A fault handling method and system based on network alarm association

Abstract

The present application discloses a fault handling method and system based on network alarm association, the method includes: obtaining alarm information data by performing information identification based on a number of acquired network alarm information within a preset time period, and each network alarm information is associated with an alarm identification identifier; performing data preprocessing on the alarm information data to obtain a number of different target alarm information; sending different target alarm information to a preset alarm association judgment model to obtain the associated judgment information corresponding to different target alarm information according to the alarm identification identifier; performing fault identification and judgment on different target alarm information based on the associated judgment information to obtain the corresponding business interruption judgment result; generating a number of fault handling work orders based on a number of different target alarm information, associated judgment information and corresponding business interruption judgment results, and sending the number of fault handling work orders to the corresponding maintenance user terminal according to the preset fault dispatching rules. The present application has the effect of improving the fault handling efficiency of network alarms.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a fault handling method and system based on network alarm association. Background Art

[0002] With the rapid development and widespread application of network technologies such as artificial intelligence and the Internet of Things, various hardware devices and software systems in data network systems generate a large number of network alarm information every day. After receiving the network alarm information, maintenance personnel need to check each network alarm information one by one from a large amount of network alarm information to investigate the cause of the failure of the network alarm information and take troubleshooting measures.

[0003] However, due to the huge amount of network alarm information, and the need to consider whether a network alarm information is related to other network alarm information when troubleshooting the network alarm information, it interferes with the network fault troubleshooting work of maintenance personnel and increases the difficulty of troubleshooting. In addition, because manual troubleshooting of network alarm information is prone to omissions and low screening efficiency, the time for troubleshooting is further extended. Therefore, there is a defect of low efficiency in troubleshooting network alarms, which urgently needs to be improved. Summary of the invention

[0004] In order to improve the efficiency of network alarm fault handling, the present application provides a fault handling method and system based on network alarm association.

[0005] In the first aspect, the invention objective of the present application is achieved by adopting the following technical solutions:

[0006] A fault handling method based on network alarm association, comprising:

[0007] Performing information identification based on a plurality of network alarm information obtained within a preset time period to obtain alarm information data, wherein each of the network alarm information is associated with an alarm identification identifier;

[0008] Performing data preprocessing on the warning information data to obtain a plurality of different target warning information; sending the different target warning information to a preset warning association judgment model to obtain association judgment information corresponding to different target warning information according to the warning identification identifier;

[0009] Based on the association judgment information, performing fault identification and judgment on the different target alarm information to obtain a corresponding service interruption judgment result;

[0010] A plurality of fault handling work orders are generated based on a plurality of different target alarm information, associated judgment information and corresponding service interruption judgment results, and the plurality of fault handling work orders are sent to corresponding maintenance user terminals according to preset fault dispatching rules.

[0011] By adopting the above technical scheme, a number of network alarm information of a network communication system (i.e., a network system that outputs network alarm information) is obtained within a specified time period. Since network alarm information may be repeatedly pushed, the network alarm information is complicated, invalid alarms exist, etc., and the network alarm information of various types of equipment in the network system of the Internet of Things needs to be distinguished according to the actual equipment type before fault determination is performed to improve the efficiency of fault determination of the network alarm information; therefore, it is necessary to perform information identification and extraction on the obtained number of network alarm information to preliminarily screen out the invalid network alarm information and obtain alarm information data. An alarm identification identifier is associated with each network alarm information, and the alarm identification identifier is used to characterize the content of the network alarm information and the equipment type information; then, data processing is performed on the number of alarm information data: data preprocessing such as data deduplication and filtering is performed to obtain the target alarm information, which is beneficial to reduce the calculation amount of the alarm association judgment model.

[0012] Furthermore, in order to establish and obtain the correlation relationship between several target alarm information, several target alarm information are sent to the alarm correlation judgment model. The alarm correlation judgment model performs fault judgment on the correlation relationship between several target alarm information and outputs the corresponding business interruption judgment result. The business interruption judgment result is used to characterize the fault severity of the target alarm information and whether it will cause business interruption to the current network system; then, based on several different target alarm information, business interruption judgment results and other information, a fault handling work order is generated, and then the work order is dispatched to the corresponding maintenance user terminal. The maintenance user terminal is connected to maintenance personnel with corresponding maintenance professional skills, which is convenient to operate and improves the overall fault handling efficiency of network alarms.

[0013] In a preferred example of the present application, the network alarm information is generated by a network element of at least one target network device; after the fault identification and determination is performed on the different target alarm information based on the association determination information to obtain the corresponding service interruption determination result, the method includes:

[0014] Obtain a network element relationship tree of each target network device, wherein the network element relationship tree is generated according to the subordinate relationship of each network element on the target network device; the network element relationship tree includes a root node and multiple levels of leaf nodes; the root node represents the target network device, each level of leaf nodes represents the network element on the target network device, and each level of leaf nodes is subordinate to the upper level leaf node connected thereto;

[0015] In the obtained network element relationship tree, the target alarm information is associated with the corresponding root node or leaf node to form an alarm information tree of each target network device;

[0016] Acquire a business system topology diagram, wherein the business system topology diagram includes a plurality of business nodes and association relationships between the business nodes;

[0017] Based on the business system topology diagram, the business topology relationship of each target network device is obtained; based on the preset node matching rules and the business interruption judgment results corresponding to different target alarm information, the alarm information trees of each target network device are connected to form a visual business judgment fault diagram.

[0018] By adopting the above technical solution, the network element relationship tree represents the subordinate relationship of each network element on the target network device, so that the number of network elements on each target network device and the subordinate relationship between each network element can be understood through the network element relationship tree of the target network device, which is beneficial to calculate the impact scope of the failure and the causal relationship between the failures of each network element when a certain target network device fails.

[0019] Specifically, in the obtained network element relationship tree, the network element represented by the leaf node of each level is subordinate to the network element represented by the leaf node of the upper level to which it is connected. For example, the target network equipment includes a chassis and a board, and the board includes a physical interface, a communication interface and a logical interface, etc. The target alarm information is associated with the network element relationship tree to form an alarm information tree that specifically displays the network element location of the alarm information, so as to facilitate the associated display of multiple target alarm information; then the business system topology diagram of the multiple target network devices is obtained to obtain the number of business nodes and the association relationship between each business node, so as to facilitate the matching of business nodes based on the business topology relationship of each target network device in the business system topology diagram; in order to facilitate the review and analysis of the business interruption results in multiple target alarm information, the alarm information trees of each target network device are connected to form a business judgment fault diagram corresponding to the business interruption judgment results of multiple target alarm information; the business interruption judgment results and the target alarm information of each target network device can be quickly obtained through the business judgment fault diagram.

[0020] In a preferred example of the present application, the associated judgment information includes associated alarm information; and the performing of fault identification and judgment on the different target alarm information based on the associated judgment information to obtain a corresponding service interruption judgment result specifically includes:

[0021] Calculating the probability of occurrence of the corresponding target warning information based on the association judgment information to obtain a warning probability;

[0022] When the alarm probability is greater than or equal to a preset probability threshold, the preset alarm information database obtains a first service interruption determination result according to the corresponding target alarm information;

[0023] When the alarm probability is less than a preset probability threshold, the service interruption probability of the corresponding target alarm information is calculated, and a second service interruption determination result of the target alarm information is obtained according to the value of the service interruption probability;

[0024] The first service interruption determination result or the second service interruption determination result is used as the service interruption determination result corresponding to the target alarm information.

[0025] By adopting the above technical solution, the alarm information database stores historical target alarm information based on whether different target alarm information will cause service interruption, and the corresponding service interruption determination probability; for target alarm information with a higher alarm probability, in order to facilitate the determination of its service interruption probability, the target alarm information with an alarm probability greater than or equal to the probability threshold is directly compared with the historical target alarm information in the alarm information database, and a first service interruption determination result is output; for target alarm information with an alarm probability less than the probability threshold, the corresponding service interruption probability is further calculated, and a second service interruption determination result of the target alarm information is output according to the numerical value of the service interruption probability, thereby facilitating fault determination of the target alarm information of multiple network elements of the target network device, which is beneficial to improving the calculation and determination efficiency of network fault determination.

[0026] In a preferred example of the present application, the service interruption determination result includes a service interruption fault; the service interruption determination result corresponding to the preset node matching rule and different target alarm information is connected to form a visualized service determination fault diagram, and further includes:

[0027] When a service interruption determination result of a service interruption fault is obtained, target alarm information related to the service interruption fault is determined as fault alarm information; and several target alarm information having a causal relationship with the fault alarm information is identified and obtained in the visualized service determination fault graph;

[0028] According to the business contents of the fault alarm information and the corresponding target alarm information with causal relationships, the corresponding business work contents are listed; according to the corresponding business work contents, the business processes and business associations are determined, and a preliminary business work model is formulated and generated;

[0029] The visualized business judgment fault diagram is associated with the preliminary business work model to generate a visualized business interruption scenario simulation model.

[0030] By adopting the above technical scheme, in order to facilitate the visual scenario simulation of the service interruption failure of the network communication system, and intelligently diagnose the fault alarm information of the root cause of the fault and the network alarm information generated by the fault alarm information; it is necessary to diagnose and analyze the causal relationship between the fault alarm information and the fault alarm information of other network elements or target network devices when the fault occurs, so that maintenance personnel can troubleshoot a certain fault point within a timestamp range corresponding to a preset time or a preset equipment area when performing fault maintenance work; the preliminary business work model is used to indicate the business association content between the business work nodes between several target network devices and corresponding network elements: such as business causal relationship and business subordination. According to the preliminary business work model, it can be obtained whether there is a fault business association between several target alarm information, so as to associate the business judgment fault diagram with the preliminary business work model, and obtain a visual business interruption scenario simulation model including business association information, business process information and fault causal information, which is convenient for maintenance personnel to perform fault maintenance and fault cause analysis, and quickly exceed the root fault information in the target alarm information.

[0031] In a preferred example of the present application: the data preprocessing of the warning information data to obtain a plurality of different target warning information specifically includes:

[0032] Calculating the similarity between the plurality of alarm information data by a similarity algorithm to obtain a similarity data group of each network alarm information;

[0033] Filter the alarm information data and the corresponding network alarm information whose similarity data is higher than a preset similarity threshold;

[0034] The warning information data within the preset time period is preprocessed in sequence for format standardization cleaning, obvious logical error cleaning, non-required data cleaning and key information missing cleaning to obtain several different target warning information.

[0035] By adopting the above technical scheme, for repeated alarm information data received within the same specified time period, in order to reduce the computational complexity of data processing, firstly, based on the similarity algorithm, network alarm information with the same or very high similarity is found to obtain the similarity data group of the corresponding network alarm information, and two or more network alarm information with the same similarity are deduplicated, and then the multiple alarm information data after deduplication are sequentially cleaned for format standardization, obvious logical errors, non-required data and missing key information, so as to screen out the more valuable network alarm information that may cause business interruption from a large amount of complex network alarm information, and facilitate fault analysis and processing of the network alarm information.

[0036] In the second aspect, the invention objective of the present application is achieved by adopting the following technical solutions:

[0037] A fault handling system based on network alarm association, comprising: a fault handling method based on network alarm association as described above, the system comprising:

[0038] An alarm information acquisition module, used to obtain alarm information data by performing information identification based on a number of acquired network alarm information within a preset time period, each of the network alarm information is associated with an alarm identification identifier;

[0039] The association judgment matching module is used to perform data preprocessing on the warning information data to obtain a plurality of different target warning information; send the different target warning information to a preset warning association judgment model to obtain the association judgment information corresponding to the different target warning information according to the warning identification identifier;

[0040] A fault identification and determination module, configured to perform fault identification and determination on the different target alarm information based on the associated determination information to obtain a corresponding service interruption determination result;

[0041] The fault work order dispatching module is used to generate a number of fault handling work orders based on a number of different target alarm information, associated judgment information and corresponding business interruption judgment results, and send the several fault handling work orders to the corresponding maintenance user terminals according to preset fault order dispatching rules.

[0042] By adopting the above technical scheme, information identification and extraction are performed on several obtained network alarm information to preliminarily screen out invalid network alarm information and obtain alarm information data. An alarm identification identifier is associated with each network alarm information, and the alarm identification identifier is used to characterize the content and device type information of the network alarm information. Then, data processing is performed on several alarm information data: data preprocessing such as data deduplication and filtering is performed to obtain target alarm information, which is beneficial to reduce the computational complexity of the alarm association judgment model.

[0043] Furthermore, in order to establish and obtain the correlation relationship between several target alarm information, several target alarm information are sent to the alarm correlation judgment model. The alarm correlation judgment model performs fault judgment on the correlation relationship between several target alarm information and outputs the corresponding business interruption judgment result. The business interruption judgment result is used to characterize the fault severity of the target alarm information and whether it will cause business interruption to the current network system; then, based on several different target alarm information, business interruption judgment results and other information, a fault handling work order is generated, and then the work order is dispatched to the corresponding maintenance user terminal. The maintenance user terminal is connected to maintenance personnel with corresponding maintenance professional skills, which is convenient to operate and improves the overall fault handling efficiency of network alarms.

[0044] In a preferred example of the present application: the fault identification and determination module includes:

[0045] An alarm probability calculation submodule, used to calculate the probability of occurrence of the corresponding target alarm information based on the association judgment information to obtain the alarm probability;

[0046] A first interruption determination submodule, configured to obtain a first service interruption determination result from a preset alarm information database according to corresponding target alarm information when the alarm probability is greater than or equal to a preset probability threshold;

[0047] A second interruption determination submodule, configured to calculate the service interruption probability of the corresponding target alarm information when the alarm probability is less than a preset probability threshold, and obtain a second service interruption determination result of the target alarm information according to the value of the service interruption probability;

[0048] The result output submodule is used to use the first service interruption determination result or the second service interruption determination result as the service interruption determination result corresponding to the target alarm information.

[0049] By adopting the above technical solution, the alarm information database stores historical target alarm information based on whether different target alarm information will cause service interruption, and the corresponding service interruption determination probability; for target alarm information with a higher alarm probability, in order to facilitate the determination of its service interruption probability, the target alarm information with an alarm probability greater than or equal to the probability threshold is directly compared with the historical target alarm information in the alarm information database, and a first service interruption determination result is output; for target alarm information with an alarm probability less than the probability threshold, the corresponding service interruption probability is further calculated, and a second service interruption determination result of the target alarm information is output according to the numerical value of the service interruption probability, thereby facilitating fault determination of the target alarm information of multiple network elements of the target network device, which is beneficial to improving the calculation and determination efficiency of network fault determination.

[0050] In a preferred example of the present application: the association judgment and matching module includes:

[0051] A similarity calculation submodule, used to calculate the similarity between a plurality of the alarm information data by a similarity algorithm, and obtain a similarity data group of each network alarm information;

[0052] The alarm information filtering submodule is used to filter the alarm information data whose similarity data is higher than a preset similarity threshold and the corresponding network alarm information;

[0053] The data cleaning submodule is used to pre-process the alarm information data within a preset time period in order to standardize the format, clean obvious logical errors, clean non-required data, and clean missing key information, so as to obtain a number of different target alarm information.

[0054] By adopting the above technical scheme, for repeated alarm information data received within the same specified time period, in order to reduce the computational complexity of data processing, firstly, based on the similarity algorithm, network alarm information with the same or very high similarity is found to obtain the similarity data group of the corresponding network alarm information, and two or more network alarm information with the same similarity are deduplicated, and then the multiple alarm information data after deduplication are sequentially cleaned for format standardization, obvious logical errors, non-required data and missing key information, so as to screen out the more valuable network alarm information that may cause business interruption from a large amount of complex network alarm information, and facilitate fault analysis and processing of the network alarm information.

[0055] In the third aspect, the invention objective of the present application is achieved by adopting the following technical solutions:

[0056] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned fault handling method based on network alarm association when executing the computer program.

[0057] In a fourth aspect, the invention objective of the present application is achieved by adopting the following technical solutions:

[0058] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned fault handling method based on network alarm association are implemented.

[0059] In summary, the present application includes at least one of the following beneficial technical effects:

[0060] 1. Information identification and extraction are performed on the obtained network alarm information to preliminarily screen out invalid network alarm information and obtain alarm information data. Each network alarm information is associated with an alarm identification identifier, which is used to characterize the content and equipment type information of the network alarm information. Then, data processing is performed on the alarm information data: data preprocessing such as data deduplication and filtering is performed to obtain target alarm information, which is conducive to reducing the calculation amount of the alarm association judgment model. Further, in order to establish and obtain the association relationship of several target alarm information, several target alarm information is sent to the alarm association judgment model. The alarm association judgment model performs fault judgment on the association relationship of several target alarm information and outputs the corresponding business interruption judgment result. The business interruption judgment result is used to characterize the fault severity of the target alarm information and whether it will cause business interruption to the current network system. Then, after generating a fault handling work order based on several different target alarm information, business interruption judgment results and other information, the work order is dispatched to the corresponding maintenance user terminal. The maintenance user terminal is connected to maintenance personnel with corresponding maintenance professional skills, which is convenient to operate and improves the fault handling efficiency of network alarms as a whole.

[0061] 2. The alarm information database stores historical target alarm information based on whether different target alarm information will cause service interruption, and the corresponding service interruption determination probability; for target alarm information with a higher alarm probability, in order to facilitate the determination of its service interruption probability, the target alarm information with an alarm probability greater than or equal to the probability threshold is directly compared with the historical target alarm information in the alarm information database, and a first service interruption determination result is output; for target alarm information with an alarm probability less than the probability threshold, the corresponding service interruption probability is further calculated, and a second service interruption determination result of the target alarm information is output according to the value of the service interruption probability, thereby facilitating the fault determination of the target alarm information of multiple network elements of the target network device, which is conducive to improving the calculation and determination efficiency of network fault determination;

[0062] 3. For repeated alarm information data received within the same specified time period, in order to reduce the amount of data processing calculations, first find out the network alarm information with the same or very high similarity based on the similarity algorithm to obtain the similarity data group of the corresponding network alarm information, and deduplicate the two or more network alarm information with the same similarity. Then, the multiple alarm information data after deduplication are sequentially cleaned for format standardization, obvious logical errors, non-required data and missing key information, so as to screen out the more valuable network alarm information that may cause business interruption from a large amount of complex network alarm information, and facilitate fault analysis and processing of the network alarm information. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a flow chart of a fault handling method based on network alarm association in an embodiment of the present application;

[0064] Figure 2 It is a flowchart after step S3 in a fault handling method based on network alarm association in an embodiment of the present application;

[0065] Figure 3 It is a flowchart of step S3 in a fault handling method based on network alarm association in an embodiment of the present application;

[0066] Figure 4 This is another flow chart of a fault handling method based on network alarm association in an embodiment of the present application;

[0067] Figure 5 It is a flowchart of step S2 in a fault handling method based on network alarm association in an embodiment of the present application;

[0068] Figure 6 It is a schematic diagram of a device in an embodiment of the present application. DETAILED DESCRIPTION

[0069] The present application is further described in detail below in conjunction with the accompanying drawings.

[0070] In one embodiment, if Figure 1 As shown, the present application discloses a fault handling method based on network alarm association, which specifically includes the following steps:

[0071] S1: performing information identification based on a plurality of acquired network alarm information within a preset time period to obtain alarm information data, wherein each network alarm information is associated with an alarm identification identifier.

[0072] In this embodiment, the preset duration is a specified time period; the alarm identification identifier is a unique identification information code with alarm information, and the alarm identification identifier is used to characterize the content of the network alarm information and the equipment type information; to facilitate maintenance personnel to perform network alarm information analysis and maintenance work, the present application is provided with a fault handling platform based on network alarm association, and the fault handling terminal is communicatively connected with multiple target network devices. When the target network device receives the network alarm information, the target network device synchronously transmits the network alarm information to the fault handling platform in the form of a data message.

[0073] Specifically, in the data transmission process of obtaining network alarm information, serious frame loss such as network alarm information loss may occur. There may also be a situation where the readability of the corresponding network alarm information is seriously reduced due to the Border Gateway Protocol (BGP) protocol accidentally generating a peer jitter alarm, resulting in the network alarm information being invalid. The present application obtains the alarm information data by performing information identification on the network alarm information and then filtering out the invalid network alarm information for the first time.

[0074] Within a specified time period, several network alarm information of a network communication system (i.e., a network system that outputs network alarm information) is obtained. Since network alarm information may be pushed repeatedly, the network alarm information may be complicated, and there may be invalid alarms, and the network alarm information of various types of equipment in the network system of the Internet of Things needs to be differentiated according to the actual equipment type before fault determination is performed to improve the efficiency of fault determination of the network alarm information; therefore, it is necessary to perform information identification and extraction on the several network alarm information obtained to preliminarily screen out invalid network alarm information and obtain alarm information data.

[0075] S2: Preprocess the warning information data to obtain a number of different target warning information; send the different target warning information to a preset warning association judgment model to obtain the association judgment information corresponding to the different target warning information according to the warning identification identifier.

[0076] In this embodiment, data preprocessing includes data preprocessing operations such as data filtering and data cleaning; the alarm association judgment model pre-stores association judgment rules corresponding to different target alarm information based on different alarm identification identifiers. For example, when the alarm identification identifier A generates XX type target alarm information A1, it will generate a fault association with the target alarm information B1 and B2 subordinate to it.

[0077] S3: Based on the associated judgment information, perform fault identification and judgment on different target alarm information to obtain corresponding service interruption judgment results.

[0078] In this embodiment, fault identification is determined to determine whether the target alarm information indicates fault characteristics of service interruption or service damage; the service interruption determination result includes the fault diagnosis result of whether the target alarm information will cause service interruption or service damage for the target network device.

[0079] S4: Generate a number of fault handling work orders based on a number of different target alarm information, associated judgment information and corresponding service interruption judgment results, and send the number of fault handling work orders to corresponding maintenance user terminals according to preset fault dispatching rules.

[0080] In this embodiment, the fault handling work order includes a fault handling work order including target alarm information, associated judgment information and corresponding business interruption judgment result information; the fault handling work includes detailed fault information content such as fault type information and faulty equipment; based on this, in order to facilitate the arrangement of fault repair work, maintenance personnel with maintenance qualifications for the fault are quickly arranged to perform repairs. The fault dispatching rules are based on dispatching analysis dimensions such as the matching degree between the fault repair content and the maintenance qualifications of the maintenance personnel, the working hours of the maintenance personnel, and the number of work processed for the same fault. A fault dispatching personnel list is generated from high to low according to the maintenance matching degree. Multiple maintenance personnel are listed in the fault dispatching personnel list, and the fault handling work is preferentially dispatched to the maintenance personnel ranked first in the fault dispatching personnel list, thereby greatly improving the overall fault handling efficiency of network alarms.

[0081] In one embodiment, if Figure 2 As shown, in step S3, the network alarm information is generated by a network element of at least one target network device; after performing fault identification and determination on different target alarm information based on the associated determination information to obtain the corresponding service interruption determination result, the following steps are included:

[0082] S31: Obtain a network element relationship tree of each target network device, where the network element relationship tree is generated based on the subordinate relationship of each network element on the target network device; the network element relationship tree includes a root node and multiple levels of leaf nodes; the root node represents the target network device, and each level of leaf node represents a network element on the target network device, and each level of leaf node is subordinate to the upper level leaf node to which it is connected.

[0083] In this embodiment, after obtaining the service interruption determination result, in order to determine the alarm distribution range of the target alarm information and the detailed distribution range of the corresponding service interruption determination; based on the network element relationship tree, the subordinate relationship of each network element on the target network device is represented. In the network element relationship tree, the network element represented by each level of leaf node is subordinate to the network element represented by the leaf node of the upper level connected to it. For example, the target network device includes a chassis and a board. The board includes a physical interface, a communication interface, and a logical interface.

[0084] Specifically, the network element relationship tree represents the subordinate relationship of each network element on the target network device, so that the number of network elements on each target network device and the subordinate relationship between each network element can be understood through the network element relationship tree of the target network device, which is beneficial for calculating the impact scope of the failure and the causal relationship between the failures of each network element when a certain target network device fails.

[0085] S32: in the obtained network element relationship tree, the target alarm information is associated with the corresponding root node or leaf node to form an alarm information tree of each target network device.

[0086] In this embodiment, the target alarm information is associated with the network element relationship tree to form an alarm information tree that specifically displays the network element location of the alarm information, so as to facilitate the associated display of multiple target alarm information.

[0087] S33: Obtain a business system topology map, where the business system topology map includes multiple business nodes and association relationships between the business nodes.

[0088] S34: obtaining the service topology relationship of each target network device based on the service system topology diagram; connecting the alarm information trees of each target network device based on the preset node matching rules and the service interruption judgment results corresponding to different target alarm information to form a visual service judgment fault diagram.

[0089] In this embodiment, the node matching rule is a matching rule between a business node and different target alarm information, and the node matching rule can be defined by the staff. Based on the business topology relationship in the business system topology diagram, the node matching rules between multiple business nodes, and the business interruption determination results corresponding to different target alarm information, the alarm information number of each target network device is associated with the business node and the business interruption determination result to form a business determination fault diagram of the business interruption determination results corresponding to multiple target alarm information. The business interruption determination results and the target alarm information of each target network device can be quickly obtained through the business determination fault diagram.

[0090] In one embodiment, if Figure 3 As shown, in step S3, based on the associated judgment information, fault identification and judgment are performed on different target alarm information to obtain corresponding service interruption judgment results, which specifically includes:

[0091] S301: Calculate the probability of occurrence of corresponding target warning information based on the association judgment information to obtain the warning probability.

[0092] In this embodiment, the business interruption determination results include business interruption failures, uninterrupted business, and damaged business; the fault handling platform is preset with an alarm information database, and the alarm information database stores historical target alarm information and corresponding business interruption results; within a specified time period, the business interruption determination probability corresponding to different target alarm information is regularly updated.

[0093] Specifically, the associated judgment information includes associated alarm information; for target alarm information of repeated alarms, when performing service fault identification and judgment, a fault identification and judgment can be quickly performed based on the service interruption judgment results of similar historical target alarm information; by calculating the alarm probability of the target alarm information, it is possible to quickly distinguish whether the target alarm information is stored in the alarm information database of the fault processing platform, so as to improve the fault identification efficiency of the target alarm information.

[0094] S302: When the alarm probability is greater than or equal to a preset probability threshold, the preset alarm information database obtains a first service interruption determination result according to the corresponding target alarm information.

[0095] Specifically, for target alarm information with a higher alarm probability, in order to facilitate the determination of its service interruption probability, the target alarm information with an alarm probability greater than or equal to the probability threshold is directly compared with the historical target alarm information in the alarm information database, and a first service interruption determination result is output.

[0096] S303: When the alarm probability is less than the preset probability threshold, the service interruption probability of the corresponding target alarm information is calculated, and a second service interruption determination result of the target alarm information is obtained according to the value of the service interruption probability.

[0097] S304: Use the first service interruption determination result or the second service interruption determination result as the service interruption determination result corresponding to the target alarm information.

[0098] In this embodiment, for the target alarm information whose alarm probability is less than the probability threshold, the corresponding service interruption probability is further calculated, and the second service interruption determination result of the target alarm information is output according to the numerical value of the service interruption probability, thereby facilitating fault determination of the target alarm information of multiple network elements of the target network device, which is beneficial to improving the calculation and determination efficiency of network fault determination.

[0099] In one embodiment, if Figure 4 As shown, after step S34, a fault handling method based on network alarm association further includes:

[0100] S341: when a service interruption determination result of a service interruption fault is obtained, target alarm information related to the service interruption fault is determined as fault alarm information; and a plurality of target alarm information having a causal relationship with the fault alarm information is identified and obtained in a visualized service determination fault diagram.

[0101] In this embodiment, the service interruption determination result includes service interruption failure, service non-interruption, and service damage.

[0102] Specifically, in order to facilitate the visual scenario simulation of service interruption failures in the network communication system, and intelligently diagnose the fault alarm information of the root cause of the failure and the network alarm information generated by the fault alarm information; it is necessary to diagnose and analyze the causal relationship between the fault alarm information and the fault alarm information of other network elements or target network equipment when a failure occurs, so that maintenance personnel can troubleshoot a certain fault point within the timestamp range corresponding to the preset time length or the preset equipment area range when performing fault maintenance work.

[0103] S342: List corresponding business work contents according to the fault alarm information and the business contents of several target alarm information corresponding to the causal relationship; determine the business process and business association relationship according to the corresponding business work content, and formulate and generate a preliminary business work model.

[0104] Specifically, the preliminary business work model is used to indicate the business association content between business work nodes between several target network devices and corresponding network elements: such as business causality and business subordination. According to the preliminary business work model, it can be obtained whether several target alarm information has fault business association.

[0105] S343: Associating the visualized business judgment fault diagram with the preliminary business work model to generate a visualized business interruption scenario simulation model.

[0106] Specifically, the business judgment fault graph is business-associated with the preliminary business work model to obtain a visual business interruption scenario simulation model that includes business association information, business process information, and fault cause information, which is convenient for maintenance personnel to perform fault maintenance and fault cause analysis, and quickly exceed the root fault information in the target alarm information.

[0107] In one embodiment, if Figure 5 As shown, in step S2, the warning information data is preprocessed to obtain a number of different target warning information, specifically including:

[0108] S21: Calculate the similarity between a number of alarm information data using a similarity algorithm to obtain a similarity data group of each network alarm information.

[0109] In this embodiment, the similarity algorithm is a cosine similarity algorithm.

[0110] Specifically, for repeated alarm information data received within the same specified time period, in order to reduce the amount of data processing calculations, first find out network alarm information with the same or very high similarity based on the similarity algorithm to obtain the similarity data groups of the corresponding network alarm information.

[0111] S22: Filter the alarm information data whose similarity data is higher than a preset similarity threshold and the corresponding network alarm information.

[0112] Specifically, two or more network alarm information with the same similarity are deduplicated.

[0113] S23: Preprocess the warning information data within a preset time period in order to standardize the format, clean obvious logical errors, clean non-required data, and clean missing key information, so as to obtain a number of different target warning information.

[0114] Specifically, the multiple alarm information data after deduplication processing are sequentially cleaned for format standardization, obvious logical errors, non-required data and missing key information, so as to screen out the more valuable network alarm information that may cause business interruption from a large amount of complex network alarm information, and facilitate fault analysis and processing of the network alarm information.

[0115] It should be understood that the serial numbers of the steps in the above embodiments do not imply a sequence of execution. The execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0116] In one embodiment, a fault handling system based on network alarm association is provided, and the fault handling system based on network alarm association corresponds to the fault handling method based on network alarm association in the above embodiment.

[0117] A fault handling system based on network alarm association includes an alarm information acquisition module, an association judgment and matching module, a fault identification and determination module, and a fault work order dispatching module. The detailed description of each functional module is as follows:

[0118] An alarm information acquisition module is used to obtain alarm information data by performing information identification based on a number of acquired network alarm information within a preset time period, and each network alarm information is associated with an alarm identification identifier;

[0119] The correlation judgment matching module is used to perform data preprocessing on the warning information data to obtain a number of different target warning information; send the different target warning information to the preset warning correlation judgment model to obtain the correlation judgment information corresponding to the different target warning information according to the warning identification mark;

[0120] A fault identification and determination module is used to perform fault identification and determination on different target alarm information based on the associated determination information to obtain a corresponding service interruption determination result;

[0121] The fault work order dispatching module is used to generate several fault handling work orders based on several different target alarm information, related judgment information and corresponding business interruption judgment results, and send several fault handling work orders to the corresponding maintenance user terminals according to preset fault order dispatching rules.

[0122] The fault identification and determination module includes:

[0123] The alarm probability calculation submodule is used to calculate the probability of occurrence of the corresponding target alarm information based on the associated judgment information to obtain the alarm probability;

[0124] A first interruption determination submodule, configured to obtain a first service interruption determination result from a preset alarm information database according to corresponding target alarm information when the alarm probability is greater than or equal to a preset probability threshold;

[0125] A second interruption determination submodule is used to calculate the service interruption probability of the corresponding target alarm information when the alarm probability is less than a preset probability threshold, and obtain a second service interruption determination result of the target alarm information according to the value of the service interruption probability;

[0126] The result output submodule is used to use the first service interruption determination result or the second service interruption determination result as the service interruption determination result corresponding to the target alarm information.

[0127] Optionally, the association judgment matching module includes:

[0128] A similarity calculation submodule is used to calculate the similarity between a number of alarm information data by a similarity algorithm to obtain a similarity data group of each network alarm information;

[0129] The alarm information filtering submodule is used to filter the alarm information data whose similarity data is higher than a preset similarity threshold and the corresponding network alarm information;

[0130] The data cleaning submodule is used to pre-process the alarm information data within a preset time period in order to standardize the format, clean obvious logical errors, clean non-required data, and clean missing key information, so as to obtain a number of different target alarm information.

[0131] For the specific definition of a fault handling system based on network alarm association, please refer to the definition of a fault handling method based on network alarm association in the above text, which will not be repeated here; each module in the above-mentioned fault handling system based on network alarm association can be implemented in whole or in part by software, hardware and a combination thereof; each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0132] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store alarm information data, target alarm information, preliminary business work models and business interruption scenario simulation models, etc. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a fault handling method based on network alarm association is implemented.

[0133] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0134] S1: within a preset time period, information identification is performed based on a number of network alarm information obtained to obtain alarm information data, and each network alarm information is associated with an alarm identification identifier;

[0135] S2: Preprocess the warning information data to obtain a number of different target warning information; send the different target warning information to a preset warning association judgment model to obtain the association judgment information corresponding to the different target warning information according to the warning identification identifier;

[0136] S3: Based on the correlation judgment information, perform fault identification and judgment on different target alarm information to obtain corresponding service interruption judgment results;

[0137] S4: Generate a number of fault handling work orders based on a number of different target alarm information, associated judgment information and corresponding service interruption judgment results, and send the number of fault handling work orders to corresponding maintenance user terminals according to preset fault dispatching rules.

[0138] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0139] S1: within a preset time period, information identification is performed based on a number of network alarm information obtained to obtain alarm information data, and each network alarm information is associated with an alarm identification identifier;

[0140] S2: Preprocess the warning information data to obtain a number of different target warning information; send the different target warning information to a preset warning association judgment model to obtain the association judgment information corresponding to the different target warning information according to the warning identification identifier;

[0141] S3: Based on the correlation judgment information, perform fault identification and judgment on different target alarm information to obtain corresponding service interruption judgment results;

[0142] S4: Generate a number of fault handling work orders based on a number of different target alarm information, associated judgment information and corresponding service interruption judgment results, and send the number of fault handling work orders to corresponding maintenance user terminals according to preset fault dispatching rules.

[0143] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0144] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0145] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, it should be understood by those skilled in the art that the technical solutions described in the aforementioned embodiments may still be modified, or some of the features thereof may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A fault handling method based on network alarm association, characterized in that: include: Performing information identification based on a plurality of network alarm information obtained within a preset time period to obtain alarm information data, wherein each of the network alarm information is associated with an alarm identification identifier; Performing data preprocessing on the warning information data to obtain a plurality of different target warning information; Sending the different target warning information to a preset warning association judgment model to obtain association judgment information corresponding to the different target warning information according to the warning identification identifier; Based on the association judgment information, performing fault identification and judgment on the different target alarm information to obtain a corresponding service interruption judgment result; Generate a number of fault handling work orders based on a number of different target alarm information, associated judgment information and corresponding service interruption judgment results, and send the number of fault handling work orders to corresponding maintenance user terminals according to preset fault dispatching rules; The network alarm information is generated by a network element of at least one target network device; After performing fault identification and determination on the different target alarm information based on the association determination information to obtain corresponding service interruption determination results, the method includes: Obtain a network element relationship tree of each target network device, wherein the network element relationship tree is generated according to the subordinate relationship of each network element on the target network device; the network element relationship tree includes a root node and multiple levels of leaf nodes; the root node represents the target network device, each level of leaf nodes represents the network element on the target network device, and each level of leaf nodes is subordinate to the upper level leaf node connected thereto; In the obtained network element relationship tree, the target alarm information is associated with the corresponding root node or leaf node to form an alarm information tree of each target network device; Acquire a business system topology diagram, wherein the business system topology diagram includes a plurality of business nodes and association relationships between the business nodes; Based on the business system topology diagram, the business topology relationship of each target network device is obtained; based on the preset node matching rules and the business interruption judgment results corresponding to different target alarm information, the alarm information trees of each target network device are connected to form a visual business judgment fault diagram.

2. A fault handling method based on network alarm association according to claim 1, characterized in that: The associated judgment information includes associated alarm information; and the performing fault identification and judgment on the different target alarm information based on the associated judgment information to obtain a corresponding service interruption judgment result specifically includes: Calculating the probability of occurrence of the corresponding target warning information based on the association judgment information to obtain a warning probability; When the alarm probability is greater than or equal to a preset probability threshold, the preset alarm information database obtains a first service interruption determination result according to the corresponding target alarm information; When the alarm probability is less than a preset probability threshold, the service interruption probability of the corresponding target alarm information is calculated, and a second service interruption determination result of the target alarm information is obtained according to the value of the service interruption probability; The first service interruption determination result or the second service interruption determination result is used as the service interruption determination result corresponding to the target alarm information.

3. A fault handling method based on network alarm association according to claim 1, characterized in that: The service interruption determination result includes a service interruption fault; after the service interruption determination result corresponding to the preset node matching rule and different target alarm information is connected to form a visualized service determination fault diagram, the method further includes: When a service interruption determination result of a service interruption fault is obtained, target alarm information related to the service interruption fault is determined as fault alarm information; and several target alarm information having a causal relationship with the fault alarm information is identified and obtained in the visualized service determination fault graph; According to the business contents of the fault alarm information and the corresponding target alarm information with causal relationships, the corresponding business work contents are listed; according to the corresponding business work contents, the business processes and business associations are determined, and a preliminary business work model is formulated and generated; The visualized business judgment fault diagram is associated with the preliminary business work model to generate a visualized business interruption scenario simulation model.

4. A fault handling method based on network alarm association according to claim 1, characterized in that: The data preprocessing of the warning information data to obtain a plurality of different target warning information specifically includes: Calculating the similarity between the plurality of alarm information data by a similarity algorithm to obtain a similarity data group of each network alarm information; Filter the alarm information data and the corresponding network alarm information whose similarity data is higher than a preset similarity threshold; The warning information data within the preset time period is preprocessed in sequence for format standardization cleaning, obvious logical error cleaning, non-required data cleaning and key information missing cleaning to obtain several different target warning information.

5. A fault handling system based on network alarm association, characterized in that: A system for executing a fault handling method based on network alarm association as claimed in any one of claims 1 to 4, comprising: An alarm information acquisition module, used to obtain alarm information data by performing information identification based on a number of acquired network alarm information within a preset time period, each of the network alarm information is associated with an alarm identification identifier; The association judgment matching module is used to perform data preprocessing on the warning information data to obtain a plurality of different target warning information; send the different target warning information to a preset warning association judgment model to obtain the association judgment information corresponding to the different target warning information according to the warning identification identifier; A fault identification and determination module, configured to perform fault identification and determination on the different target alarm information based on the associated determination information to obtain a corresponding service interruption determination result; A fault work order dispatching module is used to generate a number of fault handling work orders based on a number of different target alarm information, associated judgment information and corresponding service interruption judgment results, and send the several fault handling work orders to the corresponding maintenance user terminal according to the preset fault order dispatching rules; The network alarm information is generated by a network element of at least one target network device; after the fault identification and determination is performed on the different target alarm information based on the association determination information to obtain a corresponding service interruption determination result, the method includes: Obtain a network element relationship tree of each target network device, wherein the network element relationship tree is generated according to the subordinate relationship of each network element on the target network device; the network element relationship tree includes a root node and multiple levels of leaf nodes; the root node represents the target network device, each level of leaf nodes represents the network element on the target network device, and each level of leaf nodes is subordinate to the upper level leaf node connected thereto; In the obtained network element relationship tree, the target alarm information is associated with the corresponding root node or leaf node to form an alarm information tree of each target network device; Acquire a business system topology diagram, wherein the business system topology diagram includes a plurality of business nodes and association relationships between the business nodes; Based on the business system topology diagram, the business topology relationship of each target network device is obtained; based on the preset node matching rules and the business interruption judgment results corresponding to different target alarm information, the alarm information trees of each target network device are connected to form a visual business judgment fault diagram.

6. A fault handling system based on network alarm association according to claim 5, characterized in that: The fault identification and determination module comprises: An alarm probability calculation submodule, used to calculate the probability of occurrence of the corresponding target alarm information based on the association judgment information to obtain the alarm probability; A first interruption determination submodule, configured to obtain a first service interruption determination result from a preset alarm information database according to corresponding target alarm information when the alarm probability is greater than or equal to a preset probability threshold; A second interruption determination submodule, configured to calculate the service interruption probability of the corresponding target alarm information when the alarm probability is less than a preset probability threshold, and obtain a second service interruption determination result of the target alarm information according to the value of the service interruption probability; The result output submodule is used to use the first service interruption determination result or the second service interruption determination result as the service interruption determination result corresponding to the target alarm information.

7. A fault handling system based on network alarm association according to claim 5, characterized in that: The association judgment and matching module includes: A similarity calculation submodule, used to calculate the similarity between a plurality of the alarm information data by a similarity algorithm, and obtain a similarity data group of each network alarm information; The alarm information filtering submodule is used to filter the alarm information data whose similarity data is higher than a preset similarity threshold and the corresponding network alarm information; The data cleaning submodule is used to pre-process the alarm information data within a preset time period in order to standardize the format, clean obvious logical errors, clean non-required data, and clean missing key information, so as to obtain a number of different target alarm information.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the fault handling method based on network alarm association as described in any one of claims 1 to 4 are implemented.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of a fault handling method based on network alarm association as claimed in any one of claims 1 to 4 are implemented.

Images