Alarm root cause positioning method and device based on knowledge graph

Abstract

The invention provides an alarm root cause positioning method and device based on a knowledge graph, a medium and equipment, and relates to the technical field of big data. The network equipment topological graph is used for representing a connection relationship between the equipment; feature engineering is constructed, data are compressed, alarm type entity extraction and relation extraction are carried out, and an alarm type causal knowledge graph is constructed and used for representing a generation relation between alarm types; according to the network equipment topological graph and the alarm type causal knowledge graph, generating an alarm propagation graph based on a fusion rule; according to the alarm propagation atlas, the alarm root cause propagation link atlas is obtained through reasoning based on the graph search algorithm and the topological sorting algorithm, network equipment alarm root cause positioning is carried out, automatic positioning of root causes is achieved, the root cause positioning efficiency can be improved, and the labor cost is reduced.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and in particular, to a method for locating the root cause of an alarm based on a knowledge graph, an apparatus for locating the root cause of an alarm based on a knowledge graph, a computer-readable storage medium, and an electronic device. Background Art

[0002] With the development of communication technology and computer technology, communication networks tend to be more complex. In communication networks, there are usually a large number of devices, and there are different associations and transmission relationships between the devices.

[0003] Based on the above relationship, the following situations usually occur: when a device fails, it will also cause alarms on other related devices, which in turn cause alarms on more devices connected to other related devices. That is, the failure of one device usually affects multiple devices. For relevant personnel, it is usually necessary to determine the root cause from a large number of alarms based on professional knowledge and experience. This method has the problem of low efficiency in root cause location.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute relevant technology known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present application is to provide an alarm root cause location method based on a knowledge graph, an alarm root cause location device based on a knowledge graph, a computer-readable storage medium and an electronic device, which can obtain multiple historical alarm data, build a network device topology map based on the cleaned and marked device identification and device link relationship, and the network device topology map is used to characterize the connection relationship between devices; obtain multiple historical alarm data, build feature engineering and compress data, perform alarm type entity extraction and relationship extraction, and build an alarm type causal knowledge graph, and the alarm type causal knowledge graph is used to characterize the generation relationship between alarm types; according to the network device topology map and the alarm type causal knowledge graph, based on fusion rules, generate an alarm propagation map; according to the alarm propagation map, based on the graph search algorithm and the topological sorting algorithm, the alarm root cause propagation link map is inferred to locate the root cause of the network device alarm, wherein the alarm root cause propagation link map can clearly show the source of the alarm, realize the automatic location of the root cause, and do not need relevant personnel to locate the root cause based on professional knowledge or professional experience, which can improve the efficiency of root cause location and reduce labor costs.

[0006] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0007] According to one aspect of the present application, a method for locating the root cause of an alarm based on a knowledge graph is provided, comprising:

[0008] Obtain multiple historical alarm data, and build a network device topology map based on the cleaned and marked device identification and device link relationship. The network device topology map is used to characterize the connection relationship between devices.

[0009] Obtain multiple historical alarm data, construct feature engineering and compress data, extract alarm type entities and relationships, and construct an alarm type causal knowledge graph. The alarm type causal knowledge graph is used to characterize the generation relationship between alarm types.

[0010] Generate an alarm propagation graph based on the network equipment topology graph and the alarm type causal knowledge graph based on fusion rules;

[0011] According to the alarm propagation graph, the alarm root cause propagation link graph is obtained based on the graph search algorithm and the topological sorting algorithm to locate the root cause of the network device alarm.

[0012] According to one aspect of the present application, a device for locating the root cause of an alarm based on a knowledge graph is provided, comprising:

[0013] A network device topology map acquisition unit is used to acquire multiple historical alarm data and construct a network device topology map based on the cleaned and marked device identification and device link relationship. The network device topology map is used to characterize the connection relationship between devices.

[0014] The alarm type causal knowledge graph acquisition unit is used to acquire multiple historical alarm data, construct feature engineering and compress data, extract alarm type entities and relationships, and construct an alarm type causal knowledge graph. The alarm type causal knowledge graph is used to characterize the generation relationship between alarm types.

[0015] An alarm propagation graph construction unit is used to generate an alarm propagation graph based on the fusion rules according to the network equipment topology graph and the alarm type causal knowledge graph;

[0016] The alarm root cause locating unit is used to obtain the alarm root cause propagation link map based on the alarm propagation map, the graph search algorithm and the topological sorting algorithm, and locate the root cause of the network device alarm.

[0017] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in the above-mentioned various optional implementations.

[0018] According to one aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, any one of the above methods is implemented.

[0019] According to one aspect of the present application, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform any one of the above methods by executing the executable instructions.

[0020] The exemplary embodiments of the present application may have some or all of the following beneficial effects:

[0021] In the alarm root cause location method based on knowledge graph provided in an example embodiment of the present application, multiple historical alarm data can be obtained, and a network device topology map can be constructed based on the cleaned and marked device identification and device link relationship, and the network device topology map is used to characterize the connection relationship between devices; multiple historical alarm data are obtained, feature engineering is constructed and data is compressed, alarm type entity extraction and relationship extraction are performed, and an alarm type causal knowledge graph is constructed, and the alarm type causal knowledge graph is used to characterize the generation relationship between alarm types; according to the network device topology map and the alarm type causal knowledge graph, an alarm propagation map is generated based on fusion rules; according to the alarm propagation map, an alarm root cause propagation link map is inferred based on a graph search algorithm and a topological sorting algorithm to locate the root cause of the network device alarm, wherein the alarm root cause propagation link map can clearly show the source of the alarm, realize the automatic location of the root cause, and there is no need for relevant personnel to locate the root cause based on professional knowledge or professional experience, which can improve the efficiency of root cause location and reduce labor costs.

[0022] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 A flowchart of a method for locating the root cause of an alarm based on a knowledge graph according to an embodiment of the present application is schematically shown;

[0025] Figure 2 A schematic diagram of a causal knowledge graph of alarm types according to an embodiment of the present application is shown schematically;

[0026] Figure 3 A schematic diagram of a warning propagation graph generation process according to an embodiment of the present application is schematically shown;

[0027] Figure 4 A schematic diagram of multiple weakly connected components according to an embodiment of the present application is schematically shown;

[0028] Figure 5 A schematic diagram a schematically shows a method of shrinking a weakly connected component into a strongly connected component according to an embodiment of the present application;

[0029] Figure 6 A schematic diagram b schematically shows a weakly connected component being shrunk into a strongly connected component according to an embodiment of the present application;

[0030] Figure 7 A schematic diagram of an alarm root cause propagation link spectrum according to an embodiment of the present application is schematically shown;

[0031] Figure 8 The schematic diagram of the architecture of the alarm root cause location system based on the knowledge graph according to an embodiment of the present application is schematically shown;

[0032] Fig. 9 A flowchart of a method for locating the root cause of an alarm based on a knowledge graph according to another embodiment of the present application is schematically shown;

[0033] Fig.10 The structure diagram of the alarm root cause location device based on the knowledge graph according to an embodiment of the present application is schematically shown;

[0034] Fig.11 The structure diagram of a computer system suitable for implementing an electronic device of an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0035] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present application will be more comprehensive and complete, and the concept of the example embodiments will be fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical solutions of the present application may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present application.

[0036] See also Figure 1 , Figure 1 The flowchart of the method for locating the root cause of an alarm based on a knowledge graph according to an embodiment of the present application is schematically shown. Figure 1 As shown, the specific steps include the following steps.

[0037] Step S110: Acquire multiple historical alarm data, and construct a network device topology map based on the cleaned and marked device identifiers and device link relationships. The network device topology map is used to characterize the connection relationship between devices.

[0038] Step S120: Acquire multiple historical alarm data, construct feature engineering and compress data, perform alarm type entity extraction and relationship extraction, and construct an alarm type causal knowledge graph. The alarm type causal knowledge graph is used to characterize the generation relationship between alarm types.

[0039] Step S130: Generate an alarm propagation graph based on the network equipment topology graph and the alarm type causal knowledge graph and fusion rules.

[0040] Step S140: According to the alarm propagation graph, the alarm root cause propagation link graph is inferred based on the graph search algorithm and the topological sorting algorithm to locate the root cause of the network device alarm.

[0041] Implementation Figure 1 The method shown can obtain multiple historical alarm data, build a network device topology map based on the cleaned and marked device identification and device link relationship, and the network device topology map is used to characterize the connection relationship between devices; obtain multiple historical alarm data, build feature engineering and compress data, perform alarm type entity extraction and relationship extraction, and build an alarm type causal knowledge graph, and the alarm type causal knowledge graph is used to characterize the generation relationship between alarm types; according to the network device topology map and the alarm type causal knowledge graph, based on the fusion rules, generate an alarm propagation map; according to the alarm propagation map, based on the graph search algorithm and the topological sorting algorithm, the alarm root cause propagation link map is inferred to locate the root cause of the network device alarm, wherein the alarm root cause propagation link map can clearly show the source of the alarm, realize the automatic location of the root cause, and there is no need for relevant personnel to locate the root cause based on professional knowledge or professional experience, which can improve the efficiency of root cause location and reduce labor costs.

[0042] Next, the above steps of this exemplary embodiment are described in more detail.

[0043] In step S110, a plurality of historical alarm data are obtained, and a network device topology map is constructed based on the cleaned and marked device identifications and device link relationships. The network device topology map is used to characterize the connection relationship between devices.

[0044] In step S120, multiple historical alarm data are obtained, feature engineering is constructed and data is compressed, alarm type entity extraction and relationship extraction are performed, and an alarm type causal knowledge graph is constructed. The alarm type causal knowledge graph is used to characterize the generation relationship between alarm types.

[0045] As an optional embodiment, it also includes: obtaining multiple historical alarm data; cleaning and preprocessing the multiple historical alarm data, generating device identifications for the devices corresponding to the multiple historical alarm data; and generating a network device topology map based on each device identification and device link relationship. In this way, the relationship between devices related to the historical alarm data can be obtained, and the network device topology map is conducive to tracing the root cause of the alarm.

[0046] Specifically, multiple historical alarm data within a unit time (such as one year) can be obtained and cleaned and preprocessed, and the alarm devices corresponding to the multiple historical alarm data are determined to be valid devices, and device identifications are generated for these devices respectively. Since there will be device link relationships between valid devices, a network device topology map can be generated based on multiple device identifications and device link relationships; wherein, historical alarm data is used to characterize historical alarms, and historical alarm data may include alarm time, alarm type, alarm device, etc.; the device identification may be composed of one or more numbers, symbols, characters, etc., which is not limited in the embodiments of the present application; the device link relationship is used to characterize the relationship between devices, such as connection relationship, communication relationship, etc.

[0047] For example, the network device topology map can be expressed as:

[0048]

[0049]

[0050] Among them, the device identification can be represented as a number, for example, the device identification of the valid device includes: 0, 1, 2, ..., 82, 83, 84. The first row and the first column represent the device identification, and the other parts are used to represent the relationship between the two device identifications. 0 indicates that there is no connection relationship between the valid devices corresponding to the two device identifications, and 1 indicates that there is a connection relationship between the valid devices corresponding to the two device identifications. For example, 1 is displayed in the third column of the second row, indicating that there is a connection relationship between the valid device with device identification 0 and the valid device with device identification 1; wherein the connection relationship may include a wired connection relationship and / or a wireless connection relationship, which is not limited in the embodiments of the present application. In particular, in the network device topology map, the numbers corresponding to the same device identification (such as the identification in the second row and the second column) are all 1. The reason is that each device has a self-loop, that is, each device's own alarm will cause itself to generate other alarms.

[0051] As an optional embodiment, it also includes: constructing feature engineering based on multiple historical alarm data, marking the historical alarm data belonging to the physical alarm type with a first physical alarm identifier; marking the historical alarm data that does not belong to the physical alarm type with a second physical alarm identifier. In this way, it is possible to identify in advance whether the alarm type belongs to a physical alarm, which is conducive to improving the generation accuracy of the subsequent root cause propagation link.

[0052] Specifically, a physical alarm discrimination can also be performed on the alarm type contained in each of the multiple historical alarm data. If the alarm type contained in the historical alarm data belongs to the physical alarm type, it is marked with a first physical alarm identifier; if the alarm type contained in the historical alarm data does not belong to the physical alarm type, it is marked with a second physical alarm identifier; wherein the representation method of the first physical alarm identifier is different from the representation method of the second physical alarm identifier. The first physical alarm identifier and the second physical alarm identifier can be composed of one or more numbers, symbols, characters, etc., which are not limited in the embodiments of the present application. wherein the physical alarm type can include but is not limited to: equipment failure, temperature abnormality, physical port Down, etc.

[0053] As an optional embodiment, it also includes: sorting multiple historical alarm data according to the alarm times corresponding to the multiple historical alarm data to obtain a sorting result; compressing adjacent identical historical alarm data in the sorting result to obtain multiple reference historical alarm data; wherein, when adjacent historical alarm data correspond to the same device and the same alarm type, the adjacent historical alarm data are determined to be the same historical alarm data. In this way, the redundancy of the historical alarm data can be reduced and the generation accuracy of the root cause propagation link can be improved.

[0054] Specifically, multiple historical alarm data are sorted according to the alarm times corresponding to the multiple historical alarm data to obtain a sorting result, including: sorting multiple historical alarm data from early to late / from late to early according to the alarm times corresponding to the multiple historical alarm data to obtain a sorting result, in which if adjacent identical historical alarm data correspond to the same device and the same alarm type, it is determined that the adjacent identical historical alarm data belong to repeated reporting of the same alarm, so the adjacent identical historical alarm data can be compressed into one historical alarm data, and in the sorting result after data compression, each historical alarm data can be determined as reference historical alarm data, and the data named as reference historical alarm data indicates that it has undergone a data compression process. Furthermore, optionally, after completing a data compression, adjacent identical historical alarm data may still exist in the sorting result, so the above embodiment can be executed repeatedly until there is no adjacent identical historical alarm data in the sorting result.

[0055] As an optional embodiment, it also includes: extracting alarm types from multiple reference historical alarm data to deduplicate reference historical alarm data of the same alarm type to obtain multiple target historical alarm data as entities of the alarm type causal knowledge graph; extracting alarm type causal relationships based on a topological Hawkes modeling algorithm (Topological HawkesProcess, TTPM) and multiple target historical alarm data as relationships between entities of the alarm type causal knowledge graph; generating an alarm type causal knowledge graph based on the entities and relationships between entities of the alarm type causal knowledge graph; wherein the input of the topological Hawkes modeling algorithm is the alarm type, alarm time, and alarm device in multiple target historical alarm data. In this way, the relationship between the target historical alarm data can be extracted through the topological Hawkes modeling algorithm to obtain the alarm type causal knowledge graph, and the data relationship represented by the alarm type causal knowledge graph can improve the generation accuracy of the root cause propagation link.

[0056] Specifically, among multiple reference historical alarm data, although there are no adjacent identical data, there may be reference historical alarm data corresponding to the same alarm type. In order to improve the generation efficiency of the root cause propagation link, the reference historical alarm data of the same alarm type can be deduplicated to obtain multiple target historical alarm data. Any two target historical alarm data among the multiple target historical alarm data correspond to different alarm types.

[0057] Then, according to the Hawkes modeling algorithm based on the topological structure and based on multiple target historical alarm data, the alarm type causal relationship is extracted as the relationship between the entities of the alarm type causal knowledge graph; based on the entities and the relationship between the entities of the alarm type causal knowledge graph, the alarm type causal knowledge graph is generated, including: inputting the alarm type, alarm time, and alarm device into the Hawkes modeling algorithm based on the topological structure, so that the Hawkes modeling algorithm based on the topological structure outputs the relationship between the target historical alarm data, and the relationship between the target historical alarm data can be used to construct the alarm type causal knowledge graph. For the specific representation of the alarm type causal knowledge graph, you can refer to Figure 2 . Figure 2 A schematic diagram of a causal knowledge graph of alarm types according to an embodiment of the present application is shown schematically. Figure 2 In the example, assuming that each number from 0 to 21 represents an alarm type, the directed line segments between the numbers can be used to represent the transmission relationship between the alarm types. For example, the number 1 points to the number 6, which means that the alarm type corresponding to the number 1 will trigger the alarm type corresponding to the number 6.

[0058] Among them, the Hawkes process based on topology structure is evolved from the Hawkes process. The Hawkes process is a common point process modeling method used to build models for discrete events in continuous time, predict future events, and discover event causal relationships. However, the Hawkes process assumes that events are only affected by each other and not by other factors. It does not take into account the physical structure of the event, does not conform to the propagation law of alarm events, and is prone to false causal relationships. TTPM adds consideration of device topology and can be applied to the generation process of root cause propagation links, specifically used to generate alarm type causal knowledge graphs.

[0059] Specifically, according to the connection relationship between devices defined by the network equipment topology map and the generation relationship between alarm types defined by the alarm type causal knowledge map, multiple historical alarm data sequences can be respectively generated into alarm propagation maps. The alarm propagation map can be used to characterize the alarm transmission relationship between the historical alarm data in the sequence. The alarm propagation map contains multiple nodes, and each node represents a historical alarm data.

[0060] As an optional embodiment, according to the network equipment topology map and the alarm type causal knowledge map, based on the fusion rules, an alarm propagation map is generated, including: sorting multiple historical alarm data according to the alarm time corresponding to the multiple historical alarm data, and obtaining the target sorting result; dividing the target sorting result according to the preset time step to obtain multiple historical alarm data sequences; for each historical alarm data sequence in the multiple historical alarm data sequences, detecting data pairs that meet the fusion rules; wherein the fusion rules include the existence of a direct causal relationship between the data pairs, the data pairs belonging to the same device, the devices to which the data pairs belong are adjacent, and the causal direction of the alarm type of the data pairs is consistent with the device topology direction of the data pairs; determining each historical alarm data in the data pair as an alarm node, and constructing directed edges for the alarm nodes that meet the fusion rules to obtain alarm propagation maps corresponding to each historical alarm data sequence. In this way, the alarm propagation map can be accurately determined, and the alarm propagation map is conducive to generating accurate root cause propagation links.

[0061] Specifically, multiple historical alarm data within a unit time can be sorted according to the alarm time. The sorting rule can be from early to late or from late to early, which is not limited in the embodiment of the present application. The target sorting result obtained can be divided according to the preset time step h (such as 3) to obtain multiple historical alarm data sequences, which can be expressed as G = {G 1 ,G 2 ,…,G N}, where G 1 ,G 2 ,…,G NThey represent different historical alarm data sequences, G represents the set of historical alarm data sequences, and N represents the total number of historical alarm data. For example, G 1 Indicates the first historical alarm data sequence.

[0062] For example, any historical alarm data sequence G among multiple historical alarm data sequences i It can be expressed as Among them, n i Represents the i-th alarm sequence G i The number of alarms (t ij ,r ij ) indicates t ij At this moment, an r ij Alarm data of the alarm type. In addition, it should be noted that for r ij ∈R={r 1 ,r 2 ,…,r M}, R is the set of alarm types. In the historical alarm data, a total of M alarm types have been generated.

[0063] Furthermore, for any historical alarm data sequence, the following steps can be performed: detect data pairs that meet the fusion rules, where a data pair refers to a pair of historical alarm data; when there is a connection relationship between the devices corresponding to the data pairs, it is considered that there is a direct causal relationship between the data pairs, that is, the fusion rules are met; when the data pairs belong to the same device or the devices they belong to are adjacent, the fusion rules are also considered to be met; when the alarm type causal direction of the data pair (for example, historical alarm data A and historical alarm data B) is the same (for example, alarm type A points to alarm type B), and the device topology direction of the data pair is consistent (for example, device A points to device B), then the fusion rules are considered to be met.

[0064] For any historical alarm data sequence, for example, it can be expressed as the following table:

[0065]

[0066]

[0067] Furthermore, each historical alarm data in the data pair can be determined as an alarm node, and directed edges can be constructed for the alarm nodes that meet the fusion rules to obtain an alarm propagation graph corresponding to each historical alarm data sequence.

[0068] For the generation process of the above alarm propagation graph, please refer to Figure 3 , Figure 3 The following schematically shows a process diagram of generating an alarm propagation graph according to an embodiment of the present application. Figure 3As shown, if the alarm node 310 includes a1, a2, a3, a4, and a5. Generally speaking, "Port Down" will cause the interruption of the network protocol running on the ports of the devices at both ends and the interruption of the BFD protocol that detects the connectivity of the protocol. Therefore, the alarm type propagation relationship indicated by the alarm type causal knowledge graph 320 is: "Port Down" causes "OSPF Neighbor Down" and "OSPF Neighbor Down". The device relationship indicated by the network device topology graph 330 is that there is a relationship between d1 and d2, and d3 has no relationship with d1 and d2. It can be seen that the alarm type causal direction of a1 and a2 is consistent with the device topology direction where the alarm occurs. Therefore, based on the network device topology graph 330 and the alarm type causal knowledge graph 320, and based on multiple historical alarm data sequences, an alarm propagation graph 340 can be generated. The alarm propagation graph 340 indicates that a4 causes a1, a2, and a3, and a5 has no relationship with other alarm nodes.

[0069] In step S130, an alarm propagation graph is generated based on the fusion rules according to the network equipment topology graph and the alarm type causal knowledge graph.

[0070] Specifically, strongly connected components can be understood as, in a directed graph G, if there is a directed path from u to v between two vertices u and v, and there is also a directed path from v to u, then the two vertices are said to be strongly connected. In addition, a directed acyclic graph refers to a directed graph without loops in the graph.

[0071] As an optional embodiment, it also includes: searching multiple weakly connected components in the alarm propagation graph based on a depth-first search algorithm; and shrinking each weakly connected component into a strongly connected component based on the node relationship within each of the multiple weakly connected components. In this way, the generation accuracy of the root cause propagation link can be improved by shrinking the weakly connected components into the strongly connected components.

[0072] Specifically, the depth-first search algorithm (Tarjan) is an algorithm based on the depth-first search of the graph. Each strongly connected component is a subgraph in the alarm propagation graph. When searching, the unprocessed nodes in the current alarm propagation graph are added to the stack. When backtracking, it can be determined whether the node from the top of the stack to the stack is a strongly connected component.

[0073] Based on the depth-first search algorithm, we can first search for multiple weakly connected components in the alarm propagation graph. If the alarm propagation graph is represented as Figure 4 . Figure 4A schematic diagram of multiple weakly connected components according to an embodiment of the present application is shown schematically. Figure 4 As shown, if the alarm nodes included in the alarm propagation graph 400 are: {a1, a2, ..., a13}, the directed edges in the alarm propagation graph 400 are used to represent the relationship between the alarm nodes. The directed edges can be first regarded as undirected edges and the weakly connected components can be searched based on the depth-first search algorithm to obtain the weakly connected components wcc0410, wcc1420, and wcc2430.

[0074] Among them, the weakly connected component wcc0 410 includes the alarm nodes: {a1, a2, a4, a6, a7}, the weakly connected component wcc1 420 includes the alarm nodes: {a3, a12, a13}, and the weakly connected component wcc2 430 includes the alarm nodes: {a5, a8, a9, a10, a11}.

[0075] Specifically, there are directed edges between the warning nodes in the weakly connected component wcc1 420 and the weakly connected component wcc2 430, so the weakly connected component wcc1 420 can be shrunk to the strongly connected component based on the node relationship inside the weakly connected component wcc1 420. Similarly, the weakly connected component wcc2 430 can be shrunk to the strongly connected component based on the node relationship inside the weakly connected component wcc2 430.

[0076] For details, please refer to Figure 5 , Figure 5 Schematic diagram a schematically shows a diagram of shrinking a weakly connected component into a strongly connected component according to an embodiment of the present application. Figure 5 As shown, since there are directed edges between the warning nodes in the weakly connected component wcc1 510 and the weakly connected component wcc2 520, the weakly connected component wcc1 510 can be contracted to the strongly connected component s10, and the warning nodes implied by the strongly connected component s10 are: {a3, a12, a13}. The weakly connected component wcc2 520 can be contracted to the strongly connected component s20, and the warning nodes implied by the strongly connected component s20 are: {a5, a8, a9, a10, a11}.

[0077] In addition, since the weakly connected component wcc0 410 does not have directed edges between the warning nodes, the compression method of the weakly connected component wcc0 410 can refer to Figure 6 , Figure 6 Schematic diagram b schematically shows a weakly connected component being shrunk into a strongly connected component according to an embodiment of the present application. Figure 6As shown, the weakly connected component wcc0 600 can be shrunk into: the strongly connected component scc0 610 of the implicit alarm nodes a2 and a4, the strongly connected component scc1 620 of the implicit alarm node a1, the strongly connected component scc2 630 of the implicit alarm node a4, the strongly connected component scc3 640 of the implicit alarm node a6, and the strongly connected component scc4 650 of the implicit alarm node a7. Furthermore, a directed acyclic graph wcc0_dag 660 consisting of the strongly connected component scc0 610, the strongly connected component scc1 620, the strongly connected component scc2 630, the strongly connected component scc3 640, and the strongly connected component scc4 650 can be obtained.

[0078] In step S140, according to the alarm propagation graph, the alarm root cause propagation link graph is inferred based on the graph search algorithm and the topological sorting algorithm to locate the root cause of the network device alarm.

[0079] Specifically, the alarm root cause propagation link graph is used to characterize the propagation order between an alarm data node. Different alarm root cause propagation link graphs may correspond to different lengths, which is not limited in the embodiments of the present application.

[0080] As an optional embodiment, if the number of nodes contained in the strongly connected component is equal to 1, according to the alarm propagation map, the alarm root cause propagation link map is inferred based on the graph search algorithm and the topological sorting algorithm to locate the root cause of the network device alarm, including: for any two alarm data nodes corresponding to the strongly connected component, if any one of the two alarm data nodes corresponds to the first physical alarm identifier, the alarm data node corresponding to the first physical alarm identifier in the two alarm data nodes is determined as the root cause; if no node in the two alarm data nodes corresponds to the first physical alarm identifier, or if both alarm data nodes correspond to the first physical alarm identifier, the alarm data node with the earliest alarm time in the two alarm data nodes is determined as the root cause; continue to traverse other nodes corresponding to the strongly connected component until the alarm root cause propagation link map is obtained. In this way, the root cause determination can be made for each two alarm data nodes based on the first physical alarm identifier and the alarm time, until an accurate alarm root cause propagation link map is obtained, which can improve the efficiency of root cause positioning.

[0081] Specifically, the root cause can be determined based on the following expression:

[0082]

[0083] If multiple alarm sequences are represented by A = {A 1 ,A 2 ,...,A N}, Alarm sequence A i Expressed as ni Represents the i-th alarm sequence A i The number of alarms (t ij ,r ij ,p ij ) indicates that at t ij At this moment, an r ij Alarm type alarm, p ij Mark r ij Is this alarm type a physical alarm? ij Represented as the first physical alarm identifier or the second physical alarm identifier.

[0084] in,

[0085] If any of the two alarm data nodes corresponds to the first physical alarm identifier, that is, one of the nodes belongs to the physical alarm type, then it can be determined that the node belonging to the physical alarm type is the root cause of the two alarm data nodes, otherwise, the alarm data node with the earliest alarm time is determined as the root cause of the two alarm data nodes. In this way, the relationship between the nodes corresponding to the strong connection component (such as the above s20) (such as the above {a5, a8, a9, a10, a11}) can be determined, and the alarm root cause propagation link map can be obtained.

[0086] As an optional embodiment, if the number of nodes contained in the strongly connected component is greater than 1 and is represented as a directed acyclic graph, according to the alarm propagation graph, the alarm root cause propagation link graph is inferred based on the graph search algorithm and the topological sorting algorithm to locate the root cause of the network device alarm, including: screening the vertex nodes with an in-degree of 0 in the directed acyclic graph; for any two vertex nodes, if any one of the two vertex nodes corresponds to the first physical alarm identifier, then the vertex node corresponding to the first physical alarm identifier in the two vertex nodes is determined as the root cause; if there is no node with the first physical alarm identifier in the two vertex nodes, or if both vertex nodes correspond to the first physical alarm identifier, the vertex node with the earliest alarm time in the two vertex nodes is determined as the root cause; delete the vertex nodes with an in-degree of 0 in the directed acyclic graph, and the directed edges between the vertex nodes with an in-degree of 0, and continue to traverse other nodes in the directed acyclic graph until the alarm root cause propagation link graph is obtained. In this way, the root cause determination can be performed on every two alarm data nodes based on the directed acyclic graph, the first physical alarm identifier, and the alarm time, until an accurate alarm root cause propagation link map is obtained, which can improve the root cause positioning efficiency.

[0087] Specifically, when the in-degree is 0, it means that the point in the directed acyclic graph is not the end point of any edge, that is, all edges connected to this point use this point as the starting point. In the topological sorting of directed graphs, the point with in-degree 0 is usually selected to be added to the topological queue, and then all edges connected to this point are deleted.

[0088] See also Figure 7 , Figure 7 The schematic diagram of the alarm root cause propagation link spectrum according to an embodiment of the present application is schematically shown. For the directed acyclic graph wcc0_dag 660, the vertex nodes with an in-degree of 0 in the directed acyclic graph wcc0_dag 660 can be screened. For any two vertex nodes, if any one of the two vertex nodes corresponds to the first physical alarm identifier, the vertex node corresponding to the first physical alarm identifier in the two vertex nodes is determined as the root cause; if there is no node with the first physical alarm identifier in the two vertex nodes, or if both vertex nodes correspond to the first physical alarm identifier, the vertex node with the earliest alarm time in the two vertex nodes is determined as the root cause. Based on this, the sorting result {[s3, s4], s1, s0} corresponding to the directed acyclic graph wcc0_dag660 can be obtained. For [s3, s4], the above method can also be used to sort until the alarm root cause propagation link graph 700 corresponding to the directed acyclic graph wcc0_dag 660 is determined: a6->a7->a1->a2->a4. It can be seen that in the alarm root cause propagation link graph 700, the root cause is a6.

[0089] See also Figure 8 , Figure 8 The schematic diagram of the architecture of the alarm root cause location system based on the knowledge graph according to an embodiment of the present application is shown schematically. Figure 8 As shown, in the system, the application layer includes a capacity scheduling subsystem 810; the knowledge application unit includes an alarm root cause location module 821 and an alarm event propagation tracking module 822; the knowledge graph construction unit includes an entity extraction module 831, a relationship extraction module 832, and an attribute extraction module 833; the data processing unit includes a data cleaning module 841, a data preprocessing module 842, a feature engineering module 843, and a data aggregation module 844; the basic data storage unit includes alarm data 851, device detail data 852, and device topology data 853; the graph data storage unit includes a network device topology graph 861 and an alarm type causal knowledge graph 862.

[0090] Specifically, alarm data 851, device details data 852, and device topology data 853 are stored in the data warehouse Hive of the basic data storage unit. Network device topology graph 861 and alarm type causal knowledge graph 862 are stored in the neo4j graph database of the graph data storage unit.

[0091] Among them, the data cleaning module 841 is used to clean invalid data, abnormal values ​​and missing values ​​in multiple historical alarm data; the data preprocessing module 842 is used to perform structured processing on multiple historical alarm data; the feature engineering module 843 is used to merge adjacent identical historical alarm data; the data aggregation module 844 is used to deduplicate reference historical alarm data of the same alarm type.

[0092] In addition, the entity extraction module 831 is used to extract the required entities, such as alarm type and alarm device, from multiple historical alarm data; the relationship extraction module 832 is used to determine the relationship between entities; the attribute extraction module 833 is used to determine specific entity attributes in multiple historical alarm data, such as physical alarm type.

[0093] In addition, the alarm root cause location module 821 is used to determine the root alarm; the alarm event propagation tracking module 822 infers the propagation law of historical alarm data based on the causal relationship between the correlation of device nodes and the alarm type. In addition, the capability scheduling subsystem 810 is used to provide information scheduling functions for the knowledge application unit.

[0094] See also Fig. 9 , Fig. 9 The flowchart of the method for locating the root cause of an alarm based on a knowledge graph according to another embodiment of the present application is schematically shown. Fig. 9 As shown, the method for locating the root cause of an alarm based on a knowledge graph includes: steps S910 to S980.

[0095] Step S910: Acquire multiple historical alarm data, clean and pre-process the multiple historical alarm data, generate device identifiers for the devices corresponding to the multiple historical alarm data, and generate a network device topology map based on each device identifier and device link relationship.

[0096] Step S920: construct feature engineering based on multiple historical alarm data, mark the historical alarm data belonging to the physical alarm type with a first physical alarm identifier, and mark the historical alarm data that does not belong to the physical alarm type with a second physical alarm identifier.

[0097] Step S930: Sort the multiple historical alarm data according to the alarm times corresponding to the multiple historical alarm data to obtain a sorting result, and perform data compression on adjacent identical historical alarm data in the sorting result to obtain multiple reference historical alarm data; wherein, when adjacent historical alarm data correspond to the same device and the same alarm type, the adjacent historical alarm data are determined to be the same historical alarm data.

[0098] Step S940: Extract alarm types from multiple reference historical alarm data, and deduplicate reference historical alarm data of the same alarm type to obtain multiple target historical alarm data as entities of the alarm type causal knowledge graph. Then, according to the Hawkes modeling algorithm based on the topological structure and based on the multiple target historical alarm data, extract alarm type causal relationships as the relationship between entities of the alarm type causal knowledge graph; generate an alarm type causal knowledge graph based on the entities of the alarm type causal knowledge graph and the relationship between entities; wherein the input of the Hawkes modeling algorithm based on the topological structure is the alarm type, alarm time, and alarm device in the multiple target historical alarm data.

[0099] Step S950: Sort multiple historical alarm data according to the alarm times corresponding to the multiple historical alarm data respectively to obtain a target sorting result, and divide the target sorting result according to a preset time step to obtain multiple historical alarm data sequences; for each historical alarm data sequence in the multiple historical alarm data sequences, detect data pairs that meet the fusion rules; wherein the fusion rules include that there is a direct causal relationship between the data pairs, the data pairs belong to the same device, the devices to which the data pairs belong are adjacent, and the causal direction of the alarm type of the data pairs is consistent with the device topology direction of the data pairs; then, determine each historical alarm data in the data pair as an alarm node, and construct directed edges for the alarm nodes that meet the fusion rules to obtain alarm propagation graphs corresponding to each historical alarm data sequence.

[0100] Step S960: Search multiple weakly connected components in the alarm propagation graph based on the depth-first search algorithm, and shrink each weakly connected component into a strongly connected component based on the node relationship within each weakly connected component. If the number of nodes contained in the strongly connected component is equal to 1, execute step S970; if the number of nodes contained in the strongly connected component is greater than 1 and is represented as a directed acyclic graph, execute step S980.

[0101] Step S970: For any two alarm data nodes corresponding to the strongly connected component, if any one of the two alarm data nodes corresponds to the first physical alarm identifier, the alarm data node corresponding to the first physical alarm identifier among the two alarm data nodes is determined as the root cause; if no node among the two alarm data nodes corresponds to the first physical alarm identifier, or if both alarm data nodes correspond to the first physical alarm identifier, the alarm data node with the earliest alarm time among the two alarm data nodes is determined as the root cause; and then, other nodes corresponding to the strongly connected component are continuously traversed until the alarm root cause propagation link map is obtained.

[0102] Step S980: Filter the vertex nodes with in-degree 0 in the directed acyclic graph; for any two vertex nodes, if any one of the two vertex nodes corresponds to the first physical alarm identifier, the vertex node corresponding to the first physical alarm identifier among the two vertex nodes is determined as the root cause; if there is no node with the first physical alarm identifier among the two vertex nodes, or if both vertex nodes correspond to the first physical alarm identifier, the vertex node with the earliest alarm time among the two vertex nodes is determined as the root cause; then, delete the vertex nodes with in-degree 0 in the directed acyclic graph, as well as the directed edges between the vertex nodes with in-degree 0, and continue to traverse other nodes in the directed acyclic graph until the alarm root cause propagation link graph is obtained.

[0103] It should be noted that steps S910 to S980 are Figure 1 The steps and their embodiments correspond to each other. For the specific implementation of steps S910 to S980, please refer to Figure 1 The steps and their embodiments shown will not be described in detail here.

[0104] It can be seen that implementation Fig. 9 The method shown can obtain multiple historical alarm data, build a network device topology map based on the cleaned and marked device identification and device link relationship, and the network device topology map is used to characterize the connection relationship between devices; obtain multiple historical alarm data, build feature engineering and compress data, perform alarm type entity extraction and relationship extraction, and build an alarm type causal knowledge graph, and the alarm type causal knowledge graph is used to characterize the generation relationship between alarm types; according to the network device topology map and the alarm type causal knowledge graph, based on the fusion rules, generate an alarm propagation map; according to the alarm propagation map, based on the graph search algorithm and the topological sorting algorithm, the alarm root cause propagation link map is inferred to locate the root cause of the network device alarm, wherein the alarm root cause propagation link map can clearly show the source of the alarm, realize the automatic location of the root cause, and there is no need for relevant personnel to locate the root cause based on professional knowledge or professional experience, which can improve the efficiency of root cause location and reduce labor costs.

[0105] See also Fig.10 , Fig.10 The structure block diagram of the alarm root cause location device based on the knowledge graph in one embodiment of the present application is schematically shown. Fig.10 As shown, the knowledge graph-based alarm root cause location device 1000 may include the following units.

[0106] The network device topology map and alarm type causal knowledge map acquisition unit 1001 is used to acquire the network device topology map and the alarm type causal knowledge map; wherein the network device topology map is used to characterize the connection relationship between devices, and the alarm type causal knowledge map is used to characterize the generation relationship between alarm types;

[0107] The network device topology map acquisition unit 1001 is used to acquire multiple historical alarm data and construct a network device topology map based on the cleaned and marked device identifiers and device link relationships. The network device topology map is used to characterize the connection relationship between devices.

[0108] The alarm type causal knowledge graph acquisition unit 1002 is used to acquire multiple historical alarm data, construct feature engineering and compress data, perform alarm type entity extraction and relationship extraction, and construct an alarm type causal knowledge graph. The alarm type causal knowledge graph is used to characterize the generation relationship between alarm types.

[0109] The alarm propagation graph construction unit 1003 is used to generate an alarm propagation graph based on the fusion rules according to the network device topology graph and the alarm type causal knowledge graph;

[0110] The alarm root cause locating unit 1004 is used to obtain the alarm root cause propagation link graph based on the alarm propagation graph, graph search algorithm and topological sorting algorithm, and locate the network device alarm root cause.

[0111] It can be seen that the implementation Fig.10 The device shown can obtain multiple historical alarm data, build a network device topology map based on the cleaned and marked device identification and device link relationship, and the network device topology map is used to characterize the connection relationship between devices; obtain multiple historical alarm data, build feature engineering and compress data, perform alarm type entity extraction and relationship extraction, and build an alarm type causal knowledge graph, and the alarm type causal knowledge graph is used to characterize the generation relationship between alarm types; according to the network device topology map and the alarm type causal knowledge graph, based on the fusion rules, generate an alarm propagation map; according to the alarm propagation map, based on the graph search algorithm and the topological sorting algorithm, the alarm root cause propagation link map is inferred to locate the root cause of the network device alarm, wherein the alarm root cause propagation link map can clearly show the source of the alarm, realize the automatic location of the root cause, and there is no need for relevant personnel to locate the root cause based on professional knowledge or professional experience, which can improve the efficiency of root cause location and reduce labor costs.

[0112] As an optional embodiment, it also includes:

[0113] A historical alarm data acquisition unit, used to acquire multiple historical alarm data;

[0114] The device identification generating unit is used to clean and pre-process the multiple historical alarm data, and generate device identifications for the devices corresponding to the multiple historical alarm data respectively;

[0115] The network device topology map generation unit is used to generate a network device topology map according to each device identifier and device link relationship.

[0116] It can be seen that by implementing this optional embodiment, the relationship between devices related to historical alarm data can be obtained, which is conducive to tracing the root cause of the alarm based on the network device topology map.

[0117] As an optional embodiment, it also includes:

[0118] A first physical alarm identification marking unit is used to construct a feature engineering based on a plurality of historical alarm data, and mark the historical alarm data belonging to the physical alarm type with a first physical alarm identification;

[0119] The second physical alarm identification marking unit is used to mark the historical alarm data that does not belong to the physical alarm type with a second physical alarm identification.

[0120] It can be seen that by implementing this optional embodiment, it is possible to identify in advance whether the alarm type is a physical alarm, which is beneficial to improving the generation accuracy of the subsequent root cause propagation link.

[0121] As an optional embodiment, it also includes:

[0122] A historical alarm data sorting unit is used to sort the multiple historical alarm data according to the alarm times respectively corresponding to the multiple historical alarm data to obtain a sorting result;

[0123] The data merging unit is used to compress adjacent identical historical alarm data in the sorting result to obtain multiple reference historical alarm data; wherein, when adjacent historical alarm data corresponds to the same device and the same alarm type, the adjacent historical alarm data is determined to be the same historical alarm data.

[0124] It can be seen that implementing this optional embodiment can reduce the redundancy of historical alarm data and improve the generation accuracy of the root cause propagation link.

[0125] As an optional embodiment, it also includes:

[0126] A data deduplication unit is used to extract alarm types from multiple reference historical alarm data and deduplicate the reference historical alarm data of the same alarm type to obtain multiple target historical alarm data as entities of the alarm type causal knowledge graph;

[0127] The alarm type causal knowledge graph generation unit is used to extract the alarm type causal relationship as the relationship between entities of the alarm type causal knowledge graph based on the Hawkes modeling algorithm based on the topological structure and based on multiple target historical alarm data; generate the alarm type causal knowledge graph based on the entities and the relationship between entities of the alarm type causal knowledge graph; wherein the input of the Hawkes modeling algorithm based on the topological structure is the alarm type, alarm time, and alarm device in the multiple target historical alarm data.

[0128] It can be seen that by implementing this optional embodiment, the relationship between the target historical alarm data can be extracted through the Hawkes modeling algorithm based on the topology structure to obtain the alarm type causal knowledge graph. The data relationship represented by the alarm type causal knowledge graph can improve the generation accuracy of the root cause propagation link.

[0129] As an optional embodiment, the alarm propagation graph construction unit 1003 generates an alarm propagation graph based on the network device topology graph and the alarm type causal knowledge graph based on the fusion rule, including:

[0130] Sorting the multiple historical alarm data according to the alarm times respectively corresponding to the multiple historical alarm data to obtain a target sorting result;

[0131] Divide the target sorting results according to the preset time step to obtain multiple historical alarm data sequences;

[0132] For each of the multiple historical alarm data sequences, detect data pairs that meet the fusion rules; wherein the fusion rules include that there is a direct causal relationship between the data pairs, the data pairs belong to the same device, the devices to which the data pairs belong are adjacent, and the causal direction of the alarm type of the data pairs is consistent with the device topology direction of the data pairs;

[0133] Each historical alarm data in the data pair is determined as an alarm node, and directed edges are constructed for the alarm nodes that meet the fusion rules to obtain alarm propagation graphs corresponding to each historical alarm data sequence.

[0134] It can be seen that the implementation of this optional embodiment can improve the accuracy of determining the alarm propagation map, and the alarm propagation map is conducive to generating a precise root cause propagation link.

[0135] As an optional embodiment, it also includes:

[0136] A weakly connected component search unit, used for searching multiple weakly connected components in the alarm propagation graph based on a depth-first search algorithm;

[0137] The strongly connected component acquisition unit is used to shrink each weakly connected component into a strongly connected component based on the node relationship within each weakly connected component among the multiple weakly connected components.

[0138] It can be seen that by implementing this optional embodiment, the generation accuracy of the root cause propagation link can be improved by shrinking the weakly connected components into strongly connected components.

[0139] As an optional embodiment, if the number of nodes included in the strongly connected component is equal to 1, the alarm root cause locating unit 1004 obtains the alarm root cause propagation link map based on the alarm propagation map, based on the graph search algorithm and the topological sorting algorithm, and locates the network device alarm root cause, including:

[0140] For any two alarm data nodes corresponding to the strong interconnection component, if any one of the two alarm data nodes corresponds to the first physical alarm identifier, the alarm data node corresponding to the first physical alarm identifier among the two alarm data nodes is determined as the root cause;

[0141] If no node of the two alarm data nodes corresponds to the first physical alarm identifier, or if both alarm data nodes correspond to the first physical alarm identifier, the alarm data node with the earliest alarm time of the two alarm data nodes is determined as the root cause;

[0142] Continue to traverse other nodes corresponding to the strongly connected components until the alarm root cause propagation link graph is obtained.

[0143] It can be seen that by implementing this optional embodiment, the root cause determination can be performed on every two alarm data nodes based on the first physical alarm identifier and the alarm time, until an accurate alarm root cause propagation link map is obtained, which can improve the root cause positioning efficiency.

[0144] As an optional embodiment, if the number of nodes included in the strongly connected component is greater than 1 and is represented as a directed acyclic graph, the alarm root cause locating unit 1004 obtains the alarm root cause propagation link graph based on the alarm propagation graph, based on the graph search algorithm and the topological sorting algorithm, and locates the network device alarm root cause, including:

[0145] Filter the vertex nodes with in-degree 0 in the directed acyclic graph;

[0146] For any two vertex nodes, if any one of the two vertex nodes corresponds to the first physical alarm identifier, the vertex node corresponding to the first physical alarm identifier among the two vertex nodes is determined as the root cause;

[0147] If there is no node first physical alarm identifier in the two vertex nodes, or if both vertex nodes correspond to the first physical alarm identifier, the vertex node with the earliest alarm time among the two vertex nodes is determined as the root cause;

[0148] Delete the vertex nodes with in-degree 0 in the directed acyclic graph, as well as the directed edges between vertex nodes with in-degree 0, and continue to traverse other nodes in the directed acyclic graph until the alarm root cause propagation link graph is obtained.

[0149] It can be seen that by implementing this optional embodiment, the root cause determination can be performed on every two alarm data nodes based on the directed acyclic graph, the first physical alarm identifier and the alarm time, until an accurate alarm root cause propagation link map is obtained, which can improve the root cause positioning efficiency.

[0150] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0151] Since the various functional modules of the alarm root cause location device based on knowledge graph in the example embodiment of the present application correspond to the steps of the example embodiment of the alarm root cause location device based on knowledge graph mentioned above, for details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the alarm root cause location device based on knowledge graph mentioned above in the present application.

[0152] See also Fig.11 , Fig.11 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.

[0153] It should be noted that Fig.11 The computer system 1100 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0154] like Fig.11 As shown, the computer system 1100 includes a central processing unit (CPU) 1101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1102 or a program loaded from a storage part 1108 into a random access memory (RAM) 1103. Various programs and data required for system operation are also stored in the RAM 1103. The CPU 1101, the ROM 1102, and the RAM 1103 are connected to each other via a bus 1104. An input / output (I / O) interface 1105 is also connected to the bus 1104.

[0155] The following components are connected to the I / O interface 1105: an input section 1106 including a keyboard, a mouse, etc.; an output section 1107 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1108 including a hard disk, etc.; and a communication section 1109 including a network interface card such as a LAN card, a modem, etc. The communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to the I / O interface 1105 as needed. A removable medium 1111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1110 as needed, so that a computer program read therefrom is installed into the storage section 1108 as needed.

[0156] In particular, according to an embodiment of the present application, the process described below with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 1109, and / or installed from a removable medium 1111. When the computer program is executed by a central processing unit (CPU) 1101, various functions defined in the method and apparatus of the present application are executed.

[0157] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method in the above embodiment.

[0158] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0159] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0160] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0161] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary technical means in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the claims.

Claims

1. A method for locating the root cause of an alarm based on a knowledge graph, characterized in that: include: Acquire multiple historical alarm data, and construct a network device topology map based on the cleaned and marked device identifiers and device link relationships, wherein the network device topology map is used to characterize the connection relationship between devices; Acquire multiple historical alarm data, construct feature engineering and compress data, extract alarm type entities and extract relationships, and construct an alarm type causal knowledge graph, which is used to characterize the generation relationship between alarm types; Generate an alarm propagation graph based on the network device topology graph and the alarm type causal knowledge graph and based on fusion rules; According to the alarm propagation graph, an alarm root cause propagation link graph is obtained based on graph search algorithm and topological sorting algorithm, and the root cause of the network device alarm is located.

2. The method according to claim 1, characterized in that Also includes: Get multiple historical alarm data; Cleaning and preprocessing the plurality of historical alarm data, and generating device identifiers for the devices respectively corresponding to the plurality of historical alarm data; The network device topology map is generated according to each of the device identifiers and device link relationships.

3. The method according to claim 2, characterized in that Also includes: Constructing feature engineering based on the multiple historical alarm data, marking the historical alarm data belonging to the physical alarm type with a first physical alarm identifier; The historical alarm data that does not belong to the physical alarm type is marked with the second physical alarm identifier.

4. The method according to claim 3, characterized in that: Also includes: Sorting the plurality of historical alarm data according to the alarm times respectively corresponding to the plurality of historical alarm data to obtain a sorting result; The adjacent identical historical alarm data in the sorting result are compressed to obtain a plurality of reference historical alarm data; wherein, when the adjacent historical alarm data correspond to the same device and the same alarm type, the adjacent historical alarm data are determined to be identical historical alarm data.

5. The method according to claim 4, characterized in that Also includes: Extracting alarm types from the plurality of reference historical alarm data to deduplicate the reference historical alarm data of the same alarm type, so as to obtain a plurality of target historical alarm data as entities of the alarm type causal knowledge graph; According to the Hawkes modeling algorithm based on the topological structure and according to the plurality of target historical alarm data, the alarm type causal relationship is extracted as the relationship between entities of the alarm type causal knowledge graph; The alarm type causal knowledge graph is generated based on the entities and the relationships between the entities in the alarm type causal knowledge graph; wherein the input of the topology-based Hawkes modeling algorithm is the alarm type, alarm time, and alarm device in the multiple target historical alarm data.

6. The method according to claim 1, characterized in that According to the network device topology graph and the alarm type causal knowledge graph, an alarm propagation graph is generated based on a fusion rule, including: Sorting the plurality of historical alarm data according to the alarm times respectively corresponding to the plurality of historical alarm data to obtain a target sorting result; Dividing the target sorting results according to a preset time step to obtain multiple historical alarm data sequences; For each of the multiple historical alarm data sequences, detect data pairs that satisfy a fusion rule; wherein the fusion rule includes that there is a direct causal relationship between the data pairs, the data pairs belong to the same device, the devices to which the data pairs belong are adjacent, and the causal direction of the alarm type of the data pairs is consistent with the device topology direction of the data pairs; Each historical alarm data in the data pair is determined as an alarm node, and a directed edge is constructed for the alarm node that meets the fusion rule to obtain an alarm propagation graph corresponding to each historical alarm data sequence.

7. The method according to claim 1, characterized in that Also includes: Searching for multiple weakly connected components in the alarm propagation graph based on a depth-first search algorithm; Based on the node relationship within each weakly connected component of the multiple weakly connected components, the weakly connected components are respectively contracted into strongly connected components.

8. The method according to claim 7, characterized in that If the number of nodes included in the strongly connected component is equal to 1, the alarm root cause propagation link map is obtained based on the graph search algorithm and the topological sorting algorithm according to the alarm propagation map, and the root cause of the network device alarm is located, including: For any two alarm data nodes corresponding to the strong interconnection component, if any one of the two alarm data nodes corresponds to a first physical alarm identifier, determine the alarm data node corresponding to the first physical alarm identifier among the two alarm data nodes as a root cause; If no node of the two alarm data nodes corresponds to the first physical alarm identifier, or if the two alarm data nodes both correspond to the first physical alarm identifier, determining the alarm data node with the earliest alarm time among the two alarm data nodes as the root cause; Continue to traverse other nodes corresponding to the strongly connected components until the alarm root cause propagation link graph is obtained.

9. The method according to claim 7, characterized in that: If the number of nodes included in the strongly connected component is greater than 1 and is represented as a directed acyclic graph, the alarm root cause propagation link graph is obtained based on the graph search algorithm and the topological sorting algorithm according to the alarm propagation graph, and the root cause of the network device alarm is located, including: Filtering the vertex nodes with in-degree 0 in the directed acyclic graph; For any two vertex nodes, if any one of the two vertex nodes corresponds to a first physical alarm identifier, the vertex node corresponding to the first physical alarm identifier among the two vertex nodes is determined as the root cause; If none of the two vertex nodes has the first physical alarm identifier, or if both of the two vertex nodes correspond to the first physical alarm identifier, the vertex node with the earliest alarm time among the two vertex nodes is determined as the root cause; Delete the vertex nodes with an in-degree of 0 in the directed acyclic graph, and the directed edges between the vertex nodes with an in-degree of 0, and continue to traverse other nodes in the directed acyclic graph until the alarm root cause propagation link graph is obtained.

10. A device for locating the root cause of an alarm based on a knowledge graph, characterized in that: include: A network device topology map acquisition unit is used to acquire multiple historical alarm data and construct a network device topology map based on the cleaned and marked device identifiers and device link relationships, wherein the network device topology map is used to characterize the connection relationship between devices; An alarm type causal knowledge graph acquisition unit is used to acquire multiple historical alarm data, construct feature engineering and compress data, perform alarm type entity extraction and relationship extraction, and construct an alarm type causal knowledge graph, which is used to characterize the generation relationship between alarm types; An alarm propagation graph construction unit is used to generate an alarm propagation graph based on the fusion rule according to the network device topology graph and the alarm type causal knowledge graph; The alarm root cause locating unit is used to obtain the alarm root cause propagation link map based on the alarm propagation map and the graph search algorithm and the topological sorting algorithm to locate the network device alarm root cause.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

12. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to perform the method of any one of claims 1 to 9 by executing the executable instructions.

Images