Alarm information processing method and device based on alarm rule library and storage medium

Abstract

The application discloses an alarm information processing method based on an alarm rule library, a computer device and a storage medium, and comprises the following steps: acquiring first alarm information, querying, by a first network element, the alarm rule library according to the first alarm information, querying the first processing rule information corresponding to the first alarm information, processing the first alarm information according to the first processing rule information, and otherwise sending the first alarm information to a second network element. The application realizes the processing of the alarm information before the network element with the inherent alarm processing function by the NWDAF or other network functions, can fully mobilize other network elements in the core network, especially the idle network elements, realizes the alarm processing function according to the processing rule information stored in the alarm rule library, assists the network element with the inherent alarm processing function to process the alarm, improves the response capability of the alarm, and reduces the possibility of the occurrence of the alarm outbreak and the derived problems. The application is widely applied in the technical field of communication.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication technology, and in particular to an alarm information processing method based on an alarm rule library, a computer device and a storage medium. BACKGROUND

[0002] Currently, network alarms in the communication field are processed by dedicated network elements, for example, alarms in a 5G communication network are processed by an OAM network element. Alarm information generated by various fault sources is concentrated in the OAM, which greatly consumes the processing and storage resources of the OAM, and requires high operating and maintenance labor costs for alarm processing.

[0003] Term explanation:

[0004] NF: Network Function, network function;

[0005] NWDAF: Network Data Analytics Function, network data analysis function;

[0006] OAM: Operation Administration and Maintenance, operation, management and maintenance;

[0007] SMSC: Short Message Service Center, short message service center;

[0008] SMSF: Short Message Service Function, short message service function;

[0009] IMS: IP Multimedia Subsystem, IP multimedia subsystem;

[0010] NG-RAN: Next Generation Radio Access Network, next generation radio access network;

[0011] UE: User Equipment, user equipment or user terminal. SUMMARY

[0012] In view of the technical problem that centralized alarm information processing consumes a large amount of processing and storage resources in the current communication technology, the present application aims to provide an alarm information processing method based on an alarm rule library, a computer device and a storage medium.

[0013] In one aspect, the present application embodiment includes an alarm information processing method based on an alarm rule library, which comprises:

[0014] obtaining first alarm information;

[0015] querying, by the first network element, in an alarm rule library according to the first alarm information;

[0016] when first processing rule information corresponding to the first alarm information is queried, processing, by the first network element, the first alarm information according to the first processing rule information;

[0017] when first processing rule information corresponding to the first alarm information is not queried, sending, by the first network element, the first alarm information to a second network element; the second network element is a network element with inherent alarm processing function.

[0018] Further, the querying in the alarm rule library according to the first alarm information comprises:

[0019] performing a Bloom algorithm according to the first alarm information to obtain a hash code;

[0020] searching, according to the hash code, corresponding first processing rule information in the alarm rule library.

[0021] Further, the processing, by the first network element, of the first alarm information according to the first processing rule information comprises:

[0022] parsing the first processing rule information to obtain alarm processing operation instructions;

[0023] executing, by the first network element, the alarm processing operation instructions.

[0024] Further, the processing, by the first network element, of the first alarm information according to the first processing rule information comprises:

[0025] searching for a plurality of third network elements which are located in the same core network as the first network element and satisfy an idle condition;

[0026] distributing, by the first network element, the first processing rule information to each of the third network elements;

[0027] parsing the first processing rule information to obtain alarm processing operation instructions;

[0028] executing, by each of the third network elements, the alarm processing operation instructions.

[0029] Further, the obtaining of the first alarm information comprises:

[0030] obtaining a plurality of second alarm information issued by a fault source;

[0031] According to the second alarm information, prediction alarm information is obtained;

[0032] The second alarm information and the prediction alarm information are aggregated to obtain the first alarm information.

[0033] Further, the first alarm information includes:

[0034] Second alarm information sent by a fault source is obtained;

[0035] Each third network element has its own working condition deviation information; the working condition deviation information represents the deviation between the current working condition information and the ideal working condition information of the same third network element;

[0036] The second alarm information and the working condition deviation information are aggregated to obtain the first alarm information.

[0037] Further, the aggregation of the second alarm information and the working condition deviation information to obtain the first alarm information includes:

[0038] The second alarm information and the working condition deviation information are respectively processed by natural language processing to obtain a first vector representation;

[0039] The second alarm information and the working condition deviation information are respectively processed by syntax analysis to obtain a second vector representation;

[0040] The second alarm information and the working condition deviation information are respectively processed by knowledge graph analysis to obtain a third vector representation;

[0041] The first vector representation is processed by vector prediction to obtain a first prediction vector;

[0042] The second vector representation is processed by vector prediction to obtain a second prediction vector;

[0043] The third vector representation is processed by vector prediction to obtain a third prediction vector;

[0044] The first prediction vector, the second prediction vector, and the third prediction vector are used to determine the first alarm information.

[0045] Further, the alarm information processing method based on the alarm rule library further includes:

[0046] The second network element is triggered to process the first alarm information;

[0047] The processing result of the second network element on the first alarm information is obtained;

[0048] According to the processing result, the alarm rule library is maintained.

[0049] On the other hand, an embodiment of the present invention also includes a computer device, including a memory and a processor, wherein the memory is used to store at least one program, and the processor is used to load the at least one program to execute the alarm information processing method based on the alarm rule base in the embodiment.

[0050] On the other hand, an embodiment of the present invention further includes a computer-readable storage medium storing a program executable by a processor. When the program is executed by the processor, it is used to execute the alarm information processing method based on the alarm rule base in the embodiment.

[0051] The beneficial effects of the present invention are as follows: the alarm information processing method based on the alarm rule base in the embodiment is implemented by network elements such as NWDAF or other network functions, which process the alarm information before the network element with inherent alarm processing function, OAM, can fully mobilize other network elements in the core network, especially idle network elements, to implement the alarm processing function according to the processing rule information stored in the alarm rule base, thereby assisting the network element with inherent alarm processing function to perform alarm processing; from the side of the network element with inherent alarm processing function, the alarm information issued by the fault source is filtered by other network elements in the core network, and the pressure on the network element with inherent alarm processing function is reduced. From the side of the fault source, the alarm information it issues is responded to as much as possible, thereby improving the alarm response capability and reducing the possibility of alarm outbreaks and their derivative problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 Schematic diagram of a communication system to which the alarm information processing method based on the alarm rule base in the embodiment can be applied;

[0053] Figure 2 A step diagram of an alarm information processing method based on an alarm rule base in an embodiment;

[0054] Figure 3 This is a schematic diagram of the core network providing notification services to the UE in an embodiment. DETAILED DESCRIPTION

[0055] In this embodiment, the alarm information processing method based on the alarm rule library can be applied to Figure 1 In the communication system shown. Figure 1 The communication system is a 5G communication core network, which includes network elements such as NWDAF, OAM, and NF1. Among them, NF1, NF2, etc. can represent network elements such as AMF, SMF, and UPF.

[0056] Among them, NWDAF has data analysis function and can be used as the first network element in this embodiment; OAM inherent alarm processing function, such as OAM in Figure 1The network element shown in the core network and configured to be responsible for alarm processing (but other functions of OAM are not excluded) can be the second network element in the embodiment; NF1, NF2, and the like can be the third network element in the embodiment.

[0057] With reference to Figure 2 , the alarm information processing method based on the alarm rule library comprises the following steps:

[0058] S1. acquiring first alarm information;

[0059] S2. querying, by the first network element, in the alarm rule library according to the first alarm information;

[0060] S3. when the first processing rule information corresponding to the first alarm information is queried, processing, by the first network element, the first alarm information according to the first processing rule information;

[0061] S4. when the first processing rule information corresponding to the first alarm information is not queried, sending, by the first network element, the first alarm information to the second network element.

[0062] In the embodiment, steps S1-S4 and sub-steps thereof can be executed by the NWDAF.

[0063] In step S1, when the alarm information is generated by the fault source (for example, at least one network element of NF1, NF2, and the like in Figure 1 , in the case that the OAM is idle, the alarm information can be directly sent to the OAM, and the OAM performs alarm processing through its inherent alarm processing function; in the case that the OAM is busy, the fault source can send the first alarm information to the NWDAF, and the NWDAF executes step S1 to receive the first alarm information sent by the fault source. The first alarm information can be alarm information directly generated by the fault source.

[0064] In step S2, the first network element, i.e., the NWDAF, queries in the alarm rule library according to the first alarm information. The alarm rule library can be stored in a public database. When step S2 is executed, the NWDAF can execute a Bloom algorithm to query. Specifically, the alarm rule library stores multiple pieces of processing rule information in the form of Bitmap, and each piece of processing rule information is marked with corresponding alarm information. The NWDAF acquires the Hashcode corresponding to the first alarm information, queries whether the positions corresponding to the Hashcode in the Bitmap are 1 in the alarm rule library, if the positions corresponding to the Hashcode in the Bitmap are all 1, it is determined that the alarm rule library stores the processing rule information corresponding to the first alarm information, and the processing rule information is read out as the first processing rule information; otherwise, it is determined that the alarm rule library does not store the processing rule information corresponding to the first alarm information.

[0065] With reference to Figure 1 If the first processing rule information corresponding to the first alarm information is queried, step S3 is performed, and the first network element, i.e., the NWDAF, processes the first alarm information according to the first processing rule information.

[0066] Specifically, when performing step S3, the NWDAF can perform the following steps:

[0067] S301A. Analyzing the first processing rule information to obtain an alarm processing operation instruction;

[0068] S302A. The first network element executes the alarm processing operation instruction.

[0069] Steps S301A-S302A are a first execution mode of step S3.

[0070] In step S301A, the NWDAF analyzes the queried first processing rule information to obtain an alarm processing operation instruction. In step S302A, the NWDAF executes the alarm processing operation instruction, thereby executing an automatic repair script or a forwarding rule, and achieving processing of the first alarm information.

[0071] When performing step S3, the NWDAF can also perform the following steps:

[0072] S301B. Searching for a plurality of third network elements that are located in the same core network as the first network element and satisfy an idle condition;

[0073] S302B. The first network element distributes the first processing rule information to each third network element;

[0074] S303B. Analyzing the first processing rule information to obtain an alarm processing operation instruction;

[0075] S304B. Each third network element executes the alarm processing operation instruction.

[0076] Steps S301B-S304B are a second execution mode of step S3.

[0077] In step S301B, the NWDAF can detect the load of each third network element NF1, NF2, etc., and determine a network element with a load lower than a threshold value as a third network element satisfying the idle condition.

[0078] In steps S302B-S303B, the first processing rule information queried can be parsed by the NWDAF to obtain alarm processing operation instructions, and the alarm processing operation instructions are distributed to each third network element determined in step S301B. Alternatively, the first processing rule information queried can be sent by the NWDAF to each third network element determined in step S301B, and each third network element respectively parses the first processing rule information to obtain alarm processing operation instructions.

[0079] In step S304B, each third network element determined in step S301B executes the alarm processing operation instructions, thereby executing the automatic repair script or the forwarding rule, and achieving processing of the first alarm information.

[0080] It can be known from steps S301A-S302A and steps S302B-S303B that, by executing step S3, the NWDAF or other network functions and the like can achieve processing of the alarm information before the OAM, which is the inherent alarm processing function network element, and can fully mobilize other network elements in the core network, especially idle network elements, to achieve the alarm processing function according to the processing rule information stored in the alarm rule library, thereby assisting the inherent alarm processing function network element to process the alarm. From the side of the inherent alarm processing function network element, the alarm information sent by the fault source is filtered by other network elements in the core network, and the pressure of the inherent alarm processing function network element is reduced. From the side of the fault source, the alarm information sent by the fault source is responded as much as possible, thereby improving the response capability of the alarm and reducing the possibility of occurrence of the alarm outbreak and the derived problems.

[0081] Reference Figure 1 If the first processing rule information corresponding to the first alarm information is not queried, step S4 is executed, and the first network element, that is, the NWDAF, sends the first alarm information to the second network element, that is, the OAM, and triggers the OAM to process the first alarm information. For example, the OAM can execute the automatic repair script or the forwarding rule, thereby automatically processing the first alarm information; or the OAM displays the first alarm information for manual processing by the operation and maintenance personnel.

[0082] By executing step S4, the alarm can be processed by the inherent alarm processing function network element in the case that the first processing rule information is not queried and the first network element or the third network element does not have the alarm processing capability, thereby guaranteeing that the first alarm information is processed.

[0083] In this embodiment, after step S3 is executed, the first network element or the third network element can send the processing result of the first alarm information to the OAM for confirmation and review by the OAM, thereby guaranteeing the correctness of the processing of the first alarm information by the first network element or the third network element.

[0084] In this embodiment, the first alarm information can be alarm information directly generated by the fault source, or in the case that the fault source directly generates second alarm information, the first alarm information can be obtained by performing the following steps:

[0085] S101A. Obtain a plurality of second alarm information successively sent by the fault source;

[0086] S102A. Obtain predicted alarm information according to each second alarm information;

[0087] S103A. Aggregate each second alarm information and the predicted alarm information to obtain the first alarm information.

[0088] Steps S101A-S103A are a first execution mode of step S1.

[0089] In step S101A, in the case that the fault source successively sends a plurality of second alarm information (the content of each second alarm information can be different), the first network element, i.e., the NWDAF, can buffer each second alarm information through a data queue, and arrange each second alarm information in a time sequence according to the receiving time.

[0090] In step S102A, the NWDAF can run a time series prediction model such as a support vector machine to predict the time sequence of each second alarm information arranged in step S101A, and obtain predicted alarm information. The predicted alarm information can represent the prediction result of the time series prediction model, i.e., the alarm information that the fault source will send after predicting a plurality of second alarm information.

[0091] In step S103A, the NWDAF aggregates all second alarm information obtained in step S101A and the predicted alarm information obtained in step S102A together through deduplication aggregation, rule-based aggregation, basic text similarity aggregation, time sequence-based aggregation, topology-based aggregation, or knowledge base-based aggregation, to obtain the first alarm information.

[0092] The principle of steps S101A-S103A is that the first alarm information aggregates a plurality of second alarm information actually sent by the fault source and predicted alarm information that the fault source will send, which can batch process the alarm information actually sent by the fault source, and pre-process the alarm information that the fault source will have a high probability to send, so that when step S3 is performed, the time required for the alarm information that the fault source will have a high probability to send (which will be the alarm information that has been sent) can be reduced, or due to the pre-processing, the fault source will not actually send the alarm information that will have a high probability to send, reducing the concurrency of alarm information and reducing the pressure on each network element.

[0093] In the embodiment, in the case that the fault source directly generates the second alarm information, the first alarm information is obtained by performing the following steps:

[0094] S101B. Obtain the second alarm information sent by the fault source;

[0095] S102B. Obtain the working condition deviation information of each third network element;

[0096] S103B. Aggregate the second alarm information and the working condition deviation information to obtain the first alarm information.

[0097] Steps S101B-S103B are a second execution mode of step S1.

[0098] In step S101B, it is assumed that the fault source sends a single second alarm information, and the NWDAF receives the second alarm information.

[0099] In step S102B, the NWDAF obtains the working condition deviation information of each third network element, such as NF1, NF2, and the like. Specifically, taking the working condition deviation information of the third network element NF1 as an example, the NWDAF can obtain the current working condition information and the ideal working condition information of NF1, calculate the deviation of the current working condition information of NF1 from the ideal working condition information, and obtain the working condition deviation information of NF1.

[0100] In step S103B, the NWDAF predicts the second alarm information and the working condition deviation information of each third network element, such as NF1, NF2, and the like, to obtain the first alarm information.

[0101] The principle of steps S101B-S103B is that the working condition deviation information of each third network element in step S102B reflects the deviation of the actual working condition of each third network element from the ideal working condition, and the alarm information that does not actually exist but objectively exists in each third network element; the first alarm information aggregates the second alarm information actually sent by the fault source and the "alarm information" of each third network element in the same core network, which can regard the fault source and each third network element as a whole, reflect the alarm information existing in the whole, and facilitate the macro processing of the core network where the fault source is located when step S3 is performed, facilitate the discovery of large-scale and large-impact faults, and facilitate the processing of these faults in a timely manner to reduce the negative impact of large-scale faults.

[0102] In the embodiment, when step S103B is performed, that is, the second alarm information and the working condition deviation information are aggregated to obtain the first alarm information, the following steps can be performed:

[0103] S10301. respectively, the second alarm information and each working condition deviation information is processed by natural language, and a first vector representation is obtained;

[0104] S10302. respectively, the second alarm information and working condition deviation information is analyzed by syntax, and a second vector representation is obtained;

[0105] S10303. respectively, the second alarm information and working condition deviation information is analyzed by knowledge graph, and a third vector representation is obtained;

[0106] S10304. Vector prediction is performed on the first vector representation, and a first predicted vector is obtained;

[0107] S10305. Vector prediction is performed on the second vector representation, and a second predicted vector is obtained;

[0108] S10306. Vector prediction is performed on the third vector representation, and a third predicted vector is obtained;

[0109] S10307. According to the first predicted vector, the second predicted vector and the third predicted vector, the first alarm information is determined.

[0110] In step S10301, the NWDAF uses natural language processing technology to extract meaningful semantic relationships and logical relationships from the second alarm information and each working condition deviation information, such as alarm type, alarm level, alarm reason, alarm impact, etc., and converts these semantic relationships and logical relationships into vector representations, thereby obtaining the respective vector representations of the second alarm information and each working condition deviation information. The respective vector representations of the second alarm information and each working condition deviation information are arranged in sequence (e.g., in time sequence according to time sequence), thereby obtaining the first vector representation.

[0111] In step S10302, the NWDAF uses syntax analysis technology to extract meaningful temporal relationships and causal relationships from the second alarm information and each working condition deviation information, such as the order of occurrence of alarms, the dependency relationship between alarms, the impact relationship between alarms, etc., and converts these temporal relationships and causal relationships into vector representations, thereby obtaining the respective temporal vector representations of the second alarm information and each working condition deviation information. The respective temporal vector representations of the second alarm information and each working condition deviation information are arranged in sequence (e.g., in time sequence according to time sequence), thereby obtaining the second vector representation.

[0112] In step S10303, the NWDAF uses knowledge graph analysis technology to extract meaningful hierarchical relationships and dependency relationships related to device information, such as the superior-inferior relationship between devices, the connection relationship between devices, the compatibility relationship between devices, etc., from the second alarm information and each working condition deviation information, respectively, and converts these hierarchical relationships and dependency relationships into vector representations, thereby obtaining a device information vector representation of the second alarm information and each working condition deviation information. The device information vector representations of the second alarm information and each working condition deviation information are arranged in sequence (for example, in time sequence according to time sequence), thereby obtaining a third vector representation.

[0113] In step S10304, since the first vector representation obtained in step S10301 is a plurality of vectors in time sequence form, a support vector machine or other model can be used to process the first vector representation to obtain a prediction result of the first vector representation, i.e., a first prediction vector.

[0114] In step S10305, the same principle as step S10304 is used to process the second vector representation using a support vector machine or other model to obtain a prediction result of the second vector representation, i.e., a second prediction vector.

[0115] In step S10306, the same principle as step S10304 is used to process the third vector representation using a support vector machine or other model to obtain a prediction result of the third vector representation, i.e., a third prediction vector.

[0116] In step S10307, the first prediction vector represents the semantic information of the first alarm information, the second prediction vector represents the word order information of the first alarm information, and the second prediction vector represents the device information of the first alarm information, thereby forming the first alarm information.

[0117] By performing steps S10301-S10307, each alarm information can be vectorized, thereby being easily processed by a prediction model or other tool.

[0118] In this embodiment, after performing steps S1-S4, the following steps can also be performed:

[0119] S5. Triggering the second network element to process the first alarm information;

[0120] S6. Obtaining the processing result of the first alarm information by the second network element;

[0121] S7. Maintaining the alarm rule library according to the processing result.

[0122] In step S5, the first network element (NWDAF) triggers the second network element (OAM) to process the first alarm information. In step S6, the NWDAF obtains the results of the OAM's processing of the first alarm information, including the automated repair script or forwarding rules executed by the OAM when processing the first alarm information, and generates corresponding processing rules based on these automated repair scripts or forwarding rules. The NWDAF stores the identification information (e.g., hash code) of the first alarm information and the processing rules in the alarm rule base, thereby expanding the processing rules stored in the alarm rule base and enabling updates and maintenance of the alarm rule base.

[0123] By executing steps S5-S7, the OAM processing rules for the first alarm information that has not been processed by network elements such as NWDAF can be recorded. Therefore, when steps S1-S4 are subsequently executed, when NWDAF receives alarm information that is the same as or related to the first alarm information, it can be processed before OAM, thereby reducing the pressure on OAM.

[0124] In this embodiment, Figure 1 The core network shown can be Figure 3 As shown, a notification service is provided to the UE.

[0125] Reference Figure 3 The core network is connected to the UE through SMSC / SMSF, IMS and NG-RAN. IMS and SMSC / SMSF subscribe to the notification service of the NWDAF network element. Figure 3 In each process shown, NWDAF can send the alarm processing results performed by itself, the third network element or OAM to the UE via SMS or voice call, so that the operation and maintenance personnel can understand the alarm processing results through the UE or manually perform alarm processing.

[0126] A computer program that executes an alarm information processing method based on an alarm rule base in this embodiment can be written and written into a storage medium or a computer device. When the computer program is read out and run, an alarm information processing method based on an alarm rule base in this embodiment is executed, thereby achieving the same technical effect as an alarm information processing method based on an alarm rule base in the embodiment.

[0127] It should be noted that, as used in this disclosure and unless otherwise specified, an "and / or," where used, refers to a combination of that which is specified and / or one or both described with such term. In other words, "A, B, and / or C" means "only A," "only B," "only C," "A and B," "A and C," "B and C," or "A and B and C." It should also be noted that, as used in this disclosure and unless otherwise specified, a "plurality" means two or more, and a "combination" means two or more.

[0128] It should be understood that, although the terms first, second, third, etc. can be used herein to describe various elements, components, regions, layers and / or sections, these elements, components, regions, layers and / or sections should not be limited to these terms. These terms are only used to distinguish one element, component, region, layer or section from another element, component, region, layer or section. For example, a first element could also be termed a second element, and, similarly, a second element could also be termed a first element without departing from the scope of the disclosure. The use of any and all examples, or exemplary language (e.g., "such as" and "like") provided herein, is intended merely to better illuminate embodiments of the disclosure and does not pose a limitation on the scope of the disclosure unless otherwise claimed.

[0129] It should be appreciated that embodiments of the present application can be realized by either computer hardware, a combination of hardware and software, or by computer instructions stored in non-transitory computer-readable memory. The methods can be implemented in a computer program by using standard programming techniques including non-transitory computer-readable storage medium configured with a computer program, wherein the storage medium so configured makes the computer operate in a specific and predefined manner according to the methods described in the specific embodiments and the accompanying drawings. Each program can be implemented in a high-level procedural or object-oriented programming language to communicate with a computer system. However, the programs can be implemented in assembly or machine language, if desired. In any case, the language can be a compiled or interpreted language. Also, the programs can be able to run on a specially programmed integrated circuit for this purpose.

[0130] Further, the operations of the processes described in this embodiment can be performed in any suitable order, unless otherwise indicated herein or otherwise clearly contradicted by context. The processes described in this embodiment (or variations and / or combinations thereof) can be implemented under the control of one or more computer systems configured with executable instructions (e.g., computer programs, one or more computer processes, or one or more applications) that can be executed by one or more processors, by hardware, or by a combination thereof. The computer programs include a plurality of instructions that are executable by one or more processors.

[0131] Further, the methods can be implemented in any suitable type of computing platform operatively coupled to any suitable type of computing platform, including but not limited to a personal computer, a mini-computer, a mainframe, a workstation, a networked or distributed computing environment, a stand-alone or integrated computer platform, or in communication with a charged particle tool or other imaging device, and the like. Aspects of the present application can be implemented in machine-readable code stored on a non-transitory storage medium or device, whether removable or integrated to the computing platform, such as a hard disk, an optical read and / or write storage medium, RAM, ROM, and the like, such that it can be read by a programmable computer to configure and operate the computer to perform the processes described herein when the storage medium or device is read by the computer. Further, the machine-readable code, or portions thereof, can be transmitted over wired or wireless networks. The present application described in this embodiment includes these and other different types of non-transitory computer readable storage media when such media include instructions or programs that implement the steps described above in conjunction with a microprocessor or other data processor. The present application also includes the computer itself when programmed according to the methods and techniques described in the present application.

[0132] The computer programs are capable of applying to input data to perform the functions described in this embodiment, thereby transforming the input data to generate output data that is stored to non-volatile memory. The output information can also be applied to one or more output devices, such as a display. In a preferred embodiment of the present application, the transformed data represents a physical and tangible object, including a particular visual depiction of a physical and tangible object produced on a display.

[0133] The above description is only preferred embodiments of the present application, the present application is not limited to the above-described embodiments, as long as the same means to achieve the technical effects of the present application, any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application. The technical solutions and / or embodiments within the scope of protection of the present application can have various modifications and changes.

Claims

1. An alarm information processing method based on an alarm rule base, characterized by, The alarm information processing method based on the alarm rule base comprises: obtaining first alarm information; querying, by a first network element, in an alarm rule base according to the first alarm information; when first processing rule information corresponding to the first alarm information is queried, processing the first alarm information according to the first processing rule information by the first network element; when the first processing rule information corresponding to the first alarm information is not queried, sending the first alarm information to a second network element by the first network element; the second network element is a network element with inherent alarm processing function; the processing of the first alarm information according to the first processing rule information by the first network element comprises: searching for a plurality of third network elements which are located in the same core network as the first network element and satisfy an idle condition; distributing the first processing rule information to each of the third network elements by the first network element; analyzing the first processing rule information to obtain alarm processing operation instructions; executing the alarm processing operation instructions by each of the third network elements.

2. The alarm information processing method based on an alarm rule base according to claim 1, characterized by, the querying in the alarm rule base according to the first alarm information comprises: executing a Bloom algorithm according to the first alarm information to obtain a hash code; searching for corresponding first processing rule information in the alarm rule base according to the hash code.

3. The alarm information processing method based on an alarm rule base according to claim 1, characterized by, the processing of the first alarm information according to the first processing rule information by the first network element comprises: analyzing the first processing rule information to obtain alarm processing operation instructions; executing the alarm processing operation instructions by the first network element.

4. The alarm information processing method based on an alarm rule base according to claim 1, characterized by, the obtaining of the first alarm information comprises: obtaining a plurality of second alarm information sent by a fault source; predicting according to each of the second alarm information to obtain predicted alarm information; aggregating each of the second alarm information and the predicted alarm information to obtain the first alarm information.

5. The alarm information processing method based on an alarm rule base according to claim 1, characterized by, the obtaining of the first alarm information comprises: obtaining second alarm information sent by a fault source; obtaining working condition deviation information of each of the third network elements; the working condition deviation information represents the deviation between the current working condition information and the ideal working condition information of the same third network element; aggregating the second alarm information and each of the working condition deviation information to obtain the first alarm information.

6. The alarm information processing method based on an alarm rule base according to claim 5, characterized by, the aggregation of the second alarm information and each of the working condition deviation information to obtain the first alarm information comprises: respectively performing natural language processing on the second alarm information and each of the working condition deviation information to obtain first vector representations; respectively performing syntax analysis on the second alarm information and the working condition deviation information to obtain second vector representations; respectively performing knowledge graph analysis on the second alarm information and the working condition deviation information to obtain third vector representations; performing vector prediction on the first vector representations to obtain first predicted vectors; performing vector prediction on the second vector representations to obtain second predicted vectors; performing vector prediction on the third vector representations to obtain third predicted vectors; determining the first alarm information according to the first predicted vectors, the second predicted vectors and the third predicted vectors.

7. The alarm information processing method based on alarm rule base according to any one of claims 1-6, characterized in that, The alarm information processing method based on the alarm rule base further comprises: triggering the second network element to process the first alarm information; obtaining a processing result of the first alarm information by the second network element; maintaining the alarm rule base according to the processing result.

8. A computer apparatus, comprising: The apparatus comprises a memory and a processor, the memory is configured to store at least one program, and the processor is configured to load the at least one program to execute the alarm information processing method based on the alarm rule base according to any one of claims 1-7.

9. A computer readable storage medium having stored therein a program that is executable by a processor, characterized in that, The program executable by the processor, when executed by the processor, is configured to execute the alarm information processing method based on the alarm rule base according to any one of claims 1-7.

Images