Knowledge graph-based alarm root cause positioning method and device

Abstract

The application provides a knowledge graph-based alarm root cause positioning method and device, medium and equipment, relating to the technical field of big data. The method obtains a plurality of historical alarm data, constructs a network device topology graph based on the cleaned and labeled device identifiers and device link relationships, and the network device topology graph is used to represent the connection relationship between devices. Feature engineering is constructed and data is compressed, alarm type entity extraction and relationship extraction are performed, an alarm type causal knowledge graph is constructed, and the alarm type causal knowledge graph is used to represent the generation relationship between alarm types. According to the network device topology graph and the alarm type causal knowledge graph, an alarm propagation graph is generated based on a fusion rule. According to the alarm propagation graph, an alarm root cause propagation link graph is obtained by reasoning based on a graph search algorithm and a topological sorting algorithm, network device alarm root cause positioning is performed, and automatic positioning of the root cause is realized, which can improve the root cause positioning efficiency and reduce the labor cost.

Description

Technical Field

[0001] This application relates to the field of big data technology, and more specifically, to a knowledge graph-based alarm root cause localization method, a knowledge graph-based alarm root cause localization device, a computer-readable storage medium, and an electronic device. Background Technology

[0002] With the development of communication and computer technologies, communication networks are becoming increasingly complex. Communication networks typically involve a massive number of devices, with various interrelationships and transmission relationships between them.

[0003] Based on the above relationships, a common scenario is that a malfunction in one device can trigger alarms in other related devices, which in turn trigger alarms in even more connected devices. In other words, a malfunction in one device often affects multiple devices. For relevant personnel, it typically requires specialized knowledge and experience to identify the root cause from a large number of alarms, a method that suffers from low efficiency in root cause localization.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this application, and therefore may include information that does not constitute related technology known to those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide a knowledge graph-based alarm root cause localization method, a knowledge graph-based alarm root cause localization device, a computer-readable storage medium, and an electronic device. This method can acquire multiple historical alarm data sets, construct a network device topology graph based on cleaned and labeled device identifiers and device link relationships, and use this network device topology graph to represent the connection relationships between devices. It acquires multiple historical alarm data sets, performs feature engineering and data compression, extracts alarm type entities and relationships, and constructs an alarm type causal knowledge graph, which represents the generation relationships between alarm types. Based on the network device topology graph and the alarm type causal knowledge graph, an alarm propagation graph is generated based on fusion rules. Based on the alarm propagation graph, an alarm root cause propagation link graph is obtained using graph search and topology sorting algorithms for network device alarm root cause localization. The alarm root cause propagation link graph clearly shows the source of the alarm, achieving automated root cause localization without requiring personnel to perform root cause localization based on professional knowledge or experience, thus improving root cause localization efficiency and reducing labor costs.

[0006] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0007] According to one aspect of this application, a knowledge graph-based alarm root cause localization method is provided, comprising:

[0008] Multiple historical alarm data are acquired, and a network device topology map is constructed based on the cleaned and labeled device identifiers and device link relationships. The network device topology map is used to represent the connection relationships between devices.

[0009] Acquire multiple historical alarm data, construct feature engineering and compress the data, extract entities and relationships for alarm types, and construct an alarm type causal knowledge graph. The alarm type causal knowledge graph is used to represent the generation relationship between alarm types.

[0010] Based on the network device topology graph and alarm type causal knowledge graph, an alarm propagation graph is generated according to the fusion rules.

[0011] Based on the alarm propagation graph, the root cause propagation link graph of alarms is obtained by reasoning using graph search algorithm and topology sorting algorithm, and the root cause of network device alarms is located.

[0012] According to one aspect of this application, a knowledge graph-based alarm root cause localization device is provided, comprising:

[0013] The network device topology map acquisition unit is used to acquire multiple historical alarm data, and construct a network device topology map based on the cleaned and labeled device identifiers and device link relationships. The network device topology map is used to represent the connection relationships between devices.

[0014] The alarm type causal knowledge graph acquisition unit is used to acquire multiple historical alarm data, construct feature engineering and compress the data, extract alarm type entities and relationships, and construct an alarm type causal knowledge graph. The alarm type causal knowledge graph is used to represent the generation relationship between alarm types.

[0015] The alarm propagation graph construction unit is used to generate an alarm propagation graph based on the network device topology graph and the alarm type causal knowledge graph, and on the basis of fusion rules.

[0016] The alarm root cause localization unit is used to deduce the alarm root cause propagation link map based on the alarm propagation map, using graph search algorithm and topology sorting algorithm, and to locate the root cause of network device alarms.

[0017] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various alternative implementations described above.

[0018] According to one aspect of this application, a computer-readable storage medium is provided, on which a computer program is stored, wherein the computer program, when executed by a processor, implements the method of any one of the above.

[0019] According to one aspect of this application, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the method of any of the above by executing the executable instructions.

[0020] The exemplary embodiments of this application may have some or all of the following beneficial effects:

[0021] In an example embodiment of this application, the knowledge graph-based alarm root cause localization method can acquire multiple historical alarm data, construct a network device topology graph based on cleaned and labeled device identifiers and device link relationships, and use the network device topology graph to represent the connection relationships between devices; acquire multiple historical alarm data, construct feature engineering and compress the data, perform alarm type entity extraction and relationship extraction, construct an alarm type causal knowledge graph, and use the alarm type causal knowledge graph to represent the generation relationship between alarm types; generate an alarm propagation graph based on the network device topology graph and the alarm type causal knowledge graph, based on fusion rules; and obtain an alarm root cause propagation link graph based on the alarm propagation graph, using graph search algorithms and topology sorting algorithms, to perform network device alarm root cause localization. The alarm root cause propagation link graph can clearly show the source of the alarm, realizing automated root cause localization without requiring relevant personnel to perform root cause localization based on professional knowledge or experience, thereby improving root cause localization efficiency and reducing labor costs.

[0022] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0023] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0024] Figure 1 The flowchart illustrating a knowledge graph-based alarm root cause localization method according to an embodiment of this application is shown in the illustration.

[0025] Figure 2 This illustration schematically shows a cause-effect knowledge graph diagram of alarm types according to an embodiment of the present application;

[0026] Figure 3 This illustration schematically shows a process for generating an alarm propagation map according to an embodiment of the present application;

[0027] Figure 4 A schematic diagram illustrating a plurality of weakly connected components according to an embodiment of this application is shown.

[0028] Figure 5 This schematically illustrates a diagram a showing a weakly connected component looped down into a strongly connected component according to an embodiment of this application;

[0029] Figure 6 Schematic diagram b illustrates a weakly connected component looped down to a strongly connected component according to an embodiment of this application;

[0030] Figure 7 This illustration schematically shows an alarm root cause propagation path diagram according to one embodiment of the present application;

[0031] Figure 8 The illustration shows a schematic diagram of the architecture of a knowledge graph-based alarm root cause localization system according to an embodiment of this application;

[0032] Figure 9 A flowchart illustrating a knowledge graph-based alarm root cause localization method according to another embodiment of this application is shown schematically.

[0033] Figure 10 The schematic diagram illustrates the structure of a knowledge graph-based alarm root cause localization device according to an embodiment of this application.

[0034] Figure 11 The schematic diagram illustrates the structure of a computer system suitable for implementing the electronic devices of the present application. Detailed Implementation

[0035] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of the embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced with one or more of the specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this application.

[0036] Please see Figure 1 , Figure 1 A flowchart illustrating a knowledge graph-based alarm root cause localization method according to an embodiment of this application is shown. Figure 1 As shown, the specific steps include the following.

[0037] Step S110: Obtain multiple historical alarm data, and construct a network device topology map based on the cleaned and labeled device identifiers and device link relationships. The network device topology map is used to characterize the connection relationships between devices.

[0038] Step S120: Obtain multiple historical alarm data, construct feature engineering and compress the data, extract entities and relationships of alarm types, and construct an alarm type causal knowledge graph. The alarm type causal knowledge graph is used to represent the generation relationship between alarm types.

[0039] Step S130: Based on the network device topology graph and alarm type causal knowledge graph, generate an alarm propagation graph according to the fusion rules.

[0040] Step S140: Based on the alarm propagation map, the root cause propagation link map of the alarm is obtained by reasoning based on the graph search algorithm and the topology sorting algorithm, and the root cause of the network device alarm is located.

[0041] Implementation Figure 1 The method described above can acquire multiple historical alarm data sets, construct a network device topology map based on cleaned and labeled device identifiers and device link relationships, and use the network device topology map to represent the connection relationships between devices; acquire multiple historical alarm data sets, construct feature engineering and compress the data, extract alarm type entities and relationships, and construct an alarm type causal knowledge graph, which is used to represent the generation relationship between alarm types; based on the network device topology map and the alarm type causal knowledge graph, generate an alarm propagation map based on fusion rules; based on the alarm propagation map, derive an alarm root cause propagation link map based on graph search algorithm and topology sorting algorithm, and perform network device alarm root cause localization. The alarm root cause propagation link map can clearly show the source of the alarm, realizing automated root cause localization without requiring relevant personnel to perform root cause localization based on professional knowledge or experience, which can improve the efficiency of root cause localization and reduce labor costs.

[0042] The steps described above in this example implementation will now be explained in more detail.

[0043] In step S110, multiple historical alarm data are acquired, and a network device topology map is constructed based on the cleaned and labeled device identifiers and device link relationships. The network device topology map is used to characterize the connection relationships between devices.

[0044] In step S120, multiple historical alarm data are acquired, feature engineering is performed and the data is compressed, alarm type entity extraction and relationship extraction are performed, and an alarm type causal knowledge graph is constructed. The alarm type causal knowledge graph is used to characterize the generation relationship between alarm types.

[0045] As an optional embodiment, the method further includes: acquiring multiple historical alarm data sets; cleaning and preprocessing the multiple historical alarm data sets to generate device identifiers for the devices corresponding to each of the multiple historical alarm data sets; and generating a network device topology map based on each device identifier and the device link relationships. This allows for the acquisition of the relationships between devices related to the historical alarm data, and the network device topology map facilitates the tracing of the root causes of alarms.

[0046] Specifically, multiple historical alarm data points within a unit of time (e.g., one year) can be acquired, cleaned, and preprocessed. The alarm devices corresponding to each of the multiple historical alarm data points are identified as valid devices, and device identifiers are generated for each of these devices. Since there are device link relationships between valid devices, a network device topology map can be generated based on the multiple device identifiers and device link relationships. The historical alarm data represents historically occurring alarms and may include alarm time, alarm type, alarm device, etc. Device identifiers can consist of one or more of numbers, symbols, characters, etc., and are not limited in this embodiment. Device link relationships represent the relationships between devices, such as connection relationships, communication relationships, etc.

[0047] For example, a network device topology map can be represented as:

[0048]

[0049]

[0050] In this network device topology diagram, device identifiers can be represented as numbers. For example, valid device identifiers include: 0, 1, 2, ..., 82, 83, 84. The first row and first column represent the device identifiers, while the other parts are used to represent the relationship between two device identifiers. 0 indicates that there is no connection between the valid devices corresponding to the two device identifiers, and 1 indicates that there is a connection between the valid devices corresponding to the two device identifiers. For example, if 1 is displayed in the second row and third column, it indicates that there is a connection between the valid device with device identifier 0 and the valid device with device identifier 1. The connection relationship can include wired connection and / or wireless connection, which is not limited in this embodiment. In particular, in the network device topology diagram, the numbers corresponding to the same device identifier (e.g., the identifier in the second row and second column) are all 1 because each device has a self-loop, that is, each device's own alarm will cause it to generate other alarms.

[0051] As an optional embodiment, the method further includes: constructing feature engineering based on multiple historical alarm data, marking historical alarm data belonging to the physical alarm type with a first physical alarm identifier; and marking historical alarm data not belonging to the physical alarm type with a second physical alarm identifier. This allows for early identification of whether an alarm type belongs to a physical alarm, thereby improving the accuracy of subsequent root cause propagation chain generation.

[0052] Specifically, the system can also perform physical alarm identification on the alarm types contained in each of the multiple historical alarm data sets. If the alarm type contained in the historical alarm data belongs to a physical alarm type, it is marked with a first physical alarm identifier; if the alarm type contained in the historical alarm data does not belong to a physical alarm type, it is marked with a second physical alarm identifier. The representation of the first physical alarm identifier differs from that of the second physical alarm identifier. The first and second physical alarm identifiers can be composed of one or more of numbers, symbols, characters, etc., and this embodiment of the application does not limit this. The physical alarm types may include, but are not limited to: equipment failure, abnormal temperature, physical port down, etc.

[0053] As an optional embodiment, the method further includes: sorting the multiple historical alarm data according to the alarm time corresponding to each of the multiple historical alarm data, and obtaining a sorting result; compressing adjacent identical historical alarm data in the sorting result to obtain multiple reference historical alarm data; wherein, when adjacent historical alarm data correspond to the same device and the same alarm type, the adjacent historical alarm data are determined to be identical historical alarm data. This can reduce the redundancy of historical alarm data and improve the accuracy of root cause propagation link generation.

[0054] Specifically, the historical alarm data is sorted according to the alarm times corresponding to each historical alarm data point, resulting in a sorting result. This includes sorting the historical alarm data from early to late / late to early according to the alarm times corresponding to each historical alarm data point. In the sorting result, if adjacent identical historical alarm data points correspond to the same device and the same alarm type, they are determined to be duplicate reports of the same alarm. Therefore, adjacent identical historical alarm data points can be compressed into a single historical alarm data point. In the sorting result after data compression, each historical alarm data point can be identified as a reference historical alarm data point. Data points named as reference historical alarm data points indicate that the data compression process has been performed. Optionally, after completing one data compression, adjacent identical historical alarm data points may still exist in the sorting result. Therefore, the above embodiment can be executed repeatedly until there are no adjacent identical historical alarm data points in the sorting result.

[0055] As an optional embodiment, the method further includes: extracting alarm types from multiple reference historical alarm data, deduplicating reference historical alarm data of the same alarm type to obtain multiple target historical alarm data, which serve as entities in the alarm type causal knowledge graph; extracting causal relationships of alarm types based on the topological Hawkes Process (TTPM) algorithm and the multiple target historical alarm data, which serve as relationships between entities in the alarm type causal knowledge graph; and generating the alarm type causal knowledge graph based on the entities and relationships between entities in the alarm type causal knowledge graph. The input to the topological Hawkes Process (TTPM) algorithm is the alarm type, alarm time, and alarm device from the multiple target historical alarm data. This allows the extraction of relationships between target historical alarm data using the topological Hawkes Process (TTPM) algorithm to obtain the alarm type causal knowledge graph. The data relationships represented by the alarm type causal knowledge graph can improve the accuracy of generating root cause propagation links.

[0056] Specifically, although there are no adjacent identical data in multiple reference historical alarm data, there may be reference historical alarm data corresponding to the same alarm type. In order to improve the generation efficiency of the root cause propagation link, the reference historical alarm data with the same alarm type can be deduplicated to obtain multiple target historical alarm data. Any two target historical alarm data in the multiple target historical alarm data correspond to different alarm types.

[0057] Furthermore, based on the Hawkes modeling algorithm based on topology and using historical alarm data from multiple targets, causal relationships between alarm types are extracted as relationships between entities in the alarm type causal knowledge graph. The alarm type causal knowledge graph is then generated based on the entities and their relationships within the graph. This process involves inputting alarm type, alarm time, and alarm device into the Hawkes modeling algorithm based on topology, so that the algorithm outputs relationships between historical alarm data of the targets. These relationships can be used to construct the alarm type causal knowledge graph. For specific representations of the alarm type causal knowledge graph, optional references can be made. Figure 2 . Figure 2 A schematic diagram illustrating a cause-effect knowledge graph of alarm types according to an embodiment of this application is shown. Figure 2 In this example, assuming each number from 0 to 21 represents an alarm type, the directed line segments between the numbers can be used to represent the propagation relationship between alarm types. For example, the number 1 pointing to the number 6 means that the alarm type corresponding to number 1 will trigger the alarm type corresponding to number 6.

[0058] Among them, the Hawkes process based on topology is derived from Hawkes processes, a common point process modeling method used to build models of discrete events over continuous time, predict future events, and discover causal relationships. However, Hawkes processes assume that events are only affected by each other and not by other factors, failing to consider the physical structure of event occurrences, which does not conform to the propagation laws of alarm events and is prone to yielding false causal relationships. TTPM, on the other hand, incorporates device topology considerations and can be applied to the generation of root cause propagation links, specifically for generating causal knowledge graphs of alarm types.

[0059] Specifically, alarm propagation graphs can be generated from multiple historical alarm data sequences based on the connection relationships between devices defined by the network device topology graph and the generation relationships between alarm types defined by the alarm type causal knowledge graph. The alarm propagation graph can be used to characterize the alarm transmission relationship between historical alarm data within the sequence. The alarm propagation graph contains multiple nodes, and each node represents a historical alarm data.

[0060] As an optional implementation, an alarm propagation graph is generated based on a network device topology graph and an alarm type causal knowledge graph, using fusion rules. This includes: sorting multiple historical alarm data according to their respective alarm times to obtain a target sorting result; dividing the target sorting result according to a preset time step to obtain multiple historical alarm data sequences; detecting data pairs that satisfy fusion rules for each historical alarm data sequence; wherein the fusion rules include a direct causal relationship between data pairs, data pairs belonging to the same device, adjacent devices to which data pairs belong, and the causal direction of the alarm type of the data pairs being consistent with the device topology direction of the data pairs; identifying each historical alarm data in the data pairs as alarm nodes, and constructing directed edges for alarm nodes that satisfy the fusion rules to obtain alarm propagation graphs corresponding to each historical alarm data sequence. This improves the accuracy of determining the alarm propagation graph, which is beneficial for generating accurate root cause propagation links.

[0061] Specifically, multiple historical alarm data within a unit time period can be sorted according to alarm time. The sorting rule can be from earliest to latest or from latest to earliest; this embodiment does not limit this. The resulting target sorting result can be divided according to a preset time step h (e.g., 3) to obtain multiple historical alarm data sequences, which can be represented as G = {G1, G2, ..., G...} N}, where G1, G2, ..., G NThese represent different historical alarm data sequences. G represents the set of historical alarm data sequences, and N represents the total number of historical alarm data. For example, G1 represents the first historical alarm data sequence.

[0062] For example, any historical alarm data sequence G from multiple historical alarm data sequences i It can be represented as Where, n i G represents the i-th alarm sequence. i The number of alarms, (t) ij ,r ij ) represents t ij A time interval produces an r ij Alarm data for alarm types. Additionally, it should be noted that for r... ij ∈R={r1,r2,…,r M}, where R is the set of alarm types, and a total of M alarm types have been generated in the historical alarm data.

[0063] Therefore, for any historical alarm data sequence, the following steps can be performed: detect data pairs that satisfy the fusion rules, where a data pair refers to a pair of historical alarm data; if there is a connection relationship between the devices corresponding to the data pairs, then the data pairs are considered to have a direct causal relationship, that is, they satisfy the fusion rules; when the data pairs belong to the same device or the devices to which they belong are adjacent, they are also considered to satisfy the fusion rules; when the alarm type causal direction of the data pairs (e.g., historical alarm data A and historical alarm data B) is consistent (e.g., alarm type A points to alarm type B), and the device topology direction of the data pairs is consistent (e.g., device A points to device B), then they are considered to satisfy the fusion rules.

[0064] For any given historical alarm data sequence, for example, it can be represented as the following table:

[0065]

[0066]

[0067] Furthermore, each historical alarm data in the data pair can be identified as an alarm node, and directed edges can be constructed for alarm nodes that meet the fusion rules to obtain alarm propagation graphs corresponding to each historical alarm data sequence.

[0068] For details on the alarm propagation graph generation process described above, please refer to [link / reference]. Figure 3 , Figure 3 The illustration shows a schematic diagram of an alarm propagation map generation process according to an embodiment of this application. Figure 3As shown, if alarm nodes 310 include a1, a2, a3, a4, and a5, generally, "Port Down" will cause the network protocol running on the ports of both ends to be interrupted, and will also cause the BFD protocol for detecting connectivity to be interrupted. Therefore, the alarm type propagation relationship indicated by the alarm type causal knowledge graph 320 is: "Port Down" leads to "OSPF Neighbor Down" and "OSPF Neighbor Down". The device relationship indicated by the network device topology graph 330 is that there is a relationship between d1 and d2, and d3 has no relationship with either d1 or d2. It can be seen that the causal direction of the alarm type between a1 and a2 is consistent with the device topology direction where the alarm occurred. Therefore, based on the network device topology graph 330 and the alarm type causal knowledge graph 320, and based on multiple historical alarm data sequences, an alarm propagation graph 340 can be generated. The alarm propagation graph 340 indicates that a4 leads to a1, a2, and a3, and a5 has no relationship with other alarm nodes.

[0069] In step S130, an alarm propagation graph is generated based on the network device topology graph and the alarm type causal knowledge graph, according to the fusion rules.

[0070] Specifically, strongly connected components can be understood as follows: in a directed graph G, if there is a directed path from u to v and a directed path from v to u, then the two vertices are said to be strongly connected. Furthermore, a directed acyclic graph (DAG) refers to a directed graph without any cycles.

[0071] As an optional embodiment, the method further includes: searching for multiple weakly connected components in the alarm propagation graph using a depth-first search algorithm; and shrinking each weakly connected component into a strongly connected component based on the node relationships within each weakly connected component. This method can improve the accuracy of generating root cause propagation links by shrinking weakly connected components into strongly connected components.

[0072] Specifically, the Tarjan's algorithm is based on a depth-first search of a graph, where each strongly connected component is a subgraph in the alarm propagation graph. During the search, unprocessed nodes in the current alarm propagation graph are added to a stack, and during backtracking, it can be determined whether the nodes from the top of the stack to the middle of the stack form a strongly connected component.

[0073] The depth-first search algorithm can first search for multiple weakly connected components in the alarm propagation graph. If the alarm propagation graph is represented as... Figure 4 . Figure 4A schematic diagram illustrating multiple weakly connected components according to one embodiment of this application is shown. Figure 4 As shown, if the alarm propagation graph 400 contains alarm nodes {a1, a2, ..., a13}, the directed edges in the alarm propagation graph 400 are used to represent the relationship between alarm nodes. The directed edges can be treated as undirected edges and weak connected components can be searched based on the depth-first search algorithm to obtain weak connected components wcc0410, wcc1420, and wcc2430.

[0074] Among them, the alarm nodes included in the weak connectivity component wcc0 410 are: {a1, a2, a4, a6, a7}, the alarm nodes included in the weak connectivity component wcc1 420 are: {a3, a12, a13}, and the alarm nodes included in the weak connectivity component wcc2 430 are: {a5, a8, a9, a10, a11}.

[0075] Specifically, the alarm nodes in weakly connected components wcc1 420 and wcc2 430 are connected by directed edges in pairs. Therefore, weakly connected component wcc1 420 can be reduced to a strongly connected component based on the node relationships within it. Similarly, weakly connected component wcc2 430 can also be reduced to a strongly connected component based on the node relationships within it.

[0076] For details, please refer to [link / reference]. Figure 5 , Figure 5 A schematic diagram a illustrates a weakly connected component looped down to a strongly connected component according to an embodiment of this application. (See diagram a.) Figure 5 As shown, since there are directed edges between every pair of alarm nodes in the weakly connected components wcc1 510 and wcc2 520, the weakly connected component wcc1 510 can be shrunk into a strongly connected component s10. The alarm nodes implicitly contained in the strongly connected component s10 are: {a3, a12, a13}. The weakly connected component wcc2 520 can be shrunk into a strongly connected component s20. The alarm nodes implicitly contained in the strongly connected component s20 are: {a5, a8, a9, a10, a11}.

[0077] Furthermore, since not every pair of alarm nodes in the weak connectivity component wcc0 410 has a directed edge, the compression method for the weak connectivity component wcc0 410 can be found in [reference needed]. Figure 6 , Figure 6 A schematic diagram (b) illustrates a weakly connected component looping down to a strongly connected component according to an embodiment of this application. (See diagram b.) Figure 6As shown, the weakly connected component wcc0 600 can be reduced to: the strongly connected component scc0 610 containing alarm nodes a2 and a4, the strongly connected component scc1 620 containing alarm node a1, the strongly connected component scc2 630 containing alarm node a4, the strongly connected component scc3 640 containing alarm node a6, and the strongly connected component scc4 650 containing alarm node a7. Furthermore, a directed acyclic graph wcc0_dag 660 composed of the strongly connected components scc0 610, scc1 620, scc2 630, scc3 640, and scc4 650 can be obtained.

[0078] In step S140, based on the alarm propagation map, the alarm root cause propagation link map is obtained by reasoning using graph search algorithm and topology sorting algorithm, and the root cause of network device alarms is located.

[0079] Specifically, the alarm root cause propagation path graph is used to characterize the propagation order between alarm data nodes. Different alarm root cause propagation path graphs may correspond to different lengths, which are not limited in the embodiments of this application.

[0080] As an optional implementation, if the number of nodes in the strongly connected component is equal to 1, an alarm root cause propagation link graph is obtained based on the alarm propagation graph using graph search and topology sorting algorithms. This is then used for network device alarm root cause localization, including: for any two alarm data nodes corresponding to the strongly connected component, if either of the two alarm data nodes corresponds to a first physical alarm identifier, the alarm data node corresponding to the first physical alarm identifier is identified as the root cause; if no node in the two alarm data nodes corresponds to the first physical alarm identifier, or if both alarm data nodes correspond to the first physical alarm identifier, the alarm data node with the earliest alarm time is identified as the root cause; this process continues to traverse other nodes corresponding to the strongly connected component until the alarm root cause propagation link graph is obtained. This allows for root cause determination for each pair of alarm data nodes based on the first physical alarm identifier and alarm time, until an accurate alarm root cause propagation link graph is obtained, thus improving root cause localization efficiency.

[0081] Specifically, the root cause can be determined based on the following expression:

[0082]

[0083] If multiple alarm sequences are represented as A = {A1, A2, ..., A...} N Alarm sequence A i Represented as n i Let A represent the i-th alarm sequence.i The number of alarms, (t) ij ,r ij ,p ij ) indicates that at t ij A time interval produces an r ij Alarm type, p ij Marker r ij Is this alarm type a physical alarm? ij It is indicated as either the first physical alarm identifier or the second physical alarm identifier.

[0084] in,

[0085] If either of the two alarm data nodes corresponds to the first physical alarm identifier, that is, if one of the nodes belongs to the physical alarm type, then the node belonging to the physical alarm type can be determined as the root cause among the two alarm data nodes. Otherwise, the alarm data node with the earliest alarm time is determined as the root cause among the two alarm data nodes. In this way, the relationship between the nodes corresponding to the strongly connected component (e.g., s20 above) (e.g., {a5, a8, a9, a10, a11} above) can be determined, and the alarm root cause propagation path map can be obtained.

[0086] As an optional embodiment, if the number of nodes in the strongly connected component is greater than 1 and it is represented as a directed acyclic graph, the alarm root cause propagation link graph is obtained based on the alarm propagation graph, using graph search and topology sorting algorithms, and the root cause of network device alarms is located. This includes: filtering vertices with an in-degree of 0 in the directed acyclic graph; for any two vertices, if either of the two vertices corresponds to a first physical alarm identifier, then the vertex corresponding to the first physical alarm identifier is identified as the root cause; if neither of the two vertices has a first physical alarm identifier, or if both vertices correspond to the first physical alarm identifier, then the vertex with the earliest alarm time is identified as the root cause; deleting vertices with an in-degree of 0 in the directed acyclic graph, as well as the directed edges between vertices with an in-degree of 0, and continuously traversing other nodes in the directed acyclic graph until the alarm root cause propagation link graph is obtained. This allows for root cause determination of every two alarm data nodes based on the directed acyclic graph, the first physical alarm identifier, and the alarm time, until an accurate alarm root cause propagation path graph is obtained, which can improve the efficiency of root cause localization.

[0087] Specifically, when the in-degree is 0, it means that a point in the directed acyclic graph is not the endpoint of any edge; that is, all edges connected to this point are considered to originate from this point. In topological sorting of a directed graph, points with an in-degree of 0 are typically added to the topological queue, and then all edges connected to this point are deleted.

[0088] Please see Figure 7 , Figure 7 A schematic diagram of an alarm root cause propagation path graph according to an embodiment of this application is shown. For the directed acyclic graph wcc0_dag 660, vertices with an in-degree of 0 can be filtered. For any two vertices, if either vertex corresponds to a first physical alarm identifier, the vertex corresponding to the first physical alarm identifier is determined as the root cause. If neither vertex has a first physical alarm identifier, or if both vertexes correspond to the first physical alarm identifier, the vertex with the earliest alarm time is determined as the root cause. Based on this, the sorting result {[s3,s4],s1,s0} corresponding to the directed acyclic graph wcc0_dag 660 can be obtained. For [s3, s4], the sorting can also be performed in the same way as above until the alarm root cause propagation path graph 700 corresponding to the directed acyclic graph wcc0_dag 660 is determined: a6->a7->a1->a2->a4. Therefore, in the alarm root cause propagation path graph 700, the root cause is a6.

[0089] Please see Figure 8 , Figure 8 The illustration schematically depicts an architecture diagram of a knowledge graph-based alarm root cause localization system according to an embodiment of this application. Figure 8 As shown, in this system, the application layer includes a capacity scheduling subsystem 810; the knowledge application unit includes an alarm root cause localization module 821 and an alarm event propagation tracking module 822; the knowledge graph construction unit includes an entity extraction module 831, a relation extraction module 832, and an attribute extraction module 833; the data processing unit includes a data cleaning module 841, a data preprocessing module 842, a feature engineering module 843, and a data aggregation module 844; the basic data storage unit includes alarm data 851, device detail data 852, and device topology data 853; and the graph data storage unit includes a network device topology graph 861 and an alarm type causal knowledge graph 862.

[0090] Specifically, alarm data 851, device detail data 852, and device topology data 853 are stored in the data warehouse Hive of the basic data storage unit. The network device topology graph 861 and the alarm type causal knowledge graph 862 are stored in the neo4j graph database of the graph data storage unit.

[0091] The data cleaning module 841 is used to clean invalid data, outliers, and missing values ​​from multiple historical alarm data; the data preprocessing module 842 is used to perform structured processing on multiple historical alarm data; the feature engineering module 843 is used to merge adjacent historical alarm data of the same type; and the data aggregation module 844 is used to deduplicate reference historical alarm data of the same alarm type.

[0092] In addition, the entity extraction module 831 is used to extract the required entities from multiple historical alarm data, such as alarm type and alarm device; the relationship extraction module 832 is used to determine the relationship between entities; and the attribute extraction module 833 is used to determine specific entity attributes in multiple historical alarm data, such as physical alarm type.

[0093] In addition, the alarm root cause localization module 821 is used to identify the root alarm; the alarm event propagation tracking module 822 infers the propagation pattern of historical alarm data based on the correlation between device nodes and the causal relationship between alarm types. Furthermore, the capacity scheduling subsystem 810 is used to provide information scheduling functions for the knowledge application unit.

[0094] Please see Figure 9 , Figure 9 A flowchart illustrating a knowledge graph-based alarm root cause localization method according to another embodiment of this application is shown. Figure 9 As shown, the knowledge graph-based alarm root cause localization method includes steps S910 to S980.

[0095] Step S910: Obtain multiple historical alarm data, clean and preprocess the multiple historical alarm data, generate device identifiers for the devices corresponding to the multiple historical alarm data, and generate a network device topology map based on each device identifier and device link relationship.

[0096] Step S920: Construct feature engineering based on multiple historical alarm data, mark the historical alarm data that belongs to the physical alarm type with the first physical alarm identifier, and mark the historical alarm data that does not belong to the physical alarm type with the second physical alarm identifier.

[0097] Step S930: Sort the multiple historical alarm data according to the alarm time corresponding to each of the multiple historical alarm data, obtain the sorting result, and compress the adjacent identical historical alarm data in the sorting result to obtain multiple reference historical alarm data; wherein, when adjacent historical alarm data correspond to the same device and the same alarm type, the adjacent historical alarm data are determined to be identical historical alarm data.

[0098] Step S940: Extract alarm types from multiple reference historical alarm data. Deduplicate reference historical alarm data of the same alarm type to obtain multiple target historical alarm data, which serve as entities in the alarm type causal knowledge graph. Then, based on the Hawkes modeling algorithm based on topology structure and according to the multiple target historical alarm data, extract the causal relationships of alarm types as the relationships between entities in the alarm type causal knowledge graph. Generate the alarm type causal knowledge graph based on the entities and relationships between entities in the alarm type causal knowledge graph. The input of the Hawkes modeling algorithm based on topology structure is the alarm type, alarm time, and alarm device in the multiple target historical alarm data.

[0099] Step S950: Sort the historical alarm data according to the alarm time corresponding to each historical alarm data to obtain the target sorting result, and divide the target sorting result according to the preset time step to obtain multiple historical alarm data sequences; for each historical alarm data sequence in the multiple historical alarm data sequences, detect data pairs that meet the fusion rules; wherein, the fusion rules include that there is a direct causal relationship between the data pairs, the data pairs belong to the same device, the devices to which the data pairs belong are adjacent, and the causal direction of the alarm type of the data pairs is consistent with the device topology direction of the data pairs; then, determine each historical alarm data in the data pairs as alarm nodes, and construct directed edges for the alarm nodes that meet the fusion rules to obtain alarm propagation maps corresponding to each historical alarm data sequence.

[0100] Step S960: Search for multiple weakly connected components in the alarm propagation graph using a depth-first search algorithm, and shrink each weakly connected component into a strongly connected component based on the node relationships within each weakly connected component. If the number of nodes in a strongly connected component is equal to 1, proceed to step S970; if the number of nodes in a strongly connected component is greater than 1 and it represents a directed acyclic graph, proceed to step S980.

[0101] Step S970: For any two alarm data nodes corresponding to a strongly connected component, if either of the two alarm data nodes corresponds to the first physical alarm identifier, the alarm data node corresponding to the first physical alarm identifier is determined as the root cause; if no node of the two alarm data nodes corresponds to the first physical alarm identifier, or if both alarm data nodes correspond to the first physical alarm identifier, the alarm data node with the earliest alarm time is determined as the root cause; then, continue to traverse other nodes corresponding to the strongly connected component until the alarm root cause propagation path graph is obtained.

[0102] Step S980: Filter the vertices with an in-degree of 0 in the directed acyclic graph; for any two vertices, if either of the two vertices corresponds to the first physical alarm identifier, then the vertex corresponding to the first physical alarm identifier is determined as the root cause; if neither of the two vertices has a first physical alarm identifier, or if both vertices correspond to the first physical alarm identifier, then the vertex with the earliest alarm time is determined as the root cause; then, delete the vertices with an in-degree of 0 in the directed acyclic graph, as well as the directed edges between vertices with an in-degree of 0, and continue traversing other nodes in the directed acyclic graph until the alarm root cause propagation path graph is obtained.

[0103] It should be noted that steps S910 to S980 are the same as... Figure 1 For the specific implementation details of steps S910 to S980, please refer to the examples shown. Figure 1 The steps and their embodiments shown are not repeated here.

[0104] It is evident that implementation Figure 9 The method described above can acquire multiple historical alarm data sets, construct a network device topology map based on cleaned and labeled device identifiers and device link relationships, and use the network device topology map to represent the connection relationships between devices; acquire multiple historical alarm data sets, construct feature engineering and compress the data, extract alarm type entities and relationships, and construct an alarm type causal knowledge graph, which is used to represent the generation relationship between alarm types; based on the network device topology map and the alarm type causal knowledge graph, generate an alarm propagation map based on fusion rules; based on the alarm propagation map, derive an alarm root cause propagation link map based on graph search algorithm and topology sorting algorithm, and perform network device alarm root cause localization. The alarm root cause propagation link map can clearly show the source of the alarm, realizing automated root cause localization without requiring relevant personnel to perform root cause localization based on professional knowledge or experience, which can improve the efficiency of root cause localization and reduce labor costs.

[0105] Please see Figure 10 , Figure 10 A schematic block diagram of a knowledge graph-based alarm root cause localization device according to one embodiment of this application is shown. Figure 10 As shown, the knowledge graph-based alarm root cause localization device 1000 may include the following units.

[0106] The network device topology graph and alarm type causal knowledge graph acquisition unit 1001 is used to acquire the network device topology graph and alarm type causal knowledge graph; wherein, the network device topology graph is used to represent the connection relationship between devices, and the alarm type causal knowledge graph is used to represent the generation relationship between alarm types.

[0107] The network device topology map acquisition unit 1001 is used to acquire multiple historical alarm data, and construct a network device topology map based on the cleaned and labeled device identifiers and device link relationships. The network device topology map is used to characterize the connection relationships between devices.

[0108] The alarm type causal knowledge graph acquisition unit 1002 is used to acquire multiple historical alarm data, construct feature engineering and compress data, extract alarm type entities and relationships, and construct an alarm type causal knowledge graph. The alarm type causal knowledge graph is used to represent the generation relationship between alarm types.

[0109] The alarm propagation graph construction unit 1003 is used to generate an alarm propagation graph based on the network device topology graph and the alarm type causal knowledge graph, and on the basis of fusion rules.

[0110] The alarm root cause localization unit 1004 is used to obtain the alarm root cause propagation link map based on the alarm propagation map, the graph search algorithm and the topology sorting algorithm, and to locate the root cause of network device alarms.

[0111] It is evident that implementation Figure 10 The device shown can acquire multiple historical alarm data sets, construct a network device topology map based on cleaned and labeled device identifiers and device link relationships, and use the network device topology map to represent the connection relationships between devices; acquire multiple historical alarm data sets, construct feature engineering and compress the data, perform alarm type entity extraction and relationship extraction, and construct an alarm type causal knowledge graph, which is used to represent the generation relationship between alarm types; based on the network device topology map and the alarm type causal knowledge graph, generate an alarm propagation map based on fusion rules; based on the alarm propagation map, derive an alarm root cause propagation link map based on graph search algorithm and topology sorting algorithm, and perform network device alarm root cause localization. The alarm root cause propagation link map can clearly show the source of the alarm, realizing automated root cause localization without requiring relevant personnel to perform root cause localization based on professional knowledge or experience, which can improve the efficiency of root cause localization and reduce labor costs.

[0112] As an optional embodiment, it also includes:

[0113] The historical alarm data acquisition unit is used to acquire multiple historical alarm data.

[0114] The device identifier generation unit is used to clean and preprocess multiple historical alarm data, and generate device identifiers for the devices corresponding to the multiple historical alarm data respectively.

[0115] The network device topology map generation unit is used to generate a network device topology map based on the device identifiers and device link relationships.

[0116] As can be seen, by implementing this optional embodiment, the relationship between devices related to historical alarm data can be obtained, and the network device topology map is conducive to tracing the root cause of alarms.

[0117] As an optional embodiment, it also includes:

[0118] The first physical alarm identification marking unit is used to construct feature engineering based on multiple historical alarm data, and to mark the historical alarm data that belongs to the physical alarm type with the first physical alarm identifier;

[0119] The second physical alarm labeling unit is used to mark historical alarm data that does not belong to the physical alarm type with a second physical alarm label.

[0120] As can be seen, implementing this optional embodiment can identify in advance whether the alarm type belongs to physical alarm, which is conducive to improving the accuracy of subsequent root cause propagation link generation.

[0121] As an optional embodiment, it also includes:

[0122] The historical alarm data sorting unit is used to sort multiple historical alarm data according to the alarm time corresponding to each of the multiple historical alarm data, and obtain the sorting result;

[0123] The data merging unit is used to compress adjacent identical historical alarm data in the sorting results to obtain multiple reference historical alarm data; wherein, when adjacent historical alarm data correspond to the same device and the same alarm type, the adjacent historical alarm data are determined to be identical historical alarm data.

[0124] As can be seen, implementing this optional embodiment can reduce the redundancy of historical alarm data and improve the accuracy of root cause propagation chain generation.

[0125] As an optional embodiment, it also includes:

[0126] The data deduplication unit is used to extract alarm types from multiple reference historical alarm data and deduplicate reference historical alarm data of the same alarm type to obtain multiple target historical alarm data, which serve as entities in the alarm type causal knowledge graph.

[0127] The alarm type causal knowledge graph generation unit is used to extract causal relationships of alarm types based on the Hawkes modeling algorithm based on topology structure and based on historical alarm data of multiple targets, as the relationship between entities in the alarm type causal knowledge graph; and to generate the alarm type causal knowledge graph based on the entities and the relationship between entities in the alarm type causal knowledge graph; wherein, the input of the Hawkes modeling algorithm based on topology structure is the alarm type, alarm time and alarm device in the historical alarm data of multiple targets.

[0128] As can be seen, by implementing this optional embodiment, the relationship between historical alarm data of the target can be extracted by the Hawkes modeling algorithm based on topology structure to obtain an alarm type causal knowledge graph. The data relationship represented by the alarm type causal knowledge graph can improve the generation accuracy of the root cause propagation link.

[0129] As an optional embodiment, the alarm propagation graph construction unit 1003 generates an alarm propagation graph based on the network device topology graph and the alarm type causal knowledge graph, according to fusion rules, including:

[0130] Based on the alarm times corresponding to multiple historical alarm data, sort the multiple historical alarm data to obtain the target sorting result;

[0131] The target sorting results are divided according to a preset time step to obtain multiple historical alarm data sequences;

[0132] For each historical alarm data sequence in multiple historical alarm data sequences, data pairs that meet the fusion rules are detected. The fusion rules include: there is a direct causal relationship between the data pairs; the data pairs belong to the same device; the devices to which the data pairs belong are adjacent; and the causal direction of the alarm type of the data pairs is consistent with the device topology direction of the data pairs.

[0133] Each historical alarm data point in the data pair is identified as an alarm node. Directed edges are constructed for alarm nodes that meet the fusion rules to obtain alarm propagation graphs corresponding to each historical alarm data sequence.

[0134] As can be seen, implementing this optional embodiment can improve the accuracy of identifying alarm propagation patterns, which is beneficial for generating accurate root cause propagation paths.

[0135] As an optional embodiment, it also includes:

[0136] The weakly connected component search unit is used to search for multiple weakly connected components in the alarm propagation graph based on the depth-first search algorithm.

[0137] The strong connectivity component acquisition unit is used to shrink each weak connectivity component into a strong connectivity component based on the node relationships within each weak connectivity component.

[0138] As can be seen, implementing this optional embodiment can improve the accuracy of root cause propagation link generation by shrinking weakly connected components into strongly connected components.

[0139] As an optional embodiment, if the number of nodes included in the strongly connected component is equal to 1, the alarm root cause localization unit 1004, based on the alarm propagation graph, infers the alarm root cause propagation link graph using a graph search algorithm and a topology sorting algorithm, and performs network device alarm root cause localization, including:

[0140] For any two alarm data nodes corresponding to a strong connection component, if either of the two alarm data nodes corresponds to the first physical alarm identifier, the alarm data node that corresponds to the first physical alarm identifier is determined as the root cause.

[0141] If neither of the two alarm data nodes corresponds to the first physical alarm identifier, or if both alarm data nodes correspond to the first physical alarm identifier, the alarm data node with the earliest alarm time among the two alarm data nodes is determined as the root cause.

[0142] Continue traversing other nodes corresponding to strongly connected components until the alarm root cause propagation path graph is obtained.

[0143] As can be seen, by implementing this optional embodiment, the root cause determination can be performed on every two alarm data nodes based on the first physical alarm identifier and the alarm time, until an accurate alarm root cause propagation chain map is obtained, which can improve the efficiency of root cause localization.

[0144] As an optional embodiment, if the strongly connected component contains more than 1 node and is represented as a directed acyclic graph, the alarm root cause localization unit 1004, based on the alarm propagation graph, infers the alarm root cause propagation link graph using a graph search algorithm and a topology sorting algorithm, and performs network device alarm root cause localization, including:

[0145] Filter vertices with an in-degree of 0 in a directed acyclic graph;

[0146] For any two vertex nodes, if either of the two vertex nodes corresponds to the first physical alarm identifier, then the vertex node that corresponds to the first physical alarm identifier is determined as the root cause.

[0147] If neither of the two vertex nodes has a first physical alarm identifier, or if both vertex nodes correspond to the first physical alarm identifier, the vertex node with the earliest alarm time among the two vertex nodes is determined as the root cause.

[0148] Delete the vertices with an in-degree of 0 in the directed acyclic graph and the directed edges between vertices with an in-degree of 0, and continue to traverse other nodes in the directed acyclic graph until the alarm root cause propagation path graph is obtained.

[0149] As can be seen, by implementing this optional embodiment, the root cause determination can be performed on every two alarm data nodes based on the directed acyclic graph, the first physical alarm identifier, and the alarm time, until an accurate alarm root cause propagation chain map is obtained, which can improve the efficiency of root cause localization.

[0150] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0151] Since the functional modules of the knowledge graph-based alarm root cause localization device in the example embodiments of this application correspond to the steps of the above-described knowledge graph-based alarm root cause localization device, for details not disclosed in the device embodiments of this application, please refer to the above-described embodiments of the knowledge graph-based alarm root cause localization device.

[0152] Please see Figure 11 , Figure 11 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown.

[0153] It should be noted that, Figure 11 The computer system 1100 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0154] like Figure 11 As shown, the computer system 1100 includes a central processing unit (CPU) 1101, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 1102 or programs loaded from storage portion 1108 into random access memory (RAM) 1103. The RAM 1103 also stores various programs and data required for system operation. The CPU 1101, ROM 1102, and RAM 1103 are interconnected via a bus 1104. An input / output (I / O) interface 1105 is also connected to the bus 1104.

[0155] The following components are connected to I / O interface 1105: an input section 1106 including a keyboard, mouse, etc.; an output section 1107 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1108 including a hard disk, etc.; and a communication section 1109 including a network interface card such as a LAN card, modem, etc. The communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to I / O interface 1105 as needed. Removable media 1111, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1110 as needed so that computer programs read from them can be installed into storage section 1108 as needed.

[0156] In particular, according to embodiments of this application, the processes described below with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1109, and / or installed from removable medium 1111. When the computer program is executed by central processing unit (CPU) 1101, it performs the various functions defined in the methods and apparatus of this application.

[0157] In another aspect, this application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to implement the methods described in the above embodiments.

[0158] It should be noted that the computer-readable medium shown in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0159] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0160] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0161] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the claims.

Claims

1. A knowledge graph-based alarm root cause localization method, characterized in that, include: Multiple historical alarm data are acquired, and a network device topology map is constructed based on the cleaned and labeled device identifiers and device link relationships. The network device topology map is used to characterize the connection relationships between devices. Multiple historical alarm data are acquired, feature engineering is constructed and the data is compressed, alarm type entity extraction and relationship extraction are performed, and an alarm type causal knowledge graph is constructed. The alarm type causal knowledge graph is used to represent the generation relationship between alarm types. Based on the network device topology graph and the alarm type causal knowledge graph, an alarm propagation graph is generated according to the fusion rules. Based on the alarm propagation graph, the alarm root cause propagation link graph is obtained by reasoning using graph search algorithm and topology sorting algorithm, and the root cause of network device alarms is located. The alarm propagation graph is searched using a depth-first search algorithm to find multiple weakly connected components. Based on the node relationships within each of the multiple weakly connected components, each weakly connected component is circumscribed into a strongly connected component. Wherein, if the number of nodes in the strongly connected component is equal to 1, the step of reasoning about the alarm root cause propagation link graph based on the alarm propagation graph using graph search algorithm and topology sorting algorithm, and performing network device alarm root cause localization, includes: For any two alarm data nodes corresponding to the strong connectivity component, if either of the two alarm data nodes corresponds to the first physical alarm identifier, the alarm data node corresponding to the first physical alarm identifier among the two alarm data nodes is determined as the root cause. If none of the two alarm data nodes corresponds to the first physical alarm identifier, or if both alarm data nodes correspond to the first physical alarm identifier, the alarm data node with the earliest alarm time among the two alarm data nodes is determined as the root cause. Continue traversing the other nodes corresponding to the strongly connected components until the alarm root cause propagation path graph is obtained.

2. The method according to claim 1, characterized in that, Also includes: Obtain multiple historical alarm data; The multiple historical alarm data are cleaned and preprocessed, and device identifiers are generated for the devices corresponding to the multiple historical alarm data. The network device topology map is generated based on the device identifiers and device link relationships.

3. The method according to claim 2, characterized in that, Also includes: Based on the aforementioned historical alarm data, a feature engineering is constructed, and the historical alarm data belonging to the physical alarm type is marked with the first physical alarm identifier. Historical alarm data that does not belong to the physical alarm type is marked with a second physical alarm identifier.

4. The method according to claim 3, characterized in that, Also includes: The historical alarm data are sorted according to the alarm time corresponding to each of the historical alarm data, and a sorting result is obtained. The adjacent identical historical alarm data in the sorting results are compressed to obtain multiple reference historical alarm data; wherein, when adjacent historical alarm data correspond to the same device and the same alarm type, the adjacent historical alarm data are determined to be identical historical alarm data.

5. The method according to claim 4, characterized in that, Also includes: From the multiple reference historical alarm data, alarm types are extracted and duplicate reference historical alarm data of the same alarm type are removed to obtain multiple target historical alarm data, which serve as entities in the causal knowledge graph of the alarm type. Based on the Hawkes modeling algorithm based on topology structure, and according to the historical alarm data of the multiple targets, the causal relationship of alarm type is extracted as the relationship between entities in the causal knowledge graph of alarm type; The alarm type causal knowledge graph is generated based on the entities and relationships between entities in the alarm type causal knowledge graph; wherein, the input of the Hawkes modeling algorithm based on topology structure is the alarm type, alarm time, and alarm device in the historical alarm data of the multiple targets.

6. The method according to claim 1, characterized in that, Based on the network device topology graph and the alarm type causal knowledge graph, an alarm propagation graph is generated according to fusion rules, including: Based on the alarm times corresponding to the multiple historical alarm data, the multiple historical alarm data are sorted to obtain the target sorting result; The target sorting results are divided according to a preset time step to obtain multiple historical alarm data sequences; For each historical alarm data sequence in the multiple historical alarm data sequences, data pairs that satisfy the fusion rules are detected; wherein, the fusion rules include that there is a direct causal relationship between the data pairs, the data pairs belong to the same device, the devices to which the data pairs belong are adjacent, and the causal direction of the alarm type of the data pairs is consistent with the device topology direction of the data pairs; Each historical alarm data in the data pair is identified as an alarm node, and directed edges are constructed for the alarm nodes that satisfy the fusion rules to obtain alarm propagation graphs corresponding to each historical alarm data sequence.

7. The method according to claim 1, characterized in that, If the strongly connected component contains more than 1 node and is represented as a directed acyclic graph, based on the alarm propagation graph, an alarm root cause propagation link graph is obtained using graph search and topology sorting algorithms, and network device alarm root cause localization is performed, including: Filter the vertices in the directed acyclic graph that have an in-degree of 0; For any two vertex nodes, if either of the two vertex nodes corresponds to a first physical alarm identifier, then the vertex node that corresponds to the first physical alarm identifier is determined as the root cause. If neither of the two vertex nodes has the first physical alarm identifier, or if both of the two vertex nodes correspond to the first physical alarm identifier, the vertex node with the earliest alarm time among the two vertex nodes is determined as the root cause. Delete the vertex nodes with an in-degree of 0 in the directed acyclic graph and the directed edges between the vertex nodes with an in-degree of 0, and continue to traverse the other nodes in the directed acyclic graph until the alarm root cause propagation path graph is obtained.

8. A knowledge graph-based alarm root cause localization device, characterized in that, include: The network device topology map acquisition unit is used to acquire multiple historical alarm data, and construct a network device topology map based on the cleaned and labeled device identifiers and device link relationships. The network device topology map is used to characterize the connection relationships between devices. The alarm type causal knowledge graph acquisition unit is used to acquire multiple historical alarm data, construct feature engineering and compress data, perform alarm type entity extraction and relationship extraction, and construct an alarm type causal knowledge graph, which is used to characterize the generation relationship between alarm types. The alarm propagation graph construction unit is used to generate an alarm propagation graph based on the network device topology graph and the alarm type causal knowledge graph, according to fusion rules. The alarm root cause localization unit is used to infer the alarm root cause propagation link map based on the alarm propagation map, using graph search algorithm and topology sorting algorithm, and to perform network device alarm root cause localization. The weakly connected component search unit is used to search for multiple weakly connected components in the alarm propagation graph based on the depth-first search algorithm. The strong connectivity component acquisition unit is used to shrink each weak connectivity component into a strong connectivity component based on the node relationship within each weak connectivity component in multiple weak connectivity components. Wherein, if the number of nodes in the strongly connected component is equal to 1, the alarm root cause localization unit, based on the alarm propagation graph, and using graph search and topology sorting algorithms, infers the alarm root cause propagation link graph, and performs network device alarm root cause localization, including: For any two alarm data nodes corresponding to a strong connection component, if either of the two alarm data nodes corresponds to the first physical alarm identifier, the alarm data node that corresponds to the first physical alarm identifier is determined as the root cause. If neither of the two alarm data nodes corresponds to the first physical alarm identifier, or if both alarm data nodes correspond to the first physical alarm identifier, the alarm data node with the earliest alarm time among the two alarm data nodes is determined as the root cause. Continue traversing other nodes corresponding to strongly connected components until the alarm root cause propagation path graph is obtained.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1-7.

10. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to perform the method of any one of claims 1-7 by executing the executable instructions.

Images