A method for verifying association rules in a network management system

Abstract

This invention discloses a method for verifying association rules in a network management system, comprising the following steps: S1: The interface selects the query conditions for simulated alarms and sends a request to the controller; S2: The controller validates the input parameters and calls the API of the alarm query parser; S3: The alarm query parser filters out simulated alarms according to the conditions and returns them to the controller; S4: The interface receives and displays the returned results; S5: The interface selects the simulated alarm to be verified as verification data and sends a request to the controller; S6: The controller validates the input parameters of the simulated alarms and transmits the simulated alarm data to the association simulator; S7: The association simulator, based on the alarm data, sends the intermediate data and association results of the association processing to the association result analyzer; S8: The association result analyzer outputs the association results and analysis report to the controller; S9: The interface displays the output results. This invention not only has high verification efficiency and reduces the work of manual analysis, but also has a user-friendly interface.

Description

Technical Field

[0001] This invention relates to the field of network management system technology, and more specifically to a method for verifying association rules in a network management system. Background Technology

[0002] In a network management system (hereinafter referred to as the network management system), alarms are generated by network devices due to faults. There are topological relationships between devices (which are mapped to resources). Therefore, network fault analysis can be performed based on resource relationships and alarms. This configuration that describes alarms, resources, and analysis and processing is called association rules, and the program that processes alarms and association rules is called association service.

[0003] The associated service loads association rules to form a rule space, simultaneously receives and filters alarms, marks alarms, and then supplements associated resources according to the resource supplementation configuration mapped to the alarm marks. Finally, the alarm data is placed into the rule space. When the alarm data in the rule space meets preset conditions, an association result is generated. The core processing flow is illustrated below. Figure 1 As shown, the specific explanation is as follows:

[0004] Alarm Tagging: By setting filter conditions in association rules, an alarm that meets the conditions is considered to belong to the alarm scope of that rule. Multiple tags can be set in an association rule to distinguish different alarm scopes. Tagging alarms is mainly used for subsequent resource supplementation and association calculations.

[0005] Related resource supplementation: Load the corresponding related resources in the association rules according to the alarm flags. Related resources can be found using SQL. Regular expression matching and dynamic scripts are also supported to process the data.

[0006] Association calculation: The relationship between alarms and resources is used as a condition for association calculation. When this condition is met, an association result is generated. Multiple association calculation scenarios can exist in a single association rule.

[0007] After the rules are edited, testing and verification usually require experienced personnel. However, with the development of network management systems, the resource relationships involved in the association rules are becoming more and more complex, and the verification process has become very cumbersome.

[0008] The core process of current validation association rules, such as Figure 2 As shown, it consists of 3 steps:

[0009] Step 1: Update the association rules to be verified to the associated service;

[0010] Step 2: Analyze resource relationships, simulate alarms, and send them to the associated services, waiting for the associated services to complete their processing;

[0011] Step 3: Based on the log information, analyze the alarm handling process in related services to form correlation analysis results;

[0012] Of these steps, steps 2 and 3 are the most time-consuming and labor-intensive. The difficulty of analyzing resource relationships in step 2 depends mainly on the complexity of the resource relationships involved in the requirements, which places high demands on the verification personnel's business skills. The difficulty of step 3 is mainly due to the large number of possible factors that could cause the association processing to fail, requiring the verification personnel to be very familiar with the program's processing mechanism.

[0013] If a rule fails to pass verification, the rule needs to be adjusted or a new simulated alarm needs to be prepared until it succeeds.

[0014] As can be seen from the above, the existing solutions have the following drawbacks:

[0015] A. Verification data (simulated alarms) and correlation result analysis both require manual intervention, which is inefficient and the verification time is generally more than 30 minutes.

[0016] B. The data preparation process for verification requires personnel who understand resources and business, while the correlation analysis results require personnel who understand business and process handling mechanisms, thus placing high demands on verification personnel.

[0017] C. The display of association analysis results is not user-friendly. Summary of the Invention

[0018] The technical problem to be solved by the present invention is to provide a method for verifying association rules in a network management system, which not only has high verification efficiency and reduces the work of manual analysis, but also has a user-friendly interface.

[0019] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows.

[0020] A method for verifying association rules in a network management system, based on an interactive interface + backend model; the backend includes a controller, an alarm query parser, an association simulator, and an association result analyzer; the method includes the following steps:

[0021] S1: Select the query criteria for simulated alarms on the interface, click the query button, and send a request to the controller;

[0022] S2: The controller validates the input parameters and calls the alarm query parser's API;

[0023] S3: The alarm query parser filters out simulated alarms from the historical alarm database based on conditions and returns the alarm data to the controller;

[0024] S4: The interface receives and displays the return results of the control simulation alarm;

[0025] S5: The interface selects the simulated alarm to be verified as the verification data based on the alarm selection suggestion and sends a request to the controller;

[0026] S6: The controller verifies the input parameters of the simulated alarm. If the verification is successful, the simulated alarm data is transmitted to the associated simulator.

[0027] S7: The association simulator performs alarm marking, association resource supplementation, and association calculation processing based on alarm data and verified association rules, and sends the intermediate data and association results to the association result analyzer.

[0028] S8: The correlation result analyzer performs analysis and processing based on the correlation results and intermediate data of the correlation processing, and outputs the correlation results and analysis report to the controller;

[0029] S9: The interface receives and displays the associated results and analysis reports returned by the controller.

[0030] Preferably, step S3 specifically includes the following steps:

[0031] S31: The alarm query parser receives the input parameters, which include the alarm ID set, rule ID, and whether to filter alarms based on associated resources.

[0032] S32: Assemble query conditions based on input parameters;

[0033] S33: Call the alarm history database query API and pass in the query conditions to obtain the alarm set;

[0034] S34: Supplement alarm selection suggestions by combining alarm sets and assembly conditions;

[0035] S35: Returns parameters, including alarm set and alarm selection suggestions.

[0036] Preferably, the implementation process of step S32 is as follows:

[0037] If the input parameters contain a set of alarm IDs, then the query conditions are assembled using the alarm IDs.

[0038] If the alarm ID set is not present in the input parameters, the rule content is obtained based on the rule ID, and the filtering conditions of the alarm range in the rule are parsed. The filtering conditions are then used to assemble the query conditions. If the switch is enabled based on the filtering of alarms by associated resources, the resource variables corresponding to the alarm markers in the rule also need to be parsed, the data corresponding to the resource variables is extracted, and the data is integrated into the query conditions.

[0039] Preferably, the association simulator includes an alarm tagging simulation, an association resource replenishment simulation, and an association calculation simulation that are sequentially connected to generate association results;

[0040] The method for generating intermediate data in step S7 is as follows:

[0041] The alarm tagging simulation completes the alarm tagging function by calling the API provided by the alarm tagging, and at the same time generates intermediate alarm tagging data;

[0042] The associated resource replenishment simulation completes the associated resource replenishment function by calling the API provided by the associated resource replenishment, and at the same time generates intermediate data of the associated resource set.

[0043] The association calculation simulation completes the association calculation function by calling the API provided by the association calculation, and at the same time generates intermediate data on the conditions and satisfaction status of each association scenario.

[0044] Preferably, in step S8, the correlation result analyzer analyzes the alarm flags and associated resource assignments of alarms related to the correlation scenario conditions based on intermediate data analysis to initially determine whether the verification data is normal. The judgment process is as follows:

[0045] S81: Determine if there are alarm markers in the intermediate data. If the alarm markers are empty, it means that the alarm does not meet the filtering conditions in the rule, and prompt the user to check the filtering condition configuration in the rule; otherwise, proceed to step S82.

[0046] S82: Determine the associated resources. If the associated resources are empty, it indicates a problem during the resource replenishment process, and prompts you to check and adjust the associated resource configuration or resource data; otherwise, it appears normal from a data perspective.

[0047] S83: Finally, based on the results of steps S81 and S82, assemble the data analysis report.

[0048] Preferably, in step S8, the association result analyzer performs association scenario analysis according to the stages of association scenario - association scenario conditions.

[0049] Preferably, the processing flow for the multiple associated scenarios is as follows:

[0050] S84: Obtain the correlation results, intermediate data, and data analysis report obtained in step S83;

[0051] S85: Retrieve all associated scenario conditions in the rule;

[0052] S86: Analyze the association conclusion of this associated scenario based on a given associated scenario condition;

[0053] S87: Determine if there is a next related scenario. If there is, continue to step S86; otherwise, proceed to step S88.

[0054] S88: After all related scenarios have been analyzed, the analysis report is assembled and returned along with the related results.

[0055] Preferably, the analysis process for each condition within a single associated scenario in step S86 is as follows:

[0056] S861: Extract valid resources and set resource codes to put them into the resource code pool;

[0057] S862: Retrieve all conditions under this associated scenario;

[0058] S863: Match alarms according to the alarm flags related to a condition. If no alarm matches the condition, it means that no alarm meets the condition. The reason why the condition fails is determined to be the reason for the alarm. Otherwise, continue to step S864.

[0059] S864: Retrieve the associated resources from the alarm in step S863 and match them in the resource code pool. If no resource code can be retrieved, it means that the reason this condition is not met is due to a resource issue. Otherwise, continue to step S865.

[0060] S865: Determine whether this condition itself is passed. If not, it means that the reason why this condition failed is for other reasons; otherwise, this condition is normal.

[0061] S866: Continue to evaluate the next condition.

[0062] Preferably, the method for displaying the correlation results and analysis report on the interface in step S9 is as follows:

[0063] Tabs are used to distinguish the analysis results of each related scenario. Under each related scenario, the original related scenario conditions are displayed, and color rendering is applied based on the condition's pass / fail status. The analysis result for each condition is displayed after each condition box. Clicking on the analysis result displays the resource information involved under the currently selected condition on the left side of the resource association information area. Clicking on the resource information displays the data content and matching results related to the clicked resource on the right side. Links are also provided to view the intermediate data of the alarm.

[0064] Due to the adoption of the above technical solutions, the technical progress achieved by this invention is as follows.

[0065] This invention employs an interactive interface + backend model. The interface handles information input and result display; the backend processing can be summarized as follows: using the alarm history database as the data source to filter simulated alarms, collecting intermediate data generated during the verification process, analyzing the correlation results, inferring potential problems, and returning a correlation analysis report. This not only improves verification efficiency and reduces manual analysis work, but also provides a user-friendly interface. Attached Figure Description

[0066] Figure 1 This is a flowchart illustrating the core processing steps in the existing network management system.

[0067] Figure 2 This is a flowchart illustrating the core process of verifying association rules in an existing network management system.

[0068] Figure 3 This is a flowchart of the present invention;

[0069] Figure 4 This is a flowchart of the alarm query parser of the present invention;

[0070] Figure 5 This is a flowchart illustrating the specific implementation of the alarm query parser of the present invention assembling query conditions based on input parameters;

[0071] Figure 6 This is a flowchart of the associated simulator processing of the present invention;

[0072] Figure 7 The flowchart for the preliminary determination of whether the verification data is normal by the correlation result analyzer of the present invention is shown below;

[0073] Figure 8 This is a flowchart illustrating the processing of multiple related scenarios when the correlation result analyzer of the present invention performs correlation scenario analysis;

[0074] Figure 9 A flowchart illustrating the analysis of various conditions within a single associated scenario using the association result analyzer of this invention.

[0075] Figure 10 The interface of this invention displays the verification results and analysis report of the association rules.

[0076] Figure 11 This is a screenshot showing the intermediate data display of the alarm in the interface of this invention. Detailed Implementation

[0077] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0078] A method for verifying association rules in a network management system employs an interactive interface + backend model. The interface handles information input and result display; the backend includes a controller, an alarm query parser, an association simulator, and an association result analyzer. The backend processing can be summarized as follows: simulated alarms are filtered out using the alarm history database as the data source; intermediate data generated during the verification process is collected; and the association results are analyzed to infer potential problems, returning an association analysis report. Figure 3 As shown, the detailed operation process of this method includes the following steps:

[0079] S1: Select the query criteria for simulated alarms on the interface, click the query button, and send a request to the controller.

[0080] S2: The controller validates the input parameters and calls the alarm query parser's API.

[0081] S3: The alarm query parser filters simulated alarms from the historical alarm database based on conditions and returns the alarm data to the controller.

[0082] S4: The interface displays the return results of the control simulation alarm.

[0083] S5: The interface selects the simulated alarm to be verified as the verification data based on the alarm selection suggestion and sends a request to the controller.

[0084] S6: The controller verifies the input parameters of the simulated alarm, and if they pass, it transmits the simulated alarm data to the associated simulator.

[0085] S7: The association simulator performs alarm marking, association resource supplementation, and association calculation processing based on alarm data and verified association rules, and sends the intermediate data and association results to the association result analyzer.

[0086] S8: The correlation result analyzer performs analysis and processing based on the correlation results and intermediate data of the correlation processing, and outputs the correlation results and analysis report to the controller.

[0087] S9: The interface receives and displays the associated results and analysis reports returned by the controller.

[0088] To facilitate the explanation of the key processing logic in the workflow, a specific example of association rule configuration needs to be specified:

[0089]

[0090] The following is an additional explanation of the above example of association rules:

[0091] A. Two types of alarm tags are set for the alarm range.

[0092] Alarm flag 1 and alarm flag 2 each have their own filtering conditions. If an alarm meets the filtering conditions of a certain flag, it will be marked with the relevant alarm flag.

[0093] B. The associated resource definition sets one resource variable and specifies the mapping relationship between alarm flags and resource variables.

[0094] Resource variable circuit, also known as circuitKey, retrieves resource values ​​via SQL.

[0095] This variable is specified to map both alarm flag 1 and alarm flag 2, indicating that an alarm with alarm flag 1 or alarm flag 2 will supplement the circuit's associated resources.

[0096] C. An association scenario is set up in the association calculation.

[0097] The associated scenario conditions for associated scenario 1 include two conditions. The first condition is related to alarm flag 1 (event_a), and the associated resource is a circuit. The second condition is related to alarm flag 2 (event_b), and the associated resource is a circuit. It also specifies that the resource relationship between the two is the same circuit.

[0098] The associated action will only be executed if both of the above conditions are met.

[0099] The process of alarm query parser processing in step S3 is explained as follows: Figure 4 As shown, the specific steps include:

[0100] S31: The alarm query parser receives the input parameters, which include the alarm ID set, rule ID, and whether to filter alarms based on associated resources.

[0101] S32: Assemble query conditions based on input parameters.

[0102] The specific implementation process is as follows: Figure 5 As shown:

[0103] If the input parameters contain a set of alarm IDs, then the query conditions are assembled using the alarm IDs (assembly method: alarm ID).

[0104] If the alarm ID set is not present in the input parameters, the rule content is obtained based on the rule ID, and the filter conditions of the alarm range in the rule are parsed. The filter conditions are then used to assemble the query conditions (assembly method: filter conditions). If the switch is enabled based on the alarm filtering of associated resources, the resource variables corresponding to the alarm markers in the rule also need to be parsed, the data corresponding to the resource variables is extracted, and integrated into the query conditions (assembly method: filter conditions + resource variables).

[0105] S33: Call the alarm history database query API and pass in the query conditions to get the alarm set.

[0106] S34: Combine alarm set and assembly conditions to supplement alarm selection suggestions.

[0107] The following table 1 provides recommendations for selecting the three assembly conditions.

[0108] Assembly conditions Alarm Selection Recommendations alarm ID High matching degree Filtering conditions Low matching degree Filtering conditions + resource variables In terms of matching degree

[0109] Table 1

[0110] S35: Returns parameters, including alarm set and alarm selection suggestions.

[0111] Since the alarm query parser analyzes and obtains verification data at the code level by combining input parameters and rule settings, it greatly reduces the workload of manual analysis.

[0112] The main processing steps for step S7, which associates the simulator, are as follows: Figure 6 As shown, the association simulator mainly simulates the environment of the association core processing.

[0113] The association simulator includes alarm tagging simulation, associated resource replenishment simulation, and associated calculation simulation connected in sequence, which can generate association results. At the same time, the association simulator collects intermediate data generated during the verification process.

[0114] The key processing logic of several stages of the associated simulator is explained by combining two alarm data (see Table 2) and resource data (related records in circuit are shown in Table 3), namely, the method of generating intermediate data (hereinafter referred to as intermediate data) in step S7.

[0115] Serial Number alarm ID title Network element types Network element ID 1 10000 LOS circuit board c01eb31 2 10001 LOF circuit board c02dd65

[0116] Table 2

[0117] Serial Number obj_id circuit_no 1 c01eb31 10efn87g 2 c02dd65 3d0e5690

[0118] Table 3

[0119] a. Alarm flag simulation

[0120] The alarm tagging function is accomplished by calling the API provided by the alarm tagging service.

[0121] The intermediate data generated in this step is the alarm identifier.

[0122]

[0123]

[0124] b. Related resource replenishment simulation

[0125] The function of supplementing related resources is accomplished by calling the API provided by the related resource supplementation service.

[0126] The intermediate data generated in this step is a set of related resources.

[0127]

[0128] c-correlation computation simulation

[0129] The association calculation function is accomplished by calling the API provided by the association calculation.

[0130] The intermediate data generated in this step consists of the conditions and their fulfillment in various related scenarios.

[0131]

[0132] Regarding the correlation result analyzer in step S8, analysis logic for correlation results has been added. The correlation result analyzer performs intermediate data analysis and correlation scenario analysis based on the correlation results and intermediate data of correlation processing, thereby generating an analysis report and correlation results.

[0133] Intermediate data analysis:

[0134] The main analysis focuses on alarm flags and associated resource assignments related to alarms in relevant scenario conditions to initially determine whether the verification data is normal. The judgment process is as follows: Figure 7 As shown, the main analysis focuses on whether there are alarm flags and whether the associated resources are empty. Specifically, this includes the following steps:

[0135] S81: Determine if there are alarm markers in the intermediate data. If the alarm markers are empty, it means that the alarm does not meet the filtering conditions in the rule, and prompt the user to check the filtering condition configuration in the rule; otherwise, proceed to step S82.

[0136] S82: Determine the associated resources. If the associated resources are empty, it indicates a problem during the resource replenishment process, which may be due to configuration errors or problems with resource data. In this case, prompt the user to check and adjust the associated resource configuration or resource data. Otherwise, the data appears normal.

[0137] S83: Finally, based on the results of steps S81 and S82, assemble the data analysis report.

[0138] Related scenario analysis:

[0139] A rule may contain multiple related scenarios, so the analysis is performed in stages of related scenarios and related scenario conditions.

[0140] like Figure 8 As shown, the processing flow for multiple related scenarios is as follows:

[0141] S84: Obtain the correlation results, intermediate data, and data analysis report obtained in step S83.

[0142] S85: Retrieves all associated scenario conditions from the rules.

[0143] S86: Analyze the association conclusion of this associated scenario based on an associated scenario condition.

[0144] like Figure 9 As shown, the analysis process for each condition within a single associated scenario is as follows:

[0145] S861: Extract valid resources and set resource codes to put them into the resource code pool.

[0146] S862: Retrieve all conditions under this associated scenario.

[0147] S863: Match alarms according to the alarm identifiers related to a condition. If no alarm matches the condition, it means that no alarm meets the condition. The reason why the condition fails is determined to be the reason for the alarm. Otherwise, continue to step S864.

[0148] S864: Retrieve the associated resources from the alarm in step S863 and match them in the resource code pool. If no resource code can be retrieved, it means that the reason this condition was not met is due to a resource issue. Otherwise, continue to step S865.

[0149] S865: Determine whether this condition itself is passed. If not, it means that the reason why this condition failed is for other reasons; otherwise, this condition is normal.

[0150] S866: Continue to evaluate the next condition.

[0151] S87: Determine if there is a next related scenario. If there is, continue to step S86; otherwise, proceed to step S88.

[0152] S88: After all related scenarios have been analyzed, the analysis report is assembled and returned along with the related results.

[0153] The interface display effect is as follows Figure 10 As shown, the method for displaying the association results and analysis report on the interface in step S9 is as follows:

[0154] Tabs are used to differentiate the analysis results for each related scenario. Each related scenario displays the original related scenario conditions, rendered with colors based on the condition's pass / fail status (green for pass, red for fail, and green for all conditions indicating successful verification). The analysis result for each condition is displayed next to it. Clicking on the analysis result shows the resource information related to the currently selected condition on the left side of the resource association information area. Clicking on resource information displays the data and matching results related to the clicked resource on the right side. Links are also provided to view intermediate alarm data, such as... Figure 11 As shown, the left side displays all the alarm analysis results for this verification. Clicking to view will display all the related resource content under that alarm on the right side.

[0155] When in use, this invention automatically matches verification data from the alarm history database by setting the filtering conditions and resource content in the alarm range of the association rules. The verification process is not only fast and efficient, with a typical verification time of a few minutes, but it also greatly reduces the workload of manual analysis. By simulating the core processing environment of the association, the association results and intermediate data are obtained. Then, the alarm data, intermediate data, and association results are analyzed to find out the reasons why the association scenario conditions are not met, and an association result analysis report is output, which greatly reduces the workload of manual analysis. The analysis report is displayed through an interface, which can quickly and intuitively identify configuration problems in the association rules. The interface is user-friendly, and the key points of the analysis report are clear.

Claims

1. A method for verifying association rules in a network management system, characterized in that: The method is based on an interface + backend interaction model; the backend includes a controller, an alarm query parser, an association simulator, and an association result analyzer, and includes the following steps: S1: Select the query criteria for simulated alarms on the interface, click the query button, and send a request to the controller; S2: The controller validates the input parameters and calls the alarm query parser's API; S3: The alarm query parser filters out simulated alarms from the historical alarm database based on conditions and returns the alarm data to the controller; S4: The interface receives and displays the return results of the control simulation alarm; S5: The interface selects the simulated alarm to be verified as the verification data based on the alarm selection suggestion and sends a request to the controller; S6: The controller verifies the input parameters of the simulated alarm. If the verification is successful, the simulated alarm data is transmitted to the associated simulator. S7: The association simulator performs alarm marking, association resource supplementation, and association calculation processing based on alarm data and verified association rules, and sends the intermediate data and association results to the association result analyzer. S8: The correlation result analyzer performs analysis and processing based on the correlation results and intermediate data of the correlation processing, and outputs the correlation results and analysis report to the controller; S9: The interface receives and displays the associated results and analysis reports returned by the controller.

2. The method for verifying association rules in a network management system according to claim 1, characterized in that: Step S3 specifically includes the following steps: S31: The alarm query parser receives input parameters, which include the alarm ID set, rule ID, and whether to filter alarms based on associated resources. S32: Assemble query conditions based on input parameters; S33: Call the alarm history database query API and pass in the query conditions to obtain the alarm set; S34: Supplement alarm selection suggestions by combining alarm sets and assembly conditions; S35: Returns parameters, including alarm set and alarm selection suggestions.

3. The method for verifying association rules in a network management system according to claim 2, characterized in that: The implementation process of step S32 is as follows: If the input parameters contain a set of alarm IDs, then the query conditions are assembled using the alarm IDs; If the alarm ID set is not present in the input parameters, the rule content is obtained based on the rule ID, and the filter conditions of the alarm range in the rule are parsed and used to assemble the query conditions. If the switch is enabled based on filtering alarms according to associated resources, it is also necessary to parse the resource variables corresponding to the alarm markers in the rules, extract the data corresponding to the resource variables, and integrate them into the query conditions.

4. The method for verifying association rules in a network management system according to claim 1, characterized in that: The association simulator includes alarm tagging simulation, association resource replenishment simulation, and association calculation simulation, which are sequentially connected to generate association results. The method for generating intermediate data in step S7 is as follows: The alarm tagging simulation completes the alarm tagging function by calling the API provided by the alarm tagging, and at the same time generates intermediate alarm tagging data; The associated resource replenishment simulation completes the associated resource replenishment function by calling the API provided by the associated resource replenishment, and at the same time generates intermediate data of the associated resource set. The association calculation simulation completes the association calculation function by calling the API provided by the association calculation, and at the same time generates intermediate data on the conditions and satisfaction status of each association scenario.

5. The method for verifying association rules in a network management system according to claim 4, characterized in that: In step S8, the correlation result analyzer analyzes the alarm flags and associated resource assignments of alarms related to the correlation scenario conditions based on intermediate data analysis to initially determine whether the verification data is normal. The judgment process is as follows: S81: Determine if there are alarm markers in the intermediate data. If the alarm markers are empty, it means that the alarm does not meet the filtering conditions in the rule, and prompts you to check the filtering condition configuration in the rule. Otherwise, proceed to step S82; S82: Determine the associated resources. If the associated resources are empty, it indicates a problem during the resource replenishment process, and prompts you to check and adjust the associated resource configuration or resource data; otherwise, it appears normal from a data perspective. S83: Finally, based on the results of steps S81 and S82, assemble the data analysis report.

6. The method for verifying association rules in a network management system according to claim 5, characterized in that: In step S8, the association result analyzer performs association scenario analysis according to the stages of association scenario and association scenario conditions.

7. The method for verifying association rules in a network management system according to claim 6, characterized in that: The processing flow for multiple related scenarios is as follows: S84: Obtain the correlation results, intermediate data, and data analysis report obtained in step S83; S85: Retrieve all associated scenario conditions in the rule; S86: Analyze the association conclusion of this associated scenario based on a given associated scenario condition; S87: Determine if there is a next related scenario. If there is, continue to step S86; otherwise, proceed to step S88. S88: After all related scenarios have been analyzed, the analysis report is assembled and returned along with the related results.

8. The method for verifying association rules in a network management system according to claim 7, characterized in that: The analysis process for each condition within a single associated scenario in step S86 is as follows: S861: Extract valid resources and set resource codes to put them into the resource code pool; S862: Retrieve all conditions under this associated scenario; S863: Match alarms according to the alarm flags related to a condition. If no alarm matches the condition, it means that no alarm meets the condition. The reason why the condition is not met is determined to be the reason for the alarm. Otherwise, continue to step S864. S864: Retrieve the associated resources from the alarm in step S863 and match them in the resource code pool. If no resource code can be retrieved, it means that the reason this condition is not met is due to a resource issue. Otherwise, continue to step S865. S865: Determine whether this condition itself is passed. If not, it means that the reason why this condition failed is for other reasons; otherwise, this condition is normal. S866: Continue to evaluate the next condition.

9. The method for verifying association rules in a network management system according to claim 8, characterized in that: The method for displaying the correlation results and analysis report in step S9 is as follows: Tabs are used to distinguish the analysis results of each related scenario. Under each related scenario, the original related scenario conditions are displayed, and color rendering is applied based on the condition's pass / fail status. The analysis result for each condition is displayed after each condition box. Clicking on the analysis result displays the resource information involved under the currently selected condition on the left side of the resource association information area. Clicking on the resource information displays the data content and matching results related to the clicked resource on the right side. Links are also provided to view the intermediate data of the alarm.

Images