Alarm root cause positioning method and device, electronic equipment and readable storage medium

Abstract

Embodiments of the present application provide a method and device for positioning alarm root cause, electronic equipment and readable storage medium, which are related to the field of intelligent operation and maintenance technology in communication field. The method comprises: obtaining each current alarm data in a current period, dividing each current alarm data into each current alarm event, and generating a directed graph of each current alarm event; determining a target node from each node of the target directed graph according to at least one of the number of nodes in the target directed graph and the weight of each directed edge; and taking the current alarm data corresponding to the target node as the alarm root cause of the current alarm event. The method can quickly and accurately locate the alarm root cause of each current alarm event, and then eliminate the fault causing at least one current alarm data in the current alarm event based on the root cause, thereby improving the speed of eliminating the fault.

Description

Technical Field

[0001] This application relates to the field of intelligent operation and maintenance technology in the field of communications. Specifically, this application relates to a method, device, electronic device, and readable storage medium for locating the root cause of an alarm. Background Technology

[0002] With the development of cloud computing technology, more and more software systems are being deployed in cloud environments. The high stability requirements of communication services bring three major challenges to the operation and maintenance of cloud networks. First, a large number of faults may occur at a single moment, and it is time-consuming and labor-intensive for operation and maintenance personnel to check massive amounts of alarm data, which is not conducive to quickly handling business system faults. Second, a large number of alarm data occur simultaneously, and the relationships between the data are complex, extensive, and intertwined, making it difficult to quickly find the true root cause of the alarms. Third, the cloud network environment is complex, and alarm information is diverse. Even the most experienced operation and maintenance personnel cannot guarantee a complete understanding of all alarms, and human experts have limited experience in dealing with cloud network alarms.

[0003] Existing solutions typically locate the root cause of alarms by classifying alarm data and assigning an impact score. However, these methods require operations and maintenance experts to analyze, preprocess, and label the alarm data, which consumes a significant amount of expert experience and manpower, and cannot avoid subjectivity. Furthermore, these methods cannot handle alarm storms, cannot compress or segment large numbers of alarms, and usually fail to effectively pinpoint the accurate root cause of alarms. Summary of the Invention

[0004] This application provides a method, apparatus, electronic device, computer-readable storage medium, and computer program product for locating alarm root causes, which can solve the problems in the background art. The technical solution is as follows:

[0005] According to a first aspect of the embodiments of this application, a method for locating the root cause of an alarm is provided, the method comprising:

[0006] Within the current period, at least one target network element is identified from the network cloud. The target network element is the network element that generates the current alarm data. The current alarm data of each target network element is then obtained.

[0007] Obtain the topology map of the network cloud. The topology map includes nodes used to represent network elements, and the lines between nodes are used to represent the connection relationship between network elements. Divide the topology map to obtain at least one target sub-topology map. The target sub-topology map includes at least one node used to represent the target network element. Each pair of target sub-topology maps is separated by a preset number of normal network elements. Normal network elements are network elements that have not generated the current alarm data.

[0008] For each target sub-topology map, the current alarm data of each target network element in the target sub-topology map is taken as a current alarm event; the current alarm event includes at least one current alarm data.

[0009] For each current alarm event, a target directed graph corresponding to the current alarm event is generated, and the weight of each directed edge in the directed graph is determined. The nodes of the target directed graph represent the current alarm data in the current alarm event. The direction between the start node and the end node of the directed edge represents the generation of the current alarm data corresponding to the start node, which leads to the generation of the current alarm data corresponding to the end node. The weight of the directed edge is used to represent the probability of the influence of the current alarm data represented by the start node of the directed edge on the current alarm data represented by the end node of the directed edge.

[0010] For each target directed graph, the target node is determined from each node in the target directed graph based on at least one of the number of nodes in the target directed graph and the weight of each directed edge, and the current alarm data corresponding to the target node is taken as the alarm root cause of the current alarm event.

[0011] According to a second aspect of the embodiments of this application, an alarm root cause location device is provided, the device comprising:

[0012] The current alarm data acquisition module is used to identify at least one target network element from the network cloud within the current period. The target network element is the network element that generates the current alarm data; and to acquire the current alarm data of each target network element.

[0013] The topology graph segmentation module is used to obtain the topology graph of the network cloud. The topology graph includes nodes that represent network elements, and the lines between nodes represent the connection relationships between network elements. The topology graph is segmented to obtain at least one target sub-topology graph. The target sub-topology graph includes at least one node that represents the target network element. Each pair of target sub-topology graphs is separated by a preset number of normal network elements, which are network elements that have not generated the current alarm data.

[0014] The current alarm event generation module is used to generate a current alarm event for each target network element in the target sub-topology map for each target sub-topology map; the current alarm event includes at least one current alarm data.

[0015] The directed graph determination module is used to generate a target directed graph corresponding to each current alarm event and determine the weight of each directed edge in the directed graph. The nodes of the target directed graph represent the current alarm data in the current alarm event. The direction between the start node and the end node of the directed edge represents the generation of the current alarm data corresponding to the start node, which leads to the generation of the current alarm data corresponding to the end node. The weight of the directed edge is used to represent the probability of the influence of the current alarm data represented by the start node of the directed edge on the current alarm data represented by the end node of the directed edge.

[0016] The alarm root cause localization module is used to determine the target node from each node in the target directed graph based on at least one of the following: the number of nodes in the target directed graph and the weight of each directed edge. The current alarm data corresponding to the target node is then used as the alarm root cause of the current alarm event.

[0017] According to a third aspect of the embodiments of this application, an electronic device is provided, the electronic device including a memory, a processor and a computer program stored in the memory, wherein the processor executes the program to implement the steps of the method provided in the first aspect.

[0018] According to a fourth aspect of the embodiments of this application, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps of the method provided in the first aspect.

[0019] According to a fifth aspect of the present application, a computer program product is provided, the computer program product including computer instructions stored in a computer-readable storage medium, wherein when a processor of a computer device reads the computer instructions from the computer-readable storage medium, the processor executes the computer instructions, causing the computer device to perform steps implementing the method provided in the first aspect.

[0020] The beneficial effects of the technical solutions provided in this application are:

[0021] In this embodiment, for each current alarm data obtained in the current period, each current alarm data is divided into each current alarm event, and a directed graph of each current alarm event is generated. Based on at least one of the number of nodes in the target directed graph and the weight of each directed edge, a target node is determined from each node in the target directed graph. The current alarm data corresponding to the target node is taken as the alarm root cause of the current alarm event. This can quickly and accurately locate the alarm root cause of each current alarm event, and then eliminate the fault that caused at least one current alarm data in the current alarm event based on the root cause, thereby improving the speed of fault elimination. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below.

[0023] Figure 1 A flowchart illustrating a method for locating the root cause of an alarm provided in an embodiment of this application;

[0024] Figure 2 A network cloud topology diagram provided in this application embodiment;

[0025] Figure 3 This is a schematic diagram of at least one target sub-topology obtained by segmenting the topology map of a network cloud, as provided in an embodiment of this application.

[0026] Figure 4 This application provides a method for generating a target directed graph of a current alarm event based on a target sub-topology graph of that current alarm event, as provided in the embodiments of this application.

[0027] Figure 5 A schematic diagram illustrating the weights of each directed edge in a target directed graph and the obtained weight matrix, provided as an embodiment of this application.

[0028] Figure 6 A flowchart illustrating yet another method for locating the root cause of an alarm, as provided in the embodiments of this application;

[0029] Figure 7 A schematic diagram of the structure of an alarm root cause location device provided in an embodiment of this application;

[0030] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0031] The embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the embodiments described below with reference to the accompanying drawings are exemplary descriptions for explaining the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions of the embodiments of this application.

[0032] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the terms “comprising” and “including” as used in embodiments of this application mean that the corresponding feature can be implemented as the presented feature, information, data, step, operation, element, and / or component, but do not exclude implementation as other features, information, data, step, operation, element, component, and / or combinations thereof supported by the art. It should be understood that when we say that an element is “connected” or “coupled” to another element, the one element can be directly connected or coupled to the other element, or it can mean that the one element and the other element establish a connection relationship through an intermediate element. Furthermore, “connected” or “coupled” as used herein can include wireless connection or wireless coupling. The term “and / or” as used herein indicates at least one of the items defined by the term; for example, “A and / or B” can be implemented as “A,” or as “B,” or as “A and B.”

[0033] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0034] First, let's introduce and explain several terms used in this application:

[0035] A network topology diagram, or simply topology diagram, shows the network configuration and interconnections of network servers, terminals, and workstations. Its structure mainly includes star, ring, bus, distributed, tree, mesh, and cellular topologies. The nodes of the topology diagram represent network devices, which can be terminals, servers, switches, etc. The edges of the topology diagram represent the connections between network devices, which can be physical or logical connections.

[0036] Association rule analysis was developed to uncover the relationships between data. Let's define an association rule:

[0037]

[0038] Here, X and Y represent two data points, with Y considered as the cause and X as the consequence. The association rule stated above indicates that Y leads to X. The strength of the relationship between these two events is further analyzed using the evaluation criteria of frequent itemsets.

[0039] The commonly used evaluation criteria for frequent itemsets include support, confidence, and lift.

[0040] Frequent itemsets: Frequent patterns refer to itemsets, sequences, or substructures that frequently appear in a dataset. In this application embodiment, an alarm event is a dataset, and a frequent itemset is a set whose support is greater than or equal to the minimum support (min_sup).

[0041] Support: The proportion of times several related data points appear in a dataset relative to the total number of data points, or the probability of several data points appearing together. If we have two data points X and Y to analyze their relationship, the corresponding support is:

[0042]

[0043] Generally speaking, data with high support does not necessarily constitute a frequent itemset, but data with very low support certainly does not constitute a frequent itemset.

[0044] Confidence level: The probability that one data point will occur after another data point has occurred, or the conditional probability of the data. If we have two data points X and Y that we want to analyze the correlation between, the confidence level of X with respect to Y is:

[0045]

[0046] Lift: Represents the ratio of the probability of having Y and X simultaneously to the overall probability of X occurring.

[0047]

[0048] The lift reflects the relationship between X and Y. This can represent the degree to which the occurrence of Y increases the probability of the occurrence of X:

[0049] Improvement but It is a valid strong association rule;

[0050] Improvement but It is an invalid strong association rule.

[0051] The alarm root cause localization method, apparatus, electronic device, computer-readable storage medium, and computer program product provided in this application are intended to solve the above-mentioned technical problems of the prior art.

[0052] The technical solutions of this application and their effects are described below through several exemplary embodiments. It should be noted that the following embodiments can be referenced, borrowed from, or combined with each other. Identical terms, similar features, and similar implementation steps in different embodiments will not be repeated.

[0053] This application provides a method for locating the root cause of an alarm. This method is executed by a computer device, which can be a terminal or a server. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc., but is not limited to these. The terminal and server can be directly or indirectly connected via wired or wireless communication, which is not limited in this application.

[0054] like Figure 1 As shown, it exemplarily illustrates a flowchart of a method for locating the root cause of an alarm according to an embodiment of this application. The method includes:

[0055] Step S101: Within the current period, determine at least one target network element from the network cloud. The target network element is the network element that generates the current alarm data; obtain the current alarm data of each target network element.

[0056] In this application embodiment, each cycle corresponds to a preset time interval. For example, one cycle is 5 minutes, then 0:00-0:05 is one cycle, 0:05-0:10 is one cycle, and so on. This preset time interval can be set based on the actual situation, and this application embodiment does not limit it.

[0057] The network cloud in this application embodiment includes at least one network element, which is a network device. It can periodically acquire at least one alarm data generated by each network device in the network cloud. The alarm data generated in each current period is called the current alarm data, and the network element that generates the current alarm data is called the target network element.

[0058] A target network element can generate at least one current alarm data. Multiple current alarm data generated by the same target network element are different. If the same target network element generates current alarm data A twice and alarm data B once in the current period, then the two current alarm data A generated can be regarded as a single current alarm data A. That is, the current alarm data generated by the target network element in the current period includes current alarm data A and current alarm data B.

[0059] After obtaining multiple current alarm data, these current alarm data can be preprocessed, which is called data cleaning. Preprocessing includes, but is not limited to, extracting key fields of alarm data and removing null values ​​of key fields. The key fields can be alarm level, webpage name, network element name, location, etc. If a key field of a certain current alarm data is empty, it means that the current alarm data lacks a key field. The current alarm data can be deleted or the key field can be filled into the current alarm data to achieve data cleaning.

[0060] Step S102: Obtain the topology map of the network cloud. The topology map includes nodes used to represent network elements, and the lines between nodes are used to represent the connection relationship between network elements. The topology map is segmented to obtain at least one target sub-topology map. The target sub-topology map includes at least one node used to represent the target network element.

[0061] If there are at least two target sub-topologies, then the target sub-topologies are separated by a preset number of normal network elements, and the number of nodes corresponding to at least one normal network element is greater than the first preset number or the number of consecutive normal network elements in at least one normal network element is greater than the second preset number.

[0062] This application embodiment can obtain a network cloud topology map, which includes nodes used to represent network elements. The lines between nodes are used to represent the connection relationship between network elements. The connection relationship can be a physical connection relationship or a logical connection relationship. This application embodiment does not limit this.

[0063] In this embodiment of the application, after obtaining the topology map of the network cloud, the topology map is segmented. The topology map can be segmented based on the nodes corresponding to normal network elements that have not generated current alarm data. After segmentation, at least one target sub-topology map is obtained, and each target sub-topology map includes at least one node used to represent the target network element.

[0064] Specifically, for any pair of target network elements, if it is determined that there are no nodes corresponding to normal network elements between the two nodes corresponding to the two target network elements in the topology graph, then the two nodes corresponding to the two target network elements belong to the same target sub-topology graph. If it is determined that there is at least one normal network element between the two nodes corresponding to the two target network elements in the topology graph, and the number of at least one normal network element is greater than a first preset number (e.g., 3) or the number of consecutive normal network elements is greater than a second preset number (e.g., 2), then the two nodes corresponding to the two target network elements belong to different target sub-topologies graphs. If it is determined that there is at least one normal network element between the two nodes corresponding to the two target network elements in the topology graph, and the number of at least one normal network element is not greater than a first preset number or the number of consecutive normal network elements is not greater than a second preset number, then the two nodes corresponding to the two target network elements belong to the same target sub-topology graph. Based on the partitioning results, the shortest distance between any two target sub-topologies is greater than the preset distance. Therefore, a first node can be selected from one target sub-topology and a second node can be selected from the other target sub-topology. The distance between the first node and the second node is then determined. The shortest distance between the first node and the second node is the shortest distance between any two target sub-topologies.

[0065] As can be seen from the above, there is at least one node corresponding to a normal network element between each pair of target sub-topologies. Based on the nodes corresponding to normal network elements that have not experienced failures, the topology is divided into various target sub-topologies. At least one target network element in each target sub-topology generates current alarm data in the current period. There may be correlations between these current alarm data. This correlation may be that current alarm data a leads to the generation of other current alarm data in the current alarm event, or that current alarm data a leads to the generation of current alarm data b, and the generation of current alarm data b leads to the generation of current alarm data c, and so on.

[0066] When multiple current alarm data are generated in the network cloud, the topology of the network cloud is segmented based on the nodes corresponding to normal network elements to obtain at least one sub-topology map. The at least one sub-topology map includes at least one target sub-topology map. The sub-topology map does not include the target network element, but the target sub-topology map contains the target network element.

[0067] like Figure 2As shown, it exemplarily illustrates the topology of a network cloud, where the topology of the network cloud includes nodes 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, and 18. The network elements corresponding to nodes 1, 2, 3, 4, 5, 7, 8, 9, 10, 13, 14, and 18 are the target network elements that generate alarm data, while the network elements corresponding to nodes 6, 11, 12, 15, 16, and 17 are normal network elements.

[0068] like Figure 3 As shown, it exemplarily illustrates a schematic diagram of at least one target sub-topology obtained after segmenting the topology map of the network cloud. Assuming that each pair of target sub-topology maps is separated by two normal network elements, then after segmenting the above topology map, three target sub-topology maps can be obtained. Among them, nodes 1, 2, 3, 4, 5, 6, 7, 8, 9, and 10 correspond to one target sub-topology map; nodes 13 and 14 correspond to one target sub-topology map; and node 18 is a separate target sub-topology map.

[0069] This application classifies at least one current alarm data generated by each target network element in each target sub-topology as a current alarm event, thereby classifying at least one current alarm data. In subsequent processing, for each current alarm event, it is necessary to find an alarm root cause that caused the current alarm event from the various current alarm data contained in the current alarm event.

[0070] Step S103: For each target sub-topology map, the current alarm data of each target network element in the target sub-topology map is taken as a current alarm event; the current alarm event includes at least one current alarm data.

[0071] In this embodiment of the application, for each target sub-topology map, the current alarm data of each target network element in the target sub-topology map is taken as a current alarm event. A current alarm event includes the current alarm data generated by all target network elements in the target sub-topology map.

[0072] As illustrated in the foregoing embodiments, for a target sub-topology, compared to other target network elements in other target sub-topologies, the interconnectivity between the target network elements in the target sub-topology is relatively high. For a current alarm event corresponding to each target sub-topology, there is a high degree of interconnectivity between at least one current alarm data in the current alarm event. It is possible that an alarm data is generated due to an alarm in a target network element, which in turn causes other target network elements in the target sub-topology to generate current alarm data.

[0073] Specifically, suppose that current alarm data a, current alarm data b, and current alarm data c belong to a target sub-topology graph, and there is a high degree of correlation between current alarm data a, current alarm data b, and current alarm data c. The generation of current alarm data a may lead to the generation of current alarm data b and current alarm data c, or the generation of current alarm data b may lead to the generation of current alarm data a and current alarm data c, or the generation of current alarm data c may lead to the generation of current alarm data a and current alarm data b, or current alarm data a may lead to the generation of current alarm mouse b, which in turn leads to the generation of current alarm data c, and so on.

[0074] Step S104: For each current alarm event, generate a target directed graph corresponding to the current alarm event and determine the weight of each directed edge in the directed graph; the nodes of the target directed graph represent the current alarm data in the current alarm event, and the direction between the start node and the end node of the directed edge represents the generation of the current alarm data corresponding to the start node leading to the generation of the current alarm data corresponding to the end node; the weight of the directed edge is used to represent the probability of the influence of the current alarm data represented by the start node of the directed edge on the current alarm data represented by the end node of the directed edge.

[0075] In this embodiment of the application, for each current alarm event, a target directed graph corresponding to the current alarm event is generated. The nodes in the target directed graph represent the current alarm data in the current alarm event, and the direction between the start node and the end node of the directed edge represents the generation of the current alarm data corresponding to the start node, which leads to the generation of the current alarm data corresponding to the end node.

[0076] The target directed graph can be generated in the following way: For the target sub-topology graph corresponding to the current alarm event, remove other normal network elements in the target sub-topology graph except for the target network element, convert the target sub-topology graph with other normal network elements removed into the initial directed graph, and modify the target network element represented by each node in the initial directed graph to the current alarm data corresponding to the target network element.

[0077] like Figure 4As shown, it exemplifies the generation of a target directed graph for a current alarm event based on a target sub-topology graph of a current alarm event. In this target sub-topology graph, the network elements corresponding to nodes A, B, and C are the target network elements that generate the current alarm data, and node D is a normal network element that does not generate the current alarm data. The current alarm data generated by the target network elements corresponding to nodes A, B, and C are current alarm data 1, current alarm data 2, and current alarm data 3, respectively.

[0078] After removing node D corresponding to the normal network element from the target sub-topology graph, a target sub-topology graph containing nodes A, B, and C is obtained. The target sub-topology graph with other normal network elements removed can be converted into an initial directed graph. Each undirected edge in the target sub-topology graph will be converted into two directed edges. The nodes of the initial directed graph will be modified from representing the target network element to representing the current alarm data generated by the target network element.

[0079] It is worth noting that if a node corresponding to a normal network element to be removed is located between nodes corresponding to two target network elements, then after removing the node corresponding to the normal network element, the nodes corresponding to the two target network elements can be considered as adjacent nodes, i.e., the nodes corresponding to the normal network elements are treated as edges. For example, the connection relationship between nodes 1, 2, and 3 is: node 1-node 2-node 3, where the network elements corresponding to nodes 1 and 3 are target network elements, and the network element corresponding to node 2 is a normal network element. When converting to the target directed graph, node 1-node 2-node 3 is converted into nodes... Node 3.

[0080] In this embodiment, after obtaining the target directed graph, the weight of each directed edge is determined. The weight of the directed edge is used to represent the probability that the current alarm data represented by the starting node of the directed edge has an impact on the current alarm data represented by the ending node of the directed edge. Specifically, assuming the weight of the directed edge A→B is 1 / 3, it means that the probability that the current alarm data corresponding to the starting node A of the directed edge has an impact on the current alarm data corresponding to the ending node B of the directed edge is 1 / 3; assuming the weight of the directed edge B→A is 1 / 5, it means that the probability that the current alarm data corresponding to the starting node A of the directed edge has an impact on the current alarm data corresponding to the ending node B of the directed edge is 1 / 5.

[0081] Typically, for two nodes A and B in a directed graph, the weights of A→B and B→A are usually different. The weights of each directed edge are determined based on the confidence, support, and lift between the two current alarm data. Details will be provided in subsequent sections.

[0082] Step S105: For each target directed graph, determine the target node from each node of the target directed graph based on at least one of the number of nodes in the target directed graph and the weight of each directed edge, and take the current alarm data corresponding to the target node as the alarm root cause of the current alarm event.

[0083] In this embodiment, each target directed graph corresponds to a current alarm event. Each current alarm event includes at least one current alarm data point. The generation of a current alarm event must have a root cause. A target node can be determined from the nodes of the target directed graph based on at least one of the following: the number of nodes in the target directed graph and the weight of each directed edge. The current alarm data corresponding to the target node is then used as the root cause of the current alarm event. Furthermore, in this embodiment, the location of the alarm root cause is periodic, locating the root cause of each current alarm event within the current period.

[0084] In this embodiment, each alarm data obtained in the current period is divided into alarm events, and a directed graph of each alarm event is generated. Based on at least one of the number of nodes in the target directed graph and the weight of each directed edge, a target node is determined from each node in the target directed graph. The current alarm data corresponding to the target node is taken as the root cause of the current alarm event. This enables the rapid and accurate location of the root cause of each current alarm event, and the elimination of the fault that caused at least one current alarm data in the current alarm event is based on the root cause, thereby improving the speed of fault elimination.

[0085] This application provides a possible implementation method for determining a target node from the nodes of the target directed graph based on at least one of the number of nodes in the target directed graph and the weight of each directed edge, including:

[0086] If the target directed graph is determined to contain one node, then that one node is taken as the target node.

[0087] If the target directed graph contains two nodes, then compare the weights of the two directed edges between the two nodes, and take the starting node of the directed edge with the largest weight as the target node.

[0088] If the target directed graph includes one node, then that one node can be directly taken as the target node, and the current alarm data corresponding to that one node is the root cause of the current alarm event.

[0089] If the target directed graph contains two nodes, the weights of the two directed edges between the two nodes can be compared. For example, if the weight of the directed edge A→B is 1 / 3, it means that the probability of the current alarm data corresponding to the starting node A of the directed edge affecting the current alarm data corresponding to the ending node B of the directed edge is 1 / 3. Assuming the weight of the directed edge B→A is 1 / 5, it means that the probability of the current alarm data corresponding to the starting node A of the directed edge affecting the current alarm data corresponding to the ending node B of the directed edge is 1 / 5. From the above weights, it can be determined that the correlation between the two nodes should be: the generation of the current alarm data corresponding to the starting node of the directed edge with the largest weight leads to the generation of the current alarm data corresponding to the ending node. Therefore, the starting node of the directed edge with the largest weight can be taken as the target node, that is, the current alarm data corresponding to the starting node of the directed edge with the largest weight is the root cause of the current alarm event.

[0090] This application provides a possible implementation method, which determines the target node from the nodes of the target directed graph based on at least one of the number of nodes in the target directed graph and the weight of each directed edge, and further includes:

[0091] If the target directed graph is determined to contain at least 3 nodes, then the target importance of each node is determined based on the weight of each directed edge.

[0092] The node corresponding to the maximum importance of the target is taken as the target node.

[0093] The foregoing embodiments have described how to determine the target node in a directed graph when it includes one or two nodes. When the target directed graph includes three nodes, the target importance of each node can be determined based on the weight of each directed edge. The target importance of a node is also the importance of the current alarm data represented by the node. The higher the target importance of a node, the greater the likelihood that the node is the root cause of the alarm. In this embodiment, the node corresponding to the maximum target importance can be taken as the target node.

[0094] This application provides a possible implementation method for determining the target importance of each node based on the weight of each directed edge, including:

[0095] Based on the weights of each directed edge in the target directed graph, a weight matrix is ​​generated. Each element of the weight matrix represents: the probability of the current alarm data corresponding to the row number of the generated position affecting the current alarm data corresponding to the column number of the generated position.

[0096] Obtain the initial importance of each node in the target directed graph and generate an initial vector matrix. Each element in the initial vector matrix represents the initial importance of the corresponding node. The initial importance is determined based on the number of nodes in the target directed graph.

[0097] The initial vector matrix is ​​iteratively updated based on the weight matrix, and the vector matrix obtained in the last iteration is used as the target vector matrix. Each element in the target vector matrix represents the target importance of the corresponding current alarm data.

[0098] In this embodiment, the target importance of each node is determined iteratively. Specifically, a weight matrix is ​​generated based on the weights of each directed edge in the target directed graph. Each element of the weight matrix is ​​a probability; that is, the weight matrix is ​​actually a transition probability matrix. This probability represents the probability of the current alarm data corresponding to the row number of the generated position affecting the current alarm data corresponding to the column number of the generated position. This weight matrix can be represented by M. n*n This means that the element in the i-th row and j-th column of the matrix represents the probability of the current alarm data in the i-th row affecting the current alarm data in the j-th column.

[0099] At the same time, it is also necessary to obtain the initial importance of each node in the target directed graph. The initial importance of each node is determined based on the number of nodes in the target directed graph. The default initial importance of each node can be 1 / n, where n is the number of nodes in the target directed graph.

[0100] This application implements a method that, after obtaining each initial importance level, generates an initial vector matrix. Each row element in the initial vector matrix represents the initial importance of the corresponding node. After obtaining the weight matrix and the initial vector matrix, iterative updates are performed on the initial vector matrix based on the weight matrix. In each iteration, the vector matrix of the current iteration is multiplied by the weight matrix, and the product is used as the vector matrix of the next iteration. If the determinant of the difference matrix between the vector matrix of the current iteration and the vector matrix of the next iteration is less than a preset threshold, the iteration stops, and the vector matrix obtained in the last iteration is used as the target vector matrix. Each row element in the target vector matrix represents the target importance of the corresponding current alarm data. The vector matrix obtained in each iteration can be represented as R. t Where t represents the t-th iteration, Where Vi represents the i-th node, PR(v i The weight matrix M represents the importance of the i-th node. Specifically, if the weight matrix is ​​M, then the vector matrix obtained in the next iteration (t+1) is R. t+1 =M*R tThe vector matrices that can be obtained from the 0th iteration to the tth iteration are R0, R1, R2...R t Where R1 = MR0, R2 = M 2 R0, ..., R t =M t R0, that is, the vector matrices that can be obtained from the 0th iteration to the tth iteration are R0, MR0, M 2 R0,…,M t R0.

[0101] This application provides a possible implementation method that iteratively updates the initial vector matrix based on the weight matrix, including:

[0102] In each iteration, the vector matrix and weight matrix of the current iteration are multiplied, and the product is used as the vector matrix for the next iteration.

[0103] If the determinant of the difference matrix between the vector matrix of the current iteration and the vector matrix of the next iteration is less than a preset threshold, the iteration stops.

[0104] As illustrated in the foregoing embodiments, if the weight matrix is ​​M and the vector matrix for this iteration is R... t Then the vector matrix obtained in the next iteration, i.e., the (t+1)th iteration, is R. t+1 =M*R t The difference matrix between the two is ΔR = R t+1 -R t If the determinant value of ΔR, |ΔR|, is less than the preset threshold ε, that is:

[0105] |△R|=|M t+1 *R0-M t The iteration stops when *R0|<ε.

[0106] In one specific embodiment, such as Figure 5 As shown in the diagram, it illustrates the weights of each directed edge in the target directed graph and the resulting weight matrix. The weights of edges a-->b are 1 / 5, b-->d are 2 / 3, d-->c are 1 / 3, c-->a are 2 / 3, b-->a are 1 / 3, a-->c are 4 / 5, c-->d are 1 / 3, and d-->b are 1 / 2. Therefore, the weight matrix of the directed graph can be determined as follows: The initial vector matrix of the directed graph is The vector matrix obtained in the t-th iteration is The vector matrix obtained in the (t+1)th iteration is If the determinant of the difference matrix between the vector matrix obtained in the (t+1)th iteration and the vector matrix obtained in the tth iteration is less than the preset threshold ε, then the iteration is stopped.

[0107] This application provides a possible implementation for determining the weight of each directed edge in a directed graph, including:

[0108] For each directed edge, determine the current alarm data represented by the starting node that generates the directed edge, and the support, confidence, and lift of the current alarm data represented by the ending node that generates the directed edge.

[0109] Obtain the weights corresponding to support, confidence, and lift;

[0110] Based on the respective weights of support, confidence, and lift, a weighted sum is calculated for support, confidence, and lift to obtain the weights of the directed edges.

[0111] In this embodiment, the weight of each directed edge is determined based on the support, confidence, and lift of the current alarm data represented by the starting node that generates the directed edge and the current alarm data represented by the ending node that generates the directed edge.

[0112] Support, confidence, and lift are three commonly used evaluation criteria in frequent item sets. The support, confidence, and lift between two alarm data points are determined based on massive amounts of alarm data. It is impossible to accurately determine the support, confidence, and lift between two current alarm data points based on the individual current alarm data points in a current alarm event. The support, confidence, and lift between current alarm data points are determined based on massive amounts of historical alarm events. The detailed process will be discussed later.

[0113] Determine the current alarm data represented by the starting node that generates the directed edge, and obtain the support, confidence, and lift of the current alarm data represented by the ending node that generates the directed edge. Then, obtain the weights corresponding to the support, confidence, and lift. Based on the weights corresponding to the support, confidence, and lift, perform a weighted summation of the support, confidence, and lift to obtain the weight of the directed edge.

[0114] Specifically, assuming The support, confidence, and lift are 90%, 90%, and 1, respectively, and the weights of support, confidence, and lift are 1 / 3. Therefore, the weight of the directed edge w = 1 / 3 * 90% + 1 / 3 * 90% + 1 / 3 * 1 = 93.33%.

[0115] This application provides a possible implementation method for determining the current alarm data represented by the starting node that generates the directed edge, and the support, confidence, and lift of the current alarm data represented by the ending node that generates the directed edge, including:

[0116] Determine the historical periods preceding the current period and obtain the historical alarm events for each historical period; each historical alarm event includes at least two historical alarm data points, and the at least two historical alarm data points in each historical alarm event are different alarm data points generated by different network elements in the network cloud within the same historical period;

[0117] Determine the occurrence count of each historical alarm data in all historical alarm events. Based on the occurrence count of each historical alarm data, identify at least one target historical alarm data from the historical alarm data included in each historical alarm event. The set of at least one target historical alarm data is the maximum frequent itemset of each historical alarm event.

[0118] If it is determined that there are first target historical alarm data and second target historical alarm data in each target historical alarm data, and the first target historical alarm data is the same as the current alarm data represented by the starting node of the directed edge, and the second target historical alarm data is the same as the current alarm data represented by the ending node of the directed edge, then based on the occurrence frequency of the first target alarm data and the occurrence frequency of the second target historical alarm data, the support, confidence, and lift of generating the first target historical alarm data for generating the second target historical alarm data are determined.

[0119] The support, confidence, and lift of the historical alarm data for the first target to the historical alarm data for the second target are respectively used as the support, confidence, and lift of the current alarm data represented by the starting node of the directed edge to the current alarm data represented by the ending node of the directed edge.

[0120] In this application embodiment, each current alarm data is collected within the current period. Based solely on the current alarm data collected in the current period, it is impossible to accurately determine the support, confidence, and lift between any two current alarm data. This application embodiment can determine a massive number of historical periods before the current period, such as obtaining 100 historical periods before the current period, and obtaining the historical alarm events of each historical period. At least two historical alarm data in each historical alarm event are different alarm data generated by different network elements in the network cloud within the same historical period. That is, each historical alarm event is a collection of historical alarm data in the network cloud.

[0121] This application embodiment determines the occurrence count of each historical alarm data in all historical alarm events. Based on the occurrence count of each historical alarm data, at least one target historical alarm data is determined from the historical alarm data included in each historical alarm event. The set of at least one target historical alarm data is the maximum frequent itemset of each historical alarm event. Specifically, each historical alarm event is regarded as a data set, and candidate 1-itemsets and their corresponding support are searched. 1-itemsets with support lower than the required support are pruned to obtain frequent 1-itemsets. Then, the remaining frequent 1-itemsets are joined to obtain candidate frequent 2-itemsets. Candidate frequent 2-itemsets with support lower than the required support are filtered out to obtain the true frequent 2-itemsets. This process is repeated iteratively until no frequent k+1-itemsets can be found. The set of the corresponding frequent k-itemsets is the output of the algorithm, and each historical alarm data in the frequent k-itemsets is the required target historical alarm data.

[0122] It is worth noting that each historical period is different for each current period. Therefore, the maximum frequent itemset determined for each current period may be different, meaning that the historical alarm data for each target may be different.

[0123] Specifically, the target historical alarm data can be determined as follows: Obtain each historical alarm event corresponding to each historical period. Each historical alarm event includes at least one historical alarm data point, and different alarm data generated by different network elements in the network cloud within the same historical period. Scan each historical alarm event and calculate the support of candidate frequent k-itemsets. Remove datasets with support below a threshold from the candidate frequent k-itemsets to obtain frequent k-itemsets. If the obtained frequent k-itemsets are empty, directly return the set of frequent k-1 itemsets as the algorithm result, and the algorithm ends. If the obtained frequent k-itemsets contain only one item, directly return the set of frequent k-itemsets as the algorithm result, and the algorithm ends. Based on the frequent k-itemsets, generate candidate frequent k+1 itemsets through concatenation.

[0124] For any type of alarm data, including current alarm data and historical alarm data, the alarm data includes the alarm name, the name or identifier of the target network element that generated the alarm data, the content of the alarm data, and the type of the alarm data. For two alarm data, if the alarm name, the name or identifier of the target network element that generated the alarm data, the content of the alarm data, and the type of the alarm data are all the same, then it can be determined that the two alarm data are the same.

[0125] In this embodiment of the application, after obtaining the historical alarm data of each target, it is determined that there is a first target historical alarm data and a second target historical alarm data in the historical alarm data of each target. The first target historical alarm data is the same as the current alarm data represented by the starting node of the directed edge, and the second target historical alarm data is the same as the current alarm data represented by the ending node of the directed edge.

[0126] If it is determined that there are first target historical alarm data and second target historical alarm data in the historical alarm data of each target, the support, confidence and lift of the generation of the first target historical alarm data to the generation of the second target historical alarm data are determined based on each historical alarm event. The support, confidence and lift of the generation of the first target historical alarm data to the generation of the second target historical alarm data are respectively used as the support, confidence and lift of the current alarm data represented by the starting node of the directed edge to the current alarm data represented by the ending node of the directed edge.

[0127] If it is determined that there is no historical alarm data for the first target or the second target in the historical alarm data of each target, then the first preset value (e.g., 0), the second preset value (e.g., 0), and the third preset value (e.g., 0) are respectively used as the support, confidence, and lift of the current alarm data represented by the starting node of the directed edge to the current alarm data represented by the ending node of the directed edge.

[0128] Based on the above embodiments, it can be seen that the weights in the directed graph of this application are determined based on alarm data in existing historical alarm events, while the target importance of each node in this application is determined based on the iterative process. The data involved in the iterative process is active alarm data, which is real-time data. That is, the alarm root cause determined by this application based on historical periodic data and current periodic data greatly improves the accuracy of determining the alarm root cause.

[0129] This application provides a possible implementation for generating a directed graph of the target corresponding to the current alarm event, including:

[0130] For the target sub-topology map corresponding to the current alarm event, remove all network elements in the target sub-topology map except for the target network element;

[0131] The target sub-topology graph, after removing other network elements, is converted into an initial directed graph. The target network element represented by each node in the initial directed graph is then modified to the current alarm data corresponding to the target network element.

[0132] The foregoing embodiments have already described this, and the embodiments of this application will not be repeated here.

[0133] In a scenario, such as Figure 6As shown, an exemplary flowchart illustrates yet another method for locating the root cause of an alarm:

[0134] Within the current period, acquire the current alarm data corresponding to each of the missing target network elements in the network cloud; the target network element is the network element that generated the current alarm data.

[0135] Obtain the topology map of the network cloud. The topology map includes nodes that represent network elements and lines between nodes that represent the connection relationships between network elements. Segment the topology map to obtain at least one target sub-topology map.

[0136] For each target sub-topology map, the current alarm data of each target network element in the target sub-topology map is taken as a current alarm event; the current alarm event includes at least one current alarm data, thereby dividing each current alarm data into a current alarm event;

[0137] For each current alarm event, generate the target directed graph corresponding to the current alarm event; determine each historical period before the current period, and obtain the historical alarm events of each historical period; determine the occurrence frequency of each historical alarm data in all historical alarm events, and based on the occurrence frequency of each historical alarm data, determine at least one target historical alarm data from the historical alarm data included in each historical alarm event; the set composed of at least one target historical alarm data is the maximum frequent itemset of each historical alarm event; if it is determined that there is a first target historical alarm data and a second target historical alarm data among the target historical alarm data, and the first target historical alarm data is the same as the current alarm data represented by the starting node of the directed edge, and the second target historical alarm data is the same as the current alarm data represented by the ending node of the directed edge, then based on each historical alarm event, determine the generation of the first target historical alarm data to generate the first target historical alarm data. The support, confidence, and lift of the historical alarm data for the two targets are calculated. The support, confidence, and lift of the historical alarm data for the first target to the historical alarm data for the second target are used as the support, confidence, and lift of the current alarm data represented by the starting node of each directed edge to the current alarm data represented by the ending node of each directed edge. If it is determined that there is no historical alarm data for the first or second target in the historical alarm data of each target, then the first, second, and third preset values ​​are used as the support, confidence, and lift of the current alarm data represented by the starting node of each directed edge to the current alarm data represented by the ending node of each directed edge. For each directed edge, the support, confidence, and lift of the directed edge are weighted and summed based on the weights corresponding to the support, confidence, and lift, to obtain the weight of the directed edge.

[0138] For each target directed graph

[0139] If the target directed graph is determined to contain one node, then that one node is taken as the target node.

[0140] If the target directed graph is determined to contain 2 nodes, then compare the weights of the two directed edges between the two nodes, and take the starting node of the directed edge with the largest weight as the target node.

[0141] If the target directed graph is determined to include at least 3 nodes, a weight matrix is ​​generated based on the weight of each directed edge in the target directed graph; the initial importance of each node in the target directed graph is obtained, an initial vector matrix is ​​generated, the initial vector matrix is ​​iteratively updated based on the weight matrix, and the vector matrix obtained in the last iteration is used as the target vector matrix. Each row element in the target vector matrix represents the target importance of the corresponding current alarm data, and the node corresponding to the maximum value of the target importance is used as the target node.

[0142] The current alarm data corresponding to the target node is used as the root cause of the current alarm event.

[0143] This application provides a device for locating the root cause of an alarm, such as... Figure 7 As shown, the alarm root cause locating device 70 may include:

[0144] The current alarm data acquisition module 710 is used to determine at least one target network element from the network cloud within the current period. The target network element is the network element that generates the current alarm data; and to acquire the current alarm data of each target network element.

[0145] The topology map segmentation module 720 is used to acquire the topology map of the network cloud. The topology map includes nodes that represent network elements, and the lines between nodes represent the connection relationships between network elements. The topology map is segmented to obtain at least one target sub-topology map. The target sub-topology map includes at least one node that represents the target network element. Each pair of target sub-topology maps is separated by a preset number of normal network elements, which are network elements that have not generated the current alarm data.

[0146] The current alarm event generation module 730 is used to take the current alarm data of each target network element in the target sub-topology map as a current alarm event for each target sub-topology map; the current alarm event includes at least one current alarm data.

[0147] The directed graph determination module 740 is used to generate a target directed graph corresponding to each current alarm event and determine the weight of each directed edge in the directed graph for each current alarm event. The nodes of the target directed graph represent the current alarm data in the current alarm event, and the direction between the start node and the end node of the directed edge represents the generation of the current alarm data corresponding to the start node, which leads to the generation of the current alarm data corresponding to the end node. The weight of the directed edge is used to represent the probability of the influence of the current alarm data represented by the start node of the directed edge on the current alarm data represented by the end node of the directed edge.

[0148] The alarm root cause localization module 750 is used to determine the target node from each node of the target directed graph based on at least one of the number of nodes in the target directed graph and the weight of each directed edge, and to take the current alarm data corresponding to the target node as the alarm root cause of the current alarm event.

[0149] This application embodiment provides a possible implementation, wherein the alarm root cause localization module is specifically used for:

[0150] If the target directed graph is determined to contain one node, then that one node is taken as the target node.

[0151] If the target directed graph contains two nodes, then compare the weights of the two directed edges between the two nodes, and take the starting node of the directed edge with the largest weight as the target node.

[0152] This application provides a possible implementation method, in which the alarm root cause localization module is further used to: if it is determined that the target directed graph includes at least 3 nodes, then determine the target importance of each node based on the weight of each directed edge; and take the node corresponding to the maximum target importance as the target node.

[0153] This application embodiment provides a possible implementation, wherein the alarm root cause localization module includes:

[0154] The weight matrix generation submodule is used to generate a weight matrix based on the weights of each directed edge in the target directed graph. The elements at each position of the weight matrix represent: the current alarm data corresponding to the row number of the generated position, and the probability of its influence on the current alarm data corresponding to the column number of the generated position.

[0155] The initial vector matrix generation submodule is used to obtain the initial importance of each node in the target directed graph and generate an initial vector matrix. Each element in the initial vector matrix represents the initial importance of the corresponding node; the initial importance is determined based on the number of nodes in the target directed graph.

[0156] The iterative update submodule is used to iteratively update the initial vector matrix based on the weight matrix. The vector matrix obtained in the last iteration is used as the target vector matrix. Each element in the target vector matrix represents the target importance of the corresponding current alarm data.

[0157] This application provides a possible implementation method in which the iterative update submodule is specifically used to multiply the vector matrix and weight matrix of the current iteration in each iteration, and use the product result as the vector matrix of the next iteration.

[0158] If the determinant of the difference matrix between the vector matrix of the current iteration and the vector matrix of the next iteration is less than a preset threshold, the iteration stops.

[0159] This application provides a possible implementation method, in which the directed graph determination module includes:

[0160] The determination submodule is used to determine, for each directed edge, the current alarm data represented by the starting node that generates the directed edge, and the support, confidence, and lift of the current alarm data represented by the ending node that generates the directed edge.

[0161] The weight acquisition submodule is used to obtain the weights corresponding to support, confidence, and lift.

[0162] The weighted submodule is used to perform a weighted summation of support, confidence, and lift based on their respective weights to obtain the weights of the directed edges.

[0163] This application embodiment provides a possible implementation method, which determines that the submodule is specifically used for:

[0164] The historical alarm data determination unit is used to determine the historical periods before the current period and obtain the historical alarm events of each historical period. Each historical alarm event includes at least two historical alarm data, and the at least two historical alarm data in each historical alarm event are different alarm data generated by different network elements in the network cloud within the same historical period.

[0165] The target historical alarm data determination unit is used to determine the number of times each historical alarm data occurs in all historical alarm events. Based on the occurrence frequency of each historical alarm data, at least one target historical alarm data is determined from the historical alarm data included in each historical alarm event. The set of at least one target historical alarm data is the maximum frequent itemset of each historical alarm event.

[0166] The three-dimensional determination unit is used to determine the support, confidence, and lift of generating the historical alarm data of the first target to generating the historical alarm data of the second target if it is determined that there are historical alarm data of the first target and historical alarm data of the second target in the historical alarm data of each target, the historical alarm data of the first target and the current alarm data represented by the starting node of the directed edge are the same, and the historical alarm data of the second target and the current alarm data represented by the ending node of the directed edge are the same.

[0167] This application provides a possible implementation method. The three-degree determination unit is further configured to, if it is determined that there is no first target historical alarm data or second target historical alarm data in each target historical alarm data, use the first preset value, the second preset value and the third preset value as the support degree, confidence degree and lift degree of the current alarm data represented by the starting node of the directed edge to the current alarm data represented by the ending node of the directed edge.

[0168] This application provides a possible implementation method for a directed graph determination module.

[0169] The removal submodule is used to remove other network elements in the target subtopology map, except for the target network element, for the target subtopology map corresponding to the current alarm event;

[0170] The modified submodule is used to convert the target sub-topology graph (after removing other network elements) into an initial directed graph, and to modify the target network element represented by each node in the initial directed graph to the current alarm data corresponding to the target network element.

[0171] The apparatus in this application embodiment can execute the method provided in this application embodiment, and the implementation principle is similar. The actions performed by each module in the apparatus of each embodiment of this application correspond to the steps in the method of each embodiment of this application. For detailed functional descriptions of each module of the apparatus, please refer to the descriptions in the corresponding methods shown above, which will not be repeated here.

[0172] This application provides an electronic device, including a memory, a processor, and a computer program stored in the memory. The processor executes the computer program to implement the steps of a method for locating the root cause of an alarm. Compared with related technologies, this application can achieve the following: For each current alarm data obtained in the current period, this application divides each current alarm data into each current alarm event and generates a directed graph of each current alarm event. Based on at least one of the number of nodes in the target directed graph and the weight of each directed edge, a target node is determined from each node in the target directed graph. The current alarm data corresponding to the target node is used as the root cause of the current alarm event. This can achieve fast and accurate location of the root cause of each current alarm event, and then eliminate the fault that caused at least one current alarm data in the current alarm event based on the root cause, thereby improving the speed of fault elimination.

[0173] In one alternative embodiment, an electronic device is provided, such as Figure 8 As shown, Figure 8 The illustrated electronic device 8000 includes a processor 8001 and a memory 8003. The processor 8001 and the memory 8003 are connected, for example, via a bus 8002. Optionally, the electronic device 8000 may further include a transceiver 8004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 8004 is not limited to one type, and the structure of the electronic device 8000 does not constitute a limitation on the embodiments of this application.

[0174] The processor 8001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor 8001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0175] Bus 8002 may include a pathway for transmitting information between the aforementioned components. Bus 8002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 8002 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 8 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0176] The memory 8003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media, other magnetic storage devices, or any other medium capable of carrying or storing computer programs and capable of being read by a computer, without limitation herein.

[0177] The memory 8003 stores computer programs that execute embodiments of this application, and its execution is controlled by the processor 8001. The processor 8001 executes the computer programs stored in the memory 8003 to implement the steps shown in the foregoing method embodiments.

[0178] The electronic device package may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital radio receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), and in-vehicle terminals (such as in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 8 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments disclosed herein.

[0179] This application provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program can implement the steps and corresponding content of the aforementioned method embodiments. Compared with the prior art, this application can achieve the following: For each current alarm data obtained in the current period, this application divides each current alarm data into each current alarm event and generates a directed graph of each current alarm event. Based on at least one of the number of nodes in the target directed graph and the weight of each directed edge, a target node is determined from each node in the target directed graph. The current alarm data corresponding to the target node is used as the alarm root cause of the current alarm event. This enables rapid and accurate location of the alarm root cause of each current alarm event, and then eliminates the fault that caused at least one current alarm data in the current alarm event based on the alarm root cause, thereby improving the speed of fault elimination.

[0180] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium, a computer-readable medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0181] This application also provides a computer program product, including a computer program that, when executed by a processor, can implement the steps and corresponding content of the aforementioned method embodiments. Compared with the prior art, this application can achieve the following: For each current alarm data obtained in the current period, this application divides each current alarm data into each current alarm event and generates a directed graph of each current alarm event. Based on at least one of the number of nodes in the target directed graph and the weight of each directed edge, a target node is determined from each node in the target directed graph. The current alarm data corresponding to the target node is used as the alarm root cause of the current alarm event. This enables rapid and accurate location of the alarm root cause of each current alarm event, and then eliminates the fault that caused at least one current alarm data in the current alarm event based on the alarm root cause, thereby improving the speed of fault elimination.

[0182] The terms "first," "second," "third," "fourth," "1," "2," etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in a sequence other than that shown in the figures or text.

[0183] It should be understood that although arrows indicate various operation steps in the flowcharts of this application's embodiments, the order in which these steps are implemented is not limited to the order indicated by the arrows. Unless explicitly stated herein, in some implementation scenarios of this application's embodiments, the implementation steps in each flowchart can be executed in other orders as required. Furthermore, some or all steps in each flowchart, based on the actual implementation scenario, may include multiple sub-steps or multiple stages. Some or all of these sub-steps or stages can be executed at the same time, and each sub-step or stage can also be executed at different times. In scenarios where execution times differ, the execution order of these sub-steps or stages can be flexibly configured according to requirements, and this application's embodiments do not limit this.

[0184] The above are only optional implementation methods for some implementation scenarios of this application. It should be noted that for those skilled in the art, other similar implementation methods based on the technical concept of this application, without departing from the technical concept of this application, also fall within the protection scope of the embodiments of this application.

Claims

1. A method for locating the root cause of an alarm, characterized in that, include: Within the current period, at least one target network element is identified from the network cloud, the target network element being the network element that generated the current alarm data; Obtain the current alarm data for each target network element; Obtain the topology map of the network cloud, the topology map includes nodes for representing network elements, and the lines between nodes are used to represent the connection relationship between network elements. Segment the topology map to obtain at least one target sub-topology map. The target sub-topology graph includes at least one node for representing the target network element; each pair of target sub-topology graphs is separated by a preset number of normal network elements, which are network elements that have not generated current alarm data; For each target sub-topology map, the current alarm data of each target network element in the target sub-topology map is taken as a current alarm event; The current alarm event includes at least one current alarm data; For each current alarm event, generate the target directed graph corresponding to the current alarm event, and determine the weight of each directed edge in the target directed graph; The nodes of the target directed graph represent the current alarm data in the current alarm event. The direction between the start node and the end node of the directed edge represents the generation of the current alarm data corresponding to the start node, which leads to the generation of the current alarm data corresponding to the end node. The weight of the directed edge is used to represent the probability of the influence of the current alarm data represented by the start node of the directed edge on the current alarm data represented by the end node of the directed edge. For each target directed graph, a target node is determined from each node of the target directed graph based on at least one of the number of nodes in the target directed graph and the weight of each directed edge, and the current alarm data corresponding to the target node is taken as the alarm root cause of the current alarm event. The step of determining the target node from the nodes of the target directed graph based on at least one of the number of nodes in the target directed graph and the weight of each directed edge includes: if it is determined that the target directed graph includes at least 3 nodes, then determining the target importance of each node based on the weight of each directed edge; and taking the node corresponding to the maximum target importance as the target node. The determination of the target importance of each node based on the weight of each directed edge includes: Based on the weights of each directed edge in the target directed graph, a weight matrix is ​​generated; each element of the weight matrix represents the probability of the influence of the current alarm data corresponding to the row number of the position on the current alarm data corresponding to the column number of the position. The initial importance of each node in the target directed graph is obtained, and an initial vector matrix is ​​generated. Each element in the initial vector matrix represents the initial importance of the corresponding node. The initial importance is determined based on the number of nodes in the target directed graph. The initial vector matrix is ​​iteratively updated based on the weight matrix, and the vector matrix obtained in the last iteration is used as the target vector matrix. Each element in the target vector matrix represents the target importance of the corresponding current alarm data.

2. The method according to claim 1, characterized in that, The step of determining the target node from the nodes of the target directed graph based on at least one of the number of nodes in the target directed graph and the weight of each directed edge includes: If it is determined that the target directed graph includes one node, then that one node is taken as the target node; If the target directed graph is determined to contain two nodes, the weights of the two directed edges between the two nodes are compared, and the starting node of the directed edge with the largest weight is taken as the target node.

3. The method according to claim 1, characterized in that, The iterative update of the initial vector matrix based on the weight matrix includes: In each iteration, the vector matrix of the current iteration is multiplied by the weight matrix, and the product is used as the vector matrix for the next iteration. If the determinant of the difference matrix between the vector matrix of the current iteration and the vector matrix of the next iteration is less than a preset threshold, the iteration stops.

4. The method according to claim 1, characterized in that, Determining the weights of each directed edge in the target directed graph includes: For each directed edge, determine the current alarm data represented by the starting node that generates the directed edge, and the support, confidence, and lift of the current alarm data represented by the ending node that generates the directed edge. Obtain the weights corresponding to the support, confidence, and lift, respectively. Based on the weights corresponding to the support, confidence, and lift, the weights of the directed edges are obtained by weighted summation of the support, confidence, and lift.

5. The method according to claim 4, characterized in that, The determination of the support, confidence, and lift of the current alarm data represented by the starting node that generates the directed edge to the current alarm data represented by the ending node that generates the directed edge includes: Determine each historical period prior to the current period and obtain historical alarm events for each historical period; each historical alarm event includes at least two historical alarm data, and the at least two historical alarm data in each historical alarm event are different alarm data generated by different network elements in the network cloud within the same historical period; Determine the occurrence frequency of each historical alarm data in all historical alarm events. Based on the occurrence frequency of each historical alarm data, determine at least one target historical alarm data from the historical alarm data included in each historical alarm event. The set of the at least one target historical alarm data is the maximum frequent itemset of each historical alarm event. If it is determined that there are first target historical alarm data and second target historical alarm data in each target historical alarm data, the first target historical alarm data is the same as the current alarm data represented by the starting node of the directed edge, and the second target historical alarm data is the same as the current alarm data represented by the ending node of the directed edge, then the support, confidence and lift of generating the first target historical alarm data to generating the second target historical alarm data are determined based on each historical alarm event. The support, confidence, and lift of the historical alarm data for the first target to the historical alarm data for the second target are respectively used as the support, confidence, and lift of the current alarm data represented by the starting node of the directed edge to the current alarm data represented by the ending node of the directed edge.

6. The method according to claim 5, characterized in that, The step of determining at least one target historical alarm data from the historical alarm data included in each historical alarm event further includes: If it is determined that there is no historical alarm data for the first target or the second target in the historical alarm data of each target, then the first preset value, the second preset value and the third preset value are respectively used as the support, confidence and lift of the current alarm data represented by the starting node of the directed edge to the current alarm data represented by the ending node of the directed edge.

7. The method according to claim 1, characterized in that, The generation of the target directed graph corresponding to the current alarm event includes: For the target sub-topology map corresponding to the current alarm event, remove all network elements in the target sub-topology map except for the target network element; The target sub-topology graph, after removing other network elements, is converted into an initial directed graph. The target network element represented by each node in the initial directed graph is then modified to the current alarm data corresponding to the target network element.

8. A device for locating the root cause of an alarm, characterized in that, include: The current alarm data acquisition module is used to determine at least one target network element from the network cloud within the current period, wherein the target network element is the network element that generated the current alarm data; Obtain the current alarm data for each target network element; The topology graph segmentation module is used to obtain the topology graph of the network cloud, the topology graph including nodes for representing network elements, the lines between nodes for representing the connection relationship between network elements, and segment the topology graph to obtain at least one target sub-topology graph. The target sub-topology graph includes at least one node for representing the target network element; each pair of target sub-topology graphs is separated by a preset number of normal network elements, which are network elements that have not generated current alarm data; The current alarm event generation module is used to take the current alarm data of each target network element in the target sub-topology map as a current alarm event for each target sub-topology map. The current alarm event includes at least one current alarm data; The directed graph determination module is used to generate a target directed graph corresponding to each current alarm event and determine the weight of each directed edge in the target directed graph for each current alarm event. The nodes of the target directed graph represent the current alarm data in the current alarm event. The direction between the start node and the end node of the directed edge represents the generation of the current alarm data corresponding to the start node, which leads to the generation of the current alarm data corresponding to the end node. The weight of the directed edge is used to represent the probability of the influence of the current alarm data represented by the start node of the directed edge on the current alarm data represented by the end node of the directed edge. The alarm root cause localization module is used to determine the target node from each node of the target directed graph based on at least one of the number of nodes in the target directed graph and the weight of each directed edge, and to take the current alarm data corresponding to the target node as the alarm root cause of the current alarm event. The alarm root cause localization module is further configured to, when it is determined that the target directed graph includes at least 3 nodes, determine the target importance of each node based on the weight of each directed edge; and take the node corresponding to the maximum target importance as the target node. The alarm root cause localization module is also used to generate a weight matrix based on the weights of each directed edge in the target directed graph. The element at each position of the weight matrix represents: the probability of the influence of the current alarm data corresponding to the row number of the position on the current alarm data corresponding to the column number of the position. Obtain the initial importance of each node in the target directed graph and generate an initial vector matrix, wherein each element in the initial vector matrix represents the initial importance of the corresponding node; The initial importance level is determined based on the number of nodes in the target directed graph; The initial vector matrix is ​​iteratively updated based on the weight matrix, and the vector matrix obtained in the last iteration is used as the target vector matrix. Each element in the target vector matrix represents the target importance of the corresponding current alarm data.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-7.

Images