Fault root cause alarm positioning method, fault alarm mode construction method and device

Abstract

The application discloses a fault root cause alarm positioning method, a fault alarm mode construction method and equipment, wherein the fault root cause alarm positioning method comprises the following steps: acquiring an aggregated fault, splitting the aggregated fault to obtain a plurality of sub-faults; for each sub-fault, determining a target root alarm in the sub-fault according to the sub-fault and a plurality of preset fault alarm modes, wherein each preset fault alarm mode comprises a preset root alarm and a preset derived alarm corresponding to the preset root alarm; and merging the target root alarms in all the sub-faults to obtain a final root alarm. The embodiment of the application is different from the existing unified processing of fault alarms, can solve the problem that different fault alarms do not have a propagation relationship, realizes a fault splitting and merging method, splits the aggregated fault, performs root alarm positioning on the sub-faults, and then merges the root alarms of the sub-faults, so that the accuracy of root alarm positioning can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method for locating a fault root cause alarm, a method for constructing a fault alarm mode, and a device. Background Art

[0002] In telecommunications networks, when a fault occurs, one or more alarms directly related to the fault are often generated. These alarms are called root cause alarms, or root alarms for short. Root alarms enable quick and effective fault analysis and resolution, making root alarm location crucial. However, when a fault occurs, related equipment and services also generate a large number of non-root alarms within a short period of time. These alarms, called derivative alarms, can overwhelm the root alarms, severely impacting the troubleshooting efficiency of operations and maintenance personnel. Summary of the Invention

[0003] The embodiments of the present application provide a fault root cause alarm locating method, a fault alarm mode construction method and a device, which can improve the accuracy of root alarm locating.

[0004] On the one hand, an embodiment of the present application provides a fault root cause alarm locating method, including: obtaining an aggregate fault, splitting the aggregate fault to obtain multiple sub-faults; for each of the sub-faults, determining a target root alarm in the sub-fault based on the sub-fault and multiple preset fault alarm modes, wherein each of the preset fault alarm modes includes a preset root alarm and a preset derivative alarm corresponding to the preset root alarm; merging the target root alarms in all the sub-faults to obtain a final root alarm.

[0005] On the other hand, an embodiment of the present application also provides a fault alarm pattern construction method for constructing the preset fault alarm pattern in the fault root cause alarm locating method as described above; the fault alarm pattern construction method includes: obtaining alarm association rules, wherein the alarm association rules include multiple parent alarms and sub-alarms directly associated with each parent alarm; determining a target parent alarm from the multiple parent alarms, and screening out target sub-alarms that are directly and indirectly associated with the target parent alarm; constructing the preset fault alarm pattern based on the target parent alarm and the target sub-alarms, wherein the preset root alarm in the preset fault alarm pattern is the target parent alarm, and the preset derivative alarm in the preset fault alarm pattern is the target sub-alarm.

[0006] On the other hand, an embodiment of the present application also provides a network device, including: a memory, a processor, and a computer program stored on the memory and runnable on the processor, wherein when the processor executes the computer program, it implements the fault root cause alarm locating method and / or the fault alarm mode construction method as described above.

[0007] On the other hand, an embodiment of the present application further provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the fault root cause alarm locating method and / or fault alarm mode constructing method as described above.

[0008] On the other hand, an embodiment of the present application also provides a computer program product, including a computer program or computer instructions, wherein the computer program or the computer instructions are stored in a computer-readable storage medium, and the processor of a computer device reads the computer program or the computer instructions from the computer-readable storage medium, and the processor executes the computer program or the computer instructions, so that the computer device executes the fault root cause alarm locating method and / or the fault alarm mode construction method as described above.

[0009] In the embodiment of the present application, unlike the existing unified processing of fault alarms, the embodiment of the present application first splits the aggregate fault into sub-faults, matches the sub-faults using a preset fault alarm pattern, obtains the target root alarm corresponding to each sub-fault, and finally merges the target root alarms of all sub-faults to obtain the final root alarm. The embodiment of the present application can address the problem of no propagation relationship between different fault alarms and implements a method for fault splitting and merging. The aggregate fault is split, the root alarms of the sub-faults are located, and the root alarms of the sub-faults are merged, thereby improving the accuracy of root alarm location. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 This is a schematic diagram of an implementation environment for executing a fault root cause alarm locating method and / or a fault alarm mode establishing method provided by an embodiment of the present application;

[0011] Figure 2 This is a flow chart of a fault root cause alarm location method provided by an embodiment of the present application;

[0012] Figure 3 yes Figure 2 A diagram showing the specific steps of an embodiment of a method for splitting an aggregation fault in step S100;

[0013] Figure 4 yes Figure 2 Specific steps of another embodiment of the aggregation fault splitting method in step S100;

[0014] Figure 5 This is a diagram of specific steps for sorting and screening multiple sub-faults provided by an embodiment of the present application;

[0015] Figure 6This is a diagram of specific steps for determining a target root alarm according to a first matching degree provided by an embodiment of the present application;

[0016] Figure 7 This is a diagram of specific steps for adjusting a fault alarm in a sub-fault according to a second matching degree, provided in one embodiment of the present application;

[0017] Figure 8 This is a diagram of specific steps for adjusting a fault alarm in a sub-fault provided by an embodiment of the present application;

[0018] Figure 9 This is a diagram of specific steps for adjusting a fault alarm in a sub-fault provided by another embodiment of the present application;

[0019] Figure 10 This is a diagram of the specific steps of merging target root alarms to obtain a final root alarm, provided by an embodiment of the present application;

[0020] Figure 11 This is a diagram of specific steps for merging target root alarms to obtain a final root alarm, provided by another embodiment of the present application;

[0021] Figure 12 This is a flowchart of a method for constructing a fault alarm mode provided by an embodiment of the present application;

[0022] Figure 13 This is a flowchart of building a fault alarm mode by simulating a fault, provided by an embodiment of the present application;

[0023] Figure 14 This is a diagram of specific steps for updating multiple preset fault alarm modes according to a simulated fault alarm mode provided by an embodiment of the present application;

[0024] Figure 15 This is a diagram of specific steps for updating multiple preset fault alarm modes according to a simulated fault alarm mode provided by another embodiment of the present application;

[0025] Figure 16 This is a diagram of specific steps for updating multiple preset fault alarm modes according to a simulated fault alarm mode provided by another embodiment of the present application;

[0026] Figure 17 This is a diagram of specific steps for updating multiple preset fault alarm modes according to a simulated fault alarm mode provided by another embodiment of the present application;

[0027] Figure 18 This is a flowchart of constructing a fault alarm mode by artificial intelligence, provided by an embodiment of the present application;

[0028] Figure 19This is a diagram of specific steps for updating multiple preset fault alarm modes based on historical fault alarm modes provided by an embodiment of the present application;

[0029] Figure 20 This is a diagram of specific steps for updating multiple preset fault alarm modes according to historical fault alarm modes provided by another embodiment of the present application;

[0030] Figure 21 This is a diagram of specific steps for updating multiple preset fault alarm modes according to historical fault alarm modes provided by another embodiment of the present application;

[0031] Figure 22 This is a diagram of specific steps for updating multiple preset fault alarm modes according to historical fault alarm modes provided by another embodiment of the present application;

[0032] Figure 23 This is a general structural diagram of an intelligent fault handling system provided by an embodiment of the present application;

[0033] Figure 24 This is a flowchart of fault alarm pattern mining provided by an embodiment of the present application;

[0034] Figure 25 This is an example diagram of a fault alarm mode provided by an embodiment of the present application;

[0035] Figure 26 This is a flow chart of a fault root cause alarm location method based on a fault alarm mode provided by an embodiment of the present application;

[0036] Figure 27 This is a flowchart of a fault alarm pattern matching method provided by an embodiment of the present application;

[0037] Figure 28 A flowchart of fault alarm pattern mining provided by one embodiment of the present application;

[0038] Figure 29 A flowchart of root alarm location based on fault alarm pattern matching provided by one embodiment of the present application;

[0039] Figure 30 An example diagram of PTN resource topology and fault alarms provided in one embodiment of the present application;

[0040] Figure 31 A flowchart of sub-fault alarm pattern matching provided by one embodiment of the present application;

[0041] Figure 32 It is a structural diagram of a network device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical methods and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0043] It should be noted that although a logical order is shown in the flowcharts, in some cases, the steps shown or described may be performed in a different order than that shown in the flowcharts. The terms "first," "second," and the like in the specification, claims, and drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0044] In some cases, when a fault occurs in a telecommunications network, one or more alarms directly related to the fault are generated. These alarms are called root cause alarms, or root alarms for short. Root alarms enable quick and effective fault analysis and resolution, making root alarm location crucial. However, when a fault occurs, related equipment and services also generate a large number of non-root alarms within a short period of time. These alarms are called derivative alarms. These numerous derivative alarms overwhelm the root alarms, severely impacting the troubleshooting efficiency of operations and maintenance personnel.

[0045] Intelligent fault handling is a technology that analyzes faults from a fault perspective. This technology aggregates the alarms caused by a single fault, referred to as fault aggregation. This allows analysis of only those aggregated faults, avoiding simultaneous analysis of all network alarms. This facilitates root alarm location and fault analysis and processing, improving O&M efficiency and reducing O&M costs.

[0046] Furthermore, alarm correlation analysis is a key method for locating root alarms. It leverages the propagation or causal relationships between alarms to identify the root alarm. Through the accumulation of expert experience and AI (artificial intelligence) mining, a large number of alarm correlation rules have been accumulated in various fields. However, these rules often fail to cover all alarms. Furthermore, due to the rapid development of telecommunications networks and the continuous emergence of new products and technologies, the refinement of alarm correlation rules is a long-term and ongoing process. Furthermore, mining alarm correlation rules requires accurate annotation, which is challenging.

[0047] At the same time, intelligent fault root alarm location often only analyzes aggregated fault alarms, which requires accurate and comprehensive aggregation of fault alarms. However, in telecommunications networks, especially complex transmission networks, when fault alarms are aggregated, it is inevitable that there will be too few or too many related alarms for this fault. Directly using alarm correlation analysis to analyze aggregated alarms will affect the accuracy of root alarm location.

[0048] In this regard, the embodiments of the present application provide a fault root cause alarm location method, a fault alarm pattern construction method, a network device, a computer-readable storage medium, and a computer program product. Among them, the fault alarm pattern construction method of the embodiment of the present application can not only make full use of the existing alarm association rules, but also facilitate the use of simulated faults or artificial intelligence methods for mining, thereby ensuring the efficiency of pattern mining; compared with the alarm correlation rules, the use of fault alarm patterns to locate the root alarm has a certain fault tolerance capability. In addition, the fault root cause alarm location method of the embodiment of the present application is different from the existing unified processing of fault alarms. The embodiment of the present application will first split the fault into sub-faults according to the business or topology, and for the sub-faults, use fault alarm pattern matching to locate the root alarm, and finally use fault alarm pattern matching to merge the sub-fault alarms to finally obtain the root alarm. In the fault matching process, the current processing fault and its associated faults are secondary analyzed and adjusted to solve the problem of multiple or insufficient clustering of fault alarms.

[0049] The embodiments of the present application are further described below with reference to the accompanying drawings.

[0050] like Figure 1 As shown, Figure 1 This is a schematic diagram of an implementation environment for executing a fault root cause alarm locating method and / or a fault alarm mode constructing method provided by an embodiment of the present application.

[0051] exist Figure 1 In the example of FIG, the implementation environment includes but is not limited to a telecommunications device 110 and a control device 120, wherein the telecommunications device 110 and the control device 120 are communicatively connected.

[0052] In one embodiment, the aforementioned telecommunications equipment 110 may be a general-purpose network device. Specifically, the telecommunications equipment 110 may be, but is not limited to, a PTN (Packet Transport Network) device or an OTN (Optical Transport Network) device, or may be a switch or router. This embodiment of the present application does not specifically limit the device type of the telecommunications equipment 110. Furthermore, the telecommunications network to which the telecommunications equipment 110 belongs in this embodiment of the present application may be a bearer network PTN network, an OTN network, or a data center. This embodiment of the present application does not specifically limit the network type of the telecommunications network to which the telecommunications equipment 110 belongs.

[0053] In addition, in one embodiment, the above-mentioned control device 120 can be one or several servers, or a server cluster, or other network devices with the ability to locate the root cause of fault alarms and the ability to construct fault alarm modes. The embodiment of the present application does not specifically limit the device type of the control device 120.

[0054] In addition, in one embodiment, the implementation environment also includes but is not limited to a data transmission network 130, wherein the data transmission network 130 is a network connecting the control device 120 and the telecommunications device 110, and is used to transmit alarms, logs and other data generated by the telecommunications device 110 to the control device 120, and can also be used to send various network instructions of the control device 110 to the corresponding telecommunications device 120.

[0055] in addition, Figure 1 The example in the figure is only an application scenario of one embodiment of the present application and is not intended to limit the application scenario of the present application.

[0056] Those skilled in the art will understand that the implementation environment for executing the fault root cause alarm locating method and / or the fault alarm mode construction method can be applied to 3G communication network systems, LTE communication network systems, 5G communication network systems, 6G communication network systems and subsequent evolved mobile communication network systems, etc., and this embodiment does not make any specific limitations on this.

[0057] It will be understood by those skilled in the art that Figure 1 The implementation environment shown in the figure does not constitute a limitation on the embodiments of the present application, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0058] Based on the above implementation environment, various embodiments of the fault root cause alarm locating method of the present application are proposed below.

[0059] like Figure 2 As shown, Figure 2 This is a flowchart of a fault root cause alarm location method provided by an embodiment of the present application. The fault root cause alarm location method can be applied but is not limited to Figure 1 The control device in the process may include but is not limited to step S100, step S200 and step S300.

[0060] Step S100: Obtain an aggregate fault, split the aggregate fault into multiple sub-faults;

[0061] Step S200: For each sub-fault, determine a target root alarm in the sub-fault according to the sub-fault and multiple preset fault alarm modes, wherein each preset fault alarm mode includes a preset root alarm and a preset derived alarm corresponding to the preset root alarm;

[0062] Step S300: Merge the target root alarms in all sub-faults to obtain a final root alarm.

[0063] Specifically, in the embodiment of the present application, unlike the existing unified processing of fault alarms, the embodiment of the present application first splits the aggregate fault into sub-faults, matches the sub-faults using a preset fault alarm pattern, obtains the target root alarm corresponding to each sub-fault, and finally merges the target root alarms of all sub-faults to obtain the final root alarm. The embodiment of the present application can address the problem of no propagation relationship between different fault alarms and implements a method for fault splitting and merging. It splits the aggregate fault, locates the root alarms for the sub-faults, and then merges the root alarms of the sub-faults, thereby improving the accuracy of root alarm location.

[0064] In addition, the splitting method of the aggregate failure in step S100 may include but is not limited to: Figure 3 and Figure 4 There are two implementation scenarios, as follows:

[0065] like Figure 3 As shown, Figure 3 yes Figure 2 FIG. 4 is a diagram showing the specific steps of an embodiment of a method for splitting an aggregate fault in step S100; splitting the aggregate fault in step S100 to obtain multiple sub-faults may include but is not limited to step S410.

[0066] Step S410: Split the aggregate fault according to service type to obtain multiple sub-faults.

[0067] like Figure 4 As shown, Figure 4 yes Figure 2 FIG. 4 is a diagram showing the specific steps of another embodiment of a method for splitting an aggregate fault in step S100; splitting the aggregate fault in step S100 to obtain multiple sub-faults may include but is not limited to step S420.

[0068] Step S420: Split the aggregate fault according to the network topology to obtain multiple sub-faults.

[0069] Specifically, the embodiments of the present application can split aggregated faults according to business type or network topology. For the problem that the alarms of fault aggregation are located in different business types or network topologies, and there is no propagation relationship between alarms of different business types or network topologies, the embodiments of the present application implement a method for fault splitting and merging, which splits the aggregated faults according to business type or network topology relationship, locates the root alarms for the sub-faults, and then merges the root alarms of the sub-faults, thereby improving the accuracy of root alarm positioning.

[0070] In addition, if Figure 5 As shown, Figure 5 This is a specific step diagram for sorting and screening multiple sub-faults provided by an embodiment of the present application; after obtaining multiple sub-faults in the above step S100, the fault root cause alarm locating method may also include but is not limited to step S510 and step S520.

[0071] Step S510: Determine the number of alarms in each sub-fault, and sort all sub-faults in descending order according to the number of alarms;

[0072] Step S520 : When the first m sub-faults include all fault alarms in the aggregate fault, select the first m sub-faults as target sub-faults to determine a final root alarm from the target sub-faults, where m is a positive integer.

[0073] Specifically, the sub-faults are sorted from most to least according to the number of alarms they contain. If the first few sub-faults already contain all the alarms, the subsequent sub-faults are deleted.

[0074] In addition, if Figure 6 As shown, Figure 6 This is a specific step diagram for determining a target root alarm based on a first matching degree provided by an embodiment of the present application; regarding the determination of the target root alarm in the sub-fault based on the sub-fault and multiple preset fault alarm modes in the above-mentioned step S200, it may include but is not limited to step S610, step S620, step S630 and step S640.

[0075] Step S610: Obtain the priority of each preset fault alarm mode, and select a target preset fault alarm mode from multiple preset fault alarm modes in descending order of priority;

[0076] Step S620: Match the target preset fault alarm pattern with the sub-fault to obtain the root alarm and non-root alarm in the sub-fault;

[0077] Step S630: determining a first matching degree according to the non-root alarm and the preset derivative alarm in the target preset fault alarm pattern, wherein the first matching degree is a ratio of an intersection of the non-root alarm and the preset derivative alarm to the non-root alarm;

[0078] Step S640: until the first matching degree is greater than a first preset threshold, the root alarm is used as the target root alarm.

[0079] Specifically, the embodiment of the present application selects a target preset fault alarm mode from multiple preset fault alarm modes in order of priority from high to low, then matches the root alarm in the sub-fault, and determines the non-root alarm in the sub-fault, and then determines the first matching degree between the non-root alarm and the preset derivative alarm in the target preset fault alarm mode. If the first matching degree is greater than the first preset threshold, the root alarm is used as the target root alarm; if the first matching degree is less than or equal to the first preset threshold, the preset fault alarm mode of the next priority is used as the next target preset fault alarm mode, and similar matching steps as mentioned above are performed.

[0080] The first preset threshold may be pre-set, and the embodiment of the present application does not specifically limit the value of the first preset threshold.

[0081] In addition, if Figure 7 As shown, Figure 7 This is a specific step diagram for adjusting the fault alarm in the sub-fault according to the second matching degree provided by an embodiment of the present application; after taking the root alarm as the target root alarm in the above step S640, the fault root cause alarm locating method may also include but is not limited to step S710, step S720 and step S730.

[0082] Step S710: determining a second matching degree according to the non-root alarm and the preset derived alarm in the target preset fault alarm pattern, wherein the second matching degree is a ratio of an intersection of the non-root alarm and the preset derived alarm to the preset derived alarm;

[0083] Step S720: When the second matching degree is less than or equal to a second preset threshold, obtain an associated fault corresponding to the aggregated fault;

[0084] Step S730: Adjust the fault alarm in the sub-fault according to the associated fault, the target preset fault alarm mode and the sub-fault.

[0085] Specifically, after determining the target root alarm, the embodiment of the present application will determine a second matching degree based on the non-root alarm and the preset derivative alarm in the target preset fault alarm mode. If the second matching degree is less than or equal to the second preset threshold, the fault alarm in the sub-fault will be adjusted according to the associated fault, the target preset fault alarm mode and the sub-fault; if the second matching degree is greater than the second preset threshold, there is no need to adjust the fault alarm in the sub-fault.

[0086] The second preset threshold may be pre-set, and the embodiment of the present application does not specifically limit the value of the second preset threshold.

[0087] In addition, regarding the adjustment of the fault alarm in the sub-fault according to the associated fault, the target preset fault alarm mode and the sub-fault in the above step S730, it may include but is not limited to Figure 8 or Figure 9 There are two implementation scenarios, as follows:

[0088] like Figure 8 As shown, Figure 8 This is a diagram of specific steps for adjusting a fault alarm in a sub-fault provided by an embodiment of the present application; regarding the above-mentioned step S730, adjusting the fault alarm in the sub-fault according to the associated fault, the target preset fault alarm mode and the sub-fault may include but is not limited to step S810 and step S820.

[0089] Step S810: When the preset derivative alarm in the associated fault and the target preset fault alarm mode includes the target fault alarm, and the sub-fault does not include the target fault alarm;

[0090] Step S820: Adjust the target fault alarm from an associated fault to a sub-fault.

[0091] like Figure 9 As shown, Figure 9 This is a specific step diagram for adjusting the fault alarm in a sub-fault provided by another embodiment of the present application; regarding the above-mentioned step S730, adjusting the fault alarm in the sub-fault according to the associated fault, the target preset fault alarm mode and the sub-fault may include but is not limited to step S910 and step S920.

[0092] Step S910: When the preset derivative alarms in the associated fault and target preset fault alarm pattern do not include the target fault alarm, and the sub-fault includes the target fault alarm;

[0093] Step S920: Adjust the target fault alarm from a sub-fault to a related fault.

[0094] In addition, regarding the above step S300, the target root alarms in all sub-faults are merged to obtain the final root alarm, which may include but is not limited to: Figure 10 or Figure 11 There are two implementation scenarios, as follows:

[0095] like Figure 10 As shown, Figure 10 This is a specific step diagram of merging target root alarms to obtain a final root alarm provided by an embodiment of the present application; regarding the merging of target root alarms in all sub-faults in the above step S300 to obtain the final root alarm, it may include but is not limited to step S1000.

[0096] Step S1000: When the target root alarms in all sub-faults are consistent, the target root alarm is used as the final root alarm.

[0097] like Figure 11 As shown, Figure 11 This is a specific step diagram provided by an embodiment of the present application for merging target root alarms to obtain a final root alarm; regarding the above-mentioned step S300 of merging the target root alarms in all sub-faults to obtain the final root alarm, it may include but is not limited to step S1100 and step S1120.

[0098] Step S1110: When the target root alarms in all sub-faults are inconsistent, obtain all target root alarms and all non-root alarms in all sub-faults;

[0099] Step S1120: Delete the intersection of all target root alarms and all non-root alarms from all target root alarms to obtain a final root alarm.

[0100] Based on the fault root cause alarm locating methods of the above-mentioned embodiments, the fault root cause alarm locating methods of the embodiments of the present application include but are not limited to the following technical effects:

[0101] First, in order to address the problem that the alarms of fault aggregation are located in different services or topologies, and there is no propagation relationship between the alarms of different services or topologies, the embodiment of the present application implements a method for fault splitting and merging, which splits the aggregated fault according to the service or topology relationship, locates the root alarm for the sub-fault, and then merges the root alarms of the sub-faults, thereby improving the accuracy of the root alarm positioning.

[0102] Secondly, using pattern matching, we achieve root alarm location and merging of sub-fault root alarms. We match root alarms and derived alarm clusters separately, eliminating the need for pairwise matching. This approach offers greater applicability and improves the accuracy of root alarm location. Pattern matching supports various matching algorithms, such as the Rete algorithm, ensuring efficient pattern matching.

[0103] Thirdly, in order to address the problem of excessive or insufficient alarm aggregation when fault alarms are aggregated, during the pattern matching process, secondary analysis and alarm adjustments are performed on the analyzed faults and faults with time, business or topology correlations, which react to the aggregated faults and improve the accuracy of fault aggregation alarms.

[0104] Based on the above implementation environment and fault root cause alarm locating method, various embodiments of the fault alarm mode construction method of the present application are proposed below.

[0105] like Figure 12 As shown, Figure 12This is a flowchart of a fault alarm mode construction method provided by an embodiment of the present application; the fault alarm mode construction method is used to construct a preset fault alarm mode in the fault root cause alarm locating method of any of the above embodiments, and may include but is not limited to step S1200, step S1300 and step S1400.

[0106] Step S1200: Acquire alarm association rules, where the alarm association rules include multiple parent alarms and child alarms directly associated with each parent alarm;

[0107] Step S1300: determining a target parent alarm from multiple parent alarms, and screening out target child alarms that are directly and indirectly associated with the target parent alarm;

[0108] Step S1400: construct a preset fault alarm pattern according to the target parent alarm and the target child alarm, wherein the preset root alarm in the preset fault alarm pattern is the target parent alarm, and the preset derived alarm in the preset fault alarm pattern is the target child alarm.

[0109] Specifically, the embodiments of the present application can be based on pattern mining of alarm association rules, mainly using the accumulated alarm association rules to construct a basic fault alarm pattern.

[0110] In addition, if Figure 13 As shown, Figure 13 This is a flowchart of constructing a fault alarm mode by simulating a fault, provided by an embodiment of the present application; after constructing a preset fault alarm mode based on the target parent alarm and the target child alarm in the above step S1400, the fault alarm mode construction method may also include but is not limited to step S1510, step S1520 and step S1530.

[0111] Step S1510: Acquire a simulated root alarm and a simulated derived alarm corresponding to the simulated root alarm;

[0112] Step S1520: Construct a simulated fault alarm mode according to the simulated root alarm and the simulated derived alarm;

[0113] Step S1530: Update multiple preset fault alarm modes according to the simulated fault alarm mode.

[0114] Specifically, the embodiments of the present application can perform artificial creation or simulation of faults based on pattern mining of simulation data using a test environment or a simulation environment, and the generated fault alarm patterns can be used to supplement and improve the basic fault alarm patterns.

[0115] In addition, the updating of multiple preset fault alarm modes according to the simulated fault alarm mode in step S1530 may include but is not limited to: Figures 14 to 17 The four implementation scenarios are as follows:

[0116] like Figure 14 As shown, Figure 14 This is a specific step diagram for updating multiple preset fault alarm modes according to a simulated fault alarm mode provided by an embodiment of the present application; regarding the updating of multiple preset fault alarm modes according to the simulated fault alarm mode in the above step S1530, it may include but is not limited to step S1611 and step S1612.

[0117] Step S1611: When the simulated root alarm is consistent with the preset root alarm;

[0118] Step S1612: Add the derived alarms that exist in the simulated fault alarm mode but not in the preset fault alarm mode to the preset fault alarm mode.

[0119] like Figure 15 As shown, Figure 15 This is a specific step diagram for updating multiple preset fault alarm modes according to a simulated fault alarm mode provided by another embodiment of the present application; regarding the updating of multiple preset fault alarm modes according to the simulated fault alarm mode in the above-mentioned step S1530, it may include but is not limited to step S1621, step S1622 and step S1623.

[0120] Step S1621: When the simulated root alarm is a subset of the preset root alarm;

[0121] Step S1622: Using the simulated fault alarm mode as a new preset fault alarm mode;

[0122] Step S1623: Add the derived alarms that exist in the simulated fault alarm mode but not in the preset fault alarm mode to the preset fault alarm mode.

[0123] like Figure 16 As shown, Figure 16 This is a specific step diagram for updating multiple preset fault alarm modes according to a simulated fault alarm mode provided by another embodiment of the present application; regarding the updating of multiple preset fault alarm modes according to the simulated fault alarm mode in the above step S1530, it may include but is not limited to step S1631 and step S1632.

[0124] Step S1631: When the preset root alarm is a subset of the simulated root alarm;

[0125] Step S1632: Use the simulated fault alarm mode as a new preset fault alarm mode.

[0126] like Figure 17 As shown, Figure 17This is a specific step diagram for updating multiple preset fault alarm modes according to a simulated fault alarm mode provided by another embodiment of the present application; regarding the updating of multiple preset fault alarm modes according to the simulated fault alarm mode in the above step S1530, it may include but is not limited to step S1641 and step S1642.

[0127] Step S1641: When the simulated root alarm does not exist in the preset fault alarm mode;

[0128] Step S1642: Use the simulated fault alarm mode as a new preset fault alarm mode.

[0129] In addition, if Figure 18 As shown, Figure 18 This is a flowchart of constructing a fault alarm mode through artificial intelligence provided by an embodiment of the present application; after constructing a preset fault alarm mode based on the target parent alarm and the target child alarm in the above step S1400, the fault alarm mode construction method may also include but is not limited to step S1710, step S1720 and step S1730.

[0130] Step S1710: Obtain historical fault alarms, and generate historical aggregated faults based on the historical fault alarms;

[0131] Step S1720: Using artificial intelligence to mine historical aggregated faults to obtain historical fault alarm patterns;

[0132] Step S1730: Update multiple preset fault alarm modes according to historical fault alarm modes.

[0133] Specifically, the embodiment of the present application can perform AI pattern mining based on fault aggregation alarms, utilize historical alarms of the monitoring network, aggregate historical alarms into individual faults based on the fault dimension, and then use AI algorithms to perform pattern mining on the aggregated faults.

[0134] In addition, the updating of multiple preset fault alarm modes according to the historical fault alarm modes in step S1730 may include but is not limited to: Figures 19 to 22 The four implementation scenarios are as follows:

[0135] like Figure 19 As shown, Figure 19 This is a specific step diagram for updating multiple preset fault alarm modes based on historical fault alarm modes provided by an embodiment of the present application; regarding the updating of multiple preset fault alarm modes based on historical fault alarm modes in the above step S1730, it may include but is not limited to step S1811 and step S1812.

[0136] Step S1811: When the root alarm in the historical fault alarm mode is consistent with the preset root alarm;

[0137] Step S1812: Add the derived alarms that exist in the historical fault alarm pattern but not in the preset fault alarm pattern to the preset fault alarm pattern.

[0138] like Figure 20 As shown, Figure 20 This is a specific step diagram for updating multiple preset fault alarm modes based on historical fault alarm modes provided by another embodiment of the present application; regarding the updating of multiple preset fault alarm modes based on historical fault alarm modes in the above-mentioned step S1730, it may include but is not limited to step S1821, step S1822 and step S1823.

[0139] Step S1821: When the root alarm in the historical fault alarm mode is a subset of the preset root alarm;

[0140] Step S1822: Use the historical fault alarm mode as a new preset fault alarm mode;

[0141] Step S1823: Add the derived alarms that exist in the historical fault alarm pattern but not in the preset fault alarm pattern to the preset fault alarm pattern.

[0142] like Figure 21 As shown, Figure 21 This is a specific step diagram for updating multiple preset fault alarm modes based on historical fault alarm modes provided by another embodiment of the present application; regarding the updating of multiple preset fault alarm modes based on historical fault alarm modes in the above step S1730, it may include but is not limited to step S1831 and step S1832.

[0143] Step S1831: When the preset root alarm is a subset of the root alarms in the historical fault alarm mode;

[0144] Step S1832: Use the historical fault alarm mode as a new preset fault alarm mode.

[0145] like Figure 22 As shown, Figure 22 This is a specific step diagram for updating multiple preset fault alarm modes based on historical fault alarm modes provided by another embodiment of the present application; regarding the updating of multiple preset fault alarm modes based on historical fault alarm modes in the above step S1730, it may include but is not limited to step S1841 and step S1842.

[0146] Step S1841: when the root alarm in the historical fault alarm mode does not exist in the preset fault alarm mode;

[0147] Step S1842: Use the historical fault alarm mode as a new preset fault alarm mode.

[0148] Based on the fault alarm mode construction method of each of the above embodiments, the fault alarm mode construction method of the embodiment of the present application includes but is not limited to the following technical effects:

[0149] Fault alarm patterns are defined as the relationship between a root alarm and its derivative alarms. Derivative alarms form a group of alarms, all generated after a root alarm. The relationships between these derivative alarms do not need to be considered. Therefore, when mining fault alarm patterns, we only need to aggregate alarms belonging to a particular fault type and identify the root alarm. This eliminates the need to mine relationships between two alarms, significantly reducing the difficulty of mining alarm relationships.

[0150] First, we leverage existing alarm correlation rules to construct a preliminary fault alarm model. We use a key alarm as the root alarm, for example, the operator's dispatch alarm. Using alarm correlation rules, we gradually identify all related alarms as derivative alarms. This fully utilizes existing alarm correlation rules based on expert and AI mining, while also obtaining the desired fault alarm model.

[0151] Secondly, you can create or simulate a fault in the test environment, and use the related alarms generated by the fault as a fault alarm pattern. According to the type of fault, mark the root alarm and other alarms as derivative alarms. Based on the root alarm, compare it with the existing fault alarm pattern, add a new fault alarm pattern, or modify the existing fault alarm pattern.

[0152] Thirdly, historical alarms that have already been generated can be used to aggregate them into individual faults according to time, business type, or topology dimensions. Considering that major faults occur relatively rarely in the network, pattern matching mining is relatively simple, unlike alarm correlation mining, and only focuses on related faults with important alarms. Combined with AI methods such as frequent item sets, fault alarm patterns can be obtained. Fault alarm patterns only require mining alarm clusters and marking root alarms, without mining the relationship between two alarms, which greatly reduces the difficulty of mining.

[0153] Based on the above implementation environment, fault root cause alarm locating method and fault alarm mode construction method, various embodiments of the overall structure of the intelligent fault handling system of the present application are proposed below.

[0154] like Figure 23 As shown, Figure 23 This is a diagram of the overall structure of an intelligent fault handling system provided by one embodiment of the present application. The system includes but is not limited to an alarm collection module 210, an alarm aggregation module 220, a root alarm location module 230, a resource knowledge graph 240, and a fault alarm pattern library 250. The functions of each module are as follows:

[0155] The alarm collection module 210 is mainly responsible for monitoring the collection, filtering, backfilling and distribution of alarms in the network. Among them, the alarm collection module 210 includes but is not limited to the alarm filtering submodule 211, the alarm backfilling submodule 212 and the alarm distribution submodule 213, among which the main purpose of the alarm filtering submodule 211 is to filter redundant or invalid alarms, including invalid alarms, flash alarms, oscillation alarms, and system configuration ignorable alarms. The main purpose of the alarm backfilling submodule 212 is to add some fields to the alarm to facilitate alarm aggregation and root alarm positioning, such as the business affected by the alarm, the control domain to which the alarm belongs, etc. The main purpose of the alarm distribution submodule 213 is to distribute alarms according to different dimensions in order to process alarms in parallel and ensure the processing efficiency of the system. For example, they can be distributed according to the control domain of the network or by business.

[0156] The alarm aggregation module 220 is mainly responsible for aggregating alarms that affect the same service or have a topological relationship within the same time period, and analyzing them according to the fault dimension. The aggregated fault may contain one or more sub-faults at the same time. Among them, the alarm aggregation module 220 includes but is not limited to the fault aggregation submodule 221 and the conflict merging submodule 222. Among them, the main purpose of the fault aggregation submodule 221 is to select a suitable aggregation method according to different network types to aggregate alarms, with the purpose of aggregating alarms of the same dimension. For example, for the SPN static service path scenario, alarms can be aggregated according to the spatiotemporal method of the service and time dimensions. The main purpose of the conflict merging submodule 222 is to merge the results of aggregation by different aggregation methods to form a major fault event. For example, multiple faults that occur in the same time period and affect the same service are merged. These faults can occur in different network elements, boards or interfaces.

[0157] The root alarm locating module 230 is mainly responsible for analyzing the alarms aggregated according to the fault dimension and finding the root alarm of the fault. The same fault may contain one or more root alarms. The root alarm locating module 230 includes but is not limited to the fault correlation submodule 231, the pattern matching submodule 232 and the root alarm recommendation submodule 233. The main purpose of the fault correlation submodule 231 is to find faults that are associated with the analyzed fault according to the time and business or topology dimensions. The main purpose is to conduct a secondary analysis on the alarms that are aggregated or under-aggregated by the fault aggregation module during the pattern matching process to improve the accuracy of the root alarm locating and adjust the fault aggregation alarms, thereby reacting to the aggregated fault. For example, when performing fault aggregation according to the time dimension, because the time when alarms of different types of faults occur is quite different, the alarm of a certain fault may be aggregated to other faults, or the alarms of other faults may be aggregated to this fault. The primary purpose of the pattern matching submodule 232 is to employ a fault splitting and merging scheme. First, it splits a fault into sub-faults based on the service or topology dimension. Then, leveraging the accumulated fault alarm pattern library, it employs a pattern matching algorithm to perform fault matching, including root alarm matching and derivative alarm matching. Derivative alarm matching is further divided into primary and secondary matching. Furthermore, during pattern matching, alarm adjustments are performed for associated faults, improving the accuracy of fault aggregation and root alarm location. The primary purpose of the root alarm recommendation submodule 233 is to merge the root alarms of sub-faults, using the same merging method as described above for pattern matching, ultimately obtaining the root alarm for the fault.

[0158] The resource knowledge graph 240 is mainly designed to solve the problems of scattered, duplicated, missing, and low query efficiency in traditional network management systems. The network and business data are stored in a hierarchical and unified manner in the graph database to meet the needs of fast resource and business query.

[0159] The fault alarm pattern library 250 can store fault alarm patterns of various faults, including root alarms and derived alarms. Derived alarms are alarm clusters, and there is no need to mine the propagation relationship between derived alarms.

[0160] Based on the overall structure of the intelligent fault handling system described above, various embodiments of the fault alarm mode construction method and the fault root cause alarm locating method of the present application are proposed below.

[0161] Regarding the fault alarm mode construction method of the embodiment of the present application, Figure 24 As shown in Figure 2, there are three fault alarm pattern mining methods.

[0162] The mining of fault alarm patterns fully considers the application of existing alarm associations and the mining of new fault alarm patterns. The mining includes three methods, namely, mining based on alarm association relationships, simulated fault mining, and AI-based mining. At the same time, the alarm weight is calculated for the mined fault alarm patterns to be used for root alarm location scenarios when fault alarm pattern matching fails.

[0163] like Figure 25 As shown, the fault alarm pattern is a set of alarms caused by a single fault, which includes one or more root alarms and a derived alarm cluster. There is no need to learn the association between alarms, thus greatly reducing the difficulty of fault alarm pattern mining.

[0164] The first fault module mining method fully utilizes existing alarm association rules to generate basic fault alarm patterns. Through the accumulation of manual experience and the use of AI mining, a large number of alarm association rules have been accumulated in various fields. One of the fault alarm pattern mining methods is to obtain them from existing alarm association rules. For different networks, typical fault scenarios and alarms are selected. The selected alarms are used as root alarms. According to the association rules, the associated alarms are queried step by step. The derivative alarms of the root alarm are the fault alarm patterns. The specific steps include the following:

[0165] 1. Select existing alarm correlation rules. Alarm correlation rules refer to the correlation or causal relationship between two alarms. To date, various fields, such as the bearer network (SPN), have accumulated a large number of alarm correlation rules based on manual experience or AI algorithms.

[0166] 2. Typical fault scenarios and root alarm selection. First, for the network being analyzed, such as the PTN network, select a typical alarm as the root alarm of the fault alarm mode. For example, the operator's dispatch alarm can be selected as the root alarm.

[0167] 3. Extract derived alarms starting from the root alarm. Starting from the selected root alarm, obtain the associated alarms of this alarm as derived alarms. Then, based on the derived alarms, continue to query their associated alarms until all related alarms are obtained.

[0168] 4. Root alarm marking: For the alarm cluster generated above, the typical alarm selected at the beginning will be marked as the root alarm. Other alarms will be the derivative alarms of this root alarm to generate a type of fault alarm mode.

[0169] The second fault module mining method is generated directly from typical faults, making full use of the fault alarm data from tests or simulations as a supplement to the basic fault alarm model. It specifically includes the following steps:

[0170] 1. Artificially simulate faults. This can be done using product test data or by performing dedicated fault simulations. Using a test or simulation environment, artificially create or simulate a typical fault and obtain the associated alarms caused by this fault.

[0171] 2. Based on experience, filter out alarms that are not related to this fault, such as vibration alarms.

[0172] 3. Manually mark the root alarm of this fault, and other alarms as derivative alarms as the preliminary fault alarm mode, such as mode a.

[0173] 4. Compare and optimize fault alarm patterns. During the comparison, match according to the root alarm. If the root alarm exists in the fault alarm pattern library, such as fault alarm pattern A, then use the newly generated pattern a to optimize fault alarm pattern A. This is because existing alarm association rules are often not comprehensive enough to cover all scenarios and alarms, resulting in the basic fault alarm patterns generated based on alarm association rules being incomplete. Therefore, the derived alarms of pattern a can be merged into pattern A. If the root alarm of pattern a does not exist in the pattern library, then pattern a is directly stored in the pattern library as a newly discovered fault alarm pattern.

[0174] For the third fault module mining method, we can use historical alarms to aggregate faults and then use AI algorithms to mine them. This method also serves as a supplement to the basic fault alarm mode. It specifically includes the following steps:

[0175] 1. Fault aggregation: Aggregate collected historical alarms into individual faults. This involves building a resource knowledge graph for the resources or business objects where the historical alarms reside. This facilitates resource and business queries and assists in generating aggregated fault alarms. Using the resource knowledge graph or other methods, historical alarms are aggregated into individual faults based on time and resource relationships.

[0176] 2. Fault alarm pattern mining: Using AI methods, such as frequent itemsets, we mine alarm item sets that match support counts for aggregated faults. Because root alarms often occur less frequently in real networks, many root alarms would be filtered out using conventional mining algorithms. Therefore, it is necessary to screen out faults with typical alarms and then perform pattern mining on these faults.

[0177] 3. Root alarm labeling: For faults discovered by AI, experts are required to label the root alarms, save the faults with labeled root alarms, and generate fault alarm pattern a.

[0178] 4. Comparison and optimization of fault alarm patterns are performed, which is consistent with the processing method in the second fault alarm pattern mining method mentioned above and will not be repeated here.

[0179] In addition, regarding the fault root cause alarm location method of the embodiment of the present application, it can be as follows Figure 26 As shown, the fault is first split into sub-faults based on the service or topology. For each sub-fault, fault alarm pattern matching is used to locate the root alarm. Finally, fault alarm pattern matching is used to merge the sub-fault alarms to ultimately obtain the root alarm. This includes but is not limited to the following steps 1 to 7.

[0180] Step 1: Fault correlation involves correlating faults with this fault in terms of time, business, or topology. In terms of business or topology, these faults belong to the same business or topology; in terms of time, these faults occur within a certain period of time before and after this fault, such as within ten minutes. The purpose of fault correlation is to resolve fault aggregation errors. During fault aggregation, it is inevitable that some alarms from the same fault will be aggregated into other faults, or alarms from other faults will be aggregated into this fault. Failure to perform correlation will affect the accuracy of root alarm location.

[0181] Step 2, splitting by service or topology, involves splitting the fault based on the fault aggregation method, preferably by service. For example, if a fault affects multiple services, you can split the fault by service, assigning the alarms to different services. During the splitting process, the alarms are categorized by service one by one. When all alarms have been assigned, the splitting stops, and it is not necessary to split all affected services.

[0182] Step 3: After the fault is split, multiple sub-faults are generated, and the root alarm is located for each sub-fault.

[0183] Step 4: Extract the alarm identifier. Extract the identifier of each alarm to match it with the identifier of the fault alarm mode. This identifier is unique to the network. For example, for a PTN network, the alarm type is the resource type where the alarm is located + the alarm code.

[0184] Step 5: Pattern matching is to determine the root alarm and derivatives of the sub-fault. The specific matching method is as follows: Figure 27 As shown, including but not limited to the steps:

[0185] 1. Root alarm matching compares the root alarm of the fault alarm pattern with the sub-fault alarms to confirm whether the root alarm is included in the sub-fault alarms. To improve matching efficiency, you can use a Rete algorithm, such as drools, and set the pattern matching priority.

[0186] 2. Derived alarm primary matching involves selecting fault alarm patterns that successfully match the root alarm and performing derivative alarm matching. This involves matching the intersection of the fault alarm pattern's derived alarms and sub-fault alarms with the sub-fault alarms. This is because the derived alarms of a fault alarm pattern are relatively complete, while sub-fault alarms are inevitably lost or under-aggregated during fault aggregation. Therefore, derived alarm matching involves matching the sub-fault alarms and the derived alarms of the fault alarm pattern separately. This matching step is called sub-fault alarm matching.

[0187] For example, for a sub-fault alarm, the alarm set other than the root alarm is A, and the set of alarms derived from the fault alarm pattern is B, then the main matching degree is M. 主 =(A∩B) / A, which is the first matching degree mentioned above; the auxiliary matching degree is M 辅 =(A∩B) / B, which is the second matching degree mentioned above.

[0188] 3. Select the mode in which the derived alarm primary match is successful, and continue to perform the derived alarm secondary matching. If the secondary matching degree is greater than the threshold, the judgment is terminated and the root alarm and derived alarm are output; otherwise, related fault query and adjustment are performed.

[0189] 4. Adjust the alarms of associated faults. Based on the derived alarms in the fault alarm pattern, query the associated faults for the same alarm type and make a comprehensive judgment based on the time and space dimensions. If the relevant alarms meet the requirements, the alarms in this part of the associated faults (such as alarm set C) are likely to belong to this fault. Temporarily include alarm set C in this fault and delete it from the associated faults.

[0190] 5. Output the root and derivative alarms of sub-faults.

[0191] Step 6: Merge and analyze the root alarms of multiple sub-faults. When merging the root alarms, the fault alarm pattern is also used for analysis. If the sub-fault alarms exist in the fault alarm pattern library, the method in step 6 is used to locate the root alarms for the second time. Otherwise, the root alarms are directly merged.

[0192] Step 7: Output the root alarm. Based on the result of merging the sub-fault root alarms in step 6, output the root alarm as the recommended root alarm for the fault.

[0193] Based on the above implementation environment, the fault root cause alarm locating method and the fault alarm mode construction method, specific embodiments of the fault root cause alarm locating method and the fault alarm mode construction method of the present application are proposed below.

[0194] like Figure 28 As shown, Figure 28A flowchart of fault alarm pattern mining provided for one embodiment of the present application; it uses the fault alarm pattern mined by existing alarm association rules as a basic model, and uses the pattern mined by simulation data and AI as a supplementary model, including but not limited to steps S2010 to S2040.

[0195] A fault alarm pattern consists of a root alarm and derived alarms. The root alarm is the direct alarm for the fault and can be used to locate the root cause of the fault. For example, in a PTN network, when a device port connection problem occurs, a port signal loss alarm is the root cause alarm. Simultaneously, a large number of other alarms, such as the Flexible Ethernet port disconnection alarm, Flexible Ethernet PHY frame loss alarm, tunnel switching alarm, and fast reroute alarm, are generated. These alarms are grouped together, with the port signal loss alarm as the root alarm and the other alarms as derived alarms, creating a fault alarm pattern.

[0196] Step S2010 involves pattern mining based on alarm association rules, primarily leveraging accumulated alarm association rules to construct basic fault alarm patterns. Because telecommunications networks are constantly evolving, new alarms are constantly emerging. Alarm association rules require the continuous accumulation of expert experience and AI-powered mining. Therefore, conventional alarm association rules often fail to cover all fault scenarios and require supplementation with other methods.

[0197] Alarm association rules are the propagation or causal relationship between two alarms. The generation of the first alarm often leads to the generation of the second alarm. The first alarm is defined as the parent alarm, and the second alarm is defined as the child alarm. The schematic table of alarm association rules is shown in Table 1:

[0198] Table 1

[0199]

[0200] The first step is to select alarms for typical faults in the monitored network. Resource type + alarm code uniquely identifies a type of alarm, expressed as resource type_alarm code. For example, consider dispatch alarms in telecommunications networks. Using the data in Table 1 as an example, typical alarms include board dislocation (33_62), Ethernet physical interface (ETPI) signal loss (LOS) (4203_8), Ethernet physical interface (ETPI) Ethernet port disconnected (4203_37), and L3VPN peer unreachable (577_3511). Because 577_3511 is a service alarm, typically caused by a fault, it is not considered a typical fault alarm here.

[0201] In the second step, take the typical alarm as the root alarm, and search for sub-alarms step by step as derivative alarms of the root alarm. For example, take 33_62 as the root alarm, and the other alarms in the table are all derivative alarms. Aggregate the alarms together and identify the root alarm, which is the fault alarm mode of single board dislocation. Similarly, take 203_8 as the root alarm to generate the fault alarm mode of Ethernet physical interface (ETPI) signal loss (LOS); in particular, when the Ethernet physical port fails, 203_8 and 203_37 are often direct alarms of the fault. These two alarms can both be used as root alarms of a fault. Using this method, fault alarm modes for various faults can be generated. The default fault priority is 0. The fault diagram is shown in Table 2:

[0202] Table 2

[0203]

[0204]

[0205] The third step is to set the priority of the fault alarm mode. The main purpose is to sort the faults and set different weights to resolve conflicts in fault alarm mode matching. The sorting of fault alarm modes is mainly based on the root alarm. For example, the derivative alarm of Mode 1 in Table 2 contains the root alarms of other modes. Mode 1 has the highest priority, and this method is the main method for sorting fault alarm modes. In addition, Mode 3 and Mode 4 do not have a propagation mode, and the two modes have the same priority. Mode 2 is a combination of Mode 3 and Mode 4, and has a higher priority than Mode 2 and Mode 3. According to this method, the priority of the fault alarm modes in Table 2 is as follows: Mode 1 > Mode 2 > Mode 3 / 4, and the priorities of the four fault alarm modes are modified to 1, 2, 3, and 3 respectively.

[0206] Step S2020, pattern mining based on simulation data, mainly utilizes the test environment or simulation environment to artificially create or simulate faults, and generates fault alarm patterns to supplement and improve the basic fault alarm patterns.

[0207] The test or simulation environment can be a laboratory test environment or a purpose-built fault simulation environment to ensure a clean and complete network configuration. Artificially created or simulated faults involve manually performing various operations to cause various faults, such as plugging and unplugging optical fibers, disabling port fiber activators, and modifying communication IP addresses. Each time, only one type of fault is created, and the generated alarm data is then analyzed.

[0208] Aggregate the alarm data of the above faults, manually mark the root alarm, and use other alarms as derivative alarms to generate a fault alarm pattern; wherein, the alarms generated by the above artificial faults are filtered to filter out alarms unrelated to the corresponding fault.

[0209] The new fault alarm mode data obtained above is added to the fault alarm mode library. The specific steps are as follows:

[0210] The first step is to query the patterns in the current pattern library from high to low according to the fault alarm pattern priority in the pattern library, and check whether the root alarm of the new pattern already exists in the current fault alarm pattern, and obtain all patterns containing all root alarms of the new pattern;

[0211] In the second step, if the query result is not empty, different scenarios are processed separately.

[0212] If the root alarm is completely matched, that is, the root alarm type and quantity are consistent, the derivative alarm of the new pattern is used to improve the derivative alarm of the corresponding pattern in the pattern library. The derivative alarm improvement is to add the derivative alarm that exists in the new pattern but not in the corresponding pattern in the pattern library to the corresponding pattern in the pattern library.

[0213] If the new pattern root alarm is a subset of the existing pattern root alarm, the new pattern will be added to the pattern library, and a new fault alarm pattern will be added to the current fault library. At the same time, the derivative alarms of the new pattern will be added to the existing fault alarm pattern containing the new pattern root alarm.

[0214] If the existing pattern root alarm is a subset of the new pattern root alarm, or the two root alarms have an intersection, in such scenarios, the new pattern will be directly added to the pattern library, and a new fault alarm pattern will be added to the current pattern library.

[0215] In the third step, if the query result is empty, it means that the new pattern does not exist in the current pattern library, and the new pattern is directly included in the fault alarm pattern library.

[0216] Step 4: Prioritize the newly added pattern in the fault alarm pattern library using the same method as step S2010. Priority is set only for the newly added pattern; existing patterns in the pattern library do not need to be updated. If the priority of the new pattern falls between two patterns in the pattern library, with priorities P1 and P2, the priority of the newly added fault alarm pattern is (P1 + P2) / 2.

[0217] Step S2030: AI pattern mining based on fault aggregation alarms. Utilizing historical alarms from the monitoring network, based on the fault dimension, historical alarms are aggregated into individual faults. Then, AI algorithms are used to perform pattern mining on the aggregated faults. The main methods are as follows:

[0218] The first step is to aggregate historical alarms into faults. Prioritize building a resource knowledge graph based on the resources / business objects where the historical alarms are located to facilitate resource and business queries and assist in generating fault alarm aggregation. Using the resource knowledge graph or other methods, historical alarms are aggregated into faults based on time and resource relationships.

[0219] The second step is to filter out faults with typical alarms to facilitate the mining of fault alarm patterns.

[0220] The third step is to use AI methods to mine fault alarm patterns. For this, the frequent itemset method can be used. For the aggregated faults, alarm item sets that meet the support count are mined.

[0221] In the fourth step, experts label the root alarms for the mined fault alarm patterns, and other alarms are labeled as derivative alarms and newly identified faults.

[0222] The fifth step is to use the method in step S2020 to add the newly identified fault to the current fault alarm pattern library.

[0223] Step S2040: Update the newly generated or improved fault alarm pattern to the fault alarm pattern library. At the same time, generate a new fault alarm pattern query method or update the existing fault alarm pattern query method.

[0224] In addition, if Figure 29 As shown, Figure 29 A flowchart of root alarm location based on fault alarm pattern matching is provided for an embodiment of the present application; its target object is aggregated fault, and the aggregated fault is to aggregate the collected alarm data according to the fault dimension. It includes alarm filtering, fault aggregation and conflict merging processes. Alarm filtering is to filter out alarms that are not related to the fault, as well as oscillation alarms, flash alarms, etc. from the alarms collected from the control network; fault aggregation is fault aggregation for different alarm types, with the purpose of aggregating alarms generated by a fault into the fault. For example, alarms can be aggregated according to time and business or topology dimensions. For different businesses or topologies, a sliding time window is used for fault aggregation; conflict merging is to merge different faults that affect the same business or the same topology equipment into the same fault. For example, if two faults affect the same business, the two faults are merged into one fault. Specifically, the root alarm location method based on fault alarm pattern matching includes but is not limited to steps S2110 to S2150.

[0225] Step S2110: Fault splitting: The aggregated fault is split into multiple sub-faults based on service or topology dimensions. Fault splitting is primarily due to the fact that when conflicting faults are merged, different sub-faults that affect the same service or have the same topological devices are merged together. These sub-fault alarms lack a propagation relationship. Simultaneously analyzing the entire fault often results in incorrect root alarms and derivative alarms being identified, seriously affecting the accuracy of root alarm location.

[0226] In order to illustrate the fault splitting process, an embodiment of the present application is used for illustration. For example, for a static service scenario of a PTN network, its resources and service topology are as follows: Figure 30 As shown, when the fault is aggregated, Figure 30 In the example, all alarms are aggregated into one fault because they affect the same service. However, this fault actually contains two different sub-faults: port A input optical power exceeds the limit and port B is down.

[0227] The first step is to split the fault according to the business or network topology affected by the fault. For the alarms of the same business, they can be split according to the primary and backup links. For example, Figure 30 The fault can be divided into sub-fault 1 and sub-fault 2. Sub-fault 1 includes the input optical power over-limit alarm, derived alarm 11, derived alarm 12, derived alarm 13, derived alarm 31, and derived alarm 32; sub-fault 2 includes the port down alarm, derived alarm 21, derived alarm 22, derived alarm 23, derived alarm 31, and derived alarm 32.

[0228] The second step is sub-fault selection. Sub-faults are sorted from most to least based on the number of alarms they contain. If the first few sub-faults already contain all the alarms, the subsequent sub-faults are deleted. For example, if a fault is split into n sub-faults according to the first step and sorted by alarms, and the first m sub-faults already contain all the fault alarms, only these m sub-faults are selected.

[0229] Step S2120: extract the alarm identifier, extract the unique identifier of the alarm, which is consistent with the identifier in the fault alarm pattern library and is used for matching the fault alarm pattern. For example, for the PTN network, the alarm identifier is the resource type restype+alarm code alarmCode.

[0230] Step S2130, sub-fault alarm pattern matching, is to match the fault alarm with the alarm in the pattern library, giving priority to the root alarm matching. After the root alarm matching is successful, the derivative alarm matching is then performed. After the matching is successful, the root alarm and the derivative alarm are output. When the derivative alarm matching is successful, it is divided into primary matching and secondary matching. Among them, the secondary matching can adjust the fault aggregation, react to the fault aggregation, and improve the accuracy of the fault aggregation. Figure 30The two sub-faults shown in the figure output the optical power over-limit alarm and the port down alarm respectively, which serve as the root alarms of the two sub-faults. Figure 31 Detailed description.

[0231] Step S2140: Merge the sub-fault root alarms. Analyze and merge the root alarms identified by the sub-faults. The merging of sub-fault root alarms is not a simple merging. Instead, the method of step S2130 is used to perform secondary identification of the root alarms to obtain the final root alarm. Figure 30 The two sub-faults are directly merged, and this fault has two root alarms.

[0232] Step S2150: Output the root alarm formed by merging the sub-faults as the root alarm of the fault for use in root cause analysis of the intelligent fault.

[0233] In addition, if Figure 31 As shown, Figure 31 This is a flowchart for matching sub-fault alarm patterns according to one embodiment of the present application. First, based on the fault alarm pattern priority, all root alarms of the fault alarm pattern are confirmed to exist within the sub-fault. Then, derived alarms of the fault alarm pattern are used to match non-root alarms of the sub-fault using a primary and secondary matching method, ultimately obtaining the root alarm of the sub-fault. Specifically, this sub-fault alarm pattern matching method includes but is not limited to steps S2210 to S2260.

[0234] Step S2210: root alarm matching, matching the root alarm according to the priority of the fault alarm pattern in the fault alarm pattern library.

[0235] When the fault alarm pattern library is generated, each fault alarm pattern is sorted to ensure the order of fault alarm pattern matching and eliminate matching conflicts. For example, pattern 1 has a higher priority than pattern 2. If a sub-fault alarm contains root alarms for both pattern 1 and pattern 2, pattern 1 will be prioritized when matching the root alarm.

[0236] In order to ensure matching efficiency, an existing pattern matching algorithm may be adopted, wherein the Rete algorithm may be adopted to automatically perform pattern matching.

[0237] Step S2220, the derived alarm primary matching, involves matching the non-root alarms of sub-faults using the derived alarms of the fault alarm pattern after the root alarm is successfully matched. If the matching accuracy does not meet the set threshold, the pattern matching fails and the matching of other patterns continues. The threshold is set based on experience, for example, a matching accuracy of 80% can be set.

[0238] The primary matching object of the derived alarm is the non-root alarm of the sub-fault. This is because, when the fault is aggregated, due to network configuration or aggregation algorithm problems, there are often cases where the fault alarms are aggregated too much or too little. The derived alarms of the fault alarm pattern are relatively accurate and complete. From the perspective of the completeness of the derived alarm, the non-root alarms of the sub-fault are matched first. For example, the alarm set other than the current fault root alarm is A, and the set of derived alarms of the fault alarm pattern is B, then the primary matching degree is M. 主 =(A∩B) / A. If the matching degree meets the preset threshold, the auxiliary matching is continued; otherwise, the root alarm matching is continued.

[0239] Step S2230, derivative alarm auxiliary matching, refers to the auxiliary matching performed after the root alarm and the derivative alarm are successfully matched. The purpose of the auxiliary matching is not to improve the matching accuracy, but to adjust the aggregated fault alarm and improve the accuracy of the aggregated fault.

[0240] Derivative alarm auxiliary matching, the target is the derivative alarm of the fault alarm mode, the auxiliary matching degree is M 辅 =(A∩B) / B. If the secondary matching degree exceeds the threshold, the process proceeds to the next step. Otherwise, this indicates that fault aggregation may be insufficient or excessive. Inadequate aggregation can be addressed through fault correlation. In the case of excessive aggregation, the fault itself is not addressed and is resolved through associated fault processing. The threshold is set based on experience, for example, 80%.

[0241] A correlated fault is a fault that has a temporal, service, or topological relationship with the current fault. Alarms that are clustered together, either heavily or lightly, are often associated with associated faults, or the alarms of the current fault are aggregated into associated faults. If a fault alarm pattern-derived alarm, such as alarm type C, is absent from the subfault but present in the associated fault, alarm C is likely mistakenly aggregated into the associated fault and should be adjusted from the associated fault to the current fault. Similarly, an alarm that is absent from a derived alarm but present in the subfault, such as alarm D, is likely mistakenly added to the current fault and should be adjusted from the current fault to the associated fault. Analysis and adjustment of alarm D is not performed during subfault analysis, but is performed during associated fault analysis.

[0242] Step S2240 , recommending the sub-fault root alarm and derived alarms. Based on the above process, the root alarm of the sub-fault and the corresponding derived alarms can be obtained and input into the next process together.

[0243] Step S2250: Merge sub-fault root alarms. When a fault is split into multiple sub-faults, the root alarms of the sub-faults need to be merged. If the root alarms of the sub-faults are consistent, this alarm is considered the root alarm of the fault. Otherwise, the sub-fault root alarms and derived alarms are merged to generate a root alarm list R and a derived alarm list D. Then, the intersection of the root and derived alarms is deleted from the root alarm list and becomes the root alarm of the fault.

[0244] Step S2260: Output the sub-fault root alarm. Output the root alarm and derived alarms analyzed above as the root alarm and derived alarms of the sub-fault, and end the process.

[0245] In addition, if Figure 32 As shown, Figure 32 It is a structural diagram of a network device provided by an embodiment of the present application; an embodiment of the present application also discloses a network device 400, including: a memory 420, a processor 410, and a computer program stored on the memory 420 and executable on the processor 410. When the processor 410 runs the computer program, it executes the fault root cause alarm locating method and / or the fault alarm mode constructing method as in any of the previous embodiments.

[0246] The memory 420 is a non-transient computer-readable storage medium that can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory 420 may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 420 may optionally include a memory remotely located relative to the processor 410, and these remote memories may be connected to the implementation environment via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0247] The network device 400 in this embodiment may correspond to Figure 1 The BIER observation point or collector in the implementation environment of the shown embodiment belongs to the same application concept, so both have the same implementation principles and beneficial effects, and will not be described in detail here.

[0248] The non-transient software program and instructions required to implement the fault root cause alarm locating method of the above embodiment are stored in the memory 420 , and when executed by the processor 410 , the fault root cause alarm locating method of the above embodiment is executed.

[0249] Alternatively, the non-transient software program and instructions required to implement the fault alarm mode construction method of the above embodiment are stored in the memory 420, and when executed by the processor 410, the fault alarm mode construction method of the above embodiment is executed.

[0250] It is worth noting that the specific implementation and technical effects of the network device 400 in the embodiment of the present application can correspond to the specific implementation and technical effects of the above-mentioned fault root cause alarm locating method and / or fault alarm mode construction method.

[0251] In addition, an embodiment of the present application further discloses a computer-readable storage medium storing computer-executable instructions for executing the fault root cause alarm locating method and / or fault alarm mode constructing method as in any of the previous embodiments.

[0252] In addition, an embodiment of the present application also discloses a computer program product, including a computer program or computer instructions, which are stored in a computer-readable storage medium. The processor of a computer device reads the computer program or computer instructions from the computer-readable storage medium, and the processor executes the computer program or computer instructions, so that the computer device executes the fault root cause alarm locating method and / or the fault alarm mode construction method as in any of the previous embodiments.

[0253] Those skilled in the art will appreciate that all or some of the steps and systems in the method disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, and the computer-readable medium can include computer storage media (or non-transitory media) and communication media (or temporary media). As known to those skilled in the art, the term computer storage media is included in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data) and is volatile and non-volatile, removable, and non-removable. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory, or other memory technology, CD-ROM, digital versatile disks (DVD), or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage, or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, as is well known to those skilled in the art, communication media typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

Claims

1. A fault root cause alarm location method, comprising: Obtain an aggregate fault, and split the aggregate fault into multiple sub-faults; For each of the sub-faults, determining a target root alarm in the sub-fault according to the sub-fault and a plurality of preset fault alarm modes, wherein each of the preset fault alarm modes includes a preset root alarm and a preset derived alarm corresponding to the preset root alarm; Merging the target root alarms in all the sub-faults to obtain a final root alarm; The determining of a target root alarm in the sub-fault according to the sub-fault and a plurality of preset fault alarm modes includes: Obtaining the priority of each of the preset fault alarm modes, and selecting a target preset fault alarm mode from the plurality of preset fault alarm modes in descending order of priority; Matching the target preset fault alarm mode with the sub-fault to obtain the root alarm and non-root alarm in the sub-fault; Determining a first matching degree according to the non-root alarm and the preset derived alarm in the target preset fault alarm mode, wherein the first matching degree is a ratio between an intersection of the non-root alarm and the preset derived alarm and the non-root alarm; Until the first matching degree is greater than a first preset threshold, the root alarm is used as the target root alarm.

2. The fault root cause alarm location method according to claim 1, characterized in that: The aggregate fault is split to obtain multiple sub-faults, including one of the following: Splitting the aggregate fault according to service type to obtain multiple sub-faults; The aggregate fault is split according to the network topology to obtain multiple sub-faults.

3. The fault root cause alarm location method according to claim 1, characterized in that: After obtaining the multiple sub-faults, the fault root cause alarm locating method further includes: Determine the number of alarms in each of the sub-faults, and sort all the sub-faults from most to least according to the number of alarms; In the case that the first m sub-faults include all fault alarms in the aggregate fault, the first m sub-faults are selected as target sub-faults to determine a final root alarm from the target sub-faults, wherein m is a positive integer.

4. The fault root cause alarm location method according to claim 1, characterized in that: After taking the root alarm as the target root alarm, the fault root cause alarm locating method further includes: determining a second matching degree according to the non-root alarm and the preset derived alarm in the target preset fault alarm mode, wherein the second matching degree is a ratio between an intersection of the non-root alarm and the preset derived alarm and the preset derived alarm; When the second matching degree is less than or equal to a second preset threshold, obtaining an associated fault corresponding to the aggregated fault; According to the associated fault, the target preset fault alarm mode and the sub-fault, the fault alarm in the sub-fault is adjusted.

5. The fault root cause alarm location method according to claim 4, characterized in that: The adjusting the fault alarm in the sub-fault according to the associated fault, the target preset fault alarm mode, and the sub-fault includes at least one of the following: When the associated fault and the preset derivative alarm in the target preset fault alarm mode include a target fault alarm, and the sub-fault does not include the target fault alarm, adjusting the target fault alarm from the associated fault to the sub-fault; When the preset derivative alarms in the associated fault and the target preset fault alarm mode do not include the target fault alarm, and the sub-fault includes the target fault alarm, the target fault alarm is adjusted from the sub-fault to the associated fault.

6. The fault root cause alarm location method according to claim 1, characterized in that: The merging of the target root alarms in all the sub-faults to obtain a final root alarm includes at least one of the following: When the target root alarms in all the sub-faults are consistent, taking the target root alarm as the final root alarm; When the target root alarms in all the sub-faults are inconsistent, all target root alarms and all non-root alarms in all the sub-faults are obtained, and the intersection of all target root alarms and all non-root alarms is deleted from all the target root alarms to obtain a final root alarm.

7. A method for constructing a fault alarm mode, used to construct the preset fault alarm mode in the fault root cause alarm location method according to any one of claims 1 to 6; The fault alarm mode construction method includes: Acquire an alarm association rule, wherein the alarm association rule includes multiple parent alarms and child alarms directly associated with each parent alarm; Determine a target parent alarm from the multiple parent alarms, and filter out target child alarms that are directly and indirectly associated with the target parent alarm; The preset fault alarm mode is constructed according to the target parent alarm and the target sub-alarm, wherein the preset root alarm in the preset fault alarm mode is the target parent alarm, and the preset derived alarm in the preset fault alarm mode is the target sub-alarm.

8. The fault alarm mode construction method according to claim 7, characterized in that: After constructing the preset fault alarm mode according to the target parent alarm and the target child alarm, the fault alarm mode construction method further includes: Obtaining a simulated root alarm and a simulated derived alarm corresponding to the simulated root alarm; Constructing a simulated fault alarm mode according to the simulated root alarm and the simulated derived alarm; The plurality of preset fault alarm modes are updated according to the simulated fault alarm mode.

9. The fault alarm mode construction method according to claim 8, characterized in that: The updating of the plurality of preset fault alarm modes according to the simulated fault alarm mode includes at least one of the following: When the simulated root alarm is consistent with the preset root alarm, adding the derived alarms that exist in the simulated fault alarm mode but not in the preset fault alarm mode to the preset fault alarm mode; When the simulated root alarm is a subset of the preset root alarm, the simulated fault alarm mode is used as a new preset fault alarm mode, and the derived alarms that exist in the simulated fault alarm mode but not in the preset fault alarm mode are added to the preset fault alarm mode; When the preset root alarm is a subset of the simulated root alarm, taking the simulated fault alarm mode as a new preset fault alarm mode; When the simulated root alarm does not exist in the preset fault alarm mode, the simulated fault alarm mode is used as a new preset fault alarm mode.

10. The fault alarm mode construction method according to claim 7, characterized in that: After constructing the preset fault alarm mode according to the target parent alarm and the target child alarm, the fault alarm mode construction method further includes: Obtain historical fault alarms, and generate historical aggregated faults based on the historical fault alarms; Using artificial intelligence to mine historical aggregated faults to obtain historical fault alarm patterns; The plurality of preset fault alarm modes are updated according to the historical fault alarm modes.

11. The fault alarm mode construction method according to claim 10, characterized in that: The updating of the plurality of preset fault alarm modes according to the historical fault alarm mode includes at least one of the following: When the root alarm in the historical fault alarm pattern is consistent with the preset root alarm, adding the derived alarms that exist in the historical fault alarm pattern but not in the preset fault alarm pattern to the preset fault alarm pattern; When the root alarm in the historical fault alarm pattern is a subset of the preset root alarm, the historical fault alarm pattern is used as a new preset fault alarm pattern, and the derived alarms that exist in the historical fault alarm pattern but not in the preset fault alarm pattern are added to the preset fault alarm pattern; When the preset root alarm is a subset of the root alarms in the historical fault alarm pattern, taking the historical fault alarm pattern as a new preset fault alarm pattern; When the root alarm in the historical fault alarm pattern does not exist in the preset fault alarm pattern, the historical fault alarm pattern is used as a new preset fault alarm pattern.

12. A network device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for locating the root cause alarm of a fault according to any one of claims 1 to 6 and / or the method for constructing a fault alarm mode according to any one of claims 7 to 11 are implemented.

13. A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the fault root cause alarm locating method described in any one of claims 1 to 6 and / or the fault alarm mode construction method described in any one of claims 7 to 11.

14. A computer program product comprising a computer program or computer instructions, characterized in that The computer program or the computer instructions are stored in a computer-readable storage medium, the processor of the computer device reads the computer program or the computer instructions from the computer-readable storage medium, and the processor executes the computer program or the computer instructions, so that the computer device executes the fault root cause alarm locating method described in any one of claims 1 to 6 and / or the fault alarm mode construction method described in any one of claims 7 to 11.

Images