Alarm monitoring method, device and equipment and storage medium

Abstract

The application discloses an alarm monitoring method and device, equipment and a storage medium, relates to the technical field of computer networks, and is used for improving the efficiency of monitoring core network alarms. The method comprises the following steps: acquiring a plurality of alarm information of a core network, wherein the alarm information comprises a fault network element and associated resource information of the fault network element; determining an associated parameter between any two pieces of alarm information in the plurality of alarm information, wherein the associated parameter is used for determining the degree of association between the two pieces of alarm information; determining a target alarm information set from the plurality of alarm information based on the associated parameter between any two pieces of alarm information, wherein the associated parameter between any two pieces of alarm information in the target alarm information set is greater than a first preset threshold; and determining a target network element in which the core network has a fault based on the associated resource information of the fault network element included in each piece of alarm information in the target alarm information set. The application is applied to a scene of monitoring alarms.

Description

Technical Field

[0001] This application relates to the field of computer network technology, and in particular to an alarm monitoring method, apparatus, device and storage medium. Background Technology

[0002] In the core network framework of 5G (5th generation mobile communication technology), all network element functions have been virtualized based on the virtualized network function (VNF) architecture. By building different network element functional units on general-purpose hardware (such as physical machines), the decoupling of different functional units in the core network is achieved, thereby giving the 5G core network high flexibility and high scalability. However, this architecture makes the 5G core network architecture more complex than the 4G core network architecture.

[0003] Currently, when monitoring faults in the 5G core network, core network metrics (such as the number of access users, access success rate, and protocol data unit (PDU) session establishment success rate) and alarm data can be reported by the core network elements or the manufacturer's (Operations Management Center, OMC). Engineers can then analyze the core network metrics and alarm data and proactively intervene to repair faults when key metrics are abnormal or key alarms are detected.

[0004] However, when engineers analyze indicator and alarm data to monitor the core network, a large number of experienced engineers are required to summarize and comprehensively analyze various relevant information before troubleshooting can be carried out. This process is time-consuming, wastes human resources, and cannot meet the needs of the complex network environment of 5G core networks. Therefore, the efficiency of monitoring core network alarms is low. Summary of the Invention

[0005] This application provides an alarm monitoring method, apparatus, device, and storage medium to solve the technical problem that when monitoring the core network through engineers analyzing indicator data and alarm data, a large number of experienced engineers are required to summarize and comprehensively analyze various relevant information before fault handling can be carried out. This process is time-consuming, wastes human resources, and cannot meet the needs of the complex network environment of 5G core networks. This application aims to improve the efficiency of core network alarm monitoring.

[0006] To achieve the above objectives, this application adopts the following technical solution:

[0007] Firstly, an alarm monitoring method is provided, comprising: acquiring multiple alarm messages from the core network, the alarm messages including: a faulty network element and associated resource information of the faulty network element; determining a correlation parameter between any two alarm messages from the multiple alarm messages, the correlation parameter being used to determine the degree of correlation between the two alarm messages; based on the correlation parameter between any two alarm messages, determining a target alarm message set from the multiple alarm messages, wherein the correlation parameter between any two alarm messages from at least two alarm messages included in the target alarm message set is greater than a first preset threshold; and based on the associated resource information of the faulty network element included in each alarm message in the target alarm message set, determining the target network element in the core network where the fault has occurred.

[0008] In one possible implementation, the method further includes: based on a preset topology relationship, determining whether the faulty network element corresponding to the first alarm information in the target alarm information set interacts with the faulty network element corresponding to any other alarm information, wherein any other alarm information is an alarm information in the target alarm information set other than the first alarm information; if the faulty network element corresponding to the first alarm information does not interact with the faulty network element corresponding to any other alarm information, deleting the first alarm information from the target alarm information set.

[0009] In one possible implementation, the associated resource information includes bearer network elements, which are network elements used to implement the functions of the faulty network element; based on the associated resource information of the faulty network element included in each alarm information in the target alarm information set, the target network element in which the core network has failed is determined, including: if the target bearer network element corresponding to any alarm information in the target alarm information set fails within the target time period, the target network element in which the core network has failed is determined as the target bearer network element.

[0010] In one possible implementation, the method further includes: if it is determined that among multiple alarm messages there is an alarm message indicating abnormal power supply to the computer room, the cause of the core network failure is determined to be an abnormal power supply to the computer room.

[0011] In one possible implementation, the method further includes: determining the target service carried by multiple faulty network elements corresponding to the target alarm information set, wherein the multiple faulty network elements include the faulty network element included in each alarm information in the target alarm information set; inputting the target service into the target model, determining the target service indicator parameters of the target service within the target time period, wherein the target model is used to simulate the execution of the target service; and determining that the target service is abnormal if the target service indicator parameters are less than a second preset threshold or greater than a third preset threshold, wherein the second preset threshold is less than the third preset threshold.

[0012] In one possible implementation, the method further includes: if the target service is determined to be abnormal and no alarm information is received from the core network within a preset time period, the target service indicator parameters are determined based on the target model within the preset time period; if the target service indicator parameters are greater than or equal to a second preset threshold and less than or equal to a third preset threshold, the target service is determined to have returned to normal.

[0013] Secondly, an alarm monitoring device is provided, comprising: an acquisition unit and a determination unit; the acquisition unit is used to acquire multiple alarm messages from the core network, the alarm messages including: faulty network element and associated resource information of the faulty network element; the determination unit is used to determine the association parameter between any two alarm messages from the multiple alarm messages, the association parameter being used to determine the degree of association between the two alarm messages; the determination unit is further used to determine a target alarm message set from the multiple alarm messages based on the association parameter between any two alarm messages, wherein the association parameter between any two alarm messages included in the target alarm message set is greater than a first preset threshold; the determination unit is further used to determine the target network element in the core network where the fault has occurred based on the associated resource information of the faulty network element included in each alarm message in the target alarm message set.

[0014] In one possible implementation, the alarm monitoring device further includes a processing unit; a determining unit, which is further configured to determine, based on a preset topology relationship, whether the faulty network element corresponding to the first alarm information in the target alarm information set interacts with the faulty network element corresponding to any other alarm information, wherein any other alarm information is an alarm information in the target alarm information set other than the first alarm information; and a processing unit, which is configured to delete the first alarm information from the target alarm information set if the faulty network element corresponding to the first alarm information does not interact with the faulty network element corresponding to any other alarm information.

[0015] In one possible implementation, the associated resource information includes bearer network elements, which are network elements used to implement the functions of the faulty network element; the determining unit is further configured to determine the target network element that has failed in the core network as the target bearer network element when the target bearer network element corresponding to any alarm information in the target alarm information set fails within the target time period.

[0016] In one possible implementation, the determining unit is further configured to determine that the cause of the core network failure is an abnormal power supply to the data center when multiple alarm messages contain an alarm message indicating an abnormal power supply to the data center.

[0017] In one possible implementation, the determining unit is further configured to determine the target service carried by multiple faulty network elements corresponding to the target alarm information set, wherein the multiple faulty network elements include the faulty network element included in each alarm information in the target alarm information set; the determining unit is further configured to input the target service into the target model to determine the target service indicator parameters of the target service within the target time period, wherein the target model is used to simulate the execution of the target service; the determining unit is further configured to determine that the target service is abnormal if the target service indicator parameters are less than a second preset threshold or greater than a third preset threshold, wherein the second preset threshold is less than the third preset threshold.

[0018] In one possible implementation, the determining unit is further configured to, when determining that the target service is abnormal and no alarm information is received from the core network within a preset time period, determine the target service indicator parameters within the preset time period based on the target model; the determining unit is further configured to, when the target service indicator parameters are greater than or equal to a second preset threshold and less than or equal to a third preset threshold, determine that the target service has returned to normal.

[0019] Thirdly, an electronic device includes a processor and a memory; wherein the memory stores one or more programs, the one or more programs including computer-executable instructions, and when the electronic device is running, the processor executes the computer-executable instructions stored in the memory to cause the electronic device to perform an alarm monitoring method as described in the first aspect.

[0020] Fourthly, a computer-readable storage medium is provided for storing one or more programs, the one or more programs including instructions that, when executed by a computer, cause the computer to perform an alarm monitoring method as described in the first aspect.

[0021] This application provides an alarm monitoring method, apparatus, device, and storage medium, applicable to alarm monitoring scenarios. When alarm monitoring of the core network is required, multiple alarm messages from the core network can be acquired and input into a target algorithm to determine the correlation parameters between any two alarm messages. Further, based on the correlation parameters between any two alarm messages, a target alarm message set is determined from the multiple alarm messages where the correlation parameters between any two alarm messages are greater than a preset threshold. Then, based on the associated resource information of the faulty network element included in each alarm message in the target alarm message set, the target network element where the core network fault occurred is determined. That is, the larger the correlation parameter between two alarm messages, the greater the probability that these two alarm messages are generated due to the same fault. Therefore, alarm messages with a high degree of correlation among multiple alarm messages can be merged into the same alarm message set for unified analysis of the causes of core network faults.

[0022] The above method allows for the identification of a target alarm set from multiple alarm messages. Based on the associated resource information of the faulty network element included in each alarm message within this target alarm set, the target network element experiencing a core network failure can be determined. This solves the technical problem of requiring a large number of experienced engineers to summarize and comprehensively analyze various relevant information before fault handling can be performed when monitoring the core network using indicator and alarm data. This process is time-consuming, wastes human resources, and fails to meet the needs of the complex network environment of 5G core networks. Therefore, it improves the efficiency of core network alarm monitoring. Attached Figure Description

[0023] Figure 1 A schematic diagram of the structure of an alarm monitoring system provided for embodiments of this application. Figure 1 ;

[0024] Figure 2 A schematic diagram of the structure of an alarm monitoring system provided for embodiments of this application. Figure 2 ;

[0025] Figure 3 A flowchart illustrating an alarm monitoring method provided for embodiments of this application. Figure 1 ;

[0026] Figure 4 A schematic diagram of an FP-Tree provided for an embodiment of this application;

[0027] Figure 5 A flowchart illustrating an alarm monitoring method provided for embodiments of this application. Figure 2 ;

[0028] Figure 6 A schematic diagram of a cross-level topology of a 5G core network provided for an embodiment of this application;

[0029] Figure 7 A flowchart illustrating an alarm monitoring method provided for embodiments of this application. Figure 3 ;

[0030] Figure 8 A flowchart illustrating an alarm monitoring method provided for embodiments of this application. Figure 4 ;

[0031] Figure 9 A flowchart illustrating an alarm monitoring method provided for embodiments of this application. Figure 5 ;

[0032] Figure 10 A flowchart illustrating an alarm monitoring method provided for embodiments of this application. Figure 6 ;

[0033] Figure 11 A flowchart illustrating a core network alarm monitoring and analysis method provided for an embodiment of this application;

[0034] Figure 12 A schematic diagram of the structure of an alarm monitoring device provided for an embodiment of this application;

[0035] Figure 13 This is a schematic diagram of the structure of an electronic device provided as an embodiment of this application. Detailed Implementation

[0036] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0037] In the description of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. "And / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" and "multiple" refer to two or more. The terms "first," "second," etc., do not limit the quantity or order of execution, and "first," "second," etc., do not necessarily imply differences.

[0038] Currently, when monitoring faults in the 5G core network, core network metrics and alarm data can be reported by network elements or the manufacturer's OMC. Engineers can then analyze this data and proactively intervene to resolve faults when key metrics or alarms are detected. Furthermore, upon receiving user complaints, the operational status of equipment within the core network can be inspected to diagnose and address faults.

[0039] However, when engineers monitor the core network by analyzing indicator and alarm data, a large number of experienced engineers need to manually summarize and analyze various relevant information to determine the cause of the fault before troubleshooting can begin. This process is time-consuming, often resulting in delayed fault handling, wasted human resources, and an inability to meet the needs of the complex network environment of 5G core networks. Furthermore, responding to user complaints after they have been received can easily lead to user complaints and a poor user experience.

[0040] Specifically, when a core network failure occurs, it is often accompanied by a large amount of alarm data and abnormal indicator data. However, current monitoring methods lack the means to merge and aggregate alarms caused by the same failure, forcing maintenance personnel to spend a significant amount of time processing invalid alarm information, thus reducing operational efficiency. When a failure occurs, it is impossible to determine the scope of services affected by the failure to confirm the priority of failure handling. After maintenance personnel handle the failure, it is impossible to verify whether service operation has returned to normal. Furthermore, the system demands high skill levels from maintenance personnel, requiring them to be familiar with the core network's business processes and understand various data query methods to support timely analysis and handling of failures, resulting in high labor costs.

[0041] This application provides an alarm monitoring method. When alarm monitoring of the core network is required, multiple alarm messages from the core network can be acquired and input into a target algorithm to determine the correlation parameter between any two alarm messages. Further, based on the correlation parameter between any two alarm messages, a target alarm message set is determined from the multiple alarm messages where the correlation parameter between any two alarm messages is greater than a preset threshold. Then, based on the associated resource information of the faulty network element included in each alarm message in the target alarm message set, the target network element where the core network fault occurred is determined. That is, the larger the correlation parameter between two alarm messages, the greater the probability that these two alarm messages are generated due to the same fault. Therefore, alarm messages with a high degree of correlation among multiple alarm messages can be merged into the same alarm message set for unified analysis of the causes of core network faults.

[0042] The above method allows for the identification of a target alarm set from multiple alarm messages. Based on the associated resource information of the faulty network element included in each alarm message within this target alarm set, the target network element experiencing a core network failure can be determined. This solves the technical problem of requiring a large number of experienced engineers to summarize and comprehensively analyze various relevant information before fault handling can be performed when monitoring the core network using indicator and alarm data. This process is time-consuming, wastes human resources, and fails to meet the needs of the complex network environment of 5G core networks. Therefore, it improves the efficiency of core network alarm monitoring.

[0043] The alarm monitoring method provided in this application embodiment can be applied to alarm monitoring systems. Figure 1 A schematic diagram of an alarm monitoring system is shown. Figure 1 As shown, the alarm monitoring system 10 includes: electronic device 11 and core network 12. The electronic device 11 and core network 12 can be connected by wired or wireless means, and this embodiment of the invention does not limit the connection.

[0044] Electronic device 11 is used to acquire multiple alarm messages of core network 12 within a target time period, input the multiple alarm messages into a target algorithm to determine the correlation parameters between any two alarm messages, determine a target alarm message set from the multiple alarm messages based on the correlation parameters between any two alarm messages, and determine the faulty network element of core network 12 based on the associated resource information of the faulty network element included in each alarm message; core network 12 is used to generate alarm messages when a fault occurs.

[0045] Optionally, the electronic devices 11 can all be physical machines, such as base station equipment, desktop computers, servers, or server clusters composed of multiple servers. The core network 12 can be network equipment that connects mobile devices and various networks.

[0046] like Figure 2 As shown, the alarm monitoring system 20 includes: a fault monitoring module 21, a fault association aggregation module 22, a business impact judgment module 23, a fault root cause location module 24, a business recovery verification module 25, an AI algorithm training platform 26, and a scene orchestration platform 27.

[0047] The fault monitoring module 21 is used to monitor and identify alarm information in the core network, perform basic preprocessing operations such as standardization of alarm information and resource information association to support subsequent fault analysis and localization; the fault association and aggregation module 22 is used to identify core network faults and associate and aggregate core network faults through models and scenario processes output from the underlying AI algorithm platform and scenario orchestration platform to group faults of the same origin together; the service impact judgment module 23 is used to analyze the service scope affected by core network faults through service topology analysis and golden index analysis, and output specific service scope results and related judgment criteria.

[0048] The fault root cause localization module 24 is used to perform multi-dimensional analysis of the causes of core network faults by combining multi-level topology localization capabilities and cross-professional localization capabilities, and output the fault causes to assist operation and maintenance personnel in quickly judging the fault causes; the service recovery verification 25 is used to verify the key service indicators of the core network to check whether the service has returned to normal; the AI ​​algorithm training platform 26 is used to provide big data algorithm training capabilities (including algorithm management, training task management, and training result query functions) to mine historical alarms and performance data of the core network to support the fault correlation and localization of the core network; the scenario orchestration platform 27 is used to provide visual orchestration design capabilities (including fault scenario design and capability design).

[0049] It should be noted that common-source faults refer to faults caused by the same reason. Operations and maintenance personnel can configure algorithm and data training tasks on the AI ​​algorithm training platform 26. They can also define localization processes on the scenario orchestration platform 27 according to the characteristics of different core network scenarios.

[0050] The alarm monitoring method provided by an embodiment of this application is described below with reference to the accompanying drawings. Figure 3 As shown in the embodiment of this application, an alarm monitoring method is provided and applied to electronic devices. The method includes steps S201-S204:

[0051] S201. Obtain multiple alarm messages from the core network.

[0052] The alarm information includes: faulty network element, fault location information, and associated resource information of the faulty network element. The associated resource information includes at least one of the following: bearer network element, its own node (i.e., the node to which the network element belongs), its own resource pool (i.e., the resource pool to which the network element belongs), associated data center, and the node to which the network element belongs.

[0053] It is understandable that multiple alarm messages from the core network within a target time period can be obtained through electronic devices.

[0054] Optionally, multiple alarm data from the core network can be connected via a Kafka message queue (each alarm data includes faulty network element and fault location information), and the multiple alarm data can be standardized and associated with resource information.

[0055] Specifically, the standardization process involves standardizing the format of each alarm data from different vendors, including fields such as alarm standard name, network management alarm level, alarm logic classification, alarm logic subclass, impact of the event on services, and impact of the event on devices, to facilitate subsequent alarm analysis and processing.

[0056] The resource information association process is as follows: the faulty network element and fault location information included in each alarm data are associated with the resource database, and the associated resource information corresponding to each alarm data in the resource database is filled into the alarm data to obtain multiple alarm information to support subsequent analysis.

[0057] For example, the core network can be a 5G core network.

[0058] S202. Determine the correlation parameters between any two alarm messages among multiple alarm messages.

[0059] Among them, the correlation parameter is used to determine the degree of correlation between two alarm messages.

[0060] It is understandable that multiple alarm messages can be input into the target algorithm (i.e., alarm association model) through electronic devices to determine the association parameters between any two alarm messages.

[0061] Optionally, alarm data can be obtained from the alarm data pool, and the relationships between 5G core network alarms can be analyzed based on the Fpgrouth algorithm to obtain an alarm correlation model. Specifically, data pruning can be performed first, that is, based on resource correlation data, it can be determined whether there is a correlation between the various resources that generate alarm data within the same time period. If the resource correlation of alarm data is known, and a certain alarm data resource in the alarm item set has no correlation with other resources, then the feature values ​​of all alarms generated by that resource are deleted from the alarm item set, and the filtered alarm events are saved separately to generate a new alarm item set.

[0062] Furthermore, a Frequent Pattern Tree (FP-Tree) can be constructed. This involves combining the pruned alarm data based on alarm association time windows to form the original data itemsets. Then, based on the frequency of alarm occurrences, low-support alarm data is removed, and an FP-Tree is generated from the processed data. Frequent itemsets are then constructed by uniformly traversing each path in the FP-Tree and recording the frequent itemsets under each path.

[0063] For example, such as Figure 4 As shown, the resources for each alarm data can include: management plane communication anomaly between MP and SC, host computing service offline, physical machine Ethernet port offline, and port offline alarm. A1, B1, and C1 (similarly A1, B1, and C2, A1, B2, and C3, and A1, B3, and C4) constitute a path in the FP-Tree, and A1, B1, and C1 can form a frequent itemset. Therefore, in this application, A1 can be management plane communication anomaly between MP and SC, B1 can be host computing service offline, C1 can be physical machine Ethernet port offline, C2 can be port offline alarm, B2 can be physical machine Ethernet port offline, and C3 can be port offline alarm.

[0064] Furthermore, frequent itemset association analysis can be performed. After traversing and analyzing the frequent itemsets of the FP-Tree, the alarm correlation can be calculated based on the frequency of occurrence of frequent itemsets, and the confidence level can be confirmed. This allows for the analysis of the implicit correlations between alarms in the core network, in order to establish an alarm correlation model.

[0065] Optionally, the fault scenario information designed in the scenario orchestration platform can be compared based on conditions such as alarm title, alarm code, and alarm category of multiple alarm messages to confirm the fault scenario process that the alarm should enter. After completing the fault scenario identification, the association parameters between any two alarm messages among the multiple alarm messages are determined according to the alarm association model in the fault scenario, so as to associate and merge the alarm messages that meet the conditions.

[0066] S203. Based on the correlation parameters between any two alarm messages, determine the target alarm message set from multiple alarm messages.

[0067] Among them, the correlation parameter between any two alarm messages in the target alarm information set is greater than a first preset threshold. The larger the correlation parameter, the higher the frequency of any two alarm messages existing at the same time.

[0068] It is understandable that an electronic device can determine the target alarm information set from multiple alarm information based on the correlation parameters between any two alarm information.

[0069] It should be noted that the larger the correlation parameter between two alarm messages, the greater the correlation between the two alarm messages.

[0070] S204. Based on the associated resource information of the faulty network element included in each alarm message in the target alarm information set, determine the target network element in which the core network has failed.

[0071] It is understandable that the target network element experiencing a core network failure can be determined through electronic devices based on the associated resource information of the faulty network element included in each alarm message in the target alarm information set.

[0072] Optionally, the target network element in the core network that has experienced a fault can be determined based on the associated resource information of the faulty network element included in each alarm message in the target alarm information set (i.e., root cause localization of the alarm). Root cause localization includes cross-level topology fault localization and cross-disciplinary alarm localization.

[0073] In a design, such as Figure 5 As shown, the alarm monitoring method provided in this application embodiment further includes steps S301-S302 after step S203 and before step S204:

[0074] S301. Based on the preset topology relationship, determine whether the faulty network element corresponding to the first alarm information in the target alarm information set interacts with the faulty network element corresponding to any other alarm information.

[0075] Among them, any other alarm information is an alarm information in the target alarm information set other than the first alarm information.

[0076] For example, the preset topology can be a cross-level topology of the 5G core network. Figure 6 As shown, the cross-layer topology of the 5G core network includes four layers (namely VNF, Virtual Machine (VM), Network Function Virtualization Infrastructure (NFV Infrastructure, NFVI), and TOR / EOR). Specifically, VNF includes network element 1, VM includes network elements 2, 3, and 4, NFVI includes network elements 5 and 6, and TOR / EOR ​​includes network element 7. The dashed line connecting two network elements in the diagram indicates that there is data interaction between these two network elements.

[0077] It should be noted that the cross-level topology of the 5G core network is used to indicate the data interaction relationships between the various network elements included in the 5G core network.

[0078] S302. If the faulty network element corresponding to the first alarm information does not exchange data with any other faulty network element corresponding to any other alarm information, the first alarm information is deleted from the target alarm information set.

[0079] Optionally, after determining the target alarm information set, the alarm network elements in the target alarm information set that have no association relationship (i.e., data interaction relationship) with other network elements can be found according to the preset topology relationship, and they can be deleted from the target alarm information set.

[0080] One possible approach is to perform secondary analysis on the alarm information aggregated from the model based on the cross-level topology of the 5G core network, so as to remove alarm information that is obviously inconsistent with business logic and improve the accuracy of alarm aggregation.

[0081] In a design, such as Figure 7 As shown in the embodiment of this application, an alarm monitoring method is provided, and the associated resource information includes a bearer network element. The bearer network element is a network element used to implement the function of the faulty network element. The method in step S204 above specifically includes S401:

[0082] S401. If the target bearer network element corresponding to any alarm information in the target alarm information set fails within the target time period, the target network element in the core network that has failed shall be identified as the target bearer network element.

[0083] Optionally, when determining the cause of a core network failure through cross-level topology fault location, the bearer relationship between different network elements can be analyzed through the cross-level topology relationship of the core network. Specifically, the alarm information in the merged target alarm information set can be traversed to obtain the bearer network element corresponding to each alarm information, and the bearer network element information (including virtual machine information, host information, and physical machine information) of the bearer network element in the resource data can be queried based on the bearer network element.

[0084] Furthermore, after obtaining the bearer network element information, the system correlates and queries whether the bearer network element experienced a specified fault (e.g., virtual machine node offline) before and after the core network alarm occurred (i.e., within the target time period), thereby locating the faulty network element in the core network. If the target bearer network element corresponding to a certain alarm message experiences a specified fault within the target time period, then the target network element in the core network that experienced the fault is the target bearer network element.

[0085] For example, the bearer network element can be a virtual machine or a physical machine.

[0086] One possible approach is to analyze the bearer relationships between different network elements by examining the cross-level topology of the core network. This allows for the identification of the root cause of core network failures based on the failures of the bearer network elements, thereby improving the accuracy of fault cause identification.

[0087] In a design, such as Figure 8 As shown in the embodiment of this application, an alarm monitoring method is provided, the method further includes S501:

[0088] S501. If multiple alarm messages contain alarms indicating abnormal power supply to the computer room, determine that the cause of the core network failure is abnormal power supply to the computer room.

[0089] Optionally, when determining the cause of a core network failure through cross-disciplinary alarm location, the bearing relationship between the core network host and the environmental monitoring room can be checked (i.e., the room where the core network host is located can be obtained), and the time period in which the alarm occurred (i.e., the target time period) can be analyzed to determine whether the core network failure was caused by abnormal power supply in the room.

[0090] If multiple alarm messages contain alarms indicating abnormal power supply to the data center, then the cause of the core network failure is determined to be an abnormal power supply to the data center.

[0091] One possible implementation involves querying whether the data center where the core network host is located experienced a power outage or undervoltage alarm during the time period in which the alarm occurred. This helps determine whether the core network fault was caused by abnormal power supply in the data center, thereby improving the accuracy of fault cause identification.

[0092] In a design, such as Figure 9 As shown, the alarm monitoring method provided in this application embodiment further includes steps S601-S603 after step S202:

[0093] S601. Determine the target services carried by multiple faulty network elements corresponding to the target alarm information set.

[0094] Among them, multiple faulty network elements include the faulty network elements included in each alarm message in the target alarm information set.

[0095] Optionally, the scope of services affected by the fault can be determined by querying the subnet slice relationships of the core network. Specifically, firstly, based on the unique identifier (ID) of the faulty VNF network element, the association between the VNF network element and the core network subnet slice information in the resource data is queried to obtain the core network subnet slice ID to which the VNF network element belongs. Then, based on the queried core network subnet slice ID, the target services carried by the faulty network element are queried to determine the scope of service impact of the fault.

[0096] S602. Input the target business into the target model and determine the target business indicator parameters within the target time period.

[0097] Among them, the target model (i.e. the golden ratio model) is used to simulate the execution of the target business.

[0098] Optionally, performance data of the business can be obtained from the performance data pool, and the business indicator parameters of the business within a preset time period can be analyzed based on the k-means clustering algorithm (K-means) to obtain the golden indicator model.

[0099] Specifically, an initial K-cluster can be set up, which involves selecting a subset of performance metrics from the performance data pool when the business is running normally, as the initial K-cluster. Further, iterative analysis is performed, which involves grouping and iteratively analyzing the performance data to be trained based on the initial K-cluster samples, analyzing the most recent value of the initial K-cluster in each sample set. Then, based on the analysis results of each sample, the cluster mean vector is updated, and this step is repeated until the mean vector no longer changes.

[0100] Furthermore, abnormal fluctuation points are output. Based on the analysis results of each sample, data outside the mean vector range are identified as abnormal fluctuation points, and the corresponding indicator values ​​and times are recorded, generating abnormal fluctuation events. The relationship between abnormal fluctuations and alarms is then analyzed using the Fpgrouth algorithm. After the analysis is complete, a golden indicator model can be output, illustrating the business indicators directly affected by alarms.

[0101] Optionally, after confirming the scope of the business impact of the fault, the potentially affected business can be input into the Golden Index Model. Based on the alarm characteristics of the fault, the business index parameters of the Golden Index during the fault occurrence period (i.e., within the target time period) can be queried from the performance data pool according to the Golden Index Model, thereby confirming whether the fault actually affects the business.

[0102] S603. If the target business indicator parameter is less than the second preset threshold or greater than the third preset threshold, the target business is determined to be abnormal.

[0103] The second preset threshold is less than the third preset threshold.

[0104] One possible implementation involves using the K-means algorithm to detect service metrics, enabling anomaly detection of key metrics and analysis of the relationship between alarms and metrics to determine whether a fault affects services and improve the accuracy of core network monitoring.

[0105] In a design, such as Figure 10 As shown, the alarm monitoring method provided in this application embodiment further includes steps S701-S702 after step S603:

[0106] S701. If the target service is determined to be abnormal and no alarm information is received from the core network within a preset time period, the target service indicator parameters for the target service within the preset time period are determined based on the target model.

[0107] Among them, multiple faulty network elements include the faulty network elements included in each alarm message in the target alarm information set.

[0108] Optionally, after the alarm in the core network is restored, the target service indicator value (i.e., target service indicator parameter) for the next period (i.e., preset time period) can be queried through the golden indicator model to confirm whether the indicator value has returned to normal, thereby determining whether the target service has returned to normal.

[0109] S702. If the target business indicator parameter is greater than or equal to the second preset threshold and less than or equal to the third preset threshold, the target business is determined to have returned to normal.

[0110] like Figure 11 As shown, before acquiring alarm information from the core network, data mining training can be performed on the AI ​​algorithm training platform. Specifically, based on the algorithms and training tasks set by the operations and maintenance personnel on the AI ​​algorithm training platform, specified data can be periodically pulled from the alarm data pool and performance data pool, and data mining training (including alarm relationship mining and performance indicator relationship mining) can be performed. Furthermore, based on the data mining training results, alarm correlation models and golden indicator models are output to support the fault location design of the core network.

[0111] Capabilities can be designed and orchestrated on the scene orchestration platform. Specifically, the alarm correlation model and golden index model output by the AI ​​algorithm training platform can be registered to the capability design center of the scene orchestration platform to form standard, callable capability components.

[0112] Fault scenarios can be designed on the scenario orchestration platform. Specifically, AI algorithm capabilities and other capabilities can be assembled to form fault scenario rules based on specific fault scenarios of different core networks. Fault scenarios (including alarm recognition conditions and the algorithm capabilities to be invoked) can be set on the scenario orchestration platform to support scenario-based fault analysis. Fault scenarios can also be published, loading the designed fault scenarios into the rule engine to support fault correlation aggregation and root cause localization in the core network.

[0113] When an alarm occurs in the core network, alarm monitoring can be performed. The monitored alarm data can be standardized and associated with information resources to obtain alarm information. Then, fault scenario identification is performed, and the alarm information is aggregated based on an AI model of the fault scenario. The aggregated alarm information is then analyzed for bearer relationships to obtain merged alarm information. Furthermore, the root cause of the fault is located in the merged alarm information through cross-layer topology positioning and cross-professional alarm positioning. Next, business impact analysis is performed on the merged alarm information to determine the scope of business impact. Performance data from the performance data pool is used to perform golden ratio analysis on the services within the impact range, and the alarm analysis results are output. After the alarm is cleared, performance data from the performance data pool can be used to verify business recovery and output the alarm analysis results.

[0114] This application provides an alarm monitoring method. To address the shortcomings of existing core network fault monitoring methods, this application uses a big data technology-based AI training platform to learn, mine, and analyze historical fault data of the 5G core network. It also uses a scenario orchestration platform to design analysis processes for different 5G core network faults, thereby supporting alarm identification and monitoring, fault correlation aggregation, service impact judgment, fault root cause location, and service recovery verification under different core network fault scenarios, supplemented by multi-dimensional analysis and handling methods.

[0115] Specifically, based on the Fpgrouth algorithm and data correlation analysis, the actual network resource carrying relationships are introduced, increasing the accuracy and availability of alarm correlation and merging. The K-means algorithm is used to detect anomalies in key indicators and analyze the relationship between alarms and indicators. Core network fault location is performed based on the carrying relationships between different levels of network elements. Based on fault location, and combined with service configuration data, the scope of services affected by the fault is analyzed, better supporting the maintenance of key services. This achieves automatic fault analysis, automatic merging, automatic location, and automatic verification in the 5G core network, improving operational efficiency.

[0116] The foregoing mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the units and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0117] This application embodiment can divide an alarm monitoring method into functional modules based on the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0118] Figure 12 This is a schematic diagram of an alarm monitoring device provided in an embodiment of this application. Figure 12 As shown, an alarm monitoring device 40 is used to monitor the efficiency of core network alarms, for example, for performing... Figure 3 An alarm monitoring method is shown. The alarm monitoring device 40 includes: an acquisition unit 401 and a determination unit 402.

[0119] The acquisition unit 401 is used to acquire multiple alarm messages from the core network. The alarm messages include: faulty network elements and associated resource information of the faulty network elements.

[0120] The determining unit 402 is used to determine the correlation parameters between any two alarm messages among multiple alarm messages. The correlation parameters are used to determine the degree of correlation between the two alarm messages.

[0121] The determining unit 402 is further configured to determine a target alarm information set from multiple alarm information based on the correlation parameters between any two alarm information, wherein the correlation parameters between any two alarm information among at least two alarm information included in the target alarm information set are greater than a first preset threshold.

[0122] The determining unit 402 is also used to determine the target network element in which the core network has failed based on the associated resource information of the faulty network element included in each alarm information in the target alarm information set.

[0123] In one possible implementation, the alarm monitoring device further includes a processing unit 403; a determining unit 402 is further configured to determine, based on a preset topology relationship, whether the faulty network element corresponding to the first alarm information in the target alarm information set interacts with the faulty network element corresponding to any other alarm information, wherein any other alarm information is an alarm information in the target alarm information set other than the first alarm information; and the processing unit 403 is configured to delete the first alarm information from the target alarm information set if the faulty network element corresponding to the first alarm information does not interact with the faulty network element corresponding to any other alarm information.

[0124] In one possible implementation, the associated resource information includes bearer network elements, which are network elements used to implement the functions of faulty network elements; the determining unit 402 is also used to determine the target network element that has failed in the core network as the target bearer network element when the target bearer network element corresponding to any alarm information in the target alarm information set fails within the target time period.

[0125] In one possible implementation, the determining unit 402 is further configured to determine that the cause of the core network failure is an abnormal power supply to the computer room when multiple alarm messages contain an alarm message indicating an abnormal power supply to the computer room.

[0126] In one possible implementation, the determining unit 402 is further configured to determine the target service carried by multiple faulty network elements corresponding to the target alarm information set, wherein the multiple faulty network elements include the faulty network element included in each alarm information in the target alarm information set; the determining unit 402 is further configured to input the target service into the target model to determine the target service indicator parameters of the target service within the target time period, wherein the target model is used to simulate the execution of the target service; the determining unit 402 is further configured to determine that the target service is abnormal if the target service indicator parameters are less than a second preset threshold or greater than a third preset threshold, wherein the second preset threshold is less than the third preset threshold.

[0127] In one possible implementation, the determining unit 402 is further configured to, when determining that the target service is abnormal and no alarm information is received from the core network within a preset time period, determine the target service indicator parameters within the preset time period based on the target model; the determining unit 402 is further configured to, when the target service indicator parameters are greater than or equal to a second preset threshold and less than or equal to a third preset threshold, determine that the target service has returned to normal.

[0128] In the case where the functions of the integrated modules described above are implemented in hardware, this application provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 13 As shown, an electronic device 60 is used to improve the efficiency of monitoring core network alarms, for example, for performing... Figure 3 The diagram illustrates an alarm monitoring method. The electronic device 60 includes a processor 601, a memory 602, and a bus 603. The processor 601 and the memory 602 are connected via the bus 603.

[0129] Processor 601 is the control center of the communication device. It can be a single processor or a collective term for multiple processing elements. For example, processor 601 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.

[0130] As one embodiment, processor 601 may include one or more CPUs, for example Figure 13 CPU 0 and CPU 1 are shown in the diagram.

[0131] The memory 602 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0132] As one possible implementation, the memory 602 can exist independently of the processor 601. The memory 602 can be connected to the processor 601 via a bus 603 and is used to store instructions or program code. When the processor 601 calls and executes the instructions or program code stored in the memory 602, it can implement the alarm monitoring method provided in this embodiment of the application.

[0133] In another possible implementation, the memory 602 can also be integrated with the processor 601.

[0134] Bus 603 can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 13 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0135] It should be pointed out that, Figure 13 The structure shown does not constitute a limitation on the electronic device 60. Except... Figure 13 In addition to the components shown, the electronic device 60 may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0136] As an example, combined Figure 12 The functions implemented by the acquisition unit 401, the determination unit 402, and the processing unit 403 in the alarm monitoring device 40 are the same as those of the acquisition unit 401, the determination unit 402, and the processing unit 403. Figure 13 The processor 601 in it has the same function.

[0137] Optional, such as Figure 13 As shown, the electronic device 60 provided in this application embodiment may further include a communication interface 604.

[0138] Communication interface 604 is used to connect with other devices via a communication network. This communication network can be Ethernet, a wireless access network, a wireless local area network (WLAN), etc. Communication interface 604 may include a receiving unit for receiving data and a transmitting unit for transmitting data.

[0139] In one design, the communication interface in the electronic device provided in this application embodiment can also be integrated into the processor.

[0140] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional units is used as an example. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0141] This application also provides a computer-readable storage medium storing instructions. When a computer executes these instructions, the computer performs each step of the method flow shown in the above-described method embodiments.

[0142] Embodiments of this application provide a computer program product containing instructions that, when executed on a computer, cause the computer to perform an alarm monitoring method as described in the above method embodiments.

[0143] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), registers, hard disks, optical fibers, compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing, or any other form of computer-readable storage medium in the art.

[0144] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and storage medium can reside within an application-specific integrated circuit (ASIC).

[0145] In the embodiments of this application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0146] Since the electronic devices, computer-readable storage media, and computer program products in the embodiments of this application can be applied to the above methods, the technical effects they can achieve can also be referred to the above method embodiments. The embodiments of this application will not be repeated here.

[0147] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be covered within the scope of protection of this application.

Claims

1. An alarm monitoring method, characterized in that, The method includes: Obtain multiple alarm messages from the core network, including: faulty network element and associated resource information of the faulty network element; Determine the correlation parameter between any two alarm messages from the plurality of alarm messages, wherein the correlation parameter is used to determine the degree of correlation between the two alarm messages; Based on the correlation parameters between any two alarm messages, a target alarm message set is determined from the multiple alarm messages, wherein the correlation parameters between any two alarm messages in the target alarm message set are greater than a first preset threshold. Based on the associated resource information of the faulty network element included in each alarm information in the target alarm information set, the target network element in which the core network has failed is determined. The associated resource information includes the bearer network element, which is a network element used to implement the function of the faulty network element. The process of determining the target network element where the core network has failed, based on the associated resource information of the faulty network element included in each alarm message in the target alarm information set, includes: If a target bearer network element corresponding to any alarm message in the target alarm information set experiences a specified fault within a target time period, the target network element in which the core network fault occurred is determined to be the target bearer network element, and the target time period is the time period during which the alarm of any alarm message occurred. Determine the target service carried by multiple faulty network elements corresponding to the target alarm information set, wherein the multiple faulty network elements include the faulty network element included in each alarm information in the target alarm information set; The target business is input into the target model to determine the target business indicator parameters within the target time period. The target model is used to simulate the execution of the target business. If the target business indicator parameter is less than a second preset threshold or greater than a third preset threshold, the target business is determined to be abnormal, wherein the second preset threshold is less than the third preset threshold. If the target service is determined to be abnormal and no alarm information is received from the core network within a preset time period, the target service indicator parameters for the target service within the preset time period are determined based on the target model. If the target service indicator parameter is greater than or equal to the second preset threshold and less than or equal to the third preset threshold, the target service is determined to have returned to normal.

2. The method according to claim 1, characterized in that, The method further includes: Based on the preset topology, it is determined whether the faulty network element corresponding to the first alarm information in the target alarm information set interacts with the faulty network element corresponding to any other alarm information, wherein any other alarm information is an alarm information in the target alarm information set other than the first alarm information. If there is no data exchange between the faulty network element corresponding to the first alarm information and the faulty network element corresponding to any other alarm information, the first alarm information is deleted from the target alarm information set.

3. The method according to claim 1 or 2, characterized in that, The method further includes: If it is determined that among the multiple alarm messages there is an alarm message about abnormal power supply to the computer room, the cause of the core network failure is determined to be abnormal power supply to the computer room.

4. An alarm monitoring device, characterized in that, The alarm monitoring device includes: an acquisition unit and a determination unit; The acquisition unit is used to acquire multiple alarm messages from the core network, including: faulty network element and associated resource information of the faulty network element; The determining unit is used to determine the correlation parameter between any two alarm messages among the multiple alarm messages, and the correlation parameter is used to determine the degree of correlation between the two alarm messages; The determining unit is further configured to determine a target alarm information set from the plurality of alarm information based on the correlation parameters between any two alarm information, wherein the correlation parameters between any two alarm information among at least two alarm information included in the target alarm information set are greater than a first preset threshold. The determining unit is further configured to determine the target network element in which the core network has failed based on the associated resource information of the faulty network element included in each alarm information in the target alarm information set, wherein the associated resource information includes a bearer network element, and the bearer network element is a network element used to implement the function of the faulty network element; The determining unit is further configured to determine the target network element in the core network that has the specified fault as the target network element when the target bearer network element corresponding to any alarm information in the target alarm information set has a specified fault within the target time period, wherein the target time period is the time period during which the alarm of any alarm information occurs; The determining unit is further configured to determine the target service carried by multiple faulty network elements corresponding to the target alarm information set, wherein the multiple faulty network elements include the faulty network element included in each alarm information in the target alarm information set; The determining unit is further configured to input the target service into the target model, determine the target service indicator parameters of the target service within the target time period, and the target model is used to simulate the execution of the target service; The determining unit is further configured to determine that the target business is abnormal when the target business indicator parameter is less than a second preset threshold or greater than a third preset threshold, wherein the second preset threshold is less than the third preset threshold. The determining unit is further configured to, when determining that the target service is abnormal and no alarm information from the core network is received within a preset time period, determine the target service indicator parameters of the target service within the preset time period based on the target model. The determining unit is further configured to determine that the target service has returned to normal when the target service indicator parameter is greater than or equal to the second preset threshold and less than or equal to the third preset threshold.

5. The alarm monitoring device according to claim 4, characterized in that, The alarm monitoring device also includes a processing unit; The determining unit is further configured to determine, based on a preset topology relationship, whether the faulty network element corresponding to the first alarm information in the target alarm information set interacts with the faulty network element corresponding to any other alarm information, wherein any other alarm information is an alarm information in the target alarm information set other than the first alarm information. The processing unit is configured to delete the first alarm information from the target alarm information set when there is no data exchange between the faulty network element corresponding to the first alarm information and the faulty network element corresponding to any other alarm information.

6. The alarm monitoring device according to claim 4 or 5, characterized in that, The determining unit is further configured to determine, if it is determined that among the multiple alarm messages there is an alarm message indicating abnormal power supply to the computer room, the cause of the core network failure is an abnormal power supply to the computer room.

7. An electronic device, characterized in that, include: Processor and memory; The memory is used to store one or more programs, the one or more programs including computer execution instructions. When the electronic device is running, the processor executes the computer execution instructions stored in the memory to cause the electronic device to perform an alarm monitoring method according to any one of claims 1-3.

8. A computer-readable storage medium for storing one or more programs, characterized in that, The one or more programs include instructions that, when executed by a computer, cause the computer to perform an alarm monitoring method as described in any one of claims 1-3.

Images