Core network root cause alarm positioning method, device, equipment, storage medium and product

Abstract

The application provides a core network root cause alarm positioning method, device, equipment, storage medium and product, comprising: acquiring current alarm information; analyzing the current alarm information according to a pre-constructed network element fault Bayesian network and a network element first-order predicate logic, determining a network element level root cause alarm positioning result; analyzing the current alarm information according to a pre-constructed network fault Bayesian network and a network first-order predicate logic, determining a network level root cause alarm positioning result; and outputting a final root cause alarm positioning result based on the network element level and network level root cause alarm positioning results. The application can realize automatic positioning analysis of root cause alarms, improve the maintenance efficiency of the core network; by constructing the Bayesian networks at the network element and network levels, using the Bayesian networks and the first-order predicate logic, realizing the network element level and network level fault root cause positioning, filtering the influence of invalid alarms and non-root cause alarms on troubleshooting, and improving the accuracy of troubleshooting root cause positioning.

Description

Technical Field

[0001] This invention relates to the field of core network technology, and in particular to a method, apparatus, device, storage medium, and product for locating root cause alarms in a core network. Background Technology

[0002] With the development of communication technology and digital transformation, the cloud-based Virtual Internet Protocol Multimedia Subsystem (vIMS) core network has become an important part of voice services. In the cloud-based vIMS core network, the connections between various Virtual Network Functions (VNFs) are quite complex, posing significant challenges to fault analysis and localization.

[0003] Currently, core network alarms are primarily collected from various network elements through the network management platform. A large number of alarms are analyzed one by one. During troubleshooting, maintenance personnel rely on experience to analyze and judge a large amount of alarm data to ultimately pinpoint the root cause. However, because fault analysis depends entirely on manual experience, problems such as difficulty in fault location, extended processing time, and unpredictable service recovery time exist, resulting in low efficiency in locating the root cause of faults and consequently impacting the user service experience. Summary of the Invention

[0004] This invention provides a core network root cause alarm location method, device, equipment, storage medium, and product to solve the shortcomings of low efficiency in locating the root cause of faults in the prior art. It realizes the automatic sorting out of the causal relationship between alarms in the complex network structure of vIMS, digs out the root cause of alarms, and realizes intelligent delimitation and location of cloud vIMS faults, thereby significantly improving the maintenance efficiency of the core network.

[0005] This invention provides a core network root cause alarm location method, comprising:

[0006] Get current alarm information;

[0007] Based on the pre-constructed Bayesian network of network element faults and the first-order predicate logic of network elements, the current alarm information is analyzed to determine the root cause alarm location result at the network element level.

[0008] Based on the pre-constructed network fault Bayesian network and network first-order predicate logic, the current alarm information is analyzed to determine the network-level root cause alarm location result;

[0009] Based on the root cause alarm location results at the network element level and the network level, the final root cause alarm location result is output.

[0010] According to the core network root cause alarm localization method provided by the present invention, the network element fault Bayesian network is constructed in the following manner:

[0011] Construct the core network device topology relationship; the core network device topology relationship includes network element, domain relationship and network element connection relationship;

[0012] The historical alarm information is grouped at the granularity of the network element to obtain the historical alarm information of multiple network elements;

[0013] For each network element, a scalable sliding time window algorithm is used to divide the historical alarm information of the network element into multiple items, and the earliest alarm of different types in each item is retained to obtain the item set of each network element;

[0014] Based on the item set of network elements of the same type, construct a first two-dimensional matrix to describe the relationship between the number of alarms occurring among network elements of the same type;

[0015] Based on the first two-dimensional matrix, the relationship between alarms is evaluated, and a network element fault Bayesian network is constructed to describe the relationship between alarms under the same type of network element.

[0016] According to a core network root cause alarm location method provided by the present invention, the historical alarm information of the network element is divided into multiple items using a scalable sliding time window algorithm, including:

[0017] The alarms occurring in the network element are arranged in chronological order to obtain an alarm occurrence timeline;

[0018] For each main window, based on the alarms on the alarm occurrence timeline and the placement position of the main window, determine the alarms within the main window's delay range and place them in the target item;

[0019] Based on the placement of the main window, place the corresponding extended window, identify alarms within the extended window's delay range, and add them to the target item.

[0020] After placing each alarm on the alarm occurrence timeline into its corresponding item, multiple items are obtained.

[0021] According to the core network root cause alarm localization method provided by the present invention, the step of constructing a first two-dimensional matrix to describe the relationship between the occurrence frequency of alarms among network elements of the same type based on the item set of network elements of the same type includes:

[0022] Traverse the item set of network elements of the same type, and count the number of times the first alarm type occurs before the second alarm type, and the number of times the first alarm type occurs but the second alarm type does not occur; wherein, the first alarm type is any alarm type, and the second alarm type is one of the other alarm types besides the stated any alarm type;

[0023] Based on the number of times the first alarm type occurs before the second alarm type, and the number of times the first alarm type occurs but the second alarm type does not occur, a first two-dimensional matrix is ​​constructed to describe the relationship between the number of occurrences of alarms under the same type of network element.

[0024] According to the present invention, a core network root cause alarm localization method includes, in which the alarm relationship assessment is performed based on the first two-dimensional matrix, and a network element fault Bayesian network is constructed to describe the relationship between alarms under the same type of network element, comprising:

[0025] Based on the number of times the first alarm type occurred before the second alarm type and the total number of alarms occurring between them, the first evaluation value of the first alarm type as a triggering factor for the second alarm type is calculated.

[0026] Based on the number of times the second alarm type occurred before the first alarm type and the total number of alarms occurring between them, a second evaluation value for the second alarm type as a triggering factor of the first alarm type is calculated.

[0027] The correlation evaluation value between the first alarm type and the second alarm type is calculated based on the number of times the first alarm type occurs before the second alarm type, the number of times the second alarm type occurs before the first alarm type, and the total number of occurrences between the alarms.

[0028] Based on the first evaluation value and the correlation evaluation value, the relationship between the first alarm type and the second alarm type is determined; the relationship includes parent-child relationship and correlation relationship;

[0029] Based on the relationship between the first alarm type and the second alarm type and the topology relationship of the core network devices, a Bayesian network for describing the relationship between alarms under the same type of network element is constructed.

[0030] According to the core network root cause alarm localization method provided by the present invention, the step of analyzing the current alarm information based on a pre-constructed network element fault Bayesian network and network element first-order predicate logic to determine the network element-level root cause alarm localization result includes:

[0031] Using network elements as the granularity, obtain the first initial root cause alarm set within a preset range of the fault time point;

[0032] Traverse all alarm types in the first initial root cause alarm set. When the network element fault Bayesian network determines that there is a triggering alarm in the first initial root cause alarm set that is currently being traversed, remove the currently traversed alarm from the first initial root cause alarm set to obtain the first final root cause alarm set.

[0033] The first final root cause alarm set is grouped to obtain multiple root cause alarm groups; wherein, the root cause alarms within each group are related, and the root cause alarms between groups are not related.

[0034] For root cause alarms within each group, the first-order predicate logic of the network element is used for analysis to determine the root cause alarm location results at the network element level.

[0035] According to the core network root cause alarm localization method provided by the present invention, the network fault Bayesian network is constructed in the following manner:

[0036] The historical alarm information of multiple network elements in the same domain, network elements of the same type, and network elements associated with the same protocol are divided into the same group to obtain the historical alarm information of multiple groups of associated network elements.

[0037] For each group of associated network elements, a scalable sliding time window algorithm is used to divide the historical alarm information of the network element into multiple items, and the earliest alarm of different types in each item is retained to obtain the item set of each group of associated network elements.

[0038] Based on the item set of each group of associated network elements, a second two-dimensional matrix is ​​constructed to describe the alarm occurrence relationship under the same group of associated network elements;

[0039] Based on the second two-dimensional matrix, the parent-child relationship between alarms is evaluated, and a network fault Bayesian network is constructed to describe the relationship between alarms under the same group of related network elements.

[0040] According to the core network root cause alarm localization method provided by the present invention, the step of analyzing the current alarm information based on a pre-constructed network fault Bayesian network and network first-order predicate logic to determine the network-level root cause alarm localization result includes:

[0041] Using domain relationships and connection relationships as granularity, obtain the second initial root cause alarm set within a preset range of fault time points;

[0042] Traverse all alarm types in the second initial root cause alarm set. When the network fault Bayesian network determines that there is a triggering alarm in the second initial root cause alarm set that is currently being traversed, remove the currently traversed alarm from the second initial root cause alarm set to obtain the second final root cause alarm set.

[0043] The second final root cause alarm set is grouped to obtain multiple groups of root cause alarms; among them, the root cause alarms within each group are related, while the root cause alarms between groups are not related.

[0044] For root cause alarms within each group, the network first-order predicate logic is used for analysis to determine the network-level root cause alarm location results.

[0045] The present invention also provides a core network root cause alarm location device, comprising:

[0046] The information acquisition module is used to acquire current alarm information;

[0047] The first positioning module is used to analyze the current alarm information based on the pre-constructed network element fault Bayesian network and network element first-order predicate logic to determine the network element-level root cause alarm positioning result.

[0048] The second positioning module is used to analyze the current alarm information based on the pre-constructed network fault Bayesian network and network first-order predicate logic to determine the network-level root cause alarm positioning result.

[0049] The output module is used to output the final root cause alarm location result based on the network element-level root cause alarm location result and the network-level root cause alarm location result.

[0050] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the core network root cause alarm location method as described above.

[0051] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the core network root cause alarm location method as described above.

[0052] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the core network root cause alarm location method as described above.

[0053] The core network root cause alarm location method, device, equipment, storage medium, and product provided by this invention automatically sorts out the causal relationships between alarms in the complex network structure of vIMS by investigating the root cause alarm results at the network element level and investigating the network-level root cause alarm results based on the correlation alarms. This eliminates the need for manual analysis of alarm data, enabling the rapid identification of root cause alarms from massive amounts of alarm information and improving the maintenance efficiency of the cloud-based vIMS core network. By constructing Bayesian network models at the network element and network levels and utilizing Bayesian networks and first-order predicate logic, the invention achieves network element-level and network-level fault root cause location in the cloud-based vIMS network. This filters out the impact of invalid alarms and non-root cause alarms on troubleshooting, improving the accuracy of fault root cause location. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0055] Figure 1 This is a flowchart illustrating the core network root cause alarm location method provided in this embodiment of the invention.

[0056] Figure 2 This is a schematic diagram illustrating the construction process of the Bayesian network for network element faults provided in an embodiment of the present invention.

[0057] Figure 3 This is a schematic diagram of the sub-items provided in the embodiments of the present invention.

[0058] Figure 4 This is a schematic diagram of the first two-dimensional matrix provided in an embodiment of the present invention.

[0059] Figure 5 This is an example diagram illustrating root cause localization based on first-order predicate logic, provided in an embodiment of the present invention.

[0060] Figure 6 This is a functional structure diagram of the core network root cause alarm location method provided in the embodiments of the present invention.

[0061] Figure 7 This is a schematic diagram of the core network root cause alarm location device provided in an embodiment of the present invention.

[0062] Figure 8 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0063] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0064] The relevant root cause alarm localization technology mainly focuses on manual analysis of alarms generated by single network elements, which has the following main drawbacks:

[0065] 1. Dependence on personnel skill level: Operation and maintenance personnel need to collect a large number of network element alarms from the network management system, and analyze the alarm data one by one based on their personal experience to find anomalies and determine possible root causes.

[0066] 2. Low efficiency in root cause alarm troubleshooting: Mobile communication networks have complex layers and architectures. After a single network element fails, the network element itself and its surrounding related network elements will generate a large amount of related alarm data. In the massive amount of alarm data, important information is often buried. If each alarm is checked one by one, there is a problem of low efficiency in locating the root cause of the fault.

[0067] To address the aforementioned issues, this invention automatically identifies causal relationships between alarms in the complex network structure of vIMS by investigating root cause alarms at the network element level and by investigating network-level root cause alarms based on correlation alarms. This eliminates the need for manual analysis of alarm data, enabling rapid identification of root cause alarms from massive amounts of alarm information and improving the maintenance efficiency of the cloud-based vIMS core network. Furthermore, by constructing Bayesian network models at the network element and network levels and utilizing Bayesian networks and first-order predicate logic, it achieves network element-level and network-level fault root cause localization in the cloud-based vIMS network. This filters out the impact of invalid alarms and non-root cause alarms on troubleshooting, improving the accuracy of fault root cause localization.

[0068] Figure 1 This is a flowchart illustrating the core network root cause alarm location method provided in this embodiment of the invention. (Refer to...) Figure 1 This invention provides a core network root cause alarm location method, which may specifically include the following steps:

[0069] Step 110: Obtain the current alarm information.

[0070] It should be noted that the execution subject of the core network root cause alarm location method provided in this embodiment of the invention can be an electronic device, a component in the electronic device, an integrated circuit, or a chip. The electronic device can be a mobile electronic device or a non-mobile electronic device. For example, a mobile electronic device can be a mobile phone, tablet computer, laptop computer, PDA, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc., while a non-mobile electronic device can be a server, network attached storage (NAS), personal computer (PC), television (TV), ATM, or self-service machine, etc. This embodiment of the invention does not specifically limit the specific implementation of these methods.

[0071] Specifically, when a fault occurs, the network management platform can collect current alarm information and automatically perform root cause analysis on the current alarm information, and output the root cause alarm location results.

[0072] Step 120: Analyze the current alarm information based on the pre-constructed network element fault Bayesian network and network element first-order predicate logic to determine the network element-level root cause alarm location result.

[0073] Among them, the Bayesian network for network element faults can be used to describe the relationship between alarms of the same type of network element. The first-order predicate logic of network elements can be used to define the reasoning logic for inferring the root cause of faults based on the relationship between alarms of the same type of network element.

[0074] In this embodiment of the invention, multiple alarms may exist under the same type of network element. By utilizing the relationship between alarms under the same type of network element for root cause analysis, the root cause alarm location result can be determined at the network element level. Specifically, the current alarm information can be analyzed based on a pre-constructed network element-level fault Bayesian network and predefined network element-level first-order predicate logic, thereby determining the root cause alarm location result at the network element level.

[0075] This invention utilizes Bayesian networks for network element faults and first-order predicate logic for network elements to achieve root cause localization of network element-level faults in cloud-based vIMS networks. This filters out the impact of invalid alarms and non-root cause alarms on troubleshooting, thereby improving the accuracy of root cause localization.

[0076] Step 130: Analyze the current alarm information based on the pre-constructed network fault Bayesian network and network first-order predicate logic to determine the network-level root cause alarm location result.

[0077] Among them, the Bayesian network for network faults can be used to describe the relationship between alarms in the same group of related network elements. Related network elements can refer to network elements in the same domain or those with protocol associations. The first-order predicate logic of the network can be used to define the reasoning logic for inferring the root cause of a fault based on the relationship between alarms in the same group of related network elements.

[0078] In this embodiment of the invention, multiple alarms may exist under the same group of related network elements. By utilizing the relationships between alarms under the same group of related network elements for root cause analysis, the root cause alarm location result can be determined from the network level. Specifically, the current alarm information can be analyzed based on a pre-constructed network-level fault Bayesian network and predefined network-level first-order predicate logic, thereby determining the root cause alarm location result from the network level.

[0079] This invention utilizes a network fault Bayesian network and first-order predicate logic to achieve network-level fault root cause localization in cloud-based vIMS networks, thereby filtering out the impact of invalid alarms and non-root cause alarms on troubleshooting and improving the accuracy of fault root cause localization.

[0080] Step 140: Based on the network element-level root cause alarm location result and the network-level root cause alarm location result, output the final root cause alarm location result.

[0081] In this embodiment of the invention, after obtaining the root cause alarm location results at the network element level and the network level, the final root cause alarm location results can be output and fed back to the user, thereby eliminating the need for manual analysis of a large number of alarms one by one and improving the efficiency of fault root cause location.

[0082] This invention, through identifying root cause alarms at the network element level and network-level root cause alarms based on correlation alarms, automatically identifies causal relationships between alarms in the complex network structure of vIMS. This eliminates the need for manual analysis of alarm data, enabling rapid identification of root cause alarms from massive amounts of alarm information and improving the maintenance efficiency of the cloud-based vIMS core network. Furthermore, by constructing Bayesian network models at the network element and network levels, and utilizing Bayesian networks and first-order predicate logic, it achieves network element-level and network-level fault root cause localization in the cloud-based vIMS network. This filters out the impact of invalid alarms and non-root cause alarms on troubleshooting, improving the accuracy of fault root cause localization.

[0083] Figure 2 This is a schematic diagram illustrating the construction process of a Bayesian network for network element faults provided in an embodiment of the present invention. (Refer to...) Figure 2 Based on any of the above embodiments, the network element fault Bayesian network can be constructed through the following steps:

[0084] Step 210: Construct the core network device topology relationship; the core network device topology relationship includes network element, domain relationship and network element connection relationship.

[0085] In this embodiment of the invention, a topology relationship of cloud-based vIMS core network devices can be constructed for subsequent alarm association. These cloud-based vIMS core network devices may include User Data Management (UDM), Call Session Control Function (CSCF), Telephony Application Server (TAS), Data Router and Authorization Server (DRA), Session Border Controller (SBC), etc.

[0086] The topology of cloud-based vIMS core network devices can include network elements, domain relationships, and network element connection relationships. Specifically, a network element is a binary tuple (network element A, network element type), and alarms can be grouped at the network element level. A domain relationship is a binary tuple (network element A, domain name). In the cloud-based core network architecture, network functions can be shared by multiple similar devices within a functional domain. In this embodiment, alarms can be merged and mined based on functional domains or device pools. A connection relationship is a triple tuple (network element A, network element B, connection protocol). Service processes involve multi-network element collaboration, and many faults require consideration of alarm propagation across multiple types of network elements. In this embodiment, alarms can be merged and mined based on network connectivity.

[0087] Step 220: Group the historical alarm information at the granularity of the network element to obtain the historical alarm information of multiple network elements.

[0088] In this embodiment of the invention, all historical alarm data within a preset time period of the cloud-based vIMS core network can be collected from the network management system and preprocessed using data structuring. Specifically, data structuring can be completed by parsing historical alarm data and extracting information such as data center, network element name, network element type, alarm number, alarm occurrence time, alarm title, and detailed description. The preset time period can be set according to actual needs; for example, the preset time period can be 6 months.

[0089] After completing the data structuring preprocessing, network element fault Bayesian networks and network fault Bayesian networks can be constructed according to the scope of impact. Specifically, when constructing the network element fault Bayesian network, historical alarms can be grouped at the network element level, with each group corresponding to the full historical alarm structured information of a specified network element, thus obtaining the structured information of historical alarms for multiple network elements.

[0090] Step 230: For each network element, the historical alarm information of the network element is divided into multiple items using a scalable sliding time window algorithm, and the earliest alarm of different types in each item is retained to obtain the item set for each network element.

[0091] Specifically, for each set of historical alarm structured information corresponding to a specified network element, a scalable sliding time window algorithm can be used to divide the alarm information into multiple items (cases) to obtain the initial item set for each network element. Then, for each item, alarm information deduplication is performed, and the earliest alarms of different types are retained to obtain the item set for each network element.

[0092] Step 240: Based on the item set of network elements of the same type, construct a first two-dimensional matrix to describe the relationship between the number of alarms occurring among network elements of the same type.

[0093] Specifically, based on the network element type, the item sets of all network elements of the same type can be grouped together to obtain the item set of network elements of the same type. Each type of network element can correspond to a first two-dimensional matrix. Based on the item set of network elements of the same type, a first two-dimensional matrix is ​​constructed to describe the relationship between the occurrence frequency of alarms among network elements of the same type.

[0094] Step 250: Based on the first two-dimensional matrix, evaluate the relationship between alarms and construct a network element fault Bayesian network to describe the relationship between alarms under the same type of network element.

[0095] Specifically, alarm relationships can be evaluated based on the frequency of alarms among similar network elements. This evaluation determines whether the alarm relationship is a parent-child relationship or an association relationship, thereby supplementing the core network device topology with alarm relationships and obtaining a network element fault Bayesian network to describe the alarm relationships among similar network elements. Specifically, a parent-child / association relationship network model is maintained for each network element type.

[0096] This invention, through the construction of a Bayesian network model at the network element level, enables the location of network element-level faults in cloud-based vIMS networks using network element fault Bayesian networks and first-order predicate logic. This filters out the impact of invalid alarms and non-root cause alarms on troubleshooting, thereby improving the accuracy of fault root cause location.

[0097] Based on any of the above embodiments, the step of using a scalable sliding time window algorithm to divide the historical alarm information of the network element into multiple items may specifically include:

[0098] Step 231: Arrange the alarms occurring in the network element in chronological order to obtain an alarm occurrence timeline;

[0099] Step 232: For each main window, based on the alarms on the alarm occurrence timeline and the placement position of the main window, determine the alarms within the main window's delay range and place them in the target item;

[0100] Step 233: Based on the placement position of the main window, place the corresponding extended window, determine the alarms within the time delay range of the extended window, and put them into the target item;

[0101] Step 234: After placing each alarm on the alarm occurrence timeline into the corresponding item, multiple items are obtained.

[0102] The sliding time window can include a main window delay and an extended window delay. In this embodiment of the invention, alarms occurring on the same network element can be arranged in chronological order to obtain an alarm occurrence timeline corresponding to that network element. A sliding time window can be placed on the timeline, and alarms within the main window's delay range are placed into the target item corresponding to that main window based on the placement position of the alarms on the timeline and the main window. An extended window can be placed based on the main window's position, and alarms within the extended window's delay range are placed into the target item corresponding to that main window. After placing all alarms on the alarm occurrence timeline into their corresponding items, multiple items can be obtained.

[0103] Figure 3 This is a schematic diagram of the components provided in an embodiment of the present invention. (Refer to...) Figure 3 The sliding time window can include the main window delay ΔT and the extended window delay Δt.

[0104] For example, a1~a8 can be alarms occurring in the same network element, and can be arranged in chronological order. Alarms a1~a8 correspond to time points T0~T7 respectively, resulting in an alarm occurrence timeline for the same network element. A sliding time window can be placed on the timeline. Based on the placement position of the main window ΔT, it is known that T2 < T0 + ΔT (within the range of ΔT), and T3 > T0 + ΔT (outside the range of ΔT). Therefore, alarms a1, a2, and a3 can all be placed in item Case 1.

[0105] We can restart from T2 and check if there are any new alarms within the extended window delay range. Since alarm a4 occurred within the extended window delay range Δt, alarm a4 can be placed in the corresponding item Case 1.

[0106] Starting from T3, we can repeatedly check whether there are any new alarms within the extended window delay range until no new alarms appear within the extended window delay range, thus constructing Case 1.

[0107] Similarly, Case 1 (corresponding to alarms a1~a4), Case 2 (corresponding to alarms a5 and a6), and Case 3 (corresponding to alarms a7 and a8) can be constructed in the end.

[0108] This invention, through the main window delay and the corresponding extended window delay, can group fault-related alarms into the same category, so that alarms within each category are related, while alarms between categories are not related, thereby achieving the aggregation of fault-related alarms and the isolation between different fault alarms.

[0109] In this embodiment of the invention, a scalable sliding time window algorithm is used during data preprocessing to divide the historical alarm information of network elements into multiple items. The alarm itemization is achieved based on the scalable sliding window, which takes into account both the aggregation of fault-related alarms and the isolation between different fault alarms. This helps to reduce the algorithmic complexity of subsequent construction of Bayesian networks for network element-level and network-level faults.

[0110] Based on any of the above embodiments, the step of constructing a first two-dimensional matrix to describe the relationship between the frequency of alarms among network elements of the same type, according to the item set of network elements of the same type, may specifically include:

[0111] Step 241: Traverse the item set of network elements of the same type, and count the number of times the first alarm type occurs before the second alarm type, and the number of times the first alarm type occurs but the second alarm type does not occur; wherein, the first alarm type is any alarm type, and the second alarm type is one of the other alarm types besides the aforementioned any alarm type;

[0112] Step 242: Based on the number of times the first alarm type occurs before the second alarm type, and the number of times the first alarm type occurs but the second alarm type does not occur, construct a first two-dimensional matrix to describe the relationship between the number of occurrences of alarms under the same type of network element.

[0113] In this embodiment of the invention, the set of all items of all network elements of the same type can be traversed to count the occurrence frequency relationship between two alarms, and a first two-dimensional matrix N×N can be constructed to describe the pairwise relationship between alarms. Each type of network element can correspond to one first two-dimensional matrix, where N is the number of all alarm types under the same type of network element.

[0114] Specifically, any alarm type can be designated as the first alarm type, and one of the other alarm types can be designated as the second alarm type. The number of times the first alarm type occurs before the second alarm type, and the number of times the first alarm type occurs but the second alarm type does not occur, are counted. This allows us to obtain the number of times each alarm type occurs before any other alarm type, and the number of times each alarm type occurs but no other alarm type occurs.

[0115] A first two-dimensional matrix can be constructed to describe the relationship between the occurrence times of alarms of the same type under the same network element, with the number of times the first alarm type occurs before the second alarm type as the row element and the number of times the first alarm type occurs and the second alarm type does not occur as the column element.

[0116] Figure 4 This is a schematic diagram of a first two-dimensional matrix provided in an embodiment of the present invention. (Refer to...) Figure 4 As an example, 3431 / 21 represents the number of times alarm type 1 occurred before alarm type 2. And the number of times alarm type 1 occurred and alarm type 2 did not occur. ; 0 / 7 indicates the number of times alarm type 2 occurred before alarm type 1. And the number of times alarm type 2 occurred and alarm type 1 did not occur. .

[0117] This invention constructs a two-dimensional matrix and then a network element fault Bayesian network to describe the relationship between alarms under the same type of network element. Through the network element fault Bayesian network and the first-order predicate logic of the network element, the network element-level fault root cause localization of the cloud-based vIMS network can be realized, thereby filtering the impact of invalid alarms and non-root cause alarms on troubleshooting and improving the accuracy of fault root cause localization.

[0118] Based on any of the above embodiments, the step of evaluating the relationship between alarms based on the first two-dimensional matrix and constructing a network element fault Bayesian network to describe the relationship between alarms under the same type of network element may specifically include:

[0119] Step 251: Calculate the first evaluation value of the first alarm type as a triggering factor for the second alarm type based on the number of times the first alarm type occurs before the second alarm type and the total number of alarms occurring between them;

[0120] Step 252: Calculate the second evaluation value of the second alarm type as a triggering factor of the first alarm type based on the number of times the second alarm type occurred before the first alarm type and the total number of alarms occurring between them;

[0121] Step 253: Calculate the correlation evaluation value between the first alarm type and the second alarm type based on the number of times the first alarm type occurs before the second alarm type, the number of times the second alarm type occurs before the first alarm type, and the total number of occurrences between the alarms.

[0122] Step 254: Determine the relationship between the first alarm type and the second alarm type based on the first evaluation value and the correlation evaluation value; the relationship includes parent-child relationship and correlation relationship;

[0123] Step 255: Based on the relationship between the first alarm type and the second alarm type and the core network device topology relationship, construct a network element fault Bayesian network to describe the relationship between alarms under the same type of network element.

[0124] The total number of alarm occurrences is the sum of the number of times the first alarm type occurs before the second alarm type, the number of times the first alarm type occurs but the second alarm type does not occur, the number of times the second alarm type occurs before the first alarm type, and the number of times the second alarm type occurs but the first alarm type does not occur.

[0125] The condition for determining a parent-child relationship between alarms can be that the reference evaluation value is greater than the first evaluation threshold M, and the condition for determining a correlation relationship between alarms can be that the correlation evaluation value is greater than the second evaluation threshold K. The specific values ​​of the first and second evaluation thresholds can be set according to actual needs.

[0126] The following example demonstrates the relationship between alarm type 1 and alarm type 2. The total number of occurrences between alarm type 1 and alarm type 2 is the number of times alarm type 1 occurs before alarm type 2. The number of times alarm type 1 occurred and alarm type 2 did not occur. The number of times alarm type 2 occurred before alarm type 1 The number of times alarm type 2 occurred and alarm type 1 did not occur. sum.

[0127] Continue to refer to Figure 4 The ratio of the number of times alarm type 1 occurs before alarm type 2 to the total number of occurrences between alarm type 1 and alarm type 2 can be calculated to obtain the first assessment value of alarm type 1 as a triggering factor for alarm type 2: .

[0128] The ratio of the number of times alarm type 2 occurred before alarm type 1 to the total number of occurrences between alarm type 1 and alarm type 2 can be used to obtain a second evaluation value for alarm type 2 as a triggering factor for alarm type 1: .

[0129] The correlation assessment value between alarm type 1 and alarm type 2 can be obtained by calculating the sum of the number of times alarm type 1 occurs before alarm type 2 and the number of times alarm type 2 occurs before alarm type 1, and then dividing this sum by the total number of occurrences between alarm type 1 and alarm type 2. .

[0130] like Then alarm type 1 is the triggering alarm of alarm type 2 (i.e., the parent alarm); if , If alarm type 1 is related to alarm type 2, then alarm type 2 is an associated alarm; otherwise, alarm type 1 and alarm type 2 are unrelated alarms. Similarly, it can be calculated that alarm type N is both an alarm that triggers alarm type 1 and an alarm that triggers alarm type 2.

[0131] In this embodiment of the invention, based on the relationship between the first alarm type and the second alarm type and the construction of the core network device topology, a network element fault Bayesian network for describing the relationship between alarms under the same type of network element can be constructed.

[0132] This invention constructs a network element fault Bayesian network to describe the relationship between alarms under the same type of network element. Through the network element fault Bayesian network and the first-order predicate logic of the network element, the root cause location of network element-level faults in the cloud-based vIMS network can be realized, thereby filtering the impact of invalid alarms and non-root cause alarms on troubleshooting and improving the accuracy of troubleshooting root cause location.

[0133] Based on any of the above embodiments, the step of analyzing the current alarm information according to the pre-constructed network element fault Bayesian network and network element first-order predicate logic to determine the network element-level root cause alarm location result may specifically include:

[0134] Step 121: Using network elements as the granularity, obtain the first initial root cause alarm set within the preset range of the fault time point.

[0135] Specifically, based on the scalable sliding time window algorithm, all alarm data before and after the network failure time point can be extracted first. The alarms can be parsed, and information such as data center, network element name, network element type, alarm number, alarm occurrence time, alarm title and detailed description can be extracted to complete the data structuring process.

[0136] After completing the data structuring process, the set A={y} of all alarms before and after the fault time point can be obtained at the network element level. i Let the root cause alarm set be C, which can be initialized as C=A.

[0137] The preset range of the fault time point can be set according to actual needs. It can be 10 minutes before or after the fault time point, or it can be 20 minutes. This invention does not impose any specific limitations.

[0138] Step 122: Traverse all alarm types in the first initial root cause alarm set. When the network element fault Bayesian network determines that there is a triggering alarm in the first initial root cause alarm set that is currently being traversed, remove the currently traversed alarm from the first initial root cause alarm set to obtain the first final root cause alarm set.

[0139] Specifically, it is possible to iterate through all alarm types y in the first initial root cause alarm set. i When the first initial root cause alarm set is determined to contain faults based on the Bayesian network of network element faults, If the alarm triggered by the current traversed alarm y is y', then y can be removed from the first initial root cause alarm set.

[0140] The final alarm set retains several alarm types that have no parent-child relationship, meaning that there is a correlation or no correlation between any two alarm types in any root cause alarm set.

[0141] Step 123: Group the first final root cause alarm set to obtain multiple groups of root cause alarms; wherein, the root cause alarms within each group are related, and the root cause alarms between groups are not related.

[0142] In this embodiment of the invention, the first final root cause alarm set can be grouped into C1, C2, ..., Ck, i.e., k groups of root cause alarms. Root cause alarms within each group are correlated, while root cause alarms between groups are not correlated; therefore, the root cause alarm is one of C1 to Ck.

[0143] Step 124: For the root cause alarms in each group, analyze them using the first-order predicate logic of the network element to determine the root cause alarm location results at the network element level.

[0144] In this embodiment of the invention, for each group Ck, the first-order predicate logic of the network element can be used for analysis to confirm the root cause alarm location result at the network element level. The first-order predicate logic of the network element can include basic logic rules and single-network element fault reasoning rules.

[0145] The basic logic rules can be defined as follows:

[0146] (1) proto(x,y): Network element x alarm number y indicates that there is a protocol circuit fault;

[0147] (2) sys(x,y): Network element x alarm number y indicates that there is a system fault;

[0148] (3) hrd(x,y): Network element x alarm number y indicates that there is a hardware fault;

[0149] (4) parent(y1,y2): Alarm y1 is caused by alarm y2. y2 and y1 are parent and child. Whether it is true or not is calculated by Bayesian network.

[0150] (5)ancestry(y1,y2): Alarm y1 is caused directly or indirectly by alarm y2. y2 is the parent of y1. Whether it is true or not is calculated by Bayesian network.

[0151] (6) relation(y1,y2): Alarm y1 and alarm y2 are related. Whether the relationship is true or not is calculated by Bayesian network.

[0152] (7) fault(x,y1,y2): Network element x has a fault y1, which is caused by y2. The root cause alarm is y2.

[0153] The definition of single network element fault reasoning rules can be shown in Table 1:

[0154] Table 1

[0155]

[0156] If it is determined that y1, y2, and y3 are parent alarms and have a related relationship in the case, the final root cause alarm can be determined in the order of priority: hardware failure > system failure > protocol failure.

[0157] This invention, through a Bayesian network of network element faults and first-order predicate logic of network elements, can achieve network element-level fault root cause localization in cloud-based vIMS networks, thereby filtering out the impact of invalid alarms and non-root cause alarms on troubleshooting and improving the accuracy of fault root cause localization.

[0158] Based on any of the above embodiments, the network fault Bayesian network is constructed in the following way: Historical alarm information of multiple network elements associated with the same domain, the same type, and the same protocol is divided into the same group to obtain multiple groups of historical alarm information of associated network elements; for each group of associated network elements, a scalable sliding time window algorithm is used to divide the historical alarm information of the network element into multiple items, and the earliest alarm of different types in each item is retained to obtain the item set of each group of associated network elements; based on the item set of each group of associated network elements, a second two-dimensional matrix is ​​constructed to describe the alarm occurrence relationship under the same group of associated network elements; based on the second two-dimensional matrix, the parent-child relationship between alarms is evaluated to construct a network fault Bayesian network to describe the relationship between alarms under the same group of associated network elements.

[0159] In this embodiment of the invention, the process of constructing a network fault Bayesian network is similar to that of constructing a network element fault Bayesian network. The difference is that the alarm grouping is based on the network element as the granularity, while the alarms of network elements of the same type in the same domain and multiple network elements associated with the same protocol are merged based on the cloud network topology relationship. On this basis, the alarms are further divided into items using the time sequence relationship and the extended time window algorithm to realize the construction of the network fault Bayesian network. This embodiment of the invention will not be described in detail.

[0160] This invention, through the construction of a network-level Bayesian network model, enables network-level fault root cause localization in cloud-based vIMS networks using network fault Bayesian networks and first-order predicate logic. This filters out the impact of invalid alarms and non-root cause alarms on troubleshooting, thereby improving the accuracy of fault root cause localization.

[0161] Based on any of the above embodiments, the step of analyzing the current alarm information and determining the network-level root cause alarm location result according to the pre-constructed network fault Bayesian network and network first-order predicate logic includes: obtaining a second initial root cause alarm set within a preset range of fault time points using domain relations and connection relations as granularity; traversing all alarm types in the second initial root cause alarm set; when the network fault Bayesian network determines that there is a triggering alarm for the currently traversed alarm in the second initial root cause alarm set, removing the currently traversed alarm from the second initial root cause alarm set to obtain a second final root cause alarm set; grouping the second final root cause alarm set to obtain multiple groups of root cause alarms; wherein, the root cause alarms within each group have a correlation relationship, and the root cause alarms between groups do not have a correlation relationship; and analyzing the root cause alarms within each group using network first-order predicate logic to determine the network-level root cause alarm location result.

[0162] In this embodiment of the invention, multiple groups of root cause alarms obtained by grouping the second final root cause alarm set can be analyzed using network first-order predicate logic to confirm the network-level root cause alarm location results. The network first-order predicate logic can include basic logic rules and network fault reasoning rules.

[0163] The network fault reasoning rules can be defined as shown in Table 2:

[0164] Table 2

[0165]

[0166] If a single network element failure cannot be confirmed, the alarm may be triggered by other related network elements.

[0167] In this embodiment of the invention, the process of obtaining all alarm sets before and after the fault time point as A`={yi} with domain relationship / connection relationship as granularity to determine the network-level root cause alarm location result is similar to the process of determining the network element-level root cause alarm location result. The difference is that the model used is network Bayesian network and network first-order predicate logic, which will not be elaborated here.

[0168] Figure 5 This is a schematic diagram illustrating an example of root cause localization based on first-order predicate logic, provided in an embodiment of the present invention. (Refer to...) Figure 5As an example, after determining the root cause alarm location results at the network element level and the network level, the final root cause alarm location results can be displayed and output, such as CSCF (diameter alarm, module alarm, hardware alarm), DRA (diameter alarm, Stream Control Transmission Protocol (SCTP) alarm), SBC (node ​​fault alarm), etc.

[0169] When performing single-network element fault location analysis, the following can be obtained: CSCF (hardware alarm caused diameter alarm), DRA (external cause caused diameter alarm), and SBC (external cause caused node fault alarm).

[0170] When performing network fault location analysis, the following can be obtained: identifying the root cause network element (SBC and DRA problems are caused by CSCF), locating the root cause alarm (CSCF hardware alarm is the root cause), and handling suggestions (prioritize handling CSCF hardware alarm).

[0171] This invention, through the use of a Bayesian network for network faults and first-order predicate logic, can achieve network-level root cause localization of network faults in cloud-based vIMS networks, thereby filtering out the impact of invalid alarms and non-root cause alarms on troubleshooting and improving the accuracy of root cause localization.

[0172] Figure 6 This is a functional structure diagram of the core network root cause alarm location method provided in an embodiment of the present invention. (Refer to...) Figure 6 For different device types and alarm numbers in the cloud-based vIMS core network, the alarm preprocessing and filtering module can be used to count the number of times various alarms occur on the device within a historical period. The number of each alarm is divided by the total number of alarms of that device type in the same time period to obtain the alarm proportion of each alarm number. Alarm types with proportions lower than a preset threshold are selected as filtering rules. Alternatively, alarm types that need to be monitored can be manually entered into the filtering rules to achieve the screening of alarms collected in the live network through the above filtering rules.

[0173] The alarm parsing module can be used to periodically (e.g., every 10 minutes) collect all alarm data from the cloud-based vIMS core network from the network management platform and convert the full alarm data into structured alarm data. The data can include fields such as network element name, network element type, alarm number, alarm title, alarm information, occurrence time, and end time.

[0174] The alarm grouping and itemization module can be used to divide alarms into multiple different item sets according to the network element and network levels based on the topology of cloud-based vIMS core network devices. It can also use a scalable sliding time window to subdivide alarm sequences in the same group to obtain the alarm set for each item, which can be used for subsequent data statistics and Bayesian network construction.

[0175] The alarm database module can be used to store data using a relational database.

[0176] The single-network root cause alarm inference module can be used to obtain the ancestor alarms or ancestor alarm sets for each item's alarm set based on a Bayesian network. These alarms or alarm sets can be used as candidate root cause alarms for subsequent root cause localization.

[0177] The first-order predicate logic rules at the network element level can determine the primary and secondary relationships between alarms in a single network element (alarms of hardware type, system type, protocol type, etc.). The single network element root cause delimitation and location module can be used to further infer and confirm the root cause alarm of a single network element fault based on the first-order predicate logic of the network element.

[0178] The network-level Bayesian network stores the parent-child relationships and associations between alarm types of network elements in the same domain or with protocol associations. The network root cause alarm inference module can be used to obtain the fault root network element and the candidate root cause alarm set for each network element in the network based on the network-level fault Bayesian network.

[0179] Network-level first-order predicate logic rules determine the primary and secondary relationships of alarms among different network elements (alarms of hardware type, system type, protocol type, etc.). The network root cause delineation and localization module can be used to further infer and confirm the network-level fault root source site and root cause based on the network-level first-order predicate logic logic for candidate root cause alarms.

[0180] The delimited location summary output can be used to determine the root cause network element of the fault, the root cause alarm of the fault, and the data integration and storage of the alarm list induced by the fault, so as to present the alarm list to the front end and enable other applications to perform analysis based on the alarm list.

[0181] This invention can not only identify root cause alarm results at the network element level, but also identify network-level root cause alarm results based on related alarms, achieving automatic location of root cause alarms without relying on manual analysis of alarm data. It enables the rapid identification of root cause alarms from massive amounts of alarm information, improving the maintenance efficiency of the cloud-based vIMS core network.

[0182] The embodiments of this invention construct an alarm relationship Bayesian network based on three dimensions: network element, domain, and association protocol. Through the Bayesian network at two levels (network element and network) and first-order predicate logic, the root cause of faults in the cloud-based vIMS network can be located, thereby filtering out the impact of invalid alarms and non-root cause alarms on troubleshooting.

[0183] This invention, through a scalable sliding window method during data preprocessing, achieves alarm itemization, balancing the aggregation of fault-related alarms with the isolation between different fault alarms. This helps reduce the algorithmic complexity of subsequent construction of Bayesian networks of network elements and network relationships.

[0184] The core network root cause alarm location device provided by the present invention is described below. The core network root cause alarm location device described below can be referred to in correspondence with the core network root cause alarm location method described above.

[0185] Figure 7 This is a schematic diagram of the core network root cause alarm location device provided in an embodiment of the present invention. (Refer to...) Figure 7 This invention provides a core network root cause alarm location device, which may specifically include the following modules:

[0186] Information acquisition module 710 is used to acquire current alarm information;

[0187] The first positioning module 720 is used to analyze the current alarm information based on the pre-constructed network element fault Bayesian network and network element first-order predicate logic to determine the network element-level root cause alarm positioning result.

[0188] The second positioning module 730 is used to analyze the current alarm information based on the pre-constructed network fault Bayesian network and network first-order predicate logic to determine the network-level root cause alarm positioning result.

[0189] The output module 740 is used to output the final root cause alarm location result based on the network element-level root cause alarm location result and the network-level root cause alarm location result.

[0190] This invention, through identifying root cause alarms at the network element level and network-level root cause alarms based on correlation alarms, automatically identifies causal relationships between alarms in the complex network structure of vIMS. This eliminates the need for manual analysis of alarm data, enabling rapid identification of root cause alarms from massive amounts of alarm information and improving the maintenance efficiency of the cloud-based vIMS core network. Furthermore, by constructing Bayesian network models at the network element and network levels, and utilizing Bayesian networks and first-order predicate logic, it achieves network element-level and network-level fault root cause localization in the cloud-based vIMS network. This filters out the impact of invalid alarms and non-root cause alarms on troubleshooting, improving the accuracy of fault root cause localization.

[0191] Figure 8 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 8 As shown, the electronic device may include: a processor 810, a communications interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communications interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute a core network root cause alarm location method. This method includes: acquiring current alarm information; analyzing the current alarm information according to a pre-constructed network element fault Bayesian network and network element first-order predicate logic to determine the network element-level root cause alarm location result; analyzing the current alarm information according to a pre-constructed network fault Bayesian network and network first-order predicate logic to determine the network-level root cause alarm location result; and outputting the final root cause alarm location result based on the network element-level root cause alarm location result and the network-level root cause alarm location result.

[0192] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0193] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the core network root cause alarm localization method provided by the above methods. The method includes: acquiring current alarm information; analyzing the current alarm information according to a pre-constructed network element fault Bayesian network and network element first-order predicate logic to determine the network element-level root cause alarm localization result; analyzing the current alarm information according to a pre-constructed network fault Bayesian network and network first-order predicate logic to determine the network-level root cause alarm localization result; and outputting the final root cause alarm localization result based on the network element-level root cause alarm localization result and the network-level root cause alarm localization result.

[0194] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the core network root cause alarm localization method provided by the above methods. The method includes: acquiring current alarm information; analyzing the current alarm information according to a pre-constructed network element fault Bayesian network and network element first-order predicate logic to determine a network element-level root cause alarm localization result; analyzing the current alarm information according to a pre-constructed network fault Bayesian network and network first-order predicate logic to determine a network-level root cause alarm localization result; and outputting a final root cause alarm localization result based on the network element-level root cause alarm localization result and the network-level root cause alarm localization result.

[0195] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0196] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0197] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for locating root cause alarms in a core network, characterized in that, include: Get current alarm information; Based on the pre-constructed Bayesian network of network element faults and the first-order predicate logic of network elements, the current alarm information is analyzed to determine the root cause alarm location result at the network element level. Based on the pre-constructed network fault Bayesian network and network first-order predicate logic, the current alarm information is analyzed to determine the network-level root cause alarm location result; Based on the root cause alarm location results at the network element level and the network level, the final root cause alarm location result is output. The network element fault Bayesian network is constructed in the following way: Construct the core network device topology relationship; the core network device topology relationship includes network element, domain relationship and network element connection relationship; The historical alarm information is grouped at the granularity of the network element to obtain the historical alarm information of multiple network elements; For each network element, a scalable sliding time window algorithm is used to divide the historical alarm information of the network element into multiple items, and the earliest alarm of different types in each item is retained to obtain the item set of each network element; Based on the item set of network elements of the same type, construct a first two-dimensional matrix to describe the relationship between the number of alarms occurring among network elements of the same type; Based on the first two-dimensional matrix, the relationship between alarms is evaluated, and a Bayesian network for describing the relationship between alarms under the same type of network element is constructed. The network fault Bayesian network is constructed in the following way: The historical alarm information of multiple network elements in the same domain, network elements of the same type, and network elements associated with the same protocol are divided into the same group to obtain the historical alarm information of multiple groups of associated network elements. For each group of associated network elements, a scalable sliding time window algorithm is used to divide the historical alarm information of the network element into multiple items, and the earliest alarm of different types in each item is retained to obtain the item set of each group of associated network elements. Based on the item set of each group of associated network elements, a second two-dimensional matrix is ​​constructed to describe the alarm occurrence relationship under the same group of associated network elements; Based on the second two-dimensional matrix, the parent-child relationship between alarms is evaluated, and a network fault Bayesian network is constructed to describe the relationship between alarms under the same group of related network elements.

2. The core network root cause alarm location method according to claim 1, characterized in that, The scalable sliding time window algorithm is used to divide the historical alarm information of the network element into multiple items, including: The alarms occurring in the network element are arranged in chronological order to obtain an alarm occurrence timeline; For each main window, based on the alarms on the alarm occurrence timeline and the placement position of the main window, determine the alarms within the main window's delay range and place them in the target item; Based on the placement of the main window, place the corresponding extended window, identify alarms within the extended window's delay range, and add them to the target item. After placing each alarm on the alarm occurrence timeline into its corresponding item, multiple items are obtained.

3. The core network root cause alarm location method according to claim 1, characterized in that, The construction of a first two-dimensional matrix based on the item set of network elements of the same type to describe the relationship between the frequency of alarms among network elements of the same type includes: Traverse the item set of network elements of the same type, and count the number of times the first alarm type occurs before the second alarm type, and the number of times the first alarm type occurs but the second alarm type does not occur; wherein, the first alarm type is any alarm type, and the second alarm type is one of the other alarm types besides the stated any alarm type; Based on the number of times the first alarm type occurs before the second alarm type, and the number of times the first alarm type occurs but the second alarm type does not occur, a first two-dimensional matrix is ​​constructed to describe the relationship between the number of occurrences of alarms under the same type of network element.

4. The core network root cause alarm location method according to claim 3, characterized in that, The step of evaluating the relationship between alarms based on the first two-dimensional matrix and constructing a network element fault Bayesian network to describe the relationship between alarms of the same type of network element includes: Based on the number of times the first alarm type occurred before the second alarm type and the total number of alarms occurring between them, the first evaluation value of the first alarm type as a triggering factor for the second alarm type is calculated. Based on the number of times the second alarm type occurred before the first alarm type and the total number of alarms occurring between them, a second evaluation value for the second alarm type as a triggering factor of the first alarm type is calculated. The correlation evaluation value between the first alarm type and the second alarm type is calculated based on the number of times the first alarm type occurs before the second alarm type, the number of times the second alarm type occurs before the first alarm type, and the total number of occurrences between the alarms. Based on the first evaluation value and the correlation evaluation value, the relationship between the first alarm type and the second alarm type is determined; the relationship includes parent-child relationship and correlation relationship; Based on the relationship between the first alarm type and the second alarm type and the topology relationship of the core network devices, a Bayesian network for describing the relationship between alarms under the same type of network element is constructed.

5. The core network root cause alarm location method according to claim 1, characterized in that, The step of analyzing the current alarm information based on the pre-constructed network element fault Bayesian network and network element first-order predicate logic to determine the network element-level root cause alarm location result includes: Using network elements as the granularity, obtain the first initial root cause alarm set within a preset range of the fault time point; Traverse all alarm types in the first initial root cause alarm set. When the network element fault Bayesian network determines that there is a triggering alarm in the first initial root cause alarm set that is currently being traversed, remove the currently traversed alarm from the first initial root cause alarm set to obtain the first final root cause alarm set. The first final root cause alarm set is grouped to obtain multiple root cause alarm groups; wherein, the root cause alarms within each group are related, and the root cause alarms between groups are not related. For root cause alarms within each group, the first-order predicate logic of the network element is used for analysis to determine the root cause alarm location results at the network element level.

6. The core network root cause alarm location method according to claim 1, characterized in that, The step of analyzing the current alarm information based on a pre-constructed network fault Bayesian network and network first-order predicate logic to determine the network-level root cause alarm location result includes: Using domain relationships and connection relationships as granularity, obtain the second initial root cause alarm set within a preset range of fault time points; Traverse all alarm types in the second initial root cause alarm set. When the network fault Bayesian network determines that there is a triggering alarm in the second initial root cause alarm set that is currently being traversed, remove the currently traversed alarm from the second initial root cause alarm set to obtain the second final root cause alarm set. The second final root cause alarm set is grouped to obtain multiple groups of root cause alarms; among them, the root cause alarms within each group are related, while the root cause alarms between groups are not related. For root cause alarms within each group, the network first-order predicate logic is used for analysis to determine the network-level root cause alarm location results.

7. A core network root cause alarm location device, characterized in that, include: The information acquisition module is used to acquire current alarm information; The first positioning module is used to analyze the current alarm information based on the pre-constructed network element fault Bayesian network and network element first-order predicate logic to determine the network element-level root cause alarm positioning result. The second positioning module is used to analyze the current alarm information based on the pre-constructed network fault Bayesian network and network first-order predicate logic to determine the network-level root cause alarm positioning result. The output module is used to output the final root cause alarm location result based on the network element-level root cause alarm location result and the network-level root cause alarm location result; The network element fault Bayesian network is constructed in the following way: Construct the core network device topology relationship; the core network device topology relationship includes network element, domain relationship and network element connection relationship; The historical alarm information is grouped at the granularity of the network element to obtain the historical alarm information of multiple network elements; For each network element, a scalable sliding time window algorithm is used to divide the historical alarm information of the network element into multiple items, and the earliest alarm of different types in each item is retained to obtain the item set of each network element; Based on the item set of network elements of the same type, construct a first two-dimensional matrix to describe the relationship between the number of alarms occurring among network elements of the same type; Based on the first two-dimensional matrix, the relationship between alarms is evaluated, and a Bayesian network for describing the relationship between alarms under the same type of network element is constructed. The network fault Bayesian network is constructed in the following way: The historical alarm information of multiple network elements in the same domain, network elements of the same type, and network elements associated with the same protocol are divided into the same group to obtain the historical alarm information of multiple groups of associated network elements. For each group of associated network elements, a scalable sliding time window algorithm is used to divide the historical alarm information of the network element into multiple items, and the earliest alarm of different types in each item is retained to obtain the item set of each group of associated network elements. Based on the item set of each group of associated network elements, a second two-dimensional matrix is ​​constructed to describe the alarm occurrence relationship under the same group of associated network elements; Based on the second two-dimensional matrix, the parent-child relationship between alarms is evaluated, and a network fault Bayesian network is constructed to describe the relationship between alarms under the same group of related network elements.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the core network root cause alarm location method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the core network root cause alarm location method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the core network root cause alarm location method as described in any one of claims 1 to 6.

Images