A Fault Scenario Detection Method and System

Abstract

The present invention relates to the field of operation and maintenance technologies, and specifically to a fault scenario detection method and system, which includes the following steps: pre-check of fault scenarios, alarm filtering for fault scenarios, and merging of fault scenarios; query all alarm sets, sequentially construct alarm feature vectors in the alarm sets, and the set alarm features include the number of alarms and the number of alarm types, and train an alarm anomaly detection model according to the alarm feature vectors of all alarm sets; The beneficial effects are as follows: The fault scenario detection method and system proposed by the present invention can quickly identify possible faults based on the anomalies of alarms by extracting the alarm feature vectors of the alarm sets, merge the suspected fault alarms together, and then use the probability of other alarms occurring when an alarm occurs to eliminate irrelevant alarms, which helps to quickly locate faults. Usually, the merging of fault scenarios can effectively merge a large number of alarms when a fault occurs, avoiding alarm storms.

Description

Technical Field

[0001] The present invention relates to the technical field of operation and maintenance, and specifically provides a fault scenario detection method and system. Background Art

[0002] With the rapid development of cloud computing, more and more enterprises and individual users embrace cloud services. For cloud service providers, in order to provide stable services to users, they usually deploy a large number of monitoring systems, which results in a large number of alarms.

[0003] In the prior art, it is of great significance for operation and maintenance personnel to identify real faults from a large number of alarms. Alarm convergence technology is usually used to converge alarms, such as merging alarms according to time windows, alarm objects, regions, etc. In this way, operation and maintenance personnel cannot be reminded in time when a fault occurs, and relying solely on time windows will also merge some irrelevant alarms together, interfering with the fault location of operation and maintenance personnel. Summary of the Invention

[0004] The purpose of the present invention is to provide a fault scenario detection method and system to solve the problems raised in the above background art.

[0005] To achieve the above purpose, the present invention provides the following technical solution: A fault scenario detection method, the method includes the following steps:

[0006] Pre-inspection of fault scenarios, filtering of fault scenario alarms, and merging of fault scenarios;

[0007] Query all alarm sets, construct alarm feature vectors in the alarm sets in sequence, and the set alarm features include the number of alarms and the number of alarm types. Train an alarm anomaly detection model based on the alarm feature vectors of all alarm sets.

[0008] Query all alarm lists, traverse the alarm lists in sequence, mark the current alarm as the main alarm and increment the occurrence count by 1, query the co-occurring alarm list within a specified time interval before and after the occurrence of the current main alarm, remove duplicates of the co-occurring alarms by alarm name to obtain a co-occurring alarm set, traverse the co-occurring alarm set in sequence, mark the current co-occurring alarm as the secondary alarm and increment the occurrence count of this secondary alarm under the corresponding main alarm by 1. After all traversals are completed, calculate the conditional probability of the occurrence of the secondary alarm when the main alarm occurs.

[0009] Preferably, the specific operation of pre-inspecting the fault scenario includes:

[0010] Obtain the alarm list to be detected, construct the alarm feature vector of the current alarm list, input the alarm feature vector into the trained alarm anomaly detection model. If the detection result of the alarm anomaly detection model is a suspected fault scenario, generate a fault scenario.

[0011] Preferably, the specific operations for filtering fault scenario alarms include:

[0012] Traverse the alarm list included in the fault scenario in sequence, query the set of alarms whose conditional probability of occurrence of other alarms when the current alarm occurs meets the specified threshold. At this time, the current alarm is the main alarm and the other alarms are secondary alarms. If the alarm set is empty, query the set of alarms whose conditional probability of occurrence of the current alarm when other alarms occur meets the specified threshold. At this time, the other alarms are the main alarms and the current alarm is the secondary alarm. If the alarm set is empty, delete the current alarm from the fault scenario alarm list.

[0013] Preferably, the specific operations for merging fault scenarios include:

[0014] If the status of the latest fault scenario before the currently detected fault scenario is not closed, determine whether the interval between the creation time of the latest fault scenario and the current time is less than the set fault scenario merging time interval. If it is less, calculate the Jaccard similarity between the alarm names included in the current fault scenario and the alarm names included in the previous latest fault scenario. If the similarity is greater than the set threshold, merge the two fault scenarios.

[0015] A fault scenario detection system, which is composed of a fault scenario real-time detection module, an alarm anomaly detection model training module, and an alarm conditional probability analysis module;

[0016] The fault scenario real-time detection module is used for pre-checking fault scenarios, filtering fault scenario alarms, and merging fault scenarios;

[0017] The alarm anomaly detection model training module is used for querying all alarm sets, constructing alarm feature vectors in the alarm sets in sequence. The set alarm features include the number of alarms and the number of alarm types, and training the alarm anomaly detection model according to the alarm feature vectors of all alarm sets

[0018] And the alarm conditional probability analysis module is used for querying all alarm lists, traversing the alarm lists in sequence, recording the current alarm as the main alarm and incrementing the occurrence times by 1, querying the co-occurrence alarm list within the specified time interval before and after the occurrence of the current main alarm, removing duplicates of the co-occurrence alarms by alarm name to obtain the co-occurrence alarm set, traversing the co-occurrence alarm set in sequence, recording the current co-occurrence alarm as the secondary alarm and incrementing the occurrence times of this secondary alarm under the corresponding main alarm by 1. After all traversals are completed, calculate the conditional probability of the occurrence of the secondary alarm when the main alarm occurs.

[0019] Preferably, the fault scenario pre-check is used for obtaining the to-be-detected alarm list, constructing the alarm feature vector of the current alarm list, inputting the alarm feature vector into the trained alarm anomaly detection model. If the detection result of the alarm anomaly detection model is a suspected fault scenario, generate a fault scenario.

[0020] Preferably, for fault scenario alarm filtering, it is used to sequentially traverse the alarm list included in the fault scenario, query the set of alarms whose conditional probability of other alarms occurring when the current alarm occurs meets the specified threshold. At this time, the current alarm is the main alarm and the other alarms are secondary alarms. If the set of alarms is empty, query the set of alarms whose conditional probability of the current alarm occurring when other alarms occur meets the specified threshold. At this time, the other alarms are the main alarms and the current alarm is the secondary alarm. If the set of alarms is empty, delete the current alarm from the fault scenario alarm list.

[0021] Preferably, for fault scenario merging, if the state of the latest fault scenario before the currently detected fault scenario is not closed, it is determined whether the interval between the creation time of the latest fault scenario and the current time is less than the set fault scenario merging time interval. If it is less, calculate the Jaccard similarity between the alarm names included in the current fault scenario and the alarm names included in the previous latest fault scenario. If the similarity is greater than the set threshold, merge the two fault scenarios.

[0022] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0023] The fault scenario detection method and system proposed by the present invention can quickly identify possible faults based on the anomalies of alarms by extracting the alarm feature vectors of the alarm set, merge the suspected fault alarms together, and then use the probability of other alarms occurring when an alarm occurs to eliminate irrelevant alarms, which helps to quickly locate faults. Usually, the merging of fault scenarios can effectively merge a large number of alarms when a fault occurs, avoiding alarm storms. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is the system architecture diagram of the present invention;

[0025] Figure 2 It is the pre-check flow chart of the fault scenario of the present invention;

[0026] Figure 3 It is the fault scenario alarm filtering flow chart of the present invention;

[0027] Figure 4 It is the fault scenario merging flow chart of the present invention;

[0028] Figure 5 It is the alarm anomaly detection model training flow chart of the present invention;

[0029] Figure 6 It is the alarm conditional probability calculation flow chart of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0030] In order to clearly and completely describe the objectives, technical solutions of the present invention, and make the advantages more clearly understood, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are some embodiments of the present invention, rather than all embodiments, and are only used to explain the embodiments of the present invention, not to limit the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0031] The present invention provides a technical solution: a fault scenario detection method and system.

[0032] As shown in the Figure 1 accompanying drawings, the architecture diagram of the system includes a real-time fault scenario detection module, an alarm anomaly detection model training module, and an alarm conditional probability analysis module.

[0033] The following Figure 2 describes the pre-check process of the fault scenario:

[0034] Obtain the list of alarms to be detected, construct the alarm feature vector of the current alarm list, and input the alarm feature vector into the trained alarm anomaly detection model. If the detection result of the alarm anomaly detection model is a suspected fault scenario, a fault scenario is generated. The list of alarms to be detected is the alarm list after being converged by a certain alarm convergence method. Specifically, it can be the alarm list converged by a time window, such as the alarm list obtained by merging the alarms within 5 minutes. It can also be the alarm list converged by alarm objects, such as the alarm list obtained by merging the alarms whose alarm objects belong to the same virtual machine. The alarm feature vector can be the number of alarms included in the alarm list and the types of alarms, etc.

[0035] The following Figure 3 describes the alarm filtering process of the fault scenario:

[0036] Traverse the alarm list included in the fault scenario in sequence, query the set of alarms whose conditional probability of other alarms occurring when the current alarm occurs meets the specified threshold. At this time, the current alarm is the main alarm, and the other alarms are secondary alarms. If the set of alarms is empty, query the set of alarms whose conditional probability of the current alarm occurring when other alarms occur meets the specified threshold. At this time, the other alarms are the main alarms, and the current alarm is the secondary alarm. If the set of alarms is empty, delete the current alarm from the fault scenario alarm list.

[0037] The following Figure 4 describes the fault scenario merging process:

[0038] If the status of the latest fault scenario before the currently detected fault scenario is not closed, then determine whether the interval between the creation time of the latest fault scenario and the current time is less than the set fault scenario merging time interval. If it is less, calculate the Jaccard similarity between the alarm names included in the current fault scenario and the alarm names included in the previous latest fault scenario. If the similarity is greater than the set threshold, then merge the two fault scenarios.

[0039] The following combines the attached Figure 5 Describe the training process of the alarm anomaly detection model:

[0040] Query all alarm sets, and construct the alarm feature vectors in the alarm sets in turn. The set alarm features include the number of alarms, the number of alarm types, etc. Then, train the alarm anomaly detection model according to the alarm feature vectors of all alarm sets. The alarm anomaly detection model can adopt machine learning algorithms such as the isolation forest algorithm, the K-nearest neighbor algorithm, and the one-class support vector machine.

[0041] The following combines the attached Figure 6 Describe the calculation process of the alarm conditional probability:

[0042] Table 1 Alarm List

[0043]

[0044]

[0045] Query all alarm lists, traverse the alarm lists in turn, record the current alarm as the main alarm, and increment its occurrence count by 1. Query the co-occurrence alarm list within a specified time interval before and after the occurrence of the current main alarm, remove duplicates from the co-occurrence alarms by alarm name to obtain the co-occurrence alarm set. Traverse the co-occurrence alarm set in turn, record the current co-occurrence alarm as the secondary alarm, and increment the occurrence count of this secondary alarm under the corresponding main alarm by 1. After all traversals are completed, calculate the conditional probability of the occurrence of the secondary alarm when the main alarm occurs.

[0046] If the alarm time interval is 5 minutes, then the alarm conditional probabilities calculated for the alarm list shown in Table 1 are as shown in Table 2. The conditional probabilities can be stored using a relational database or a graph database.

[0047] Table 2 Alarm Conditional Probability List

[0048]

[0049]

[0050] Although embodiments of the present invention have been shown and described, those of ordinary skill in the art will appreciate that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A fault scenario detection method, characterized in that: The method includes the following steps: Pre-check of fault scenarios, filtering of fault scenario alarms, and merging of fault scenarios; Query all alarm sets, sequentially construct the alarm feature vectors in the alarm sets. The set alarm features include the number of alarms and the number of alarm types. Train an alarm anomaly detection model based on the alarm feature vectors of all alarm sets; Query all alarm lists, sequentially traverse the alarm lists, mark the current alarm as the main alarm and increment the occurrence count by 1. Query the co-occurrence alarm list within a specified time interval before and after the occurrence of the current main alarm. Remove duplicates from the co-occurrence alarms by alarm name to obtain the co-occurrence alarm set. Sequentially traverse the co-occurrence alarm set, mark the current co-occurrence alarm as the secondary alarm and increment the occurrence count of this secondary alarm under the corresponding main alarm by 1. After all traversals are completed, calculate the conditional probability of the occurrence of the secondary alarm when the main alarm occurs; The specific operations of pre-checking fault scenarios include: Obtain the alarm list to be detected, construct the alarm feature vector of the current alarm list, input the alarm feature vector into the trained alarm anomaly detection model. If the detection result of the alarm anomaly detection model is a suspected fault scenario, generate a fault scenario; The specific operations of filtering fault scenario alarms include: Sequentially traverse the alarm list included in the fault scenario, query the alarm set where the conditional probability of the occurrence of other alarms when the current alarm occurs meets the specified threshold. At this time, the current alarm is the main alarm and the other alarms are the secondary alarms. If the alarm set is empty, query the alarm set where the conditional probability of the occurrence of the current alarm when the other alarms occur meets the specified threshold. At this time, the other alarms are the main alarms and the current alarm is the secondary alarm. If the alarm set is empty, delete the current alarm from the fault scenario alarm list; The specific operations of merging fault scenarios include: If the state of the latest fault scenario before the currently detected fault scenario is not closed, judge whether the interval between the creation time of the latest fault scenario and the current time is less than the set fault scenario merging time interval. If it is less, calculate the Jaccard similarity between the alarm names included in the current fault scenario and the alarm names included in the previous latest fault scenario. If the similarity is greater than the set threshold, merge the two fault scenarios.

2. A fault scenario detection system using the fault scenario detection method according to claim 1, characterized in that: The system consists of a real-time fault scenario detection module, an alarm anomaly detection model training module, and an alarm conditional probability analysis module; The real-time fault scenario detection module is used for pre-checking fault scenarios, filtering fault scenario alarms, and merging fault scenarios; The alarm anomaly detection model training module is used for querying all alarm sets, sequentially constructing the alarm feature vectors in the alarm sets. The set alarm features include the number of alarms and the number of alarm types. Train an alarm anomaly detection model based on the alarm feature vectors of all alarm sets And an alarm condition probability analysis module, which is used to query all alarm lists, traverse the alarm lists in sequence, record the current alarm as the main alarm, increment the occurrence count by 1, query the co-occurring alarm list within a specified time interval before and after the occurrence of the current main alarm, remove duplicates of the co-occurring alarms by alarm name to obtain a co-occurring alarm set, traverse the co-occurring alarm set in sequence, record the current co-occurring alarm as the secondary alarm, and increment the occurrence count of the secondary alarm under the corresponding main alarm by 1. After all traversals are completed, calculate the conditional probability of the secondary alarm occurring when the main alarm occurs; Fault scenario pre-check, which is used to obtain the alarm list to be detected, construct the alarm feature vector of the current alarm list, input the alarm feature vector into the trained alarm anomaly detection model. If the detection result of the alarm anomaly detection model is a suspected fault scenario, generate a fault scenario; Fault scenario alarm filtering, which is used to traverse the alarm list included in the fault scenario in sequence, query the alarm set whose conditional probability of other alarms occurring when the current alarm occurs meets the specified threshold. At this time, the current alarm is the main alarm and the other alarms are the secondary alarms. If the alarm set is empty, query the alarm set whose conditional probability of the current alarm occurring when other alarms occur meets the specified threshold. At this time, the other alarms are the main alarms and the current alarm is the secondary alarm. If the alarm set is empty, delete the current alarm from the fault scenario alarm list; Fault scenario merging, which is used to determine whether the time interval between the creation time of the latest fault scenario before the currently detected fault scenario and the current time is less than the set fault scenario merging time interval if the status of the latest fault scenario before the currently detected fault scenario is not closed. If it is less, calculate the Jaccard similarity between the alarm names included in the current fault scenario and the alarm names included in the previous latest fault scenario. If the similarity is greater than the set threshold, merge the two fault scenarios.

Images