Alarm data processing methods, devices, electronic equipment and storage media

Abstract

This invention provides a method, apparatus, electronic device, and storage medium for processing alarm data, relating to the field of data processing technology. The method includes: acquiring alarm data for Internet Protocol Television (IPTV); grouping the alarm data to obtain several alarm data groups; constructing frequent itemsets and corresponding alarm association rules based on the alarm data, and filtering the alarm association rules to obtain a first alarm association rule that meets certain conditions; counting the number of users with poor quality corresponding to the alarm data groups under the first alarm association rule, and performing critical processing on the first alarm association rule based on the number of users with poor quality to obtain a second alarm association rule for ITV. The second alarm association rule is the root cause of alarms for ITV anomalies, thereby improving the accuracy of the alarm association rule and providing effective support for subsequent fault location, so as to improve the efficiency and accuracy of fault location.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method for processing alarm data, an apparatus for processing alarm data, an electronic device, and a computer-readable storage medium. Background Technology

[0002] With the development of network technology, traditional cable TV has evolved into Internet Protocol (IP) TV. During the use of IPTV, some usage anomalies are inevitable. These anomalies are typically reported to the service provider so that maintenance personnel can resolve them. Currently, due to the large number of alarms, alarm localization primarily requires maintenance personnel to manually determine the cause of the fault by combining identified root cause alarm information with existing network fault data, network topology, expert systems, and their own experience. They then establish rules governing the relationship between alarms and faults to locate the fault. This method is not only resource-intensive but also suffers from low efficiency and poor accuracy in fault localization. Summary of the Invention

[0003] The present invention provides a method, apparatus, electronic device, and computer-readable storage medium for processing alarm data, in order to solve or partially solve the problems of low efficiency and low accuracy in fault location.

[0004] This invention discloses a method for processing alarm data, including:

[0005] Obtain alarm data for Internet Protocol Television;

[0006] The alarm data is grouped to obtain several alarm data groups, and the alarm data contained in each alarm data group is unique;

[0007] Based on the alarm data, a frequent itemset and alarm association rules corresponding to the frequent itemset are constructed, and the alarm association rules are filtered to obtain a first alarm association rule that meets the conditions.

[0008] The number of users with poor data quality corresponding to the alarm data group under the first alarm association rule is counted, and the first alarm association rule is subjected to key processing based on the number of users with poor data quality to obtain a second alarm association rule for the Internet Protocol Television (IPTV). The second alarm association rule is the root cause of the alarm for the abnormality of the ITV.

[0009] In some feasible embodiments, the alarm data includes at least the alarm type, alarm time, and alarm details corresponding to the occurrence of the Internet Protocol Television (IPTV) alarm. The step of grouping the alarm data to obtain several alarm data groups includes:

[0010] The alarm types and alarm details are grouped according to the alarm time to obtain several alarm data groups corresponding to the alarm data.

[0011] In some feasible embodiments, the step of constructing frequent itemsets and alarm association rules corresponding to the frequent itemsets based on the alarm data includes:

[0012] Identify all individual alarm items from the alarm data;

[0013] Calculate the first support corresponding to each alarm item, and compare the first support corresponding to each alarm item with a preset support threshold to filter out target alarm items;

[0014] Perform a set union on the target alarm items to obtain a candidate frequent alarm item set;

[0015] Calculate the second support corresponding to each of the candidate frequent alarm itemsets, and compare the second support corresponding to each of the candidate frequent alarm itemsets with the preset support threshold to filter out new candidate frequent alarm itemsets;

[0016] The candidate frequent itemsets are continuously merged and filtered according to the preset support threshold until no new candidate frequent alarm itemsets can be generated. The final candidate frequent alarm itemsets are then used as the target frequent alarm itemsets corresponding to the Internet Protocol Television.

[0017] Based on the target frequent alarm item set, alarm association rules corresponding to the Internet Protocol Television are generated. The alarm association rules are used to describe the association relationship between the alarm items. Each alarm association rule consists of a predicate and a postdicate. The predicate is used to characterize the condition of the alarm association rule, and the postdicate is used to characterize the result of the alarm association rule.

[0018] In some feasible embodiments, comparing the first support corresponding to each of the alarm items with a preset support threshold to filter out target alarm items includes:

[0019] Alarm items with a first support level greater than or equal to a preset support threshold are designated as target alarm items.

[0020] In some feasible embodiments, the step of filtering the alarm association rules to obtain a first alarm association rule that meets the conditions includes:

[0021] Calculate the confidence level corresponding to each of the aforementioned alarm association rules;

[0022] Alarm association rules with a confidence level greater than or equal to a preset confidence threshold are used as the first alarm association rules for the Internet Protocol Television.

[0023] In some feasible embodiments, the step of performing critical processing on the first alarm association rule based on the number of users with poor quality to obtain a second alarm association rule for the Internet Protocol Television (IPTV) includes:

[0024] The alarm data group is sorted according to the number of users with poor quality, and the sorted number of users with poor quality is summed to obtain the corresponding sum value;

[0025] Divide the sum by the number of users with the largest quality difference to obtain the normalized target result;

[0026] The normalized result is used to calculate the Gini coefficient corresponding to the first alarm association rule using the trapezoidal area method;

[0027] The first alarm association rule with a Gini coefficient greater than or equal to a preset coefficient threshold is used as the second alarm association rule for the Internet Protocol Television.

[0028] In some feasible embodiments, it also includes:

[0029] In response to the detection of an anomaly for the Internet Protocol Television (IPTV), the system obtains the anomaly status information corresponding to the anomaly detection and matches the anomaly status information with the second alarm association rule to obtain the cause of the anomaly for the ITV.

[0030] This invention also discloses an alarm data processing apparatus, comprising:

[0031] The data acquisition module is used to acquire alarm data for Internet Protocol TV.

[0032] The data grouping module is used to group the alarm data to obtain several alarm data groups, and the alarm data contained in each alarm data group is unique.

[0033] The itemset construction module is used to construct frequent itemsets and alarm association rules corresponding to the frequent itemsets based on the alarm data, and to filter the alarm association rules to obtain a first alarm association rule that meets the conditions.

[0034] The rule processing module is used to count the number of users with poor quality corresponding to the alarm data group under the first alarm association rule, and to perform key processing on the first alarm association rule according to the number of users with poor quality to obtain a second alarm association rule for the Internet Protocol Television (IPTV). The second alarm association rule is the root cause of the alarm for the abnormality of the ITV.

[0035] In some feasible embodiments, the alarm data includes at least the alarm type, alarm time, and alarm details corresponding to the occurrence of the Internet Protocol Television (IPTV) alarm, and the data grouping module is specifically used for:

[0036] The alarm types and alarm details are grouped according to the alarm time to obtain several alarm data groups corresponding to the alarm data.

[0037] In some feasible embodiments, the itemset construction module is specifically used for:

[0038] Identify all individual alarm items from the alarm data;

[0039] Calculate the first support corresponding to each alarm item, and compare the first support corresponding to each alarm item with a preset support threshold to filter out target alarm items;

[0040] Perform a set union on the target alarm items to obtain a candidate frequent alarm item set;

[0041] Calculate the second support corresponding to each of the candidate frequent alarm itemsets, and compare the second support corresponding to each of the candidate frequent alarm itemsets with the preset support threshold to filter out new candidate frequent alarm itemsets;

[0042] The candidate frequent itemsets are continuously merged and filtered according to the preset support threshold until no new candidate frequent alarm itemsets can be generated. The final candidate frequent alarm itemsets are then used as the target frequent alarm itemsets corresponding to the Internet Protocol Television.

[0043] Based on the target frequent alarm item set, alarm association rules corresponding to the Internet Protocol Television are generated. The alarm association rules are used to describe the association relationship between the alarm items. Each alarm association rule consists of a predicate and a postdicate. The predicate is used to characterize the condition of the alarm association rule, and the postdicate is used to characterize the result of the alarm association rule.

[0044] In some feasible embodiments, the itemset construction module is specifically used for:

[0045] Alarm items with a first support level greater than or equal to a preset support threshold are designated as target alarm items.

[0046] In some feasible embodiments, the itemset construction module is specifically used for:

[0047] Calculate the confidence level corresponding to each of the aforementioned alarm association rules;

[0048] Alarm association rules with a confidence level greater than or equal to a preset confidence threshold are used as the first alarm association rules for the Internet Protocol Television.

[0049] In some feasible embodiments, the rule processing module is specifically used for:

[0050] The alarm data group is sorted according to the number of users with poor quality, and the sorted number of users with poor quality is summed to obtain the corresponding sum value;

[0051] Divide the sum by the number of users with the largest quality difference to obtain the normalized target result;

[0052] The normalized result is used to calculate the Gini coefficient corresponding to the first alarm association rule using the trapezoidal area method;

[0053] The first alarm association rule with a Gini coefficient greater than or equal to a preset coefficient threshold is used as the second alarm association rule for the Internet Protocol Television.

[0054] In some feasible embodiments, it also includes:

[0055] The analysis module is used to respond to the detection of an anomaly for the Internet Protocol Television (IPTV), obtain the anomaly status information corresponding to the anomaly detection, and match the anomaly status information with the second alarm association rule to obtain the cause of the anomaly for the ITV.

[0056] This invention also discloses an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0057] The memory is used to store computer programs;

[0058] When the processor executes a program stored in the memory, it implements the method described in the embodiments of the present invention.

[0059] This invention also discloses a computer-readable storage medium storing instructions that, when executed by one or more processors, cause the processors to perform the methods described in this invention.

[0060] The embodiments of the present invention have the following advantages:

[0061] In this embodiment of the invention, alarm data for Internet Protocol Television (IPTV) is acquired, and then the alarm data is grouped to obtain several alarm data groups. Each alarm data group contains unique alarm data. Then, frequent itemsets and alarm association rules corresponding to the frequent itemsets are constructed based on the alarm data. The alarm association rules are then filtered to obtain a first alarm association rule that meets the conditions. By compressing the alarm data, the amount of alarm data is effectively reduced, and data noise is reduced. Then, the number of users with poor quality corresponding to the alarm data groups under the first alarm association rule can be counted. The first alarm association rule is then subjected to key processing based on the number of users with poor quality to obtain a second alarm association rule for ITV. The second alarm association rule is the root cause of the alarm for ITV anomalies. By locating the root cause of the alarm based on the number of users with poor quality, the accuracy of the alarm association rule is improved, providing effective support for subsequent fault location, so as to improve the efficiency and accuracy of fault location. Attached Figure Description

[0062] Figure 1 This is a flowchart of the steps of an alarm data processing method provided in an embodiment of the present invention;

[0063] Figure 2 This is a schematic diagram of the data processing flow provided in an embodiment of the present invention;

[0064] Figure 3 This is a schematic diagram of a line graph provided in an embodiment of the present invention;

[0065] Figure 4 This is a structural block diagram of an alarm data processing device provided in an embodiment of the present invention;

[0066] Figure 5 This is a block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0067] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0068] As an example, due to the large number of alarms during the use of Internet Protocol Television (IPTV), the alarm localization process currently mainly requires maintenance personnel to combine the root cause alarm information that has been discovered with prior knowledge such as existing network fault data, network topology relationships, expert systems, and their own experience to manually determine the cause of the fault, formulate corresponding relationship rules between alarms and faults, and then locate the fault. This method not only consumes a lot of manpower and resources, but also suffers from low fault localization efficiency and poor accuracy.

[0069] To address this, this invention addresses the issue by processing the causes of faults to determine the root causes of alarms. This allows for fault location and analysis based on the root causes, improving the accuracy and effectiveness of fault location. Specifically, alarm data for Internet Protocol Television (IPTV) is acquired, then grouped into several alarm data groups. Each alarm data group contains unique alarm data. Frequent itemsets and corresponding alarm association rules are then constructed based on the alarm data. These alarm association rules are then filtered to obtain a first alarm association rule that meets certain conditions. Alarm data is compressed, effectively reducing the amount of alarm data and data noise. Then, the number of users with poor data quality corresponding to the alarm data group under the first alarm association rule can be counted. Based on the number of users with poor data quality, the first alarm association rule is processed to obtain the second alarm association rule for Internet Protocol Television (IPTV). The second alarm association rule is the root cause of alarms that cause IPTV anomalies. By locating the root cause of alarms based on the number of users with poor data quality, the accuracy of the alarm association rule is improved, providing effective support for subsequent fault location, so as to improve the efficiency and accuracy of fault location.

[0070] Reference Figure 1 The diagram illustrates a flowchart of a method for processing alarm data according to an embodiment of the present invention, which may specifically include the following steps:

[0071] Step 101: Obtain alarm data for Internet Protocol Television;

[0072] Internet Protocol Television (IPT) is an interactive network television service that utilizes broadband cable television networks, integrating internet, multimedia, and communication technologies to provide home users with digital television. During use, malfunctions are inevitable. For these malfunctions, maintenance personnel typically need to pinpoint the cause in order to perform targeted maintenance and ensure a smooth user experience.

[0073] In this embodiment of the invention, the cause of the fault that occurs during use can be determined by obtaining alarm data for Internet Protocol Television. The alarm data may include alarm data reported by the user in the past, alarm data automatically detected by the system, etc., and the present invention does not limit this.

[0074] The alarm data may include the alarm type and alarm details of a single alarm. The alarm type may include RRU (Remote Radio Unit) failure, board not in place, base station unit error, base station bus failure, base station outage, cell shutdown alarm, power supply alarm, etc. The alarm details may include at least the user identifier, alarm time, alarm location, etc., but this invention does not limit these.

[0075] Step 102: Group the alarm data to obtain several alarm data groups, and each alarm data group contains unique alarm data.

[0076] In this embodiment of the invention, the acquired alarm data can be preprocessed to organize and clean the alarm data in order to reduce data noise. After the data organization and cleaning are completed, the alarm data can be grouped to obtain several alarm data groups. The alarm data contained in each alarm data group is unique.

[0077] It should be noted that the following process can be used to organize and clean alarm data:

[0078] 1. Remove duplicate data:

[0079] When processing alarm data, the first step is to detect and remove duplicate alarm records. Duplicate alarms can distort the analysis results, so it is necessary to identify and delete duplicate entries.

[0080] 2. Handling missing values:

[0081] Check the data for missing values, i.e., blank or unrecorded data. You can choose to fill in missing values, delete records containing missing values, or use interpolation methods to fill in the missing values, depending on the importance of the data and the needs of the analysis.

[0082] 3. Handling outliers:

[0083] Outliers can affect the analysis results of alarm data, therefore it is necessary to identify and handle them. Statistical methods or domain knowledge can be used to detect and handle outliers to ensure the accuracy and consistency of the data.

[0084] 4. Timestamp processing:

[0085] If the alarm data contains timestamp information, ensure that the timestamp format is correct and perform time zone conversion or time granularity adjustment as needed for time series analysis or visualization.

[0086] 5. Data type conversion:

[0087] Ensure that each field of the data uses the appropriate data type, such as converting text fields to categorical variables and date / time fields to date / time types, for subsequent analysis and modeling.

[0088] 6. Standardization and normalization:

[0089] Standardizing or normalizing data can eliminate the influence of different units of measurement or data ranges, making the data comparable and helping to improve the accuracy and stability of the model.

[0090] 7. Verify data integrity:

[0091] Finally, the cleaned data is validated to ensure its integrity and consistency. This includes checking the dataset for any potential problems and making any necessary repairs or adjustments.

[0092] After the alarm data has been sorted and cleaned through the above process, since the alarm data includes at least the alarm type, alarm time, and alarm details when the Internet Protocol Television alarm occurs, the alarm type and alarm details can be grouped according to the alarm time to obtain several alarm data groups corresponding to the alarm data. Thus, by grouping the data, data compression is achieved, which helps to reduce the amount of data in a single data analysis.

[0093] In one example, alarm data can be grouped according to alarm time. For instance, alarm data can be divided into groups of 5 minutes. Assuming that it starts from 0:00 a.m., alarm data from 0:00 to 0:05 a.m. can be grouped together, and so on, until all alarm data is grouped.

[0094] Step 103: Construct frequent itemsets and alarm association rules corresponding to the frequent itemsets based on the alarm data, and filter the alarm association rules to obtain the first alarm association rule that meets the conditions.

[0095] In this embodiment of the invention, after the alarm data is grouped, corresponding frequent itemsets and alarm association rules corresponding to the frequent itemsets can be constructed based on the alarm data. A frequent itemset can be a collection of alarm data that frequently appear together in a dataset, and an alarm association rule can be a rule used to determine a fault when Internet Protocol Television (IPTV) meets certain state parameters. After obtaining the alarm association rules, the rules can be further filtered to obtain the first alarm association rule that meets the conditions. This effectively reduces the amount of alarm data and decreases data noise by compressing the alarm data.

[0096] In some feasible implementations, all individual alarm items can be identified from the alarm data first. Then, the first support corresponding to each alarm item is calculated, and the first support corresponding to each alarm item is compared with a preset support threshold to filter out target alarm items. Next, the target alarm items are merged to obtain candidate frequent alarm itemsets. Then, the second support corresponding to each candidate frequent alarm itemset is calculated, and the second support corresponding to each candidate frequent alarm itemset is compared with a preset support threshold to filter out new candidate frequent alarm itemsets. The candidate frequent itemsets are continuously merged and filtered according to the preset support threshold until no new candidate frequent alarm itemsets can be generated. The final candidate frequent alarm itemsets are used as the target frequent alarm itemsets corresponding to Internet Protocol Television (IPTV). Then, alarm association rules corresponding to IPTV are generated based on the target frequent alarm itemsets. Alarm association rules are used to describe the association relationship between alarm items. An alarm association rule consists of an antecedent and a consequent. The antecedent is used to characterize the condition of the alarm association rule, and the consequent is used to characterize the result of the alarm association rule.

[0097] In practical implementation, alarm items with a first support greater than or equal to a preset support threshold can be used as target alarm items. Furthermore, by calculating the confidence level of each alarm association rule and using the alarm association rule with a confidence level greater than or equal to a preset confidence threshold as the first alarm association rule for Internet Protocol Television (IPTV), the amount of alarm data is effectively reduced and data noise is decreased through alarm data compression.

[0098] It should be noted that the support and confidence levels can be set according to actual needs, and this invention does not impose any restrictions on them.

[0099] It should be noted that the construction process for frequent itemsets and alarm association rules can be based on the Apriori algorithm or the FP-growth algorithm. For example, taking the Apriori algorithm as an example, the corresponding construction process can be as follows:

[0100] 1. Identify individual alarm items: Identify all individual alarm items, or itemsets, from the pre-processed and grouped alarm data. These itemsets represent the type or specific information of a single alarm.

[0101] 2. Attempt to combine itemsets: By combining known frequent itemsets, attempt to generate larger candidate itemsets, such as frequent binomial itemsets. This process is performed alternately through join and pruning steps. The join step is used to generate candidate itemsets, while the pruning step is used to eliminate candidate itemsets that do not meet the minimum support requirement.

[0102] 3. Calculate Support: For the generated candidate itemsets, calculate their support in the data, which is the frequency of these itemsets appearing in all alarm data. Only itemsets with a support not lower than the preset minimum support threshold are considered frequent itemsets.

[0103] 4. Generate Association Rules: Based on frequent itemsets, attempt to generate association rules that describe the relationships between alarm items. An association rule consists of an antecedent and a consequent, such as A->B, indicating that B is also likely to occur if A occurs. The strength of the association is measured by calculating the confidence score of the rules.

[0104] 5. Filter valid rules: Only retain association rules with a confidence level not lower than the preset minimum confidence level threshold. These rules are considered valid.

[0105] 6. Iteration: The above process is continuously iterated, combining and filtering frequent itemsets and association rules until no new frequent itemsets can be found or more effective rules can be generated.

[0106] Step 104: Count the number of users with poor quality corresponding to the alarm data group under the first alarm association rule, and perform key processing on the first alarm association rule according to the number of users with poor quality to obtain a second alarm association rule for the Internet Protocol Television (IPTV). The second alarm association rule is the root cause of the alarm for the abnormality of the ITV.

[0107] In this embodiment of the invention, corresponding alarm association rules are obtained through a corresponding algorithm. After filtering the alarm association rules to obtain the first alarm association rule, the number of users with poor quality corresponding to the alarm data group under the first alarm association rule can be counted. Based on the number of users with poor quality, the first alarm association rule is subjected to key processing to obtain the second alarm association rule for Internet Protocol Television (IPTV). This allows for the location and analysis of actual faults and anomalies occurring in IPTV based on the second alarm association rule. By locating the root cause of the alarm based on the number of users with poor quality, the accuracy of the alarm association rule is improved, providing effective support for subsequent fault location and improving the efficiency and accuracy of fault location.

[0108] In some feasible implementations, alarm data groups can be sorted according to the number of users with poor quality, and the sorted number of users with poor quality can be summed to obtain the corresponding sum value. Then, the sum value is divided by the largest number of users with poor quality to obtain the normalized target result. Then, the Gini coefficient corresponding to the first alarm association rule is calculated using the trapezoidal area method based on the normalized result. The first alarm association rule with a Gini coefficient greater than or equal to a preset coefficient threshold is then used as the second alarm association rule for Internet Protocol Television. In this way, the root cause of the alarm can be located based on the number of users with poor quality, improving the accuracy of the alarm association rule and providing effective support for subsequent fault location, so as to improve the efficiency and accuracy of fault location.

[0109] In one example, the number of poor-quality users under each alarm group exceeding the threshold can be counted and sorted from smallest to largest. Then, the number of poor-quality users in the same alarm group can be accumulated and summed. Each summation is then divided by the largest number of poor-quality users in the same alarm group. A coordinate system is constructed with (1 divided by the number of elements) as the horizontal axis interval and preset support and confidence as the y-axis values, and the corresponding curve is plotted. The integral is then calculated using the trapezoidal area method to obtain the area B. The Gini coefficient is then calculated using the formula Gini coefficient = (0.5-B) / 0.5. The alarm with the largest coefficient is identified as the primary alarm, i.e., the root cause of the alarm. Thus, the root cause of the alarm can be located based on the number of poor-quality users, improving the accuracy of alarm association rules and providing effective support for subsequent fault location, thereby improving the efficiency and accuracy of fault location.

[0110] Furthermore, after determining the root cause of the alarm based on the above process, in practical applications, the corresponding detection system can respond to the detection of an anomaly against the Internet Protocol Television (IPTV), obtain the anomaly status information corresponding to the anomaly detection, and match the anomaly status information with the second alarm association rule to obtain the anomaly cause related to the ITV. This allows the algorithm to merge the original alarm count, completing the merging of related rules, reducing the number of redundant alarms. Secondly, it improves the accuracy of alarm root cause location, reducing the occurrence of mis-allocation and incorrect root cause location in the system's automatic alarm dispatch. Furthermore, by analyzing alarm data, potential abnormal behaviors and problems can be identified. Using the Gini coefficient as the basis for alarm root cause location, the degree of uneven distribution of alarm data can be used as an indicator of abnormal behavior, improving the accuracy of alarm association rules and providing support for subsequent fault location.

[0111] It should be noted that the embodiments of the present invention include, but are not limited to, the examples described above. It is understood that those skilled in the art can make further settings according to actual needs under the guidance of the ideas in the embodiments of the present invention, and the present invention does not limit such settings.

[0112] In this embodiment of the invention, alarm data for Internet Protocol Television (IPTV) is acquired, and then the alarm data is grouped to obtain several alarm data groups. Each alarm data group contains unique alarm data. Then, frequent itemsets and alarm association rules corresponding to the frequent itemsets are constructed based on the alarm data. The alarm association rules are then filtered to obtain a first alarm association rule that meets the conditions. By compressing the alarm data, the amount of alarm data is effectively reduced, and data noise is reduced. Then, the number of users with poor quality corresponding to the alarm data groups under the first alarm association rule can be counted. The first alarm association rule is then subjected to key processing based on the number of users with poor quality to obtain a second alarm association rule for ITV. The second alarm association rule is the root cause of the alarm for ITV anomalies. By locating the root cause of the alarm based on the number of users with poor quality, the accuracy of the alarm association rule is improved, providing effective support for subsequent fault location, so as to improve the efficiency and accuracy of fault location.

[0113] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the following examples are provided for illustrative purposes:

[0114] Reference Figure 2 The diagram illustrates a data processing flow provided in an embodiment of the present invention. Specifically:

[0115] Step 1: Obtain alarm data. Each alarm has a corresponding alarm type and specific alarm information.

[0116] Step 2: Alarm preprocessing, which involves organizing and cleaning the alarm data, grouping alarms into sets of 5 minutes based on their duration.

[0117] Step 3: APRIORI algorithm construction, build the dataset in groups of 5 minutes, and ensure that there is no duplicate data in each group.

[0118] Step 4: Set the minimum support and minimum confidence thresholds (support ≥ 50%, confidence ≥ 50%).

[0119] Step 5: Calculate the support and confidence of each alarm group. If they are greater than the threshold, proceed to the next step; if they are less than the threshold, remove the alarm group.

[0120] Step 6: Count the number of poor-quality users under each alarm group that exceeds the threshold and sort them from smallest to largest.

[0121] Step 7: Sum the sorted user counts.

[0122] Step 8: Divide each summed value by the maximum value.

[0123] Step 9: Using (1 divided by the number of elements) as the horizontal axis interval, and the result of step 4 as the y-axis value, draw a line, calculate the integral using the trapezoidal method for finding the area, and obtain the area B.

[0124] Step 10: Calculate the Gini coefficient using the formula Gini coefficient = (0.5-B) / 0.5, and determine the one with the largest coefficient as the primary alarm.

[0125] In a specific example, and considering the corresponding application scenario, the processing procedure can be as follows:

[0126] Step 1: Assuming that alarms occur in 5-minute intervals, we will process 12 sets of base station alarm data from within 1 hour.

[0127] Step 2: Calculate the support and confidence of each alarm group, take the portion greater than the threshold, and complete the merging of the association rules.

[0128] Step 3: Assume the number of users with poor quality in the alarm group is 9, 2, 6, 8, and 10 respectively.

[0129] Step 4: After sorting, the numbers are: 2, 6, 8, 9, 10. After summing, the numbers are: 2, 8, 16, 25, 35.

[0130] Step 5: (1) Divide by the maximum value (reduction) in sequence: 0.057, 0.229, 0.457, 0.714, 1; (2) Add an element 0 to the beginning of the array: 0, 0.057, 0.229, 0.457, 0.714, 1; (3) Divide the array index by the maximum value in sequence, starting from 0: 0, 0.2, 0.4, 0.6, 0.8, 1.

[0131] Step 6: Create a line graph, as shown below. Figure 3 As shown.

[0132] Integral B using the trapezoidal area method:

[0133] The first trapezoid has an upper base of 0, a lower base of 0.057, and a height of 0.2.

[0134] The first trapezoid has an upper base of 0.057, a lower base of 0.229, and a height of 0.2.

[0135] The first trapezoid has an upper base of 0.229, a lower base of 0.457, and a height of 0.2.

[0136] The first trapezoid has an upper base of 0.457, a lower base of 0.714, and a height of 0.2.

[0137] The first trapezoid has an upper base of 0.714, a lower base of 1, and a height of 0.2.

[0138] Calculate the area of ​​each area separately to obtain B.

[0139] Step 7: Finally, calculate the Gini coefficient using gini = (0.5 - B) / 0.5.

[0140] By locating the root cause of alarms based on the number of users with poor performance, the accuracy of alarm association rules is improved, providing effective support for subsequent fault location and thus improving the efficiency and accuracy of fault location.

[0141] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0142] Reference Figure 4 The diagram shows a structural block diagram of an alarm data processing device provided in an embodiment of the present invention, which may specifically include the following modules:

[0143] The data acquisition module 401 is used to acquire alarm data for Internet Protocol Television;

[0144] The data grouping module 402 is used to group the alarm data to obtain several alarm data groups, and the alarm data contained in each alarm data group is unique.

[0145] The itemset construction module 403 is used to construct frequent itemsets and alarm association rules corresponding to the frequent itemsets based on the alarm data, and to filter the alarm association rules to obtain a first alarm association rule that meets the conditions.

[0146] The rule processing module 404 is used to count the number of poor-quality users corresponding to the alarm data group under the first alarm association rule, and to perform key processing on the first alarm association rule according to the number of poor-quality users to obtain a second alarm association rule for the Internet Protocol Television (IPTV). The second alarm association rule is the root cause of the alarm for the abnormality of the ITV.

[0147] In some feasible embodiments, the alarm data includes at least the alarm type, alarm time, and alarm details corresponding to the Internet Protocol Television (IPTV) alarm, and the data grouping module 402 is specifically used for:

[0148] The alarm types and alarm details are grouped according to the alarm time to obtain several alarm data groups corresponding to the alarm data.

[0149] In some feasible embodiments, the itemset construction module 403 is specifically used for:

[0150] Identify all individual alarm items from the alarm data;

[0151] Calculate the first support corresponding to each alarm item, and compare the first support corresponding to each alarm item with a preset support threshold to filter out target alarm items;

[0152] Perform a set union on the target alarm items to obtain a candidate frequent alarm item set;

[0153] Calculate the second support corresponding to each of the candidate frequent alarm itemsets, and compare the second support corresponding to each of the candidate frequent alarm itemsets with the preset support threshold to filter out new candidate frequent alarm itemsets;

[0154] The candidate frequent itemsets are continuously merged and filtered according to the preset support threshold until no new candidate frequent alarm itemsets can be generated. The final candidate frequent alarm itemsets are then used as the target frequent alarm itemsets corresponding to the Internet Protocol Television.

[0155] Based on the target frequent alarm item set, alarm association rules corresponding to the Internet Protocol Television are generated. The alarm association rules are used to describe the association relationship between the alarm items. Each alarm association rule consists of a predicate and a postdicate. The predicate is used to characterize the condition of the alarm association rule, and the postdicate is used to characterize the result of the alarm association rule.

[0156] In some feasible embodiments, the itemset construction module 403 is specifically used for:

[0157] Alarm items with a first support level greater than or equal to a preset support threshold are designated as target alarm items.

[0158] In some feasible embodiments, the itemset construction module 403 is specifically used for:

[0159] Calculate the confidence level corresponding to each of the aforementioned alarm association rules;

[0160] Alarm association rules with a confidence level greater than or equal to a preset confidence threshold are used as the first alarm association rules for the Internet Protocol Television.

[0161] In some feasible embodiments, the rule processing module 404 is specifically used for:

[0162] The alarm data group is sorted according to the number of users with poor quality, and the sorted number of users with poor quality is summed to obtain the corresponding sum value;

[0163] Divide the sum by the number of users with the largest quality difference to obtain the normalized target result;

[0164] The normalized result is used to calculate the Gini coefficient corresponding to the first alarm association rule using the trapezoidal area method;

[0165] The first alarm association rule with a Gini coefficient greater than or equal to a preset coefficient threshold is used as the second alarm association rule for the Internet Protocol Television.

[0166] In some feasible embodiments, it also includes:

[0167] The analysis module is used to respond to the detection of an anomaly for the Internet Protocol Television (IPTV), obtain the anomaly status information corresponding to the anomaly detection, and match the anomaly status information with the second alarm association rule to obtain the cause of the anomaly for the ITV.

[0168] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0169] In addition, this invention also provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the various processes of the above-described alarm data processing method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0170] This invention also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the various processes of the above-described alarm data processing method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0171] Figure 5 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0172] The electronic device 500 includes, but is not limited to, components such as: a radio frequency unit 501, a network module 502, an audio output unit 503, an input unit 504, a sensor 505, a display unit 506, a user input unit 507, an interface unit 508, a memory 509, a processor 510, and a power supply 511. Those skilled in the art will understand that the electronic device structure involved in the embodiments of the present invention does not constitute a limitation on the electronic device. An electronic device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements. In the embodiments of the present invention, the electronic device includes, but is not limited to, mobile phones, tablet computers, laptops, PDAs, in-vehicle terminals, wearable devices, and pedometers.

[0173] It should be understood that, in this embodiment of the invention, the radio frequency unit 501 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink data from the base station and processes it with the processor 510; additionally, it transmits uplink data to the base station. Typically, the radio frequency unit 501 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier, a duplexer, etc. Furthermore, the radio frequency unit 501 can also communicate with networks and other devices through a wireless communication system.

[0174] The electronic device provides users with wireless broadband internet access through the network module 502, such as helping users send and receive emails, browse web pages, and access streaming media.

[0175] The audio output unit 503 can convert audio data received by the radio frequency unit 501 or the network module 502 or stored in the memory 509 into audio signals and output them as sound. Furthermore, the audio output unit 503 can also provide audio output related to specific functions performed by the electronic device 500 (e.g., call signal reception sound, message reception sound, etc.). The audio output unit 503 includes a speaker, a buzzer, and a receiver, etc.

[0176] Input unit 504 is used to receive audio or video signals. Input unit 504 may include a graphics processing unit (GPU) 5041 and a microphone 5042. The GPU 5041 processes image data of still images or videos acquired by an image capture device (such as a camera) in video capture mode or image capture mode. The processed image frames can be displayed on display unit 506. The image frames processed by GPU 5041 can be stored in memory 509 (or other storage medium) or transmitted via radio frequency unit 501 or network module 502. Microphone 5042 can receive sound and process such sound into audio data. The processed audio data can be converted into a format that can be transmitted to a mobile communication base station via radio frequency unit 501 in telephone call mode.

[0177] The electronic device 500 also includes at least one sensor 505, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel 5061 according to the ambient light level, and the proximity sensor can turn off the display panel 5061 and / or backlight when the electronic device 500 is moved to the ear. As a type of motion sensor, an accelerometer sensor can detect the magnitude of acceleration in various directions (generally three axes). When stationary, it can detect the magnitude and direction of gravity and can be used to identify the posture of the electronic device (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc. The sensor 505 may also include a fingerprint sensor, pressure sensor, iris sensor, molecular sensor, gyroscope, barometer, hygrometer, thermometer, infrared sensor, etc., which will not be described in detail here.

[0178] The display unit 506 is used to display information input by the user or information provided to the user. The display unit 506 may include a display panel 5061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0179] User input unit 507 can be used to receive input numerical or character information, and to generate key signal inputs related to user settings and function control of electronic devices. Specifically, user input unit 507 includes a touch panel 5071 and other input devices 5072. Touch panel 5071, also known as a touch screen, can collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near touch panel 5071). Touch panel 5071 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, and sends it to the processor 510, which receives and executes commands from the processor 510. In addition, touch panel 5071 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. Besides touch panel 5071, user input unit 507 may also include other input devices 5072. Specifically, other input devices 5072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, joysticks, etc., which will not be described in detail here.

[0180] Furthermore, the touch panel 5071 can cover the display panel 5061. When the touch panel 5071 detects a touch operation on or near it, it transmits the information to the processor 510 to determine the type of touch event. Subsequently, the processor 510 provides corresponding visual output on the display panel 5061 according to the type of touch event. It is understood that in one embodiment, the touch panel 5071 and the display panel 5061 are implemented as two independent components to realize the input and output functions of the electronic device. However, in some embodiments, the touch panel 5071 and the display panel 5061 can be integrated to realize the input and output functions of the electronic device. The specific implementation is not limited here.

[0181] Interface unit 508 serves as an interface for connecting external devices to electronic device 500. For example, external devices may include a wired or wireless headphone port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, and so on. Interface unit 508 can be used to receive input from external devices (e.g., data, power, etc.) and transmit the received input to one or more components within electronic device 500, or it can be used to transmit data between electronic device 500 and external devices.

[0182] The memory 509 can be used to store software programs and various data. The memory 509 may primarily include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function (such as sound playback, image playback, etc.), etc.; the data storage area may store data created based on the use of the mobile phone (such as audio data, phonebook, etc.). Furthermore, the memory 509 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0183] The processor 510 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines. By running or executing software programs and / or modules stored in the memory 509, and by calling data stored in the memory 509, it performs various functions and processes data, thereby providing overall monitoring of the electronic device. The processor 510 may include one or more processing units; preferably, the processor 510 may integrate an application processor and a modem processor. The application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 510.

[0184] The electronic device 500 may also include a power supply 511 (such as a battery) for supplying power to various components. Preferably, the power supply 511 can be logically connected to the processor 510 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system.

[0185] In addition, the electronic device 500 includes some functional modules not shown, which will not be described in detail here.

[0186] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0187] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0188] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

[0189] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0190] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0191] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0192] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0193] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0194] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0195] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for processing alarm data, characterized in that, include: Obtain alarm data for Internet Protocol Television; The alarm data is grouped to obtain several alarm data groups, and the alarm data contained in each alarm data group is unique; Based on the alarm data, a frequent itemset and alarm association rules corresponding to the frequent itemset are constructed, and the alarm association rules are filtered to obtain a first alarm association rule that meets the conditions. Count the number of users with poor data quality corresponding to the alarm data group under the first alarm association rule; The alarm data group is sorted according to the number of users with poor quality, and the sorted number of users with poor quality is summed to obtain the corresponding sum value; Divide the sum by the number of users with the largest quality difference to obtain the normalized target result; The normalized target result is used to calculate the Gini coefficient corresponding to the first alarm association rule using the trapezoidal area method; The first alarm association rule with a Gini coefficient greater than or equal to a preset coefficient threshold is used as the second alarm association rule for the Internet Protocol Television (IPTV). The second alarm association rule is the root cause of the alarm for the IPTV anomaly.

2. The method according to claim 1, characterized in that, The alarm data includes at least the alarm type, alarm time, and alarm details corresponding to the occurrence of the Internet Protocol Television (IPTV) alarm. The alarm data is then grouped to obtain several alarm data groups, including: The alarm types and alarm details are grouped according to the alarm time to obtain several alarm data groups corresponding to the alarm data.

3. The method according to claim 1, characterized in that, The step of constructing frequent itemsets and alarm association rules corresponding to the frequent itemsets based on the alarm data includes: Identify all individual alarm items from the alarm data; Calculate the first support corresponding to each alarm item, and compare the first support corresponding to each alarm item with a preset support threshold to filter out target alarm items; Perform a set union on the target alarm items to obtain a candidate frequent alarm item set; Calculate the second support corresponding to each of the candidate frequent alarm itemsets, and compare the second support corresponding to each of the candidate frequent alarm itemsets with the preset support threshold to filter out new candidate frequent alarm itemsets; The candidate frequent itemsets are continuously merged and filtered according to the preset support threshold until no new candidate frequent alarm itemsets can be generated. The final candidate frequent alarm itemsets are then used as the target frequent alarm itemsets corresponding to the Internet Protocol Television. Based on the target frequent alarm item set, alarm association rules corresponding to the Internet Protocol Television are generated. The alarm association rules are used to describe the association relationship between the alarm items. Each alarm association rule consists of a predicate and a postdicate. The predicate is used to characterize the condition of the alarm association rule, and the postdicate is used to characterize the result of the alarm association rule.

4. The method according to claim 3, characterized in that, The step of comparing the first support corresponding to each alarm item with a preset support threshold to filter out target alarm items includes: Alarm items with a first support level greater than or equal to a preset support threshold are designated as target alarm items.

5. The method according to claim 3, characterized in that, The step of filtering the alarm association rules to obtain a first alarm association rule that meets the conditions includes: Calculate the confidence level corresponding to each of the aforementioned alarm association rules; Alarm association rules with a confidence level greater than or equal to a preset confidence threshold are used as the first alarm association rules for the Internet Protocol Television.

6. The method according to claim 1, characterized in that, Also includes: In response to the detection of an anomaly for the Internet Protocol Television (IPTV), the system obtains the anomaly status information corresponding to the anomaly detection and matches the anomaly status information with the second alarm association rule to obtain the cause of the anomaly for the ITV.

7. An alarm data processing device, characterized in that, include: The data acquisition module is used to acquire alarm data for Internet Protocol TV. The data grouping module is used to group the alarm data to obtain several alarm data groups, and the alarm data contained in each alarm data group is unique. The itemset construction module is used to construct frequent itemsets and alarm association rules corresponding to the frequent itemsets based on the alarm data, and to filter the alarm association rules to obtain a first alarm association rule that meets the conditions. The rule processing module is used to count the number of poor-quality users corresponding to the alarm data group under the first alarm association rule; sort the alarm data group according to the number of poor-quality users, and sum the sorted poor-quality users to obtain the corresponding sum value. Divide the sum by the number of users with the largest quality difference to obtain the normalized target result; The normalized target result is used to calculate the Gini coefficient corresponding to the first alarm association rule using the trapezoidal area method; The first alarm association rule with a Gini coefficient greater than or equal to a preset coefficient threshold is used as the second alarm association rule for the Internet Protocol Television (IPTV). The second alarm association rule is the root cause of the alarm for the IPTV anomaly.

8. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; The memory is used to store computer programs; When the processor executes a program stored in the memory, it implements the method as described in any one of claims 1-6.

9. A computer-readable storage medium having instructions stored thereon that, when executed by one or more processors, cause the processors to perform the method as described in any one of claims 1-6.

Images