Statistical-based network alarm association rule mining and fault locating method and system

Abstract

This invention provides a statistical method and system for network alarm association rule mining and fault location. The method preprocesses network alarm data to remove frequently occurring jitter alarms and reduce data redundancy. It then scans the processed alarm data, calculates the number of alarm types, and establishes a timing matrix and a counting matrix. The method further scans the alarm data and processes it in segments using a sliding time window method, including processing alarms within the time window based on their alarm codes, occurrence times, and corresponding records in the timing matrix. Finally, it calculates the support and confidence of the corresponding alarm association rules based on the alarm co-occurrence frequency information in the counting matrix, thus obtaining and outputting association rules through alarm data processing. This invention effectively processes network alarm data while considering both operational efficiency and accuracy, thereby achieving more efficient and accurate network fault location.

Description

Technical Field

[0001] This invention relates to the fields of data mining technology and network fault location technology, specifically to a statistical network alarm association rule mining and fault location scheme. Background Technology

[0002] Data mining is a technique that analyzes data to find patterns and dynamics within large datasets. With technological advancements and network expansion, the number of alarms generated in network systems is increasing. Effectively processing these alarms to improve network stability is crucial. This problem is primarily addressed using association rule mining methods within data mining. These methods scan alarm data to identify root causes and derive association rules. Network operations and maintenance personnel then use these rules to pinpoint the location of network faults, enabling timely repairs and ultimately improving network stability.

[0003] E. Stamoulakatou et al. implemented an Apriori-based distributed sequential pattern mining method using the Apache Spark computing engine. This method utilizes prior attributes and information at each pattern position in the original sequence, reducing the number of candidates per iteration and improving operational efficiency. However, the method's efficiency decreases with large datasets. A. Makanju used the MapReduce framework under Hadoop to accelerate the FP-Growth method. However, traditional MapReduce does not allow automatic synchronization between jobs, so they used a parent-child MapReduce Framework, which allows for the dynamic creation and synchronization of MapReduce tasks in a hierarchical parent-child manner. Combined with parallel FP-Growth, the method's computational speed is significantly improved. However, this method performs poorly in terms of memory usage due to the need to create an FP-Tree. J. Wang et al. believe that the real reason for alarm proliferation is the large number of related alarms generated by the propagation of anomalies in a short period of time. Therefore, they improved the PrefixSpan method and incorporated causal relationships between alarms, successfully reducing subsequent alarms caused by anomaly propagation and improving the efficiency of obtaining association rules. These methods all improve operational efficiency, but they all include a step of mining frequent itemsets, which involves searching the database for itemsets with support greater than a manually set minimum support. Determining an appropriate minimum support is crucial. If the minimum support is too high or too low, it will affect the method's execution efficiency and the final result. Therefore, simultaneously addressing these issues is extremely difficult, necessitating a mining method that can simultaneously solve these problems to support more timely and effective network fault localization.

[0004] References:

[0005] [1] E. Stamoulakatou, A. Gulino and P. Pinoli, "DLA: a Distributed, Location-based and Apriori-based Algorithm for Biological Sequence Pattern Mining," 2018 IEEE International Conference on Big Data (Big Data), 2018, pp. 1121-1126.

[0006] [2] A. Makanju, Z. Farzanyar, A. An, N. Cercone, ZZHu and Y. Hu, "Deepparallelization of parallel FP-growth using parent-child MapRed uce," 2016 IEEE International Conference on Big Data (Big Data), 2016, pp.1422-1431.

[0007] [3] J.Wang, R.Jia, J.Zhou and M.Zhou, "Mining sequential alarm p atternbased on the incremental causality prefixSpan algorithm," in IE EETransactions on Artificial Intelligence, 2022, pp.1-1. Summary of the Invention

[0008] In view of the above-mentioned deficiencies in the prior art, the present invention provides a statistical network alarm association rule mining scheme.

[0009] To achieve the above objectives, the present invention provides a statistical network alarm association rule mining method, comprising the following steps:

[0010] Step 1: Preprocess the network alarm data to remove frequently occurring jitter alarms and reduce the redundancy of the alarm data;

[0011] Step 2: Scan the processed network alarm data, calculate the number of alarm types, and establish a timing matrix and a counting matrix based on the number of alarm types;

[0012] Step 3: Scan network alarm data and process the alarm data in segments using the sliding time window method. This includes processing alarms within the time window based on their alarm codes, alarm occurrence times, and corresponding records in the timing matrix. The co-occurrence frequency information for each pair of alarms is recorded in the counting matrix, and the occurrence time information for each pair of alarms is recorded in the timing matrix. After the current time window is scanned, the time window slides, containing new alarm data. The above operation is repeated for these alarm data until the alarm data is scanned completely, then proceed to Step 4.

[0013] Step 4: Calculate the support and confidence of the corresponding alarm association rules based on the alarm co-occurrence frequency information in the counting matrix, so as to obtain and output the association rules by processing the alarm data.

[0014] Furthermore, in step 1, when preprocessing the network alarm data, the alarm is treated as a tuple consisting of the alarm code and the alarm occurrence time.

[0015] Furthermore, each element in the counting matrix represents the co-occurrence count of the two corresponding alarm codes, and each element in the timing matrix represents a tuple consisting of the alarm occurrence times of the two corresponding alarm codes.

[0016] Furthermore, after processing alarm data to obtain association rules, the alarm codes in the association rules are used to find the level and device where the alarm occurred in order to locate the fault.

[0017] On the other hand, the present invention provides a statistical network alarm association rule mining system to implement the statistical network alarm association rule mining method described above.

[0018] Moreover, it includes the following modules,

[0019] The first module is used to preprocess network alarm data, remove frequently occurring jitter alarms, and reduce the redundancy of alarm data;

[0020] The second module is used to scan the processed network alarm data, calculate the number of alarm types, and establish a timing matrix and a counting matrix based on the number of alarm types.

[0021] The third module is used to scan network alarm data. It processes the alarm data in segments using a sliding time window method. This includes processing alarms within the time window based on their alarm codes, alarm occurrence times, and corresponding records in the timing matrix. The co-occurrence information of each pair of alarms is recorded in the counting matrix, and the occurrence time information of each pair of alarms is recorded in the timing matrix. After the current time window is scanned, the time window slides, containing new alarm data. The above operation is repeated for these alarm data until the alarm data is scanned.

[0022] The fourth module is used to calculate the support and confidence of the corresponding alarm association rules based on the alarm co-occurrence frequency information in the counting matrix, so as to obtain and output the association rules by processing alarm data.

[0023] Alternatively, it may include a processor and a memory, with the memory used to store program instructions and the processor used to call the stored instructions in the memory to execute a statistical network alarm association rule mining method as described above.

[0024] Alternatively, it may include a readable storage medium on which a computer program is stored, which, when executed, implements a statistical network alarm association rule mining method as described above.

[0025] This invention proposes a statistical network alarm association rule mining and fault location scheme, aiming to quickly and accurately identify the root cause of alarms. This invention has the following characteristics:

[0026] 1) Preprocessing of alarm data. This invention defines jitter alarms in alarm data, which are alarms that occur very frequently in a short period of time. These alarms greatly increase the redundancy of alarm data. It proposes to replace jitter alarms within a time period with their first occurrence. This preserves the information in the alarm data, reduces redundancy, and improves the efficiency of subsequent methods.

[0027] 2) Statistical Method. This invention segments alarm data using time windows, recording the co-occurrence frequency and occurrence time of different alarms based on their alarm codes and occurrence times, and storing this information in a counting matrix and a timing matrix. When alarm codes differ, the counting matrix is ​​manipulated based on whether the occurrence time of the corresponding alarm is recorded in the timing matrix.

[0028] 3) No need to manually set minimum support. Traditional association rule mining methods all include a step of mining frequent itemsets, which requires manually setting a minimum support. Too high a minimum support will result in too few candidate itemsets, leading to unrepresentative association rules. Conversely, too low a minimum support will result in too many candidate itemsets, impacting the method's efficiency. Statistical methods, however, do not require manually setting a minimum support; they use a sliding time window method combined with a matrix to scan alarm data.

[0029] Therefore, this invention can effectively process network alarm data while simultaneously considering the efficiency of the method and the correctness of the derived rules, thereby achieving more efficient and accurate network fault location and helping network operation and maintenance personnel improve network stability. Attached Figure Description

[0030] Figure 1This is a flowchart illustrating the scanning process according to an embodiment of the present invention.

[0031] Figure 2 This is a schematic diagram of the alarm database according to an embodiment of the present invention.

[0032] Figure 3 This is a schematic diagram of the alarm database after preprocessing according to an embodiment of the present invention.

[0033] Figure 4 This is a schematic diagram illustrating the changes in the timing matrix and counting matrix according to an embodiment of the present invention.

[0034] Figure 5 This is a schematic diagram illustrating the support of association rules in an embodiment of the present invention.

[0035] Figure 6 This is a schematic diagram illustrating the confidence level of association rules in an embodiment of the present invention. Detailed Implementation

[0036] The technical solution will be described in detail below with reference to the accompanying drawings and embodiments.

[0037] One embodiment of the present invention provides a statistical method for mining network alarm association rules. First, the alarm data is preprocessed by removing alarms that occur frequently within a short period, retaining only the first occurrence. Then, the alarm data is scanned, and the number of alarm code types is counted. A timing matrix and a counting matrix are established based on the number of alarm code types. Next, a statistical method is used to scan the alarm data, storing the information in the alarm data into the counting matrix. Finally, the support and confidence of the corresponding association rules are calculated based on the information in the counting matrix.

[0038] The key technical improvements of this invention are as follows: in order to mine network alarm association rules, a definition and processing for jitter alarms are set; in order to calculate dynamic external factors, a sliding window method is used to process alarm data and a matrix is ​​used to store alarm-related information.

[0039] The detailed implementation of the embodiment includes the following steps:

[0040] Step 1: Preprocess the network alarm data, remove frequently occurring jitter alarms, reduce the redundancy of alarm data, and proceed to Step 2.

[0041] In this embodiment, alarms are considered as a tuple consisting of an alarm code and an alarm occurrence time, and the alarm database is as follows: Figure 2 As shown, the alarm is generated by the tuple (c i ,t i Composed of ) where c i For alarm codes, t iHere, 'i' represents the alarm occurrence time, 'ID' represents the alarm sequence identifier, and 'S' represents the alarm sequence. Frequently occurring alarms within a short period are defined as fluctuating alarms and removed, retaining only their first occurrence to reduce data redundancy. The preprocessed alarm database is as follows: Figure 3 As shown. After the alarm data preprocessing is completed, proceed to Step 2;

[0042] Step 2: Scan the processed network alarm data, calculate the number of alarm types, establish a timing matrix and a counting matrix based on the number of alarm types, and then proceed to Step 3.

[0043] In this embodiment, the number of alarm code types in the alarm database is counted. To explore the relationship between each alarm code and other alarm codes, the timing matrix and counting matrix must be able to accommodate all types of alarm code information, while also ensuring that the size of the timing matrix and counting matrix is ​​not too large to avoid consuming too many storage resources. Therefore, the size of the timing matrix and counting matrix should match the number of alarm code types. For example, in this case, the number of alarm code types is 6, so the size of the timing matrix and counting matrix is ​​6*6. Each element in the counting matrix is ​​the co-occurrence count of the corresponding two alarm codes, which defaults to 0. Each element in the timing matrix is ​​a tuple consisting of the alarm occurrence times of the corresponding two alarm codes, which defaults to (0,0). Proceed to Step 3;

[0044] Step 3: Scan network alarm data using a statistical algorithm. Process alarm data in segments using a sliding time window method. For alarms within a time window, perform operations based on the alarm code, alarm occurrence time, and corresponding records in the timing matrix. Record the co-occurrence information of each pair of alarms in the counting matrix and the occurrence time information of each pair of alarms in the timing matrix. After the current time window is scanned, the time window slides, containing new alarm data. Repeat the above operations on these alarm data until all alarm data is scanned. Proceed to Step 4;

[0045] The embodiment uses a statistical method to scan the alarm database, such as... Figure 1As shown, alarm data is processed using a time window. Assume there are four alarms: (c1, 0), (c1, 10), (c3, 15), and (c2, 25). The time window size is 20 seconds. At this point, `i` points to alarm (c1, 0), and `j` points to alarm (c1, 10). The alarm time of `j` is within the time window of the alarm occurrence time of `i` (where `i` and `j` are pointers). Next, it is determined whether their alarm codes are the same. Since the alarm codes of `i` and `j` are the same, `j = j + 1`, and `j` slides backward to point to `c3, 15`. The alarm time of `j` is within the time window of the alarm occurrence time of `i`. The alarm codes of `j` are different, and since this is the first time they have appeared, the corresponding counting matrices are set to 1, and the corresponding timing matrices are updated using `(0, 15)`. Then j = j + 1, and j slides backward to (c2, 25). At this point, the alarm time of j is not within the time window of the alarm occurrence time of i, so i = i + 1, and i slides backward to (c1, 10). j = i + 1, pointing to (c3, 15). At this point, the alarm time of j is within the time window of the alarm occurrence time of i, but they are not the first occurrences. Since their current alarm times are (10, 15), which is within the range of (0, 15) recorded in the timing matrix, j = j + 1, and j slides backward to (c2, 25). At this point, the alarm time of j is within the time window of the alarm occurrence time of i. The alarm codes of the two are different, and they are the first occurrences, so the corresponding counting matrices of the two are set to 1, and the timing matrices of the two are updated with (10, 25). The above process is repeated until the alarm data is scanned.

[0046] Using the alarm time of the first alarm as a baseline, if the alarm time of a subsequent alarm falls within its time window and its alarm code is different, then the operation is based on the difference in the corresponding alarm occurrence times in the timing matrix. If the corresponding value in the timing matrix is ​​(0,0), then the value in the timing matrix is ​​updated using the current alarm times of both alarms, and the corresponding value in the counting matrix is ​​set to 1. If the first term of the current alarm times is equal to the record in the timing matrix, and the second term is greater than the record in the timing matrix, then the value in the timing matrix is ​​updated using the current alarm times of both alarms, and the counting matrix is ​​left unprocessed. If the first term of the current alarm times is greater than the record in the timing matrix, and the second term is less than the record in the timing matrix, then neither the timing matrix nor the counting matrix is ​​processed. If the first term of the current alarm times is greater than the record in the timing matrix, and the second term is also greater than the record in the timing matrix, then the value in the timing matrix is ​​updated using the current alarm times of both alarms, and the corresponding value in the counting matrix is ​​incremented by 1.

[0047] The example assumes a time window size of 50 seconds. (This value is not fixed; in practice, it can be adjusted as needed, for example, to 5 minutes.) The specific steps of the statistical method are as follows:

[0048] 1. The first time window starts 30 seconds after the first alarm (c3, 30) occurs, and ends 80 seconds after the start time. Therefore, the alarms within the first time window are: (c3, 30).

[0049] (c5,50), (c6,60), (c5,80). Starting from (c3,30), the first pair of alarms is (c3,30), (c5,50). For example... Figure 1 As shown in the flowchart, j points to (c5, 50) and i points to (c3, 30). The alarms occurred within the same window and have different codes. Since these alarms were not recorded in the timing matrix, their alarm times are used to update the corresponding timing matrix, and their corresponding counting matrices are incremented by 1. At this point, the timing matrix and counting matrix are as follows: Figure 4 As shown in (a). This means that the co-occurrence count of c3→c5 is 1, and their alarm times are (30, 50). Then it's (c3, 30), (c6, 60), performing the same operation as c3 and c5. Next is (c3, 30), (c5, 80). At this point, their records exist in the timing matrix, and the preceding item of the current alarm occurrence time is inside the record, while the following item is outside the record, so only the corresponding timing matrix is ​​updated, and the counting matrix is ​​not operated on. At this point, the timing matrix and the counting matrix are as follows. Figure 4 As shown in (b). After scanning (c3,30) within the first time window, it's (c5,50)'s turn. The first pair of alarms are (c5,50) and (c6,60). Since they are not recorded in the timing matrix, the corresponding timing and counting matrices are updated. Then it's (c5,50) and (c5,80). Since the alarm codes are the same, no operation is performed. After scanning (c5,50) within the first time window, it's (c6,60) and (c5,80)'s turn. Since they are not recorded in the timing matrix, the corresponding timing and counting matrices are updated. At this point, the first time window scanning is complete, and the timing and counting matrices are as follows. Figure 4 As shown in (c).

[0050] 2. The time window slides, with the second time window starting at 110 seconds from (c4, 110) and ending at 160 seconds. The alarms included in this window are: (c4, 110), (c2, 130), (c3, 150), and (c5, 160). The timing matrix does not record the occurrence time of (c4, 110) and the subsequent three alarms, so the corresponding timing and counting matrices are updated. Similarly, the same operation is performed on (c2, 130) and the subsequent two alarms. When it's (c3, 150) and (c5, 160)'s turn, both are recorded in the timing matrix as (30, 80). (150, 160) is not recorded, so the corresponding timing matrix is ​​updated, and the value of the corresponding counting matrix is ​​incremented by 1. At this point, the timing and counting matrices are as follows: Figure 4 As shown in (d).

[0051] 3. And so on, when the entire alarm database has been scanned, the timing matrix and counting matrix are as follows: Figure 4 As shown in (e), proceed to Step 4.

[0052] Step 4: Calculate the support and confidence of the corresponding association rules based on the values ​​in the counting matrix, thereby obtaining and outputting association rules by processing alarm data;

[0053] Support of association rules, such as Figure 5 As shown, Rule represents a rule, and Support represents support. For support, Sup(c i c j ) and Sup(c j c i The meanings are the same, indicating alarm code c. i and alarm code c j The probability of them appearing together. (Here, i and j are identifiers used to distinguish different alarm codes.) The confidence level of the association rule is as follows: Figure 6 As shown, Rule represents a rule, and Confidence represents the confidence level. For the confidence level, Conf(c i →c j ) and Conf(c j →c i The meanings of ) are completely different; the former means c. i After it has already happened c j The probability of occurrence of c, where c represents the probability of occurrence of c. j After it has already happened c i The probability of occurrence. Higher support and confidence levels for association rules indicate a closer relationship between the corresponding alarm codes. The formulas for calculating support and confidence are as follows:

[0054]

[0055]

[0056] Among them, CM ij CM represents the element in the i-th row and j-th column of the counting matrix. ji Let CM represent the element in the j-th row and i-th column of the counting matrix, Sum(CM) represent the sum of all elements in the counting matrix, Σ represents summation, k represents the index, and N represents the number of alarm codes. ik CM represents the element in the i-th row and k-th column of the counting matrix. ki This represents the element in the k-th row and i-th column of the counting matrix.

[0057] To consider the performance of the methods, the following methods are provided for comparison:

[0058] 1) The Apriori method first finds frequent itemsets with a support of 1 or higher than the minimum support, and then iterates until no more maximum itemsets are generated.

[0059] 2) The FP-Growth method stores the dataset in a compact data structure called FP-Tree and then discovers frequent itemsets.

[0060] 3) The PrefixSpan method starts mining sequence patterns from a prefix of length 1, searches the corresponding projection database to obtain frequent sequences corresponding to the prefix of length 1, and then recursively continues until no longer prefixes can be mined.

[0061] To better compare the Statistical Based Approach (BOS) with the three methods mentioned above, experiments were conducted using both synthetic and real network alarm datasets. The results were compared on the synthetic dataset. In the experiments, the time window parameters for BOS were set to 5s, 10s, 15s, 20s, and 25s, while the minimum support for the other three methods were 0.1, 0.3, 0.5, 0.7, and 0.9, respectively. It can be seen that BOS's runtime is shorter than the other three methods in most cases and does not significantly increase with the increase in data size. This is because the BOS method uses a sliding time window, with the following time complexity:

[0062]

[0063] That is, T(m) = O(m) 2 ), where k is the number of time windows, m i The number of alarms within each time window. As the alarm data volume increases, the number of alarms within each time window does not increase; only the number of sliding windows increases. Therefore, BOS is more efficient than the other three schemes. Note that in... Figure 4In part (e), BOS takes longer to run than the other three schemes. This is because the minimum support is 0.9 at this point. The other three schemes generate fewer candidate sets during the running process, so the rules they derive are not complete enough.

[0064] The experiment compared BOS with three other schemes on a real dataset. The time window parameters for BOS were set to 3 min, 4 min, 5 min, 6 min, and 7 min, while the minimum support for the other three methods were 0.1, 0.15, 0.2, 0.25, and 0.3, respectively. The experimental results show that BOS outperforms the other three schemes under different parameter settings, and the overall performance of the proposed scheme is superior. However, when comparing the association rules generated by the various schemes, contradictions were found between the rules generated by BOS and those generated by the other three schemes. For example, BOS generated association rules such as 1512→1562 and 1719→1729, while the other three schemes showed the opposite. Therefore, an experiment was conducted on alarm data, and the alarm codes with contradictory rules were extracted and plotted as a scatter plot. It can be seen that in the alarm data, 1512 occurred first and 1562 occurred later, and 1719 occurred first and 1729 occurred later. Therefore, the association rules generated by BOS are more consistent with reality, proving the correctness and rationality of the rules generated by the proposed scheme.

[0065] In another embodiment, a network fault location method is provided. After processing alarm data to obtain association rules through the above method, it can support finding the level and device where the alarm occurred by using the alarm code in the association rules to locate the fault. This makes it easier for network operation and maintenance personnel to clear the fault and replace network devices that have failed multiple times in a timely manner, thereby improving the stability of the network.

[0066] In specific implementation, the method proposed in the technical solution of this invention can be automatically executed by those skilled in the art using computer software technology. System devices for implementing the method, such as computer-readable storage media storing the corresponding computer program of the technical solution of this invention and computer equipment including the computer program running the corresponding computer program, should also be within the protection scope of this invention.

[0067] In some possible embodiments, a statistical network alarm association rule mining system is provided, including the following modules:

[0068] The first module is used to preprocess network alarm data, remove frequently occurring jitter alarms, and reduce the redundancy of alarm data;

[0069] The second module is used to scan the processed network alarm data, calculate the number of alarm types, and establish a timing matrix and a counting matrix based on the number of alarm types.

[0070] The third module is used to scan network alarm data. It processes the alarm data in segments using a sliding time window method. This includes processing alarms within the time window based on their alarm codes, alarm occurrence times, and corresponding records in the timing matrix. The co-occurrence information of each pair of alarms is recorded in the counting matrix, and the occurrence time information of each pair of alarms is recorded in the timing matrix. After the current time window is scanned, the time window slides, containing new alarm data. The above operation is repeated for these alarm data until the alarm data is scanned.

[0071] The fourth module is used to calculate the support and confidence of the corresponding alarm association rules based on the alarm co-occurrence frequency information in the counting matrix, so as to obtain and output the association rules by processing alarm data.

[0072] In some possible embodiments, a statistical network alarm association rule mining system is provided, including a processor and a memory. The memory is used to store program instructions, and the processor is used to call the stored instructions in the memory to execute a statistical network alarm association rule mining method as described above.

[0073] In some possible embodiments, a statistical network alarm association rule mining system is provided, including a readable storage medium on which a computer program is stored. When the computer program is executed, it implements the statistical network alarm association rule mining method described above.

[0074] The specific embodiments described herein are merely illustrative of the spirit of the invention. Those skilled in the art to which this invention pertains may make various modifications or additions to the described specific embodiments or use similar methods to substitute them, without departing from the spirit of the invention or exceeding the scope defined by the appended claims.

Claims

1. A statistical method for mining network alarm association rules, characterized in that: Includes the following steps, Step 1: Preprocess the network alarm data to remove frequently occurring jitter alarms and reduce the redundancy of the alarm data; Step 2: Scan the processed network alarm data, calculate the number of alarm types, and establish a timing matrix and a counting matrix based on the number of alarm types; Step 3: Scan network alarm data and process the alarm data in segments using the sliding time window method. This includes processing alarms within the time window based on their alarm codes, alarm occurrence times, and corresponding records in the timing matrix. The co-occurrence frequency information for each pair of alarms is recorded in the counting matrix, and the occurrence time information for each pair of alarms is recorded in the timing matrix. After the current time window is scanned, the time window slides, containing new alarm data. The above operation is repeated for these alarm data until the alarm data is scanned completely, then proceed to Step 4. The operation is performed based on the alarm codes, alarm occurrence times, and corresponding records in the timing matrix. The co-occurrence frequency information for each pair of alarms is recorded in the counting matrix, and the occurrence time information for each pair of alarms is recorded in the timing matrix. The implementation method is as follows: Each element in the counting matrix represents the number of times the corresponding two alarm codes co-occur, with a default value of 0; each element in the timing matrix represents a tuple consisting of the alarm occurrence times of the corresponding two alarm codes, with a default value of (0,0). Based on the alarm time of the first alarm, if the alarm time of a subsequent alarm is within its time window and the alarm code of the subsequent alarm is different from that of the first alarm, then the operation is performed according to the difference in the values ​​of the alarm occurrence times of the two alarms in the timing matrix. If the corresponding value in the timing matrix is ​​(0,0), then the value in the timing matrix is ​​updated using the current alarm times of both, and the corresponding value in the counting matrix is ​​set to 1. If the first term of the current alarm times of the two is equal to the record in the timing matrix, and the second term is greater than the record in the timing matrix, then the current alarm times of the two are used to update the value in the timing matrix, and no processing is done on the counting matrix. If the first term of the current alarm time of the two is greater than the record in the timing matrix, and the second term is less than the record in the timing matrix, then no processing is done on the timing matrix and the counting matrix. If the first term of the current alarm times of the two is greater than the record in the timing matrix, and the second term is also greater than the record in the timing matrix, then the current alarm times of the two are used to update the value in the timing matrix, and the corresponding value in the counting matrix is ​​incremented by 1. Step 4: Calculate the support and confidence of the corresponding alarm association rules based on the alarm co-occurrence frequency information in the counting matrix, so as to obtain and output the association rules by processing the alarm data.

2. The statistical network alarm association rule mining method according to claim 1, characterized in that: In step 1, when preprocessing network alarm data, alarms are treated as a tuple consisting of alarm code and alarm occurrence time.

3. The statistical network alarm association rule mining method according to claim 1 or 2, characterized in that: Each element in the counting matrix represents the co-occurrence count of the two corresponding alarm codes, and each element in the timing matrix represents a tuple consisting of the alarm occurrence times of the two corresponding alarm codes.

4. The fault location method based on statistical network alarm association rule mining as described in any one of claims 1 to 3, characterized in that: After processing alarm data to obtain association rules, the alarm codes in the association rules are used to find the level and device where the alarm occurred in order to locate the fault.

5. A statistical network alarm association rule mining system, characterized in that: This method is used to implement a statistical network alarm association rule mining method as described in any one of claims 1-3.

6. The statistical network alarm association rule mining system according to claim 5, characterized in that: Includes the following modules, The first module is used to preprocess network alarm data, remove frequently occurring jitter alarms, and reduce the redundancy of alarm data; The second module is used to scan the processed network alarm data, calculate the number of alarm types, and establish a timing matrix and a counting matrix based on the number of alarm types. The third module is used to scan network alarm data. It processes the alarm data in segments using a sliding time window method. This includes processing alarms within the time window based on their alarm codes, alarm occurrence times, and corresponding records in the timing matrix. The co-occurrence information of each pair of alarms is recorded in the counting matrix, and the occurrence time information of each pair of alarms is recorded in the timing matrix. After the current time window is scanned, the time window slides, containing new alarm data. The above operation is repeated for these alarm data until the alarm data is scanned. The fourth module is used to calculate the support and confidence of the corresponding alarm association rules based on the alarm co-occurrence frequency information in the counting matrix, so as to obtain and output the association rules by processing alarm data.

7. The statistical network alarm association rule mining system according to claim 5, characterized in that: It includes a processor and a memory, the memory being used to store program instructions, and the processor being used to call the stored instructions in the memory to execute the statistical network alarm association rule mining method as described in any one of claims 1-3.

8. The statistical network alarm association rule mining system according to claim 5, characterized in that: It includes a readable storage medium on which a computer program is stored, and when the computer program is executed, it implements a statistical network alarm association rule mining method as described in any one of claims 1-3.

Images