 102: Based on the resolution time of the alarm data, filter and exclude alarm data in the initial alarm dataset to obtain a fully valid alarm dataset;

[0047] Step 103: Perform topology mining based on the full valid alarm dataset to obtain the strength of alarm topology relationships.

[0048] For example, in the embodiments of this application, the mining of topological relationships can be based on two important inputs: effective triggering time and minimum absolute support. Effective triggering time can be the effective time for related alarms to trigger each other, or it can be regarded as the time of coexistence (co-occurrence); for example, there is a relationship between alarm A and alarm B, which can be a triggering relationship or a concurrent relationship. If alarm A and alarm B are concurrent, then there will be an alarm C that triggers the occurrence of alarms A and B.

[0049] Optionally, historical alarm data is used for analysis. The historical alarm data is sorted in ascending order by occurrence time. A sliding window with a length equal to the effective trigger time is used to divide the historical alarm data into several initial alarm data sets. The resolution time of the first alarm in each set (earliest occurrence time) is used as the standard. If any other alarm in the initial alarm data set occurs after the resolution time of the first alarm, that alarm is removed from the set. For example, if a valid initial alarm itemset contains three alarms, with alarm A resolved at time T0 and alarm B occurring at time T1, and if T1 > T0, it means alarm A was resolved before alarm B occurred, and therefore there is no correlation between them. Further filtering and elimination in the initial alarm data sets yields a fully valid alarm dataset. The minimum absolute support can then be used to further mine topological relationships within the fully valid alarm dataset to determine the strength of alarm topological relationships.

[0050] By using the effective time of triggering between related alarms as a reference in the reasoning method based on the triggering relationship between alarm templates, the influence of topological relationships can be considered and the strength of the topological relationships can be accurately determined, thereby improving the reasoning effect.

[0051] In one embodiment, step 103 may include steps 104, 105, and 106.

[0052] Step 104: Based on the full valid alarm dataset, calculate the co-occurrence count of related alarm combinations;

[0053] Step 105: If the number of co-occurrences of an alarm combination is greater than or equal to the minimum absolute support, then construct an alarm topology database based on the alarm combination.

[0054] Step 106: Based on the alarm topology database, calculate the co-occurrence frequency of topology relationships and normalize them to obtain the strength of alarm topology relationships.

[0055] For example, the minimum absolute support can be a threshold set to determine how many IT devices are considered to have a relationship when alarm templates co-occur. If relative support is used, total data needs to be added to the absolute support. Based on the set of all valid alarm data with a determined effective trigger time, the number of times different device IDs (usually IPs) of alarm combinations with a relationship are co-occurred is calculated. If the number of alarm template combinations is greater than or equal to the minimum absolute support, a relationship can be considered to exist, thus forming a topology relationship database. The strength of the alarm topology relationship can be obtained by calculating the number of co-occurrences of each topology relationship in the topology relationship database and normalizing it.

[0056] By setting a threshold in the reasoning method based on the triggering relationship between alarm templates to determine how many times the alarm templates co-occur before IT devices are considered to have a correlation, the influence of topological relationships is considered, and the strength of the topological relationship is precisely measured, thus improving the reasoning effect.

[0057] In one embodiment, the alarm topology database is updated periodically based on historical alarm data sources.

[0058] For example, in telecommunications networks, anomalies are typically identified through alarms. Due to the scale of the network and the interconnected structure of the system, operators may face millions of alarms daily. A single fault in the network can trigger a large number of alarms of various types on multiple connected IT devices. Operators expect to quickly locate the root cause of the fault from the alarm storm; however, achieving this goal is very difficult. It is necessary to provide administrators with the correlations between the topologies of alarms for rapid troubleshooting. For example, based on historical alarm datasets in the format [alarm_id, device_id, start_timestamp, end_timestamp], alarm topology relationships between multiple devices can be formed using data such as alarm type (alarm_id), the device where the alarm occurred (device_id), the total number of alarm types, and the total number of devices. Effective trigger time and minimum absolute support are used to mine and determine the strength of the topology relationships, thus constructing an alarm topology relationship database. Therefore, considering that enterprises may change the topology structure according to business needs, this topology relationship database can be updated regularly based on historical alarm data.

[0059] By periodically updating the constructed alarm topology database, the applicability of the fault prediction method is expanded.

[0060] In one embodiment, the correlation of time-series indicators in step 100 is obtained by performing time-series correlation analysis on historical time-series indicator data. The method of correlation analysis may include steps 107 and 108.

[0061] Step 107: Select any two time series indicators from the historical time series indicator data;

[0062] Step 108: Calculate the data correlation of two time series indicators at the macro and micro time granularities according to the preset algorithm to obtain the correlation of time series indicators.

[0063] For example, from a macroscopic perspective, the correlation between indicators can be determined: select two time-series indicators and obtain their historical data over the past month. One of the preset algorithms, such as Pearson, Kendall, and Spearman, can be used to calculate the correlation between the time-series indicators over the past month, which can be represented by Rm. From a microscopic perspective, the correlation between indicators can be determined: utilize a more microscopic time granularity to correct for the lack of focus caused by macroscopic data. The same algorithm described above can be used to calculate the correlation between the two time-series indicators at a microscopic time granularity of the past three hours, which can be represented by Rh. By calculating the correlation between two indicators based on historical time-series data in a fault prediction method based on time-series prediction algorithms, the influence of potentially related indicators can be analyzed, improving the accuracy of fault perception.

[0064] In one embodiment, step 120 may include steps 121 and 122.

[0065] Step 121: Determine and estimate whether the target indicator has generated any abnormal alarms before the preset time period, and obtain the influence coefficient of the auxiliary rule;

[0066] Step 122: Construct a recommendation model based on the influence coefficient of auxiliary rules, the strength of alarm topology relationships, and the correlation of time-series indicators.

[0067] For example, auxiliary rules can be: rules formulated to improve the accuracy of fault prediction in order to better detect faults; for example, determining whether the current indicator has already experienced an anomaly or alarm within a preset time period (e.g., 1 hour) before the fault occurs. If so, the probability of the current indicator failing due to the current fault will decrease, and vice versa. Based on this auxiliary rule, the influence coefficient of the auxiliary rule for the current indicator can be determined, which can be represented as M. The corresponding weights are determined based on the influence coefficient of the auxiliary rule, the strength of the alarm topology relationship, and the correlation of time-series indicators, and then a recommendation model is constructed.

[0068] By introducing the strength of topological relationships, the correlation of time-series indicators at both macro and micro time granularities, and auxiliary rules that combine actual scenario requirements, a recommendation-based approach is used to provide decision-making support for the entire operation and maintenance system to perceive faults, greatly improving the coverage and accuracy of fault perception.

[0069] In one embodiment, step 122 may include: step 1221.

[0070] Step 1221: Weight the coefficients of the auxiliary rule influence coefficient, the strength of the alarm topology relationship, the correlation of time series indicators, the probability of triggering alarms between alarm templates, and the coefficients of whether the target indicator will have an alarm in the future to obtain the recommendation model.

[0071] For example, the output of fault perception is to be presented in the form of recommendations. These recommendations are based on a weighted sum of factors including the influence coefficient of auxiliary rules, the strength of alarm topology relationships, the correlation of time-series indicators, the probability of alarms occurring between alarm templates, and the likelihood of future alarms for the target indicator. The parameters include the probability of alarms occurring between alarm templates (P), whether an indicator will trigger an alarm in the future (A), the strength of alarm topology relationships (T), the correlation of time-series indicators (Rm and Rh), and the influence coefficient of auxiliary rules (M). The recommendation score can be obtained based on the recommendation model constructed below:

[0072] Score=M*(b0*P+b1*A+b2*T+b3*Rm+b4*Rh)

[0073] The recommended scores can be used to predict indicators that may lead to failures in the entire data center in the near future.

[0074] Specifically, this fault perception method was applied to the operation and maintenance platform of a certain operator and tested continuously for three months. The operator's data center comprises over 20,000 IT devices, including servers, databases, and applications. The fault prediction method proposed in this application was compared with individual methods based on alarm template correlation and time-series prediction algorithms (fused with time-series indicator correlation) for fault prediction, with results of 98.5, 83.1, and 66.7, respectively. It can be seen that this fault prediction method outperforms other methods in recommendation, meaning that feature fusion analysis and decision-making are more effective than recommendations based on a single feature.

[0075] By integrating the triggering relationships of alarm templates and the predictability of time-series data, a fusion mechanism that takes into account both alarms and time-series data is achieved by combining static and dynamic data features. When considering the correlation of time-series indicators, the influence of both macroscopic and microscopic time granularities is taken into account. Furthermore, with the support of auxiliary rules tailored to specific scenario requirements, accuracy can be greatly improved.

[0076] Please see Figure 3 , Figure 3 An alarm fault prediction device provided in this application embodiment includes a model building module 210 and a prediction module 220.

[0077] The model building module 210 is used to build a recommendation model based on the strength of alarm topology relationships and the correlation of time-series indicators;

[0078] Prediction module 220 is used to predict the failure of target indicators based on the recommendation model;

[0079] Among them, the strength of alarm topology relationships is obtained by mining topology relationships from historical alarm data; and the correlation of time-series indicators is obtained by performing time-series correlation analysis on historical time-series indicator data.

[0080] Optionally, the model building module 210 can be used for:

[0081] The historical alarm data is effectively divided by a sliding window to obtain an initial alarm dataset; wherein, the length of the sliding window is the effective time for triggering related alarms.

[0082] Based on the resolution time of the alarm data, the alarm data in the initial alarm dataset is filtered and excluded to obtain a fully valid alarm dataset;

[0083] Based on the fully valid alarm dataset, topological relationship mining is performed to obtain the strength of the alarm topological relationships.

[0084] Optionally, the model building module 210 can be used for:

[0085] Based on the fully valid alarm dataset, calculate the co-occurrence count of related alarm combinations;

[0086] If the number of co-occurrences of the alarm combination is determined to be greater than or equal to the minimum absolute support, then an alarm topology database is constructed based on the alarm combination.

[0087] Based on the alarm topology database, the co-occurrence frequency of the topology relationships is calculated and normalized to obtain the strength of the alarm topology relationships.

[0088] Optionally, the alarm topology database is updated periodically based on historical alarm data sources.

[0089] Optionally, the model building module 210 can be used for:

[0090] Select any two time series indicators from the historical time series indicator data;

[0091] According to a preset algorithm, the data correlation of the two time series indicators at both the macro and micro time granularities is calculated to obtain the correlation of the time series indicators.

[0092] Optionally, the prediction module 220 can be used for:

[0093] The system judges and estimates whether the target indicator has generated an abnormal alarm before a preset time period, and obtains the influence coefficient of the auxiliary rule.

[0094] A recommendation model is constructed based on the influence coefficient of the auxiliary rules, the strength of alarm topology relationships, and the correlation of time-series indicators.

[0095] Optionally, the prediction module 220 can be used for:

[0096] The recommendation model is obtained by weighting and summing the coefficients of the auxiliary rule influence coefficient, the strength of alarm topology relationship, the correlation of time series indicators, the probability of triggering alarms between alarm templates, and the coefficients of whether the target indicator will have an alarm in the future.

[0097] Please see Figure 4 , Figure 4 This is a block diagram of an electronic device. The electronic device 300 may include a memory 311, a memory controller 312, a processor 313, a peripheral interface 314, an input / output unit 315, and a display unit 316. Those skilled in the art will understand that... Figure 4 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device 300. For example, the electronic device 300 may also include components that are more... Figure 4 The more or fewer components shown, or having the same Figure 4 The different configurations shown.

[0098] The aforementioned memory 311, memory controller 312, processor 313, peripheral interface 314, input / output unit 315, and display unit 316 are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines. The aforementioned processor 313 is used to execute executable modules stored in the memory.

[0099] The memory 311 can be, but is not limited to, Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), etc. The memory 311 stores programs, and the processor 313 executes these programs upon receiving execution instructions. The methods executed by the electronic device 300, as defined in any embodiment of this application, can be applied to or implemented by the processor 313.

[0100] The aforementioned processor 313 may be an integrated circuit chip with signal processing capabilities. The processor 313 may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a digital signal processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor.

[0101] The peripheral interface 314 described above couples various input / output devices to the processor 313 and the memory 311. In some embodiments, the peripheral interface 314, the processor 313, and the memory controller 312 can be implemented in a single chip. In other instances, they can be implemented by separate chips.

[0102] The input / output unit 315 described above is used to provide user input data. The input / output unit 315 may be, but is not limited to, a mouse and a keyboard.

[0103] The aforementioned display unit 316 provides an interactive interface (e.g., a user interface) for the user to reference between the electronic device 300 and the user. In this embodiment, the display unit 316 may be a liquid crystal display (LCD) or a touch screen display. The LCD or touch screen display can show the process of the processor executing the program.

[0104] The electronic device 300 in this embodiment can be used to perform the various steps in the various methods provided in the embodiments of this application.

[0105] Furthermore, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps described in the above method embodiments.

[0106] The computer program product of the above-described method provided in this application includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the steps in the above-described method embodiments. For details, please refer to the above-described method embodiments, which will not be repeated here.

[0107] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms. The functional modules in the embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0108] It should be noted that if the function is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0109] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0110] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method of predicting an alarm failure, characterized by, The method includes: A recommendation model is constructed based on the strength of alarm topology relationships and the correlation of time-series indicators; Fault prediction is performed on the target indicators based on the recommendation model; The strength of the alarm topology relationship is obtained by mining the topology relationship of historical alarm data; and the correlation of the time series indicators is obtained by performing time series correlation analysis on historical time series indicator data. The process of mining topological relationships in historical alarm data includes: effectively dividing the historical alarm data using a sliding window to obtain an initial alarm dataset; wherein the length of the sliding window is the effective time between related alarms; filtering and excluding alarm data in the initial alarm dataset based on the resolution time of the alarm data to obtain a fully valid alarm dataset; and mining topological relationships based on the fully valid alarm dataset to obtain the strength of the alarm topological relationships. The step of mining topological relationships based on the full set of valid alarm datasets to obtain the strength of alarm topological relationships includes: calculating the co-occurrence frequency of related alarm combinations based on the full set of valid alarm datasets; if the co-occurrence frequency of an alarm combination is determined to be greater than or equal to the minimum absolute support, then constructing an alarm topological relationship database based on the alarm combination; and calculating and normalizing the co-occurrence frequency of topological relationships based on the alarm topological relationship database to obtain the strength of the alarm topological relationships. The step of performing time-series correlation analysis on historical time-series indicator data includes: selecting any two time-series indicators from the historical time-series indicator data; and calculating the data correlation of the two time-series indicators at both macro-time granularity and micro-time granularity according to a preset algorithm to obtain the correlation of the time-series indicators.

2. The method according to claim 1, characterized in that, in, The alarm topology database is updated periodically based on historical alarm data sources.

3. The method according to claim 1, characterized in that, The step of constructing a recommendation model based on the strength of alarm topology relationships and the correlation of time-series indicators includes: The system judges and estimates whether the target indicator has generated an abnormal alarm before a preset time period, and obtains the influence coefficient of the auxiliary rule. A recommendation model is constructed based on the influence coefficient of the auxiliary rules, the strength of alarm topology relationships, and the correlation of time-series indicators.

4. The method according to claim 3, characterized in that, The step of constructing a recommendation model based on the influence coefficient of the auxiliary rules, the strength of alarm topology relationships, and the correlation of time-series indicators includes: The recommendation model is obtained by weighting and summing the coefficients of the auxiliary rule influence coefficient, the strength of alarm topology relationship, the correlation of time series indicators, the probability of triggering alarms between alarm templates, and the coefficients of whether the target indicator will have an alarm in the future.

5. An alarm fault prediction device, characterized in that, The device includes: a model building module and a prediction module; The model building module is used to build a recommendation model based on the strength of alarm topology relationships and the correlation of time-series indicators; The prediction module is used to predict the faults of the target indicators based on the recommendation model. The strength of the alarm topology relationship is obtained by mining the topology relationship of historical alarm data; and the correlation of the time series indicators is obtained by performing time series correlation analysis on historical time series indicator data. The model building module is specifically used for: effectively dividing the historical alarm data through a sliding window to obtain an initial alarm dataset; wherein the length of the sliding window is the effective time for related alarms to be triggered; filtering and excluding alarm data in the initial alarm dataset based on the resolution time of the alarm data to obtain a fully valid alarm dataset; and performing topological relationship mining based on the fully valid alarm dataset to obtain the strength of the alarm topological relationship. The model building module is specifically used for: calculating the co-occurrence frequency of related alarm combinations based on the full valid alarm dataset; if the co-occurrence frequency of the alarm combination is determined to be greater than or equal to the minimum absolute support, then constructing an alarm topology relation library based on the alarm combination; and calculating and normalizing the co-occurrence frequency of the topology relation based on the alarm topology relation library to obtain the strength of the alarm topology relation. The model building module is specifically used to: select any two time series indicators from the historical time series indicator data; and calculate the data correlation of the two time series indicators at the macro time granularity and micro time granularity according to a preset algorithm, so as to obtain the correlation of the time series indicators.

6. An electronic device, characterized in that, include: The processor and memory, wherein the memory stores machine-readable instructions executable by the processor, wherein when the electronic device is running, the machine-readable instructions are executed by the processor to perform the steps of the method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the method as described in any one of claims 1 to 4.

Images