Alarm aggregation method and device, storage medium and electronic device

Abstract

The embodiment of the invention provides an alarm aggregation method and device, a storage medium and an electronic device, and the method comprises the steps: determining whether a plurality of alarms have an incidence relation or not according to the alarm types of the plurality of alarms; under the condition that the multiple alarms have the association relationship, determining an association time window of the multiple alarms; whether the multiple alarms are aggregated or not is determined according to whether the multiple alarms meet time constraint conditions or not, and the time constraint conditions are used for indicating that the difference value of the alarm occurrence time of the two alarms is smaller than the associated time window. Through the method and the device, the problem of inaccurate alarm aggregation caused by a fixed associated time window in the prior art is solved.

Description

Technical Field

[0001] Embodiments of the present application relate to the field of communications, and in particular, to an alarm aggregation method and device, a storage medium, and an electronic device. Background Art

[0002] As the scale of the bearer network becomes larger and the network structure becomes more complex, when a network failure occurs, a large number of related alarms are usually generated. In order to quickly and accurately locate the fault, it is necessary to aggregate the alarms caused by the fault to generate a major fault event. The current alarm aggregation method mainly uses a fixed time window to aggregate the related alarms within the aggregation time window to generate a major fault event. Due to the use of a fixed aggregation time window, there will be problems with inaccurate alarm aggregation in actual applications. For example, when the occurrence time of related alarms caused by a fault exceeds the aggregation time window, they will be aggregated into different faults, resulting in less alarm aggregation; when alarms caused by different faults occur within the same aggregation time window, they will be aggregated into one fault, resulting in more alarm aggregation.

[0003] In order to solve the above-mentioned problem of inaccurate alarm aggregation, the alarm aggregation results can be improved by adding the judgment of alarm association relationship during alarm aggregation. That is, when alarms are aggregated, if there is an alarm association relationship between two alarms, it is determined that the aggregation conditions are met. Otherwise, it is determined that the aggregation conditions are not met. However, the existing solutions mainly use common association rule mining algorithms (such as Apriori algorithm, FP-growth algorithm, prefixspan algorithm, etc.) to mine the association relationship between alarms based on historical alarm data in advance. The use of this solution can improve the aggregation results to a certain extent, but it cannot solve the problem of inaccurate alarm aggregation. The main disadvantages are as follows:

[0004] (1) Existing solutions only mine alarm correlation relationships, without considering the differences in the correlation time windows between different alarms. When the occurrence time difference between different alarms exceeds the aggregation time window, they will still be aggregated into different faults.

[0005] (2) Due to algorithm limitations, the existing solutions can only mine limited alarm associations and cover some alarm types. When applied to alarm aggregation, it is easy to cause misjudgment. For example, alarms that have alarm associations are misjudged as not being aggregated into one fault because the alarm associations are not mined.

[0006] Therefore, the prior art only considers mining alarm correlation relationships, without considering the differences in correlation time windows between different alarms. When the occurrence time difference between different alarms exceeds the aggregation time window, they will still be aggregated into different faults. Summary of the invention

[0007] The embodiments of the present application provide an alarm aggregation method and device, a storage medium, and an electronic device to at least solve the problem in the related art that when the occurrence time difference between different alarms exceeds the aggregation time window, they will be aggregated into different faults.

[0008] According to an embodiment of the present application, a method for aggregating alarms is provided, including: determining whether there is a correlation relationship among the multiple alarms according to the alarm types of the multiple alarms; determining the correlation time window of the multiple alarms when the multiple alarms are correlated; and determining whether to aggregate the multiple alarms according to whether the multiple alarms meet the time constraint condition, wherein the time constraint condition is used to indicate that the difference in the alarm occurrence time of two alarms is less than the correlation time window. Through the present application, the problem of inaccurate alarm aggregation due to the fixed correlation time window in the prior art is solved, thereby achieving the effect of flexibly determining the correlation relationship and the correlation time window between different alarm types, and determining whether to perform aggregation according to the correlation relationship and the correlation time window.

[0009] In an exemplary embodiment, determining the associated time windows of the multiple alarms includes: determining whether the multiple alarms meet the spatial constraint conditions, wherein the spatial constraint conditions are used to indicate: there are associated scenarios between two alarms, and the associated scenarios include one of the following: the alarm locations are the same, the links corresponding to the alarms are the same, the service paths corresponding to the alarms are the same, and the root nodes of the resource nodes corresponding to the alarms are the same, and the resource nodes and the root nodes are nodes in the resource knowledge graph; when the multiple alarms meet the spatial constraint conditions, determining the associated scenarios corresponding to the multiple alarms; and determining the associated time window according to the associated scenarios corresponding to the multiple alarms and the alarm types of the multiple alarms.

[0010] In an exemplary embodiment, before determining the associated scenarios corresponding to the multiple alarms, the method also includes: determining the network element configuration and service configuration of the target network that generates the multiple alarms; constructing the resource knowledge graph based on the network element configuration and the service configuration, wherein the resource knowledge graph includes: resource nodes and edges, the resource nodes are used to indicate the network transmission resources in the target network, and the edges are used to indicate the dependencies of the network transmission resources.

[0011] In an exemplary embodiment, whether to aggregate the multiple alarms is determined based on whether the multiple alarms meet the time constraint conditions, including: if the multiple alarms meet the time constraint conditions, determining whether the multiple alarms are located in an aggregation time window, and determining whether to aggregate the multiple alarms based on whether the multiple alarms are located in the aggregation time window; if the multiple alarms do not meet the time constraint conditions, prohibiting the aggregation of the multiple alarms.

[0012] In an exemplary embodiment, whether to aggregate the multiple alarms is determined based on whether the multiple alarms are located in an aggregation time window, including: when the multiple alarms are located in the aggregation time window, determining to aggregate the multiple alarms; when the multiple alarms are not located in the aggregation time window and the correlation relationship between the multiple alarms is a strong correlation relationship, determining to aggregate the multiple alarms; when the multiple alarms are not located in the aggregation time window and the correlation relationship between the multiple alarms is a weak correlation relationship, prohibiting the aggregation of the multiple alarms.

[0013] In an exemplary embodiment, after determining whether to aggregate the multiple alarms based on whether the multiple alarms meet time constraints, the method further includes: determining alarm propagation relationships corresponding to the multiple alarms; and determining root cause alarms and derivative alarms corresponding to the multiple alarms based on the alarm propagation relationships corresponding to the multiple alarms, wherein the derivative alarms are used to indicate alarms generated due to the root cause alarms.

[0014] In an exemplary embodiment, before determining whether there is a correlation relationship among multiple alarms based on their alarm types, the method further includes: configuring an alarm relationship mining task, wherein task parameters of the alarm relationship mining task include one of the following: basic task parameters, alarm parameters, and algorithm parameters; determining alarm relationship mining results of historical alarms based on the alarm relationship mining task, wherein the alarm relationship mining results include: alarm correlation information and alarm propagation relationship.

[0015] In an exemplary embodiment, alarm association information of historical alarms is determined according to the alarm relationship mining task, including: determining the confidence and support between the alarm types of historical alarms; when the confidence is greater than or equal to a first preset threshold, and the support is greater than or equal to a second preset threshold, determining that the historical alarms have a strong association relationship; when the confidence is less than the first preset threshold and greater than a third preset threshold, and / or the support is less than the second preset threshold and greater than the third preset threshold, determining that the historical alarms have a weak association relationship; when the confidence is equal to the third preset threshold, and / or the support is equal to the third preset threshold, determining that the historical alarms do not have an association relationship.

[0016] In an exemplary embodiment, the alarm propagation relationship of the historical alarm is determined according to the alarm relationship mining task, including: determining the first resource node corresponding to the historical alarm, and determining the resource hierarchy relationship of the first resource node in the resource indication map; determining the alarm propagation relationship of the historical alarm according to the resource hierarchy relationship.

[0017] In an exemplary embodiment, the alarm propagation relationship of the historical alarm is determined according to the resource hierarchy relationship, including: when the resource hierarchy relationship indicates that the second resource node is a low-level resource node and the third resource node is a high-level resource node, the first alarm propagation relationship of the historical alarm is determined, wherein the first alarm propagation relationship indicates that the alarm corresponding to the second resource node is a root cause alarm, and the alarm corresponding to the third resource node is a derivative alarm, and the first resource node includes: the second resource node and the third resource node; when the resource hierarchy relationship indicates that the first resource node is a resource node at the same level, the alarm occurrence time of the historical alarm is determined, and the second alarm propagation relationship of the historical alarm is determined according to the alarm occurrence time, wherein the second alarm propagation relationship indicates that the alarm corresponding to the first alarm occurrence time is a root cause alarm, and the alarm corresponding to the second alarm occurrence time is a derivative alarm, and the first alarm occurrence time is earlier than the second alarm occurrence time.

[0018] According to another embodiment of the present application, an alarm aggregation device is provided, including: a first determination module, used to determine whether multiple alarms are associated according to their alarm types; a second determination module, used to determine the associated time window of the multiple alarms when the multiple alarms are associated; and a third determination module, used to determine whether to aggregate the multiple alarms according to whether the multiple alarms meet a time constraint condition, wherein the time constraint condition is used to indicate that the difference in alarm occurrence time of two alarms is less than the associated time window.

[0019] According to another embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when run.

[0020] According to another embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0021] Through this application, it is determined whether there is a correlation relationship among multiple alarms according to the alarm types of the multiple alarms; when there is a correlation relationship among the multiple alarms, the correlation time window of the multiple alarms is determined; and it is determined whether to aggregate the multiple alarms according to whether the multiple alarms meet the time constraint condition, wherein the time constraint condition is used to indicate that the difference in the alarm occurrence time of two alarms is less than the correlation time window. Through this application, the correlation relationship and the correlation time window between different alarm types are flexibly determined, and whether to aggregate is determined according to the correlation relationship and the correlation time window, which solves the problem of inaccurate alarm aggregation due to the fixed correlation time window in the prior art, thereby improving the alarm aggregation result and improving the accuracy of alarm aggregation. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a hardware structure block diagram of a computer terminal of an alarm aggregation method according to an embodiment of the present application;

[0023] Figure 2 is a flow chart of an alarm aggregation method according to an embodiment of the present application;

[0024] Figure 3 is a structural diagram of an alarm relationship mining system according to an embodiment of the present application;

[0025] Figure 4 is a schematic diagram of a resource knowledge graph corresponding to a schema according to an embodiment of the present application;

[0026] Figure 5 It is a schematic diagram of a resource knowledge graph schema corresponding to an SPN network according to an embodiment of the present application;

[0027] Figure 6 It is a structural block diagram of an alarm aggregation device according to an embodiment of the present application. DETAILED DESCRIPTION

[0028] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0030] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a computer terminal of an alarm aggregation method according to an embodiment of the present application. Figure 1 As shown, the computer terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor (Central Processing Unit, MCU) or a programmable logic device (Field Programmable Gate Array, FPGA)) and a memory 104 for storing data, wherein the above-mentioned computer terminal may also include a transmission device 106 and an input and output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above-mentioned computer terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0031] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as a computer program corresponding to an alarm aggregation method in an embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0032] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of a computer terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0033] Figure 2 is a flow chart of a method for aggregating alarms according to an embodiment of the present application, such as Figure 2 As shown, the process includes the following steps:

[0034] Step S202, determining whether there is a correlation relationship between the multiple alarms according to the alarm types of the multiple alarms;

[0035] The above alarm types are defined to measure the differences between different alarms and are unique. When there is no difference in alarms of different network devices or network element roles, the alarm type is a unique key value consisting of the alarm detection point code and alarm code corresponding to the alarm. When there is a difference in alarms of different network devices or network element roles, the alarm type is a unique key value consisting of the network element device type or network element role, the alarm detection point code and the alarm code.

[0036] Step S204, when the multiple alarms are associated, determining the associated time windows of the multiple alarms;

[0037] Step S206: Determine whether to aggregate the multiple alarms according to whether the multiple alarms meet a time constraint condition, wherein the time constraint condition is used to indicate that a difference between alarm occurrence times of two alarms is less than the associated time window.

[0038] It can be understood that whether the multiple alarms meet the time constraint condition refers to whether the time difference between two alarm occurrences is less than the set alarm occurrence time window.

[0039] Through the above steps, it is determined whether there is a correlation relationship among the multiple alarms according to the alarm types of the multiple alarms; when there is a correlation relationship among the multiple alarms, the correlation time window of the multiple alarms is determined; and it is determined whether to aggregate the multiple alarms according to whether the multiple alarms meet the time constraint condition, wherein the time constraint condition is used to indicate that: the difference between the alarm occurrence times of two alarms is less than the correlation time window. Through the present application, the correlation relationship and the correlation time window between different alarm types are flexibly determined, and whether to aggregate is determined according to the correlation relationship and the correlation time window, which solves the problem of inaccurate alarm aggregation due to the fixed correlation time window in the prior art, thereby improving the alarm aggregation result and improving the accuracy of alarm aggregation.

[0040] Optionally, the above step S204 can be determined in the following manner: determine whether the multiple alarms meet the spatial constraint conditions, wherein the spatial constraint conditions are used to indicate: there are associated scenarios between the two alarms, and the associated scenarios include one of the following: the alarm locations are the same, the links corresponding to the alarms are the same, the service paths corresponding to the alarms are the same, and the root nodes of the resource nodes corresponding to the alarms are the same, and the resource nodes and the root nodes are nodes in the resource knowledge graph; when the multiple alarms meet the spatial constraint conditions, determine the associated scenarios corresponding to the multiple alarms; determine the associated time window according to the associated scenarios corresponding to the multiple alarms and the alarm types of the multiple alarms.

[0041] It can be understood that the associated scenario refers to the scenario that needs to be mined according to the needs of the business, and each scenario corresponds to a typical business application scenario. For example, in PTN and SPN networks, associated scenarios such as the same alarm location, the link corresponding to the same alarm, the business path corresponding to the same alarm, and the root node of the resource node corresponding to the same alarm can be mined, and each associated scenario corresponds to an application scenario of fault alarm aggregation. At the same time, the associated scenario can also be expanded according to business needs.

[0042] It should be noted that whether multiple alarms meet the spatial constraint conditions refers to whether the resource nodes corresponding to the alarms are directly or indirectly connected in the resource knowledge graph, and there is a resource dependency or association relationship between one resource node and another resource node. For each associated scenario, there is a corresponding spatial constraint condition. For example, when the associated scenario is the same alarm location, the spatial constraint condition is the same alarm location; when it is a link corresponding to the same alarm, the alarms at both ends of the link are considered to meet the spatial constraint conditions; when it is the root node of the resource node corresponding to the same alarm, the root node of the alarm object is the same root node and is considered to meet the spatial constraint conditions; when it is a business path corresponding to the same alarm, the alarm objects are all on the same business path and are considered to meet the spatial constraint conditions.

[0043] Optionally, before determining the associated scenarios corresponding to the multiple alarms, it is necessary to construct a resource knowledge graph corresponding to the target network. An embodiment of the present invention constructs the resource knowledge graph in the following manner: determining the network element configuration and service configuration of the target network that generates the multiple alarms; constructing the resource knowledge graph based on the network element configuration and the service configuration, wherein the resource knowledge graph includes: resource nodes and edges, the resource nodes are used to indicate the network transmission resources in the target network, and the edges are used to indicate the dependencies of the network transmission resources.

[0044] That is to say, the above-mentioned resource knowledge graph refers to a knowledge graph built based on the corresponding network element configuration and business configuration in the target network. The knowledge graph reflects the various relationships between different resources and is composed of different nodes and edges. The resource knowledge graph has a variety of generation methods, for example: based on the network element configuration and business configuration data of the target network, the resource knowledge graph is automatically generated through a mapping script. When the resource nodes and relationships change, the corresponding resource knowledge graph can be updated synchronously, thereby ensuring the consistency of the configuration data of the target network of the resource knowledge graph. In specific implementation, the resource knowledge graph can be constructed, stored and applied using a graph database, including but not limited to the use of the following graph databases: OrientDB, Neo4j, etc.

[0045] For example, when the target network is a PTN network, the resource nodes include but are not limited to: network element, board, port, link, TMS, tunnel, pseudowire, L2VPN, TDM, L3VPN, L3VPNPeer; the edge is used to indicate one of the following: holds, belongedTrailTo, multiplex (multiplexing), memberOf, topologyForm. When the target network is an SPN network, the resource nodes include but are not limited to: FlexEGroup, FlexELSP, FlexEChannel, FlexEEthCH and other 5G slices; the edge is used to indicate one of the following: holds, belongedTrailTo, multiplex (multiplexing), memberOf, topologyForm.

[0046] Optionally, the embodiment of the present invention determines whether to aggregate the multiple alarms in the following manner:

[0047] If the multiple alarms meet the time constraint conditions, determine whether the multiple alarms are located in the aggregation time window, and determine whether to aggregate the multiple alarms based on whether the multiple alarms are located in the aggregation time window; if the multiple alarms do not meet the time constraint conditions, aggregating the multiple alarms is prohibited.

[0048] Further, when the multiple alarms are located in the aggregation time window, it is determined that the multiple alarms are aggregated; when the multiple alarms are not located in the aggregation time window and the correlation between the multiple alarms is a strong correlation, it is determined that the multiple alarms are aggregated; when the multiple alarms are not located in the aggregation time window and the correlation between the multiple alarms is a weak correlation, it is prohibited to aggregate the multiple alarms.

[0049] In the embodiment of the present application, the support count of alarm type AB is used to indicate the number of times alarm types A and B appear at the same time. The support of alarm type AB is used to indicate the ratio of the support counts corresponding to alarm types A and B to the number of all alarms. The confidence of alarm type AB is used to indicate the ratio of the support counts corresponding to alarm types A and B to the total number of alarm types A.

[0050] It can be understood that the correlation relationship refers to the correlation between the alarms. According to the support and confidence, the correlation relationship includes: strong correlation, weak correlation, no correlation and island alarm.

[0051] (1) Strong correlation: refers to the alarm correlation relationship between alarms whose confidence is greater than or equal to the set threshold (default 5%) and whose support is greater than or equal to the set threshold (default 0.005%).

[0052] (2) Weak correlation: refers to the correlation between alarms, but the confidence or support is lower than the set threshold.

[0053] (3) No correlation: This means that there is no correlation data support between the alarms, the confidence is 0, and the support count is 0.

[0054] (4) Island alarm: refers to an alarm that is not associated with any other alarm and the number of associations is 0.

[0055] It can be understood that if there is a strong correlation between two alarms, and the difference in the alarm occurrence time is within the correlation time window and within the aggregation time window, the two alarms are aggregated into one fault; if a fault has been generated, and the difference in the alarm occurrence time is within the aggregation time window, the alarm generated later is updated to the generated fault, and a fault message is sent to notify the fault analysis and processing. If there is a weak correlation between two alarms, and the difference in the alarm occurrence time is within the correlation time window and within the aggregation time window, the two alarms are aggregated into one fault. If a fault has been generated, it is prohibited to aggregate the multiple alarms, and the generated fault is no longer updated. If it is found that there is no correlation between the two alarms, the two alarms are not aggregated into one fault; if it is found that an alarm is an island alarm, a separate fault is generated.

[0056] Optionally, after executing step S206, it also includes: determining the alarm propagation relationship corresponding to the multiple alarms; determining the root cause alarms and derivative alarms corresponding to the multiple alarms according to the alarm propagation relationship corresponding to the multiple alarms, wherein the derivative alarms are used to indicate the alarms generated by the root cause alarms.

[0057] It should be noted that the alarm propagation relationship corresponding to the multiple alarms is determined based on the resource hierarchy relationship, and the propagation relationship is propagated from the lower level to the higher level. For alarms at the same level, the alarm propagation relationship is mainly determined based on the time sequence of the alarm occurrence. In principle, the first alarm is usually the root cause alarm.

[0058] In an exemplary embodiment, determining the alarm propagation relationship corresponding to the multiple alarms includes: determining the correspondence between the alarm type and the alarm propagation relationship; and determining the alarm propagation relationship corresponding to the multiple alarms based on the correspondence, wherein the correspondence is determined based on historical alarm information.

[0059] The embodiment of the present invention mines historical alarms to determine the alarm relationship between different alarm types. Specifically: an alarm relationship mining task is configured, wherein the task parameters of the alarm relationship mining task include one of the following: basic task parameters, alarm parameters and algorithm parameters; the alarm relationship mining results of the historical alarms are determined according to the alarm relationship mining task, wherein the alarm relationship mining results include: alarm correlation information and alarm propagation relationship.

[0060] The alarm propagation relationship between the above multiple alarm types includes but is not limited to: root alarm type, root alarm number, derived alarm type, derived alarm number, support count, support, confidence, correlation degree, resource hierarchy relationship, alarm time sequence, etc.

[0061] The alarm association information between the above multiple alarm types includes but is not limited to: associated scenarios, alarm types, alarm times, associated alarm types, associated alarm times, support count, support, confidence, association degree, and associated time window (including minimum and maximum values).

[0062] After determining the alarm relationship mining results of the historical alarms according to the alarm relationship mining task, the method further includes: displaying the alarm association information and the alarm propagation relationship in a list format, and allowing the user to modify the mined alarm association relationship. The user can modify the mined alarm association relationship to no association, or modify a weak association to a strong association, or modify a strong association to a weak association.

[0063] Optionally, determining alarm association information of historical alarms according to the alarm relationship mining task includes: determining the confidence and support between the alarm types of historical alarms; when the confidence is greater than or equal to a first preset threshold, and the support is greater than or equal to a second preset threshold, determining that the historical alarms have a strong association relationship; when the confidence is less than the first preset threshold and greater than a third preset threshold, and / or the support is less than the second preset threshold and greater than the third preset threshold, determining that the historical alarms have a weak association relationship; when the confidence is equal to the third preset threshold, and / or the support is equal to the third preset threshold, determining that the historical alarms do not have a association relationship.

[0064] For example, the first preset threshold is preset to 5%, the second preset threshold is preset to 0.05%, and the third preset threshold is preset to 0.0005%. When the confidence level is greater than or equal to 5%, and the support level is greater than or equal to 0.05%, it is determined that the historical alarms have a strong correlation; when the confidence level is less than 5% and greater than 0.0005%, and / or the support level is less than 0.05% and greater than 0.0005%, it is determined that the historical alarms have a weak correlation; when the confidence level is equal to 0.0005%, and / or the support level is equal to 0.0005%, it is determined that there is no correlation between the alarm types.

[0065] Optionally, determining the alarm propagation relationship of historical alarms according to the alarm relationship mining task includes: determining the first resource node corresponding to the historical alarm, and determining the resource hierarchy relationship of the first resource node in the resource indication map; determining the alarm propagation relationship of the historical alarm according to the resource hierarchy relationship.

[0066] The above resource hierarchy relationships include three types: low level -> high level, same level, and high level -> low level.

[0067] Optionally, determining the alarm propagation relationship of the historical alarm based on the resource hierarchy relationship includes: when the resource hierarchy relationship indicates that the second resource node is a low-level resource node and the third resource node is a high-level resource node, determining a first alarm propagation relationship of the historical alarm, wherein the first alarm propagation relationship indicates that the alarm corresponding to the second resource node is a root cause alarm, and the alarm corresponding to the third resource node is a derivative alarm, and the first resource node includes: the second resource node and the third resource node; when the resource hierarchy relationship indicates that the first resource node is a resource node at the same level, determining the alarm occurrence time of the historical alarm, and determining the second alarm propagation relationship of the historical alarm based on the alarm occurrence time, wherein the second alarm propagation relationship indicates that the alarm corresponding to the first alarm occurrence time is a root cause alarm, and the alarm corresponding to the second alarm occurrence time is a derivative alarm, and the first alarm occurrence time is earlier than the second alarm occurrence time.

[0068] It is understandable that all alarms except the root alarm are derived alarms.

[0069] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory (ROM / RAM), a disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0070] In order to better understand the process of the above-mentioned alarm aggregation method, the implementation process of the above-mentioned running time determination method is described below in combination with an optional embodiment, but it is not used to limit the technical solution of the embodiment of the present application.

[0071] To facilitate the understanding of the technical solution provided by the present application, a detailed explanation will be given below in combination with embodiments of specific scenarios.

[0072] Figure 3 It is a structural diagram of the alarm relationship mining system according to the embodiment of the present application, and the system includes two major parts: the alarm relationship mining front-end UI module and the alarm relationship mining background service module. Among them, the alarm relationship mining front-end UI module is responsible for providing the user interface, and the alarm relationship mining front-end UI module specifically includes: alarm relationship mining task management component, island alarm display and confirmation component, alarm relationship display and modification component; the alarm relationship mining background service module is responsible for executing the alarm relationship mining task according to the configured tasks and algorithm parameters, and outputting the alarm relationship mining results. The alarm relationship mining background service module specifically includes the alarm relationship query and modification component, the alarm relationship mining task processing component, the historical alarm query component, the alarm noise reduction component, the alarm relationship mining backfill component and the alarm association statistics mining component.

[0073] (1) Alarm relationship mining task management component, used to provide functions such as creating, deleting and modifying alarm relationship mining tasks, configuring task parameters, and viewing task execution results. The task parameters of the alarm relationship mining task include: basic parameters, alarm parameters and algorithm parameters. Among them, the basic parameters include: task name (task name is unique and cannot be repeated), enablement status (enabled by default), task cycle (daily, weekly, default daily), planned execution time (default 1:05), task description, etc.; alarm parameters include: alarm occurrence time window (default 15 minutes), alarm disappearance time window (default 1 minute) and associated scenarios (including the same location, same link, same root node, same service path, time clock adjacent network elements, etc., which can be expanded according to business needs, default all); algorithm parameters include: support threshold (default 0.005%), confidence threshold (default 5%).

[0074] (2) The island alarm display and confirmation component is used to list the island alarms mined from the alarm relationships and provide operation options for the user to confirm whether they are effective. If it is determined to be an island alarm, the fault alarm will no longer be aggregated with other alarms when it is aggregated, and a major fault event will be directly generated.

[0075] (3) The alarm relationship display and modification component is used to present the mined alarm association relationships and alarm propagation relationships in a list format, and allows users to modify them. For the mined alarm association relationships, users can modify them to no association, or modify weak associations to strong associations, or modify strong associations to weak associations. Different alarm aggregation strategies will be adopted for different degrees of association. For the mined alarm propagation relationships, users can confirm whether they are effective. By default, they are not effective. They will only take effect after the user confirms.

[0076] (4) Alarm relationship query and modification component, which is used to respond to the alarm relationship query and modification commands issued by the receiving front end, query the database based on the command requirements, feedback the island alarm statistics, alarm correlation relationship and alarm propagation relationship, and modify it according to the user, and update the saved database according to the modified island alarm information, alarm correlation relationship and alarm propagation relationship.

[0077] (5) Alarm relationship mining task processing component, which is used to execute the alarm relationship mining task according to the configured task parameters of the alarm relationship mining task and record the task execution results. It responds to the task configuration commands sent by the front end (including creating new tasks, modifying tasks, and deleting tasks), and updates the task configuration information for persistence, such as saving it to a database. It responds to the commands sent by the front end to view task configuration, view task execution status, and view task execution history, and feedbacks the specific task configuration, task execution status, and task execution history information.

[0078] (6) Historical alarm query component, which is responsible for querying historical alarms according to query conditions, including querying alarms in a specified time period by alarm occurrence time, querying alarms in a specified time period by alarm disappearance time, sorting by alarm occurrence time, and sorting by alarm disappearance time.

[0079] (7) Alarm noise reduction component, which is responsible for filtering out noise alarms, such as flash alarms and oscillation alarms. This is because such alarms will interfere with the correct alarm association results. Flash alarms are defined as alarms whose duration is less than the set threshold. The default threshold is 1 minute. Oscillation alarms refer to alarms of the same type at the same location that appear repeatedly within a specified time period.

[0080] (8) The alarm relationship mining and backfilling component is responsible for backfilling the information required for alarm association into the alarm details in advance, so as to quickly determine whether there is a spatial resource dependency or association relationship between two alarms. The information that needs to be backfilled includes: the resource knowledge graph node information corresponding to the alarm, the upper-level business nodes affected by the alarm, the links affected by the alarm, the root node to which the alarm belongs, etc. The backfilled information is determined by the association scenario that needs to be mined.

[0081] (9) An alarm correlation statistical mining component is used to statistically mine alarm correlation relationships, correlation time windows, and alarm propagation relationships based on an alarm correlation relationship mining algorithm and an alarm propagation relationship determination rule.

[0082] The PTN network is a packet transport network based on MPLS-TP, which provides Layer 2 Ethernet services, TDM services, etc. The alarm relationship mining of the PTN network is used to improve the scenario of fault aggregation and fault analysis. In an embodiment of the present application, a method for mining the alarm relationship of the PTN network is provided, which specifically includes the following steps:

[0083] Step 1: Build a resource knowledge graph based on the existing network element configuration and service configuration data corresponding to the PTN network.

[0084] The knowledge graph contains different types of nodes and edges. Different types of nodes represent different resources, and different types of edges represent the relationship between different resource nodes. For PTN networks, there are resource nodes of types such as network elements, boards, ports, links, TMS, tunnels, pseudowires, L2VPN, TDM, L3VPN, and L3VPNPeer, and edges of types such as holds, belongedTrailTo, multiplex, memberOf, and topologyForm. Figure 4As shown, it is a schematic diagram of the schema corresponding to a resource knowledge graph according to an embodiment of the present application. The resource knowledge graph is automatically generated through a mapping script based on the existing network element configuration and service configuration data. When the resource nodes and relationships change, the corresponding resource knowledge graph will be updated synchronously to ensure the consistency of the resource knowledge graph with the existing network configuration data. In specific implementation, the resource knowledge graph is usually constructed, stored and applied using a graph database, including but not limited to the use of the following graph databases, such as OrientDB, Neo4j, etc.

[0085] Step 2: Create a new alarm relationship mining task according to the business application scenario, and configure relevant task parameters, including basic task parameters, alarm parameters and algorithm parameters. Basic parameters include task name (task name is unique and cannot be repeated), enablement status (enabled by default), task cycle (daily, weekly, default daily), scheduled execution time (default 1:05 am the next day), task description, etc.; alarm parameters include alarm occurrence time window (default 15 minutes), alarm disappearance time window (default 1 minute) and associated scenarios (including the same location, same link, same root node, same business path, time clock adjacent network elements, etc., which can be expanded according to business needs, default all); algorithm parameters include support threshold (default 0.005%), confidence threshold (default 5%).

[0086] Step 3: Based on the configured alarm relationship mining task, the alarm relationship mining task is executed regularly, and the alarm relationship mining results are output. The alarm relationship mining results include: alarm statistics, alarm correlation information and alarm propagation relationship. The alarm statistics include alarm type, alarm frequency, total alarm, alarm ratio (%), and whether it is an isolated alarm; alarm correlation information includes correlation scenario, alarm type, alarm frequency, associated alarm type, associated alarm frequency, support count, support, confidence, correlation degree, and associated time window (including minimum and maximum values); alarm propagation relationship includes root alarm type, root alarm frequency, derived alarm type, derived alarm frequency, support count, support, confidence, correlation degree, resource hierarchy relationship, alarm time sequence, etc. The specific steps are as follows:

[0087] Step 31: Divide the time period for mining alarms into small time periods for cyclic processing and statistics.

[0088] For example, if the processing cycle is 1 day, it is divided into 24 time periods by hour for separate processing and statistics. The reason for this is that the amount of data directly queried for 1 day is too large, and the associated statistical process will occupy too much memory resources. Therefore, dividing it into hourly query and processing can save memory resources.

[0089] Step 32: Query the historical alarm data generated within the specified time period, and sort them in descending order according to the alarm occurrence time.

[0090] It should be noted that, in order to avoid under-stating data, each time the alarm occurrence time is queried, one more alarm occurrence time window data is queried forward.

[0091] Step 33: Perform alarm noise reduction processing on the historical alarm data that occurred during the time period.

[0092] Alarm noise reduction processing includes: filtering out flash alarms. Flash alarms refer to the duration of the alarm, that is, the difference between the alarm disappearance time and the alarm occurrence time is less than the set threshold. The default threshold is 1 minute.

[0093] Step 34: Perform alarm relationship mining and backfilling processing on the alarm data generated within the time period after noise reduction.

[0094] It should be noted that backfilling is to obtain in advance the relevant information for judging the spatial constraints of various associated scenarios and add it to the detailed information of the alarm, in order to speed up the judgment process of whether the spatial constraints are met during the alarm association statistics. The specific information that needs to be backfilled depends on the associated scenarios that need to be mined and the specific network type. For example: for bearer networks such as PTN and SPN, the information that needs to be backfilled includes the resource node information corresponding to the alarm, the business information affected by the alarm, the link information affected by the alarm, the root node information of the resource node corresponding to the alarm, etc., which can be expanded according to the needs of the associated scenarios.

[0095] Step 35: Perform cyclic correlation statistical processing on the backfilled alarm data in the order of alarm occurrence time, count and record the number of occurrences of each alarm type, find the associated alarms that meet both the time and space constraints, count and record the support count, as well as the alarm correlation time window (including maximum and minimum values), resource hierarchy relationship and alarm time sequence.

[0096] It should be noted that the support count is different from the association count. The association count is the number of times that alarm types A and B meet both the time constraint and the space constraint, while the support count refers to the number of times that alarm type A meets both the time constraint and the space constraint. Usually, the support count is less than or equal to the association count.

[0097] Step 36: Query the historical alarm data that disappeared within the specified time period, and sort them in descending order according to the alarm disappearance time.

[0098] To avoid missing statistical data, each time you query by alarm disappearance time, query the data of one more alarm disappearance time window.

[0099] Step 37: Perform alarm noise reduction processing on the historical alarm data that disappeared within the time period.

[0100] Alarm noise reduction processing includes: filtering out flash alarms. Flash alarms refer to the duration of the alarm, that is, the difference between the alarm disappearance time and the alarm occurrence time is less than the set threshold. The default threshold is 1 minute.

[0101] Step 38: Perform alarm relationship mining and backfilling processing on the alarm data that disappears within the time period after noise reduction.

[0102] The specific information that needs to be backfilled is the same as the historical alarms queried by the alarm occurrence time. In actual implementation, the backfilled alarms processed by the alarm occurrence time can be cached to avoid repeated backfill processing and improve processing performance.

[0103] Step 39: Perform cyclic correlation statistical processing on the backfilled alarm data in the order of alarm disappearance time, count and record the number of occurrences of each alarm type, find the associated alarms that meet both the time and space constraints, count and record the support count, as well as the alarm correlation time window (including maximum and minimum values), resource hierarchy relationship and alarm time sequence.

[0104] It should be noted that deduplication must be performed during statistics. Alarms and related alarms that have been processed according to the alarm occurrence time must be deleted during statistics to avoid repeated statistical counting.

[0105] Step 310: Repeat steps 32 to 39 to complete the statistics of all historical alarms within the statistical period.

[0106] Step 311: Output the alarm relationship mining result.

[0107] The alarm relationship mining results include: all alarm statistics, alarm correlation information and alarm propagation relationships. It should be noted that if an alarm is not associated with any alarm, it is determined to be an isolated alarm, which is reflected in the alarm statistics. The support of alarm type AB = the support count of alarm type AB / the number of all alarms. The confidence of alarm type AB = the support of alarm type AB = the support count of alarm type AB / the number of alarm type A. According to the size of support and confidence, the correlation is further divided into strong correlation, weak correlation and no correlation according to the degree of correlation. Priority is given to judgment based on resource hierarchy relationships, and the propagation relationship is from low level to high level. For alarms at the same level, the alarm propagation relationship is mainly determined based on the time sequence of alarm occurrence. In principle, the first alarm is usually the root alarm.

[0108] Step 4: Present the island alarm information, alarm correlation information and alarm propagation relationship to the user through the interface.

[0109] The judgment of isolated island alarms needs to be confirmed by the user before it takes effect. For alarm correlation information, the correlation degree will be automatically output according to the set threshold. If the user believes that the correlation degree judgment is inaccurate, it can be manually modified. After the modification, the result of manual confirmation shall prevail. For the excavated alarm propagation relationship, it is not effective by default and needs to be confirmed by the user before it takes effect.

[0110] Step 5: When performing alarm aggregation, you can use the association relationship between alarms and the corresponding association time window to determine whether to aggregate the alarms into a fault, thereby avoiding the problem of insufficient or excessive alarm aggregation caused by using a fixed aggregation time window. Specifically, the following situations will be processed when aggregating fault data:

[0111] 1) If there is a strong correlation between two alarms, and the difference in the alarm occurrence time is within the correlation time window, and the fault is within the aggregation window, the two alarms are aggregated into one fault. If a fault has been generated, but the difference in the alarm occurrence time is within the aggregation window, the later alarm is updated to the generated fault, and a fault message is sent to notify the fault analysis and processing. If it is not within the corresponding correlation time window, a different fault is generated;

[0112] 2) If there is a weak correlation between two alarms, and the difference in the alarm occurrence time is within the correlation time window, and the fault is within the aggregation window, the two alarms are aggregated into one fault. If the fault has been generated, the later alarm will not be updated to the generated fault, and a different fault will be generated;

[0113] 3) If it is found that there is no correlation between the two alarms, the two alarms are not aggregated into one fault;

[0114] 4) If an alarm is found to be an isolated alarm, a separate fault is generated.

[0115] Step 6: When identifying the root alarm, the alarm propagation relationship can be used to make a judgment based on the relationship between the root alarm and the derived alarms to correctly identify the root alarm.

[0116] SPN slicing packet network is a key technology in 5G network slicing. Currently, China Mobile uses SPN technology as the technology for 5G bearer transmission network. Another embodiment of the present application is to perform alarm relationship mining on SPN networks for improving fault aggregation and fault analysis scenarios, and provides a method for alarm relationship mining on SPN networks. Based on the technical solution provided in the embodiment of the present application, alarm relationship mining for SPN networks is implemented. The specific technical solution is similar to the alarm relationship mining solution for the above-mentioned PTN network. The main difference is that the constructed resource knowledge graph is different. The SPN network has nodes of 5G slicing-related resource types such as FlexEGroup, FlexELSP, FlexEChannel, and FlexEEthCH. Figure 5 Shown is a schematic diagram of a resource knowledge graph schema corresponding to an SPN network according to an embodiment of the present application.

[0117] It can be understood that the embodiments of the present application make full use of the characteristics that the alarms caused by the same fault in the network have similar occurrence times and disappearance times, and the excavated alarm association relationships are richer and the alarm types covered are more comprehensive; not only the alarm association relationships can be excavated, but also the alarm association time windows can be excavated. Applying the excavated alarm association relationships and associated time windows to alarm aggregation avoids the problem of using fixed aggregation time windows, greatly improves the alarm aggregation results, and improves the accuracy of fault aggregation; based on the excavated alarm association relationships, the alarm propagation relationships are further excavated. Applying the excavated alarm propagation relationships to root alarm analysis improves the accuracy of root alarm identification.

[0118] In this embodiment, an alarm aggregation device is also provided, which is used to implement the above embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0119] Figure 6 is a structural block diagram of an alarm aggregation device according to an embodiment of the present application, such as Figure 6 As shown, the device comprises:

[0120] A first determination module 62, configured to determine whether there is a correlation relationship between the multiple alarms according to the alarm types of the multiple alarms;

[0121] A second determination module 64 is used to determine the correlation time window of the multiple alarms when the multiple alarms are correlated;

[0122] The third determination module 66 is used to determine whether to aggregate the multiple alarms according to whether the multiple alarms meet the time constraint condition, wherein the time constraint condition is used to indicate that the difference between the alarm occurrence times of two alarms is less than the associated time window.

[0123] Through the above device, it is determined whether there is a correlation relationship among the multiple alarms according to the alarm types of the multiple alarms; when the multiple alarms are correlated, the correlation time windows of the multiple alarms are determined; and it is determined whether to aggregate the multiple alarms according to whether the multiple alarms meet the time constraint conditions, wherein the time constraint conditions are used to indicate that the difference in the alarm occurrence time of two alarms is less than the correlation time window. Through this application, the problem of inaccurate alarm aggregation due to the fixed correlation time window in the prior art is solved, thereby achieving the effect of flexibly determining the correlation relationship and the correlation time window between different alarm types, and determining whether to aggregate according to the correlation relationship and the correlation time window.

[0124] In an exemplary embodiment, the second determination module is further used to: determine whether the multiple alarms meet the spatial constraint conditions, wherein the spatial constraint conditions are used to indicate: there are associated scenarios between the two alarms, and the associated scenarios include one of the following: the alarm locations are the same, the links corresponding to the alarms are the same, the service paths corresponding to the alarms are the same, and the root nodes of the resource nodes corresponding to the alarms are the same, and the resource nodes and the root nodes are nodes in the resource knowledge graph; when the multiple alarms meet the spatial constraint conditions, determine the associated scenarios corresponding to the multiple alarms; and determine the associated time window according to the associated scenarios corresponding to the multiple alarms and the alarm types of the multiple alarms.

[0125] In an exemplary embodiment, the device also includes: a fourth determination module, determining the network element configuration and service configuration of the target network that generates the multiple alarms; constructing the resource knowledge graph based on the network element configuration and the service configuration, wherein the resource knowledge graph includes: resource nodes and edges, the resource nodes are used to indicate the network transmission resources in the target network, and the edges are used to indicate the dependencies of the network transmission resources.

[0126] In an exemplary embodiment, the third determination module is also used to: determine whether the multiple alarms are located in the aggregation time window when the multiple alarms meet the time constraint conditions, and determine whether to aggregate the multiple alarms based on whether the multiple alarms are located in the aggregation time window; and prohibit aggregating the multiple alarms when the multiple alarms do not meet the time constraint conditions.

[0127] In an exemplary embodiment, the third determination module also includes: a fifth determination module, which determines to aggregate the multiple alarms when the multiple alarms are located in the aggregation time window; determines to aggregate the multiple alarms when the multiple alarms are not located in the aggregation time window and the correlation relationship between the multiple alarms is a strong correlation relationship; and prohibits aggregating the multiple alarms when the multiple alarms are not located in the aggregation time window and the correlation relationship between the multiple alarms is a weak correlation relationship.

[0128] In an exemplary embodiment, the third determination module is also used to: determine the alarm propagation relationship corresponding to the multiple alarms; determine the root cause alarms and derivative alarms corresponding to the multiple alarms based on the alarm propagation relationship corresponding to the multiple alarms, wherein the derivative alarms are used to indicate the alarms generated due to the root cause alarms.

[0129] In an exemplary embodiment, the device also includes: a configuration module, configuring an alarm relationship mining task, wherein the task parameters of the alarm relationship mining task include one of the following: basic task parameters, alarm parameters and algorithm parameters; determining the alarm relationship mining results of historical alarms based on the alarm relationship mining task, wherein the alarm relationship mining results include: alarm correlation information and alarm propagation relationship.

[0130] In an exemplary embodiment, the configuration module also includes: a sixth determination module, which determines the confidence and support between the alarm types of historical alarms; when the confidence is greater than or equal to the first preset threshold, and the support is greater than or equal to the second preset threshold, it is determined that the historical alarms have a strong correlation; when the confidence is less than the first preset threshold and greater than the third preset threshold, and / or the support is less than the second preset threshold and greater than the third preset threshold, it is determined that the historical alarms have a weak correlation; when the confidence is equal to the third preset threshold, and / or the support is equal to the third preset threshold, it is determined that the historical alarms do not have a correlation.

[0131] In an exemplary embodiment, the configuration module also includes: a seventh determination module, which determines the first resource node corresponding to the historical alarm, and determines the resource hierarchy relationship of the first resource node in the resource indication map; and determines the alarm propagation relationship of the historical alarm based on the resource hierarchy relationship.

[0132] In an exemplary embodiment, the seventh determination module is also used to: when the resource hierarchy relationship indicates that the second resource node is a low-level resource node and the third resource node is a high-level resource node, determine the first alarm propagation relationship of the historical alarm, wherein the first alarm propagation relationship indicates that the alarm corresponding to the second resource node is a root cause alarm, and the alarm corresponding to the third resource node is a derivative alarm, and the first resource node includes: the second resource node and the third resource node; when the resource hierarchy relationship indicates that the first resource node is a resource node at the same level, determine the alarm occurrence time of the historical alarm, and determine the second alarm propagation relationship of the historical alarm based on the alarm occurrence time, wherein the second alarm propagation relationship indicates that the alarm corresponding to the first alarm occurrence time is a root cause alarm, and the alarm corresponding to the second alarm occurrence time is a derivative alarm, and the first alarm occurrence time is earlier than the second alarm occurrence time.

[0133] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0134] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0135] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0136] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0137] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0138] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0139] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0140] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for aggregating alarms, characterized in that: include: Determining whether there is a correlation relationship among the multiple alarms according to the alarm types of the multiple alarms; In the case where the multiple alarms are associated with each other, determining the associated time windows of the multiple alarms; Whether to aggregate the multiple alarms is determined according to whether the multiple alarms meet a time constraint condition, wherein the time constraint condition is used to indicate that a difference in alarm occurrence time between two alarms is less than the associated time window.

2. The method according to claim 1, characterized in that Determining the associated time windows of the multiple alarms includes: Determine whether the multiple alarms meet the spatial constraint condition, wherein the spatial constraint condition is used to indicate that: there is an associated scenario between the two alarms, and the associated scenario includes one of the following: the alarm locations are the same, the links corresponding to the alarms are the same, the service paths corresponding to the alarms are the same, and the root nodes of the resource nodes corresponding to the alarms are the same, and the resource nodes and the root node are nodes in the resource knowledge graph; In the case where the multiple alarms meet the spatial constraint condition, determining associated scenarios corresponding to the multiple alarms; The associated time window is determined according to the associated scenarios corresponding to the multiple alarms and the alarm types of the multiple alarms.

3. The method according to claim 2, characterized in that Before determining the associated scenarios corresponding to the multiple alarms, the method further includes: Determining a network element configuration and a service configuration of a target network generating the plurality of alarms; The resource knowledge graph is constructed according to the network element configuration and the service configuration, wherein the resource knowledge graph includes: resource nodes and edges, the resource nodes are used to indicate the network transmission resources in the target network, and the edges are used to indicate the dependencies of the network transmission resources.

4. The method according to claim 1, characterized in that: Determining whether to aggregate the multiple alarms according to whether the multiple alarms meet the time constraint condition includes: If the multiple alarms meet the time constraint condition, determine whether the multiple alarms are located in an aggregation time window, and determine whether to aggregate the multiple alarms according to whether the multiple alarms are located in the aggregation time window; If the multiple alarms do not meet the time constraint condition, aggregating the multiple alarms is prohibited.

5. The method according to claim 4, characterized in that Determining whether to aggregate the multiple alarms according to whether the multiple alarms are located in the aggregation time window includes: When the multiple alarms are located in the aggregation time window, determining to aggregate the multiple alarms; When the multiple alarms are not located in the aggregation time window and the correlation relationship between the multiple alarms is a strong correlation relationship, determine to aggregate the multiple alarms; When the multiple alarms are not located in the aggregation time window and the association relationship between the multiple alarms is a weak association relationship, aggregating the multiple alarms is prohibited.

6. The method according to claim 1, characterized in that After determining whether to aggregate the multiple alarms according to whether the multiple alarms meet the time constraint condition, the method further includes: Determining an alarm propagation relationship corresponding to the multiple alarms; The root cause alarms and derived alarms corresponding to the multiple alarms are determined according to the alarm propagation relationships corresponding to the multiple alarms, wherein the derived alarms are used to indicate alarms generated due to the root cause alarms.

7. The method according to claim 1, characterized in that Before determining whether the multiple alarms have a correlation relationship according to the alarm types of the multiple alarms, the method further includes: Configuring an alarm relationship mining task, wherein the task parameters of the alarm relationship mining task include one of the following: basic task parameters, alarm parameters, and algorithm parameters; The alarm relationship mining result of the historical alarms is determined according to the alarm relationship mining task, wherein the alarm relationship mining result includes: alarm correlation information and alarm propagation relationship.

8. The method according to claim 7, characterized in that Determining alarm correlation information of historical alarms according to the alarm relationship mining task includes: Determine the confidence and support between alarm types of historical alarms; When the confidence is greater than or equal to a first preset threshold, and the support is greater than or equal to a second preset threshold, determining that the historical alarms have a strong correlation relationship; When the confidence is less than the first preset threshold and greater than the third preset threshold, and / or the support is less than the second preset threshold and greater than the third preset threshold, it is determined that the historical alarms have a weak correlation relationship; When the confidence is equal to the third preset threshold, and / or the support is equal to the third preset threshold, it is determined that there is no association relationship between the historical alarms.

9. The method according to claim 7, characterized in that: Determining the alarm propagation relationship of the historical alarms according to the alarm relationship mining task includes: Determine a first resource node corresponding to the historical alarm, and determine a resource hierarchy relationship of the first resource node in a resource indication map; The alarm propagation relationship of the historical alarm is determined according to the resource hierarchical relationship.

10. The method according to claim 9, characterized in that Determining the alarm propagation relationship of the historical alarm according to the resource hierarchical relationship includes: In the case where the resource hierarchy relationship indicates that the second resource node is a low-level resource node and the third resource node is a high-level resource node, determining a first alarm propagation relationship of the historical alarm, wherein the first alarm propagation relationship indicates that the alarm corresponding to the second resource node is a root cause alarm, and the alarm corresponding to the third resource node is a derivative alarm, and the first resource node includes: the second resource node and the third resource node; In the case where the resource hierarchy relationship indicates that the first resource node is a resource node at the same level, the alarm occurrence time of the historical alarm is determined, and the second alarm propagation relationship of the historical alarm is determined based on the alarm occurrence time, wherein the second alarm propagation relationship indicates that the alarm corresponding to the first alarm occurrence time is the root cause alarm, and the alarm corresponding to the second alarm occurrence time is the derivative alarm, and the first alarm occurrence time is earlier than the second alarm occurrence time.

11. An alarm aggregation device, characterized in that: include: A first determination module, configured to determine whether there is a correlation relationship between the multiple alarms according to the alarm types of the multiple alarms; A second determination module is used to determine the correlation time window of the multiple alarms when the multiple alarms are correlated; The third determination module is used to determine whether to aggregate the multiple alarms according to whether the multiple alarms meet the time constraint condition, wherein the time constraint condition is used to indicate that the difference between the alarm occurrence times of two alarms is less than the associated time window.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 10 when executed by a processor.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 10 are implemented.

Images