Information processing method and device, electronic equipment, storage medium and product

Abstract

The invention relates to the technical field of communication, and particularly provides an information processing method and device, electronic equipment, a storage medium and a product. The method comprises the following steps: performing event analysis on a network real-time information flow to obtain first event information; acquiring non-real-time information associated with the first event information to obtain second event information; performing event grouping on the second event information to obtain an event information set; and based on a frequent item mining principle, performing root cause positioning and / or situation research and judgment analysis on the event information set. When the network event is analyzed and root cause positioning is carried out, the data analyzed by the method is higher in completeness, and key causes and potential risks generated by the event can be more accurately identified, so that the accuracy and efficiency of root cause positioning and / or situation research and judgment analysis of the network event are improved.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to an information processing method and device, electronic equipment, storage medium and product. Background Art

[0002] Currently, when conducting problem location analysis for network events, staff are often required to log in to multiple other network management systems based on their own operation and maintenance experience to view possible related information of the event, so as to determine the root cause of the event and analyze the scope of business impact.

[0003] However, since the relevant information of the event may be distributed in different network management systems, the efficiency of correlation analysis by staff is low, the speed of problem location and the duration of business impact are limited by the speed of manual location analysis, and the data completeness used for root cause judgment is not high, so it is impossible to fully analyze the data of all triggering events, and thus it is impossible to gain insight into all the analysis conclusions of the current event information, and the accuracy of the conclusions is not high. Summary of the invention

[0004] In view of the above problems, the present disclosure is proposed. The present disclosure provides an information processing method and device, an electronic device, a storage medium and a product.

[0005] According to one aspect of the present disclosure, there is provided an information processing method, including: performing event analysis on a real-time network information flow to obtain first event information; acquiring non-real-time information associated with the first event information to obtain second event information; performing event grouping on the second event information to obtain an event information set; and performing root cause location and / or situation analysis on the event information set based on the principle of frequent item mining.

[0006] According to another aspect of the present disclosure, there is provided an information processing device, including: an information analysis module, used to perform event analysis on a real-time network information flow to obtain first event information; an information acquisition module, used to perform non-real-time information associated with the first event information to obtain second event information; an event grouping module, used to perform event grouping on the second event information to obtain an event information set; and a judgment and analysis module, used to perform root cause location and / or situation judgment and analysis on the event information set based on the principle of frequent item mining.

[0007] According to another aspect of the present disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the method described in any one of the above embodiments.

[0008] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the method described in any of the above embodiments is implemented.

[0009] According to another aspect of the present disclosure, a computer program product is provided, including a computer program / instruction, which implements the method described in any of the above embodiments when the computer program / instruction is executed by a processor.

[0010] As will be described in detail below, according to an information processing method and device, electronic device, storage medium and product of an embodiment of the present disclosure. The present disclosure obtains first event information by analyzing the real-time information flow of the network, and obtains second event information based on the non-real-time information of the first event information. That is, the second event information includes at least the first event information and the non-real-time information of the first event information. And group the events according to the second event information to obtain an event information set. Finally, according to the principle of frequent item mining, the event information set is root cause located and / or situation analysis is performed to quickly locate the cause of the fault, so as to quickly find a solution based on the cause of the fault. Specifically, the present disclosure obtains non-real-time information through the first event information, obtains the second event information, combines the real-time information and the non-real-time information, thereby enriching the dimensional information related to the network event. And the relationship between the real-time information and the non-real-time information of the network is comprehensively considered by using the principle of frequent item mining, and by analyzing which data appear together with a higher frequency, the root cause mining and / or situation analysis can be performed more efficiently. In this way, when analyzing and locating the root causes of network events, the data analyzed by the present disclosure is more complete, and the key causes and potential risks of the events can be more accurately identified, thereby improving the accuracy and efficiency of network event root cause locating and / or situation assessment and analysis.

[0011] It is to be understood that both the foregoing general description and the following detailed description are exemplary, and are intended to provide further explanation of the technology as claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other purposes, features and advantages of the present disclosure will become more apparent by describing the embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0013] Figure 1 It is a flowchart illustrating an information processing method according to an embodiment of the present disclosure.

[0014] Figure 2It is a schematic diagram illustrating an event flow list according to an embodiment of the present disclosure.

[0015] Figure 3 It is a schematic diagram illustrating a grouping rule configuration interface according to an embodiment of the present disclosure.

[0016] Figure 4 FIG. 4 is a flowchart illustrating a frequent item mining method according to an embodiment of the present disclosure.

[0017] Figure 5 It is a flowchart illustrating an event information collection process according to an embodiment of the present disclosure.

[0018] Figure 6 FIG. 4 is a flowchart illustrating a method of obtaining frequent itemsets according to an embodiment of the present disclosure.

[0019] Figure 7 It is a schematic diagram illustrating an item set relationship according to an embodiment of the present disclosure.

[0020] Figure 8 is a schematic diagram illustrating a simplified process of an embodiment of the present disclosure.

[0021] Fig. 9 is a schematic diagram illustrating a root cause event detail view according to an embodiment of the present disclosure.

[0022] Fig.10 is a flowchart illustrating another information processing method according to an embodiment of the present disclosure.

[0023] Fig.11 is a block diagram illustrating an information processing apparatus according to an embodiment of the present disclosure.

[0024] Fig.12 is a hardware block diagram illustrating an electronic device according to an embodiment of the present disclosure.

[0025] Fig.13 is a schematic diagram illustrating a computer program product according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the present disclosure more obvious, the exemplary embodiments according to the present disclosure will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments of the present disclosure, and it should be understood that the present disclosure is not limited to the exemplary embodiments described here.

[0027] For IT systems, events usually refer to unplanned service interruptions, service degradation, or situations that may affect services. For telecommunications operators, network events refer to situations that affect user experience due to equipment failure, connection interruption, line degradation, external environmental factors, external emergencies, etc., resulting in a decrease in service processing capabilities or even service interruption, including but not limited to at least one of network failure events, network hidden danger events, and service degradation events.

[0028] After a network event occurs, operation and maintenance personnel often need to rely on the IT network management support system to coordinate multiple professional joint investigations when conducting problem location analysis. The investigation is difficult, the problem location takes a long time, and the monitoring efficiency is low. Taking a network failure event as an example, when a network element is unreachable, the event is often triggered based on the solidified alarm primary and secondary association rules and the related alarms are aggregated. Then, the staff will log in to multiple other network management systems based on their own operation and maintenance experience, and by setting and trying different query conditions, they can view the performance, cutover and other information that may be related to the failure, analyze historical work order data to obtain the classification of the cause of the failure, the treatment measures and other details of the failure, and then combine the expert experience to make further judgments on the cause of the failure and analyze the scope of business impact.

[0029] It can be seen that the efficiency of correlation analysis by staff is low, and the speed of problem location and the duration of business impact are limited by the speed of manual location analysis. For example, for network failure events, in addition to the primary and secondary associations and derivative association rules of alarms, the efficiency of manual analysis combined with multi-dimensional data varies from person to person. The same fault can be quickly located when analyzed by experienced experts, but after the staff is replaced, it may not be possible to correctly check the key performance indicators, engineering cutover information or historical work order data, making it difficult to quickly locate the cause of the fault, determine the scope of impact, and find a solution.

[0030] Another example is network hidden danger events. Unlike fault events, most of them can be found through alarm monitoring to find a breakthrough in problem troubleshooting and location. It is necessary to extract information from multiple data sources such as alarms, performance, and work orders to jointly determine the occurrence and elimination of network hidden dangers. However, the existing analysis methods based on alarm monitoring cannot meet the needs of active discovery and rapid location of such events.

[0031] Another example is a service degradation event. Indications of the occurrence and elimination of the event can be obtained from performance alarms. There are also many regularities in the massive performance indicators. The existing service degradation event monitoring method based on alarm monitoring is difficult to detect problems in the first place.

[0032] In addition, since it is necessary to log in to different systems to obtain relevant information about the event, the processing of network events may be seriously delayed, increasing the duration of the network event impact. Finally, the operation and maintenance experience of different staff members cannot be solidified and iteratively optimized, and cannot be used as a reference for rule adjustments.

[0033] In order to solve at least part of the above problems, the present disclosure provides an information processing method. In this method, the real-time network information flow and supplementary non-real-time information are used to locate the root cause of the event and / or analyze the situation. In this way, the information can be analyzed from the two information dimensions of real-time and non-real-time, and the key causes and potential risks of the event can be more accurately identified, thereby improving the accuracy and efficiency of network event root cause location and / or situation analysis.

[0034] The information processing method provided by the present disclosure will be described in detail below with reference to the accompanying drawings. Figure 1 is a flowchart illustrating an information processing method according to an embodiment of the present disclosure. Figure 1 As shown, the method specifically includes:

[0035] S101, performing event analysis on a real-time network information flow to obtain first event information.

[0036] Specifically, when a situation that satisfies the event derivation condition occurs in the network real-time information flow, the network real-time information that satisfies the event derivation condition is obtained, thereby analyzing and obtaining the first event information. Exemplarily, the first event information can be obtained based on the root alarm trigger.

[0037] Event derivation conditions can be understood as conditions for triggering events. That is, when certain specific conditions appear in the network real-time information flow, an event can be triggered. Event derivation conditions can be derived from any network real-time information that represents network anomalies. Event derivation conditions are set with different conditions depending on the type of information included in the network real-time information flow. That is, event derivation conditions can be alarms or other abnormal network real-time information.

[0038] The first event information includes at least part of the network real-time information in which the abnormality occurs in the network real-time information flow. In addition, the first event information may also include other information, such as the number of the network element device in which the abnormality occurs and the type of the network element device in which the abnormality occurs.

[0039] The network real-time information flow can be understood as an information flow that can be directly obtained. For example, it can also be understood as an information flow that can be obtained without interacting with other systems.

[0040] The network real-time information flow includes but is not limited to at least one of: alarms, performance indicators, logs, work orders, complaints, and engineering cutovers. The alarm can be understood as an alarm issued when the abnormality of other network real-time information exceeds a threshold, that is, when any type of information abnormality in the network real-time information reaches a certain level, an alarm will be generated. The alarm can at least include attribute dimension information of the abnormal information.

[0041] It should be noted that in any first event, there is one and only one alarm or abnormal information that best characterizes the characteristics of the first event. This disclosure will refer to this information as a root alarm. Theoretically, any abnormal information can be used as a root alarm for the occurrence of a first event. In actual scenarios, since the alarm is information that the degree of abnormality exceeds a threshold, the root alarm is often the root cause of the first event. Among them, there is a one-to-many relationship between the root alarm and the first event: a first event contains only one root alarm, and an alarm can be associated with multiple first events. When a first event is triggered by multiple alarms, other alarms can serve as sub-alarms of the root alarm belonging to the event.

[0042] Exemplarily, when the first event information is triggered based on an alarm (such as a fault alarm, a quality degradation alarm), Exemplarily, the first event can be triggered based on the occurrence of the alarm, and the first event can be eliminated after the alarm is cleared.

[0043] Exemplarily, when the first event information is obtained based on a performance indicator trigger, the occurrence and clearing of the event can be determined based on the threshold of the performance indicator. Exemplarily, the triggering condition of the first event is that a certain performance indicator is lower than the lower limit of the first threshold, and the first event is cleared after the performance indicator meets the first threshold.

[0044] Exemplarily, when the first event information is obtained based on a log trigger, the occurrence and removal of the first event can be determined based on the log matching condition. Exemplarily, the first event can be triggered when a log occurs, and the first event can be eliminated within a first preset time window after the log occurs.

[0045] Exemplarily, when the first event information is obtained based on a work order trigger, the occurrence and clearing of the event can be determined based on analysis rules such as the work order frequency. Exemplarily, the triggering condition of the first event is the corresponding fault occurrence time of the latest work order that meets the rule, and the first event is cleared within a second preset time window after the work order filing time.

[0046] It should be understood that the first threshold value, the second threshold value, the first preset time window and the second preset time window mentioned above are merely embodiments for easy understanding, and the present disclosure does not specifically limit the above values.

[0047] S102: Acquire non-real-time information associated with the first event information to obtain second event information.

[0048] This step means that after the first event is triggered, non-real-time information associated with the first event can be obtained according to different types of first events, wherein the association relationship of the non-real-time information can be obtained in combination with historical business requirements and operation and maintenance experience.

[0049] The non-real-time information here can be understood as information that cannot be directly obtained. Exemplarily, it can also be understood that the non-real-time information comes from other external network systems or non-real-time data interfaces, and needs to interact with other systems or non-real-time data interfaces to obtain information. For example, external information such as work orders and engineering cutovers of external systems can be obtained through external system interfaces. Among them, the present disclosure does not specifically limit the type of non-real-time data interfaces, and non-real-time data interfaces include but are not limited to at least one of the following: database query interface, RESTful interface, SQL interface.

[0050] The types of information included in the non-real-time information and the first event information may not be exactly the same. The non-real-time information includes, but is not limited to, at least one of the following: alarms, performance indicators, logs, work orders, complaints, and engineering cutovers. Depending on the application scenario, the type of non-real-time information required is also different, which will be described in detail later.

[0051] In an illustrative embodiment, when the non-real-time information and the first event information include the same type of information, the diversity of the information is increased to a certain extent, allowing a better understanding of various aspects of the first event and improving the efficiency of subsequent root cause mining and / or situation analysis to a certain extent.

[0052] In another illustrative embodiment, when the types of information included in the non-real-time information and the first event information are at least partially different, the non-real-time information can be used to supplement the first event information with multi-dimensional information, providing a new analysis angle for subsequent root cause mining and / or situation assessment and analysis, and to a certain extent providing a deeper understanding of the first event, thereby improving the accuracy of root cause mining and / or situation assessment and analysis.

[0053] The second event information includes: the first event information and non-real-time information related to the first event information. The method of obtaining the second event information varies according to the non-real-time information, which will be described in detail later and will not be repeated here. The second event information at least includes the first event information. In addition, the second event information may also include information related to the non-real-time information, which will be described in detail later.

[0054] Optionally, since the information format of the non-real-time information from different systems may be different from the used format, the non-real-time information may be parsed and converted after being acquired.

[0055] Optionally, non-real-time information can also be stored to facilitate subsequent calls, thereby reducing the number of interactions with other systems and saving communication resources. Furthermore, variable definition is required when storing non-real-time information. Variable definition methods include but are not limited to at least one of the following: FIX, FIELD, SQL, REG, ITF.

[0056] Among them, the variable definition method varies according to the type of non-real-time information. For example, when defining fixed text (such as text, numbers), FIX can be used. When using a fixed attribute field definition of a certain information (such as an alarm), FIELD can be used. When it is necessary to retrieve information from a database or other data source based on complex query logic, SQL can be used. When it is necessary to intercept a part of the content in the information (such as intercepting a part of the content in the alarm body) for definition, REG can be used. In addition, you can also use ITF to define it yourself. After the definition is completed, it can be directly selected as a variable. For example, through the system's internal data interface, a python function can be defined for the data that has been collected in this system.

[0057] S103: Group the second event information into groups to obtain an event information set.

[0058] In this step, the second event information may be grouped based on a preconfigured grouping rule, thereby simplifying the second event information into a number of smaller event information sets, thereby reducing algorithm complexity in subsequent frequent item mining processing.

[0059] The present disclosure does not specifically limit the specific content of the grouping rules, which can be determined according to actual conditions. For example, the grouping rules are configured based on the attribute dimensions of the root alarm information, or they can be grouped according to the fixed value of the root alarm information, or they can be a combination of the above two. The specific grouping process will be described in detail later.

[0060] S104: Based on the principle of frequent item mining, root cause location and / or situation analysis are performed on the event information set.

[0061] In this step, the event information set can be used to locate the root cause and / or analyze the situation based on the principle of frequent item mining. Optionally, the event information set can be input into a trained frequent item mining module, and the root cause event and / or situation analysis point can be output. The specific processing process of the frequent item mining module on the event information set will be described in detail later, and no specific limitation is made here.

[0062] The manifestation of the frequent item mining principle includes, but is not limited to, at least one of a frequent item mining algorithm, a frequent item mining module, and a third-party tool.

[0063] In summary, the present disclosure obtains the first event information by analyzing the real-time information flow of the network, and obtains the second event information based on the non-real-time information of the first event information. That is, the second event information at least includes the first event information and the non-real-time information of the first event information. And the events are grouped according to the second event information to obtain an event information set. Finally, according to the principle of frequent item mining, the root cause location and / or situation analysis of the event information set are performed to quickly locate the cause of the fault, so as to quickly find a solution based on the cause of the fault. Specifically, the present disclosure obtains non-real-time information through the first event information to obtain the second event information, combines the real-time information and the non-real-time information, thereby enriching the dimensional information related to the network event. And the relationship between the real-time information and the non-real-time information of the network is comprehensively considered by using the principle of frequent item mining, and by analyzing which data appear together with a higher frequency, the root cause mining and / or situation analysis can be performed more efficiently. In this way, when analyzing and locating the root causes of network events, the data analyzed by the present disclosure is more complete, and the key causes and potential risks of the events can be more accurately identified, thereby improving the accuracy and efficiency of network event root cause locating and / or situation assessment and analysis.

[0064] In step S102, the specific steps of obtaining the second event information may include steps S1021-S1023:

[0065] S1021: Determine variable definition information corresponding to the first event information.

[0066] In this step, a first task may be sent to other systems or interfaces based on the first event, and the first task is used to request variable definition information associated with the first event from other systems or interfaces. The variable definition information at least includes relevant information of the required non-real-time information.

[0067] S1022: Based on the variable definition information, obtain the non-real-time information through a non-real-time data interface.

[0068] Other systems can send the required non-real-time information to the non-real-time data interface based on the variable definition information. Thus, the non-real-time information can be obtained through the non-real-time data interface.

[0069] S1023: Associating the first event information with the non-real-time information to obtain the second event information.

[0070] In this step, the non-real-time information and the method for associating the first event information with the non-real-time information may vary according to different application scenarios. The method for associating the first event information with the non-real-time information may include but is not limited to the following embodiment 1 and / or embodiment 2.

[0071] Illustratively, in Embodiment 1, the non-real-time information may be used as a configurable attribute of the first event information to perform information association to obtain the second event information.

[0072] That is to say, when it is necessary to mine the cause of the first event (such as root cause mining), in addition to the existing first event information, non-real-time information can also be used as a supplement to the first event information. Non-real-time information plays a role in further supplementing the key information required for in-depth mining and analysis. For example, for network elements located in the same loop, belonging to the same group of primary and standby protection units, and the same topological logical relationship in the NFV network, their same attribute information can be extracted (for example, statistics on the frequency of occurrence of specific alarm information in adjacent historical time windows, etc.) as a grouping reference for further mining and analysis. The present disclosure extracts and parses the information required for event analysis in a flexible and customizable manner, unifies specifications and simplifies configurations while providing a high degree of analysis flexibility.

[0073] In another exemplary embodiment 2, the non-real-time information can be configured as supplementary alarm information of the first event information to obtain the second event information. That is to say, when it is necessary to fully analyze the events or alarms derived from the first event (for example, to conduct situation analysis), the non-real-time information can be used as supplementary alarm information. Specifically, in scenarios where it is necessary to provide important analysis conclusions of related events, hidden danger troubleshooting work order suggestion information, fault handling measures recommendation information, etc., when a certain type of alarm is detected, it is determined whether there are specific logs or performance changes in the adjacent specific time window that are helpful in describing the alarm event, and then supplementary alarm information can be generated. Among them, the supplementary alarm information includes at least the occurrence time of the supplementary alarm and the required key attribute information.

[0074] The supplementary alarm information includes but is not limited to the following: a single independent alarm information, sub-alarm information corresponding to the original root alarm, and sub-alarm information corresponding to the new root alarm.

[0075] In an illustrative embodiment, when non-real-time information is configured as a single independent alarm information, it means that the root alarm of the abnormal non-real-time information is different from the root alarm that triggers the first event, and the non-real-time information can trigger an event. This means that the non-real-time information is a root alarm, and a new event can be generated based on the non-real-time information. Optionally, when the non-real-time information is an alarm, it can be determined whether the alarm is a root alarm based on the list of "the original root alarm in the rule and the specific event in the adjacent time window".

[0076] In another exemplary embodiment, when the non-real-time information is configured as the sub-alarm information corresponding to the original root alarm, it means that the root alarm of the abnormal non-real-time information is the same as the root alarm that triggers the first event, and the abnormality of the non-real-time information is derived from the root alarm of the first event. At this time, the non-real-time information can be used as supplementary information derived from the first event. When the first event is subsequently analyzed and processed, the non-real-time information needs to be comprehensively considered.

[0077] In another exemplary embodiment, when non-real-time information is configured as sub-alarm information corresponding to a new root alarm, it means that the abnormality of the non-real-time information is derived from the new root alarm. At this time, the non-real-time information can be used as supplementary information derived from the new root alarm. When the event corresponding to the new root alarm is subsequently analyzed and processed, the non-real-time information needs to be comprehensively considered.

[0078] It should be understood that the above is only an illustrative embodiment provided by the present disclosure, and in practical applications, the above non-real-time information association processing method (i.e., the aforementioned embodiment 1 and embodiment 2) can also be used in combination. That is, according to actual needs, after obtaining non-real-time information, part of the non-real-time information can be used as a configurable attribute of the first event information, and other non-real-time information can also be configured as supplementary alarm information of the first event information.

[0079] Optionally, an event flow list can be set or updated based on the second event information, so as to facilitate searching and reduce the number of interactions with other systems. The event flow list is used to maintain the first event information and / or the second event information. The event flow list includes at least one event information; any one of the event information includes at least one of the following: alarm type, alarm time, alarm content, alarm attribute, and identification information.

[0080] Furthermore, the event flow list can also be displayed to the user. This provides intuitive flow presentation, rule configuration, and flexible annotation interaction logic for events, making the overall implementation scheme coherent and smooth. Users can easily understand and operate the system, view and annotate event details, improving the convenience of operation and user experience.

[0081] For example, when all events are triggered by alarms, please refer to the specific style of the event flow list. Figure 2 . Figure 2 Schematic diagram of an event flow list of an embodiment of the present disclosure, such as Figure 2As shown in the figure, the event flow list may include: time, alarm text, alarm attributes and situational awareness flag (described in detail later). In this case, the alarm text can be understood as the event name. For example, an event can be triggered by an alarm, and the alarm is used as a root alarm. In this case, the event name is the same as the root alarm name. The alarm attributes can be understood as the configurable attributes of the above event information. Figure 2 As can be seen from the above, any event can be described by at least one alarm attribute. Figure 2 When the leftmost symbol is symbol 002 or symbol 003, it can be considered that the event includes sub-alarms. Symbol 003 is the sub-alarm display state of the event, and symbol 002 is the sub-alarm folding state of the event. When the leftmost symbol is empty, it means that the event does not include sub-alarms. When the leftmost symbol is 001, it is an event for situation analysis and warning, which has not actually occurred. When symbol 201 exists in the row where the root alarm is located, it can be considered that the event has a root cause location. When symbol 203 exists, it can be considered that the event has a situation analysis point. The specific determination method of symbols 201, 202, and 203 will be described in detail later.

[0082] It should be understood that the symbols and names mentioned above are embodiments for easy understanding, and the specific settings can be determined according to actual conditions.

[0083] In step S103, the specific grouping process includes:

[0084] The grouping rules are displayed; wherein the grouping rules include: sequence set grouping rules and frequent item set partitioning rules; or sequence set grouping rules.

[0085] In this step, the sequence set grouping rule is used to preliminarily group each event. For example, it can be used to limit the frequent events mined when conducting frequent item mining within each type of "frequent item set grouping" to occur in network elements related to business logic (such as belonging to the same province, the same loop, the same network element). Specifically, the sequence set grouping rule can be understood as a rule for dividing events of the same type of network elements.

[0086] The rules for dividing frequent item sets are used to divide the events related to the network element sets that are oriented to different application scenarios and provide different functions into their respective sets, thereby defining the event category range within each set to carry out the mining algorithm in the subsequent steps in a targeted manner. The rules obtained in any "sequence set grouping" within the same "frequent item set grouping" can be applied to other "sequence set groupings".

[0087] In addition, the present disclosure provides a grouping rule configuration page, which intuitively presents each rule and its attribute conditions in the form of a bubble cloud chart, and feeds back the event statistics of the configured rules to facilitate reference for rule adjustment. Figure 3is a schematic diagram illustrating a grouping rule configuration interface of an embodiment of the present disclosure. For details, please refer to Figure 3 , where grouping rule 1, grouping rule 2, and grouping rule 3 are configuration pages for grouping rules of frequent itemsets and configuration pages for grouping rules of sequence sets under a preset time window length. Grouping rule 1 and grouping rule 2 show the configuration pages for grouping rules of frequent itemsets, while grouping rule 3 shows the configuration page for grouping rules of sequence sets. In grouping rule 1, network element type, province, region (such as East China region) and network element type are mainly used for grouping. Among them, in 301, the network element type is an 'or' relationship, and in 302, the province and region are an 'and' relationship, that is, the events grouped according to the grouping conditions in 301 and 302 belong to a device network element type of EOR or TOR or aggregation switch, and the location of the network element meets the grouping conditions of the province and region in 302. Grouping rule 2 shows another grouping rule for frequent itemsets. That is, while filtering the network element type, the configurable attributes (i.e., the aforementioned configurable attributes) are filtered. In grouping rule 3, network element type and network element name can be used for grouping.

[0088] It should be understood that the above is only an embodiment for convenience of understanding. In actual application, the present disclosure does not specifically limit the style and type of the grouping rule configuration interface. In other words, the grouping rule configuration interface can only display the configuration page of the frequent item set grouping rule, or can only display the configuration page of the sequence set grouping rule, without limitation.

[0089] For any grouping rule created, a set of event information can be obtained based on the historical event flow statistics based on the set of rules. Optionally, "invalid events" can be marked to filter out event types that can be ignored by the subsequent frequent item mining module, and the remaining events in the list are "valid events" within the scope of the set of rules. Among them, invalid events can be set by themselves or obtained based on historical analysis. The specific analysis method will be described in detail later.

[0090] After the second event information is grouped, the root cause location and / or situation analysis can be performed on the event information set based on the frequent item mining principle. Figure 4 Specifically, Figure 4 FIG. 1 is a flowchart illustrating a frequent item mining method according to an embodiment of the present disclosure. Figure 4 As shown, the analysis process may specifically include: S1041 to S1046.

[0091] S1041, obtaining sequence feature data in the event information set.

[0092] In this step, firstly, the events (such as valid events) need to be cleaned and standardized, and then feature extraction is performed according to fixed preset rules to ensure the consistency of the description data format of each event.

[0093] The present disclosure does not specifically limit the type of feature extraction. Optionally, Figure 3 The features are extracted from the real-time alarm information and / or the non-real-time alarm information, and the feature information is arranged in a fixed order. The extracted features are different according to different information types.

[0094] Exemplarily, when the information type for feature extraction is alarm, the main extraction includes but is not limited to at least one of the following: network element type, alarm title (i.e. alarm name), configurable attributes and value information. The information type may be nominal value information (such as topological attributes) or numerical information (such as frequency and other statistical information).

[0095] Exemplarily, when the type of information to be feature extracted is performance indicators, the main extraction includes but is not limited to at least one of the following: network element type, indicator items and values, configurable attributes and value information; indicator items such as utilization rate, network traffic, success rate, latency, proportion and other key performance indicators.

[0096] Exemplarily, for a log entry, at least one of the following is mainly extracted, including but not limited to: network element type, log content keyword information, wherein the log content keyword includes features such as error code, log message keyword, etc.

[0097] Exemplarily, when the information type for feature extraction is a work order (such as a fault work order, a problem work order, a complaint work order, etc.), the main extraction includes but is not limited to at least one of the following: content keywords (such as complaint content), configurable attributes and value information.

[0098] After that, each feature information arranged in a fixed order is discretized and encoded to obtain the encoded sequence feature data sorted by the timestamp of the event. Next, the time window length configured for the sequence feature data belonging to different event information sets can be adjusted within the preset relative historical data interval, and a large number of sequence features can be obtained by sliding the sliding time window interval. Next, the support can be used to filter the sequence feature data to obtain a list of frequent item sets, which will be described in detail later.

[0099] Among them, the preset relative historical data interval range and the preset sliding time window interval can be preset with default values ​​during the system initialization phase, for example Figure 3 In , you can use the time window length to filter events. In addition, you can also configure the aforementioned grouping rules. If you do not configure, the system default value will be used.

[0100] For example, please refer to Figure 5 , Figure 5 is a flowchart illustrating an event information collection process according to an embodiment of the present disclosure. Figure 5 As shown, after the event information set is input, after data cleaning and feature extraction, the extracted features are discretized and sequence encoded to obtain event sequence data sorted by timestamp. Among them, P001, P002, and P003 are sequence feature data, and time is the time when the event occurs. Next, the sequence feature data is input into the frequent pattern mining module (i.e., a manifestation of the aforementioned frequent item mining principle), and the first frequent item set list and the item set support and time window length information of each item set are output. Among them, the specific method for determining the frequent item set list and other information will be described in detail in steps S1042 and S1043.

[0101] Optionally, the frequent item mining principle may use at least one of the public algorithms such as Apriori, FP-Growth, etc. to process the sequence feature data.

[0102] S1042, performing frequent item mining and sorting on the sequence feature data based on the frequent item mining principle to obtain a first frequent item set list corresponding to the event information set.

[0103] The process of obtaining the first frequent item set list may include: step 1 (mining) and step 2 (sorting).

[0104] Step 1: Based on the frequent item mining principle, a third frequent item set list is determined using the support condition corresponding to the event information set and the sequence feature data.

[0105] In this step, the event information set may be used to correspond to the support condition and the sequence feature data, thereby obtaining a third frequent item set list sorted from high to low frequency.

[0106] The support condition is used to filter events whose occurrence frequency is greater than a preset threshold. For example, the support condition can be an item set with a support greater than or equal to 0.2, and the support of the item set {A, B} is 0.3, which is greater than 0.2, so the third frequent item set list can include the item set {A, B}.

[0107] Among them, the support condition can be preset with default values ​​in the system initialization stage, and can also be configured in the grouping rules. If no configuration is made, the system default value will be used, and it can be configured to select whether the screening conditions of each set are allowed to be automatically adjusted by the system; in addition, during the automatic operation stage of the system, the system can automatically step and adjust according to the number of frequent item sets in the output list to ensure that at least one valid frequent item set is output.

[0108] Step 2: sorting the frequent itemsets based on the first appearance time of each frequent itemset in the third frequent itemset list to obtain the first frequent itemset list.

[0109] In this step, the first frequent item set list is obtained by sorting the items in each frequent item set in the third frequent item set list according to their appearance time. For example, in the item set {A, B, C} and the item set {A, B, D}, the first item and the second item appear at the same time, and the event C appears earlier than the event D, so the item set {A, B, C} is before the item set {A, B, D}. For another example, when comparing the item set {A, B, C} with the item set {A, B}, although the first two events appear at the same time, the last item of the item set {A, B} appears earlier than the item set {A, B, C}, so the item set {A, B} is before the item set {A, B, C}.

[0110] The first frequent itemset list may record at least one of the following information, including but not limited to: support information of each frequent itemset, time window length information, and event quantity.

[0111] For easier understanding, please refer to Figure 6 , Figure 6 is a flowchart illustrating a method of obtaining frequent item sets according to an embodiment of the present disclosure. Figure 6 As shown in FIG. 1 , after obtaining the sequence set data (i.e., the aforementioned sequence feature data), it is sorted by time. Next, the sequence set data can be sorted again by the support condition to obtain a frequent item set list (i.e., the third frequent item set list). Finally, the time sequence of the first appearance of each sequence feature data is used to obtain a frequent item set list with time sequence information (i.e., the first frequent item set list).

[0112] S1043: Based on the number of events in each frequent itemset and the itemset support, statistical data of each event in the first frequent itemset list is counted.

[0113] In this step, the item set support can be understood as the frequency of occurrence of each event in the item set.

[0114] Statistical data can be understood as data related to item sets, including but not limited to at least one of the following: the first count of each event appearing in each subset, the second count of the event not appearing in each subset, the number of subsets, and the number of subsets with the same first item.

[0115] When the statistical data includes a first count of each event occurring in each subset and / or a second count of an event not occurring in each subset, the frequency of occurrence of each event in each item set can be counted, thereby facilitating the removal of events that are irrelevant or weakly relevant to the mining target in step S1044.

[0116] When the statistical data includes the number of subsets with the same first item and the number of subsets, it is convenient to divide the relationships among the subsets in S1043b.

[0117] Furthermore, the statistical data also includes at least one of the following: an occurrence count of the event in the second set, and a cumulative support value corresponding to the second set corresponding to the event; wherein the second set is other events except the first set.

[0118] This step specifically includes steps S1043a-S1043b:

[0119] S1043a: For any frequent itemset in the first frequent itemset list, determine whether the frequent itemset is a subset of a determined itemset.

[0120] In this step, each item set can be judged and marked in turn according to the order of the number of events in each item set from high to low and the item set support from high to low, whether it is a subset of the previous item set. For example, according to the number of events included in the item set, the item set {A, B, C} is before the item set {A, B}, where the events in the item set {A, B, C} and the item set {A, B} are sorted according to their respective supports. The item set {A, B} is a subset of the item set {A, B, C}. If there is a situation where the item set {A, B} is a subset of the item set {A, B, C}, then the subset is recorded and the first count and the second count are accumulated in the statistical table corresponding to the existing item set.

[0121] For example, please refer to Figure 6 ,like Figure 6In the following table, the first two item sets {xxx1, xxx2} and {xxx1, xxx2, xxx3} are taken as examples. {xxx1, xxx2} is a subset of {xxx1, xxx2, xxx3}, and {xxx1, xxx2, xxx3} is a subset of the item set {xxx1, xxx2, xxx3, xxx4}. In other words, {xxx1, xxx2} and {xxx1, xxx2, xxx3} are both subsets of a certain item set. xxx1 appears in both subsets, so it is displayed as 1 in the {xxx1, xxx2} appearance mark and 1 in the {xxx1, xxx2, xxx3} appearance mark. The total count of event occurrences (i.e., the first count) is displayed as 2 in the first column of the list. The total count of events that do not appear (i.e., the second count) is 0. However, xxx3 does not appear in the subset {xxx1, xxx2}, so xxx3 is displayed as 0 in the subset appearance mark of the subset {xxx1, xxx2}, and is displayed as 1 in the appearance mark of {xxx1, xxx2, xxx3}, and the total count is 1. It is marked as 1 in the non-appearance mark. By analogy, the number of times each subset appears and the number of times it does not appear can be obtained. Among them, according to the number of times each subset appears, the number of subsets with the same first item can be obtained. Among them, the number of occurrences in other sets can be understood as: the number of times xxx1 appears in the set that includes event xxx1 but {xxx1, xxx2} is not a subset of this item set. For example, the item set {xxx1, xxx4, xxx5} does not include {xxx1, xxx2}, but includes event xxx1.

[0122] S1043b: When the frequent itemset is a subset of the determined itemset, for any event in the frequent itemset, statistical data between the event and each subset are collected.

[0123] In this step, in order to solve the problem of limited sequence time span in the algorithm mining results caused by the limited time window length in the frequent item mining process, the present disclosure introduces a virtual subset. If the following conditions are met between the frequent item sets: there is a unique identical and continuous event sequence in the two sets, the last item of the event sequence is the last item of the virtual subset, and the first item of the event sequence is the first item of the item set to which the virtual subset belongs.

[0124] For example, please refer to Figure 7 , Figure 7 is a schematic diagram illustrating an item set relationship of an embodiment of the present disclosure, in Figure 7In the figure, the item set {2222, 3333, 4444} includes the item set {2222, 3333}. Therefore, the item set {2222, 3333} is a subset of the item set {2222, 3333, 4444}. The relationship that A is a subset of B is represented by a solid line, and the opposite direction of the arrow represents the subset. The itemset {1111, 2222, 3333, 4444} and the itemset {2222, 3333, 4444, 5555} contain a unique and identical continuous event sequence: {2222, 3333, 4444}, and the last item of the sequence {2222, 3333, 4444} is the last item of the itemset {1111, 2222, 3333, 4444}, and the first item of the sequence {2222, 3333, 4444} is the first item of the sequence {2222, 3333, 4444, 5555}. Therefore, the item set {1111, 2222, 3333, 4444} is a virtual subset of the item set {2222, 3333, 4444, 5555}. The relationship that A is a subset of B is represented by a dotted line, and the opposite direction of the arrow represents the virtual subset.

[0125] Therefore, based on the relationship between the subsets and virtual subsets between the item sets, statistical data between the events and each subset can be counted.

[0126] S1044: Simplify the first frequent itemset list based on the statistical data to obtain a second frequent itemset list.

[0127] The specific steps of the simplification process may include: for any event, when the statistical data meets the first condition, the event is discarded. Otherwise, it is a valid event and the event is retained. Among them, the simplification process helps to remove those events that are irrelevant or weakly relevant to the mining target, thereby reducing the deviation and noise in the results. In addition, through simplification, events that have an important impact on the mining results can be more accurately identified, thereby improving the accuracy of the entire mining process.

[0128] The first condition includes at least one of the following: the first count is greater than a preset multiple. The first count varies depending on the relationship between the item sets.

[0129] In an illustrative embodiment, when the item set has no subset, virtual subset or associated item set, the first condition may be that the first count in the item set is higher than a first preset multiple, and the first preset multiple is related to the number of other item sets. This may mean that the occurrence of the event in the current item set is accidental, or that the correlation between it and other items in the current item set is not strong. Therefore, it can be considered that the event is irrelevant in the current item set and can be discarded as an irrelevant event.

[0130] In another exemplary embodiment, when the item set has a subset, a virtual subset or an associated item set, the first condition may be that the number of item sets discarding the event is greater than a second preset multiple. That is, when more item sets consider the event to be irrelevant, the event may be discarded.

[0131] For details, please refer to Figure 8 , Figure 8 Schematic diagram illustrating a simplified process of an embodiment of the present disclosure. Figure 8 As shown, all item sets include event {1111}. After simplification, that is, discarding event {1111}, we get Figure 8 Shown on the right.

[0132] If an event is discarded in all the itemsets in which it appears, the event is classified as an "invalid event", otherwise it is a valid event. If all events in an itemset are discarded, the itemset is removed from the corresponding frequent itemset list.

[0133] S1045: Determine the root cause event voting count and / or situation analysis voting count of the second frequent itemset list to obtain a voting count result.

[0134] In this step, based on the preset first rule, the events in the second frequent item set list can be voted and counted to obtain the voting counting result, wherein the voting counting result includes but is not limited to at least one of the following: root cause event voting count and situation analysis point voting count.

[0135] The first rule includes: a root cause event voting rule and / or a situation analysis voting rule; and / or obtaining a result of a user's voting and counting process on the events in the second frequent item set list.

[0136] In an illustrative embodiment, when the first rule is a root cause event voting rule and / or a situation analysis voting rule, a root cause event voting counter and a situation analysis point voting counter can be maintained for each event in each item set, wherein both initial values ​​are 0, and the counters can be adjusted according to the following steps:

[0137] First, according to the number of subsets of each item set in the simplified frequent item set list (including subsets with the same or non-identical first items, excluding virtual subsets) and the number of events in the item set, each event list in each item set is traversed in turn, and for the events that are in the front preset percentage position (for example, the first 50%) of all events in the item set, their voting counts as the root cause events of the item set are increased according to the subset occurrence count.

[0138] Next, if there are multiple directly connected item sets in a certain item set, it can be considered that the higher the number of events that appear together in each directly connected item set, the more likely it is to be the root cause event. Among them, the directly connected item set can be understood as the item set that is closest to the subset of a frequent item set. For example, item set A is {1, 2, 3, 4, 5, 6}, item set B is {1, 2, 4, 6}, and item set C is {1, 3, 5, 6}. Then item sets B and C are both subsets of item set A, and item sets B and C differ from item set A by only two events. Then item sets B and C are both directly connected item sets of item set A, and item set A is the directly connected item set of item sets B and C.

[0139] Next, each event in each directly connected item set is traversed in turn, and the weight is calculated based on the sum of the support values ​​of other directly connected item sets where the event does not occur, and the voting count of the item set as the root cause event is increased.

[0140] Finally, the situation analysis point voting count is automatically increased for each event in each item set, where the alarm level is serious, the performance indicator degradation degree is higher than a specific threshold, and the complaint work order item is located at a preset percentage position (for example, 50%) in the order of all events in the item set, and the voting result is obtained, wherein the voting result and / or mining result is the positioning analysis judgment condition. The positioning analysis judgment condition can be understood as the judgment rule of the root cause event.

[0141] When the system is running, based on the positioning and judgment conditions, in one embodiment, when the first event in the event sequence of a certain item set affects all events before the judgment point event within the time window of the item set, the positioning and judgment conditions are met, and the event is considered to be the root cause of the item set. Exemplarily, if item set A includes events {1, 2, 3, 4, 5, 6}, item set B includes events {1, 2, 4, 6}. Item set C includes events {1, 3, 5, 6}, item set B2 includes events {1, 2, 6}, and item set C2 includes events {1, 3, 6}. When event {1, 2} occurs, according to the rules, event {1, 2} is judged to be the root cause of event set event {1, 2, 4, 6}.

[0142] For example, Fig. 9 is a schematic diagram illustrating a root cause event detail view of an embodiment of the present disclosure, please refer to Fig. 9 , monitor each event flow list. When an event contained in each item set in a frequent item set appears and meets the positioning and judgment conditions, the event involved will be associated with a specific frequent item set, and according to whether there is a "voting count of the root cause event" or a "voting count of the situation judgment point" in the item set that is not 0, a specific symbol can be used in the "situation awareness identification" item of all events involved in the event flow, such as Figure 3Grouping rules 1 and 3 are included in the event flow list. This allows the event-related root cause location and event impact analysis details to be presented in an intuitive form.

[0143] The events in the event impact analysis area can be marked according to whether they have occurred. At the same time, the current situation analysis point (when it has not actually occurred) can be displayed in the form of a virtual event. Figure 2 Presented at the top of the center.

[0144] The present disclosure may also obtain the result of the user's voting and counting process on the events in the second frequent item set list.

[0145] That is to say, the system can increase or decrease the "event-related identification", "voting count of root cause events" or "voting count of situation analysis points" of an event in the item set at different step lengths according to the level of different expert users or the trust level of the expert determined based on the historical annotation data of each expert user. When the event-related identification counter value drops to 0, the event is removed from the corresponding item set.

[0146] When an item set has a belonging item set or a virtual belonging item set, if all the events of the item set appear in a certain positioning and judgment instance, the item set associated with the instance is translated to the corresponding belonging item set state. In this process, if there are multiple corresponding belonging item sets or virtual subsets for the item set, the order of the translation target item sets is determined from high to low according to the support. In the translation target item set sequence list, if the subsequent newly added events of the instance match other item sets, it is further translated to other item sets. Until the belonging item set or virtual belonging item set list is traversed and the item set associated with the instance has no belonging item set or virtual belonging item set, the instance identification process is considered to be completed.

[0147] In summary, the present disclosure uses root cause event voting counters, situation analysis point voting counters, and event order and support conditions in frequent item sets to automatically identify root cause points and situation analysis points and filter out irrelevant events. Through intelligent root cause point and situation analysis point mining methods, the system can more accurately identify key events and potential risks, and improve the accuracy and efficiency of fault root cause location and situation analysis of network events.

[0148] S1046: Determine the root cause event and / or situation analysis result based on the voting counting result.

[0149] Finally, the root cause event and / or situation analysis result can be determined based on the voting count result. Further, the root cause event and / or situation analysis result can also be displayed.

[0150] Among them, after determining the root cause event and / or situation analysis results, experts can also mark them. The present disclosure allows experts to mark alarms, logs and other events in the current state as root cause events, or mark alarms, performance degradation and other events as situation analysis points. The corresponding root cause and situation analysis point markings can also be canceled. Thereby supporting operation and maintenance personnel to freely combine different data sources based on experience, edit / call the required script functions, and flexibly customize the analysis tasks triggered by each type of event. Different segmentation rules can be set for different events, different data and professions, which is conducive to solidifying expert operation and maintenance experience and iterative optimization.

[0151] For example, please refer to Fig. 9 , the details view has a regular mode and an annotation mode, in which the regular mode only presents the event flow list of "Current Status of Event", "Location of Event Root Cause", and "Analysis of Event Impact". The annotation mode can be opened to expert users of different levels with annotation permissions, in which an indicator box is marked to indicate whether each event comes from the mining mode (i.e., the frequent item mining principle mentioned above), and an expert annotation indicator box is provided. The default value of the check state in the "Expert Annotation" indicator box of each expert user in each "Location Analysis Instance" under each frequent item set is the indicator box state of the mining mode. When the expert modifies any annotation state in the "Expert Annotation" indicator box of a certain location analysis instance and saves the annotation state (or does not modify it but clicks to confirm and save to indicate that the instance is correct), a annotation record for the instance is generated, and all events involved in the instance are archived in the historical knowledge base. Each time the same expert clicks on the same location analysis instance, the check state in the "Expert Annotation" indicator box will first query the historical marking results of the expert. If there is no historical mark, the default value is presented.

[0152] In addition, experts are allowed to uncheck events in the current status of events, or to further uncheck items marked by the expert for unchecking root causes and situation analysis points, indicating that the expert has determined that the event is not related to this positioning analysis instance.

[0153] Optionally, experts can be allowed to configure and select (click the configuration button) existing events outside this item set as root cause events, or configure and select different event types outside this item set as event impact judgment points. If so, a copy of the item set is created in the frequent item set list corresponding to the original mining result, in which the user-configured event is added and the corresponding "voting count of root cause event" or "voting count of situation judgment point" is assigned. The duplicate item set is not included in the subset statistics and the statistics of the item set to which it belongs in the new round of item set mining and update process.

[0154] The above is an information processing method provided by the present disclosure. The above embodiments can be combined according to actual conditions, and the present disclosure does not make specific restrictions on this. Specifically, the steps of the information processing method provided by the present disclosure can refer to Fig.10 , Fig.10 is a flowchart illustrating another information processing method according to an embodiment of the present disclosure. Fig.10 As shown, after the real-time data and non-real-time data are respectively processed using mining algorithms (i.e., through frequent mining models) and rule calculations, they are then fed back after intelligent operation and expert experience configuration for root cause and / or situation analysis, thereby making root cause mining and / or situation analysis more convenient and quick.

[0155] The present disclosure also provides an information processing device. Fig.11 is a block diagram illustrating an information processing device according to an embodiment of the present disclosure. Fig.11 As shown, the information processing device 1100 includes:

[0156] The information analysis module 1101 is used to perform event analysis on the network real-time information flow to obtain first event information.

[0157] The information acquisition module 1102 is used to obtain the second event information from the non-real-time information associated with the first event information.

[0158] The event grouping module 1103 is used to group the second event information into groups to obtain an event information set.

[0159] The research and analysis module 1104 is used to locate the root cause and / or perform situation research and analysis on the event information set based on the principle of frequent item mining.

[0160] In an exemplary embodiment, the information processing device 1100 is also configured to obtain non-real-time information associated with the first event information to obtain second event information, including: determining variable definition information corresponding to the first event information; based on the variable definition information, obtaining the non-real-time information through a non-real-time data interface; and associating the first event information with the non-real-time information to obtain the second event information.

[0161] In an exemplary embodiment, the information processing device 1100 is further configured to perform an associative process on the first event information and the non-real-time information to obtain the second event information, including: performing information associative process on the non-real-time information as a configurable attribute of the first event information to obtain the second event information;

[0162] and / or,

[0163] The non-real-time information is configured as supplementary alarm information of the first event information to obtain the second event information; wherein the supplementary alarm information includes: a single independent alarm information, sub-alarm information corresponding to the original root alarm, and sub-alarm information corresponding to the new root alarm.

[0164] In an exemplary embodiment, the information processing device 1100 is also configured so that the method also includes at least one of the following: updating the event flow list based on the second event information; displaying the event flow list; wherein the event flow list is used to maintain the first event information and / or the second event information; wherein the event flow list includes at least one event information; any one of the event information includes at least one of the following: alarm type, alarm time, alarm content, alarm attribute, identification information.

[0165] In an exemplary embodiment, the information processing device 1100 is also configured to group the second event information to obtain the event information set, including: grouping the second event information based on a preconfigured grouping rule to obtain the event information set; wherein the grouping rule is configured based on each attribute dimension of the root alarm information.

[0166] In an exemplary embodiment, the information processing device 1100 is further configured to display the grouping rules; wherein the grouping rules include: sequence set grouping rules and frequent item set partitioning rules; or sequence set grouping rules.

[0167] In an exemplary embodiment, the information processing device 1100 is also configured to perform root cause location and / or situation analysis on the event information set based on the frequent item mining principle, including: obtaining sequence feature data in the event information set; performing frequent item mining and sorting on the sequence feature data based on the frequent item mining principle to obtain a first frequent item set list corresponding to the event information set; based on the number of events and item set support in each frequent item set, counting the statistical data of each event in the first frequent item set list; simplifying the first frequent item set list based on the statistical data to obtain a second frequent item set list; determining the root cause event voting count and / or situation analysis voting count of the second frequent item set list to obtain the voting count result; determining the root cause event and / or situation analysis result based on the voting count result.

[0168] In an exemplary embodiment, the information processing device 1100 is further configured to perform frequent item mining and sorting on the sequence feature data based on the frequent item mining principle to obtain a first frequent item set list corresponding to the event information set, including: based on the frequent item mining principle, using the support condition corresponding to the event information set and the sequence feature data, determining a third frequent item set list; sorting frequent item sets based on the first appearance time of each frequent item set in the third frequent item set list to obtain the first frequent item set list.

[0169] In an exemplary embodiment, the information processing device 1100 is further configured to count the statistical data of each event in the first frequent item set list based on the number of events in each frequent item set and the item set support, including: for any frequent item set in the first frequent item set list, determine whether the frequent item set is a subset of the determined item set; when the frequent item set is a subset of the determined item set, for any event in the frequent item set, count the statistical data between the event and each subset; wherein the statistical data includes at least one of the following: a first count of the event appearing in each subset, a second count of the event not appearing in each subset, the number of subsets, and the number of subsets with the same first item.

[0170] In an exemplary embodiment, the information processing device 1100 is also configured to simplify the first frequent item set list based on the statistical data to obtain a second frequent item set list, including: for any event, when the statistical data meets a first condition, discard the event; wherein the first condition includes: the first count is greater than a first preset multiple, and the third count is greater than a second preset multiple; wherein the third count is related to the frequent item set that discards the event.

[0171] In an exemplary embodiment, the information processing device 1100 is further configured to determine the root cause event voting count and / or situation analysis voting count of the second frequent item set list to obtain the voting count result, including: based on a preset first rule, voting count the events in the second frequent item set list to obtain the voting count result, the first rule including: root cause event voting rule and / or situation analysis voting rule;

[0172] and / or,

[0173] Obtain the result of the user's voting and counting process on the events in the second frequent item set list.

[0174] In an exemplary embodiment, the information processing device 1100 is further configured so that the first rule also includes: a positioning analysis and determination condition; wherein the positioning analysis and determination condition is obtained based on the root cause event voting result and / or the situation analysis and determination voting result.

[0175] In an exemplary embodiment, the information processing device 1100 is further configured to display root cause events and / or situation analysis results.

[0176] Fig.12 The electronic device 1200 according to the embodiment of the present disclosure includes at least a memory, a processor and a computer program stored in the memory, and the processor executes the computer program to implement the signal transmission method described in any of the above embodiments.

[0177] Fig.12 The electronic device 1200 shown specifically includes: a central processing unit (CPU) 1201, a graphics processing unit (GPU) 1202 and a memory 1203. These units are connected to each other via a bus 1204. The central processing unit (CPU) 1201 and / or the graphics processing unit (GPU) 1202 can be used as the above-mentioned processor, and the memory 1203 can be used as the above-mentioned memory storing computer-readable instructions. In addition, the electronic device 1200 may also include a communication unit 1205, a storage unit 1206, an output unit 1207, an input unit 1208 and an external device 1209, which are also connected to the bus 1204.

[0178] Fig.13 A schematic diagram of a computer-readable storage medium provided in an embodiment of the present disclosure. Fig.13 As shown, a computer-readable storage medium 1300 according to an embodiment of the present disclosure has computer-readable instructions 1301 stored thereon. When the computer-readable instructions 1301 are executed by a processor, the signal transmission method described in any of the foregoing embodiments of the present disclosure is implemented. The computer-readable storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, optical disk, magnetic disk, etc.

[0179] The present disclosure further provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the information processing method described in any of the foregoing embodiments of the present disclosure.

[0180] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0181] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0182] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0183] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0184] Various changes, substitutions, and modifications of the techniques described herein may be made without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and actions described above. Currently existing or later to be developed processes, machines, manufactures, compositions of events, means, methods, or actions that perform substantially the same functions or achieve substantially the same results as the corresponding aspects described herein may be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or actions within their scope.

[0185] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0186] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. An information processing method, characterized in that: The method comprises: Performing event analysis on the real-time network information flow to obtain first event information; Acquire non-real-time information associated with the first event information to obtain second event information; Grouping the second event information to obtain an event information set; Based on the principle of frequent item mining, the event information set is subjected to root cause location and / or situation analysis.

2. The method according to claim 1, characterized in that The acquiring of the non-real-time information associated with the first event information to obtain the second event information includes: Determine variable definition information corresponding to the first event information; Based on the variable definition information, acquiring the non-real-time information through a non-real-time data interface; The first event information is associated with the non-real-time information to obtain the second event information.

3. The method according to claim 2, characterized in that The associating the first event information with the non-real-time information to obtain the second event information includes: The non-real-time information is used as a configurable attribute of the first event information to perform information association to obtain the second event information; and / or, Configuring the non-real-time information as supplementary alarm information of the first event information to obtain the second event information; The supplementary alarm information includes: a single independent alarm information, sub-alarm information corresponding to the original root alarm, and sub-alarm information corresponding to the new root alarm.

4. The method according to claim 1, characterized in that: The method further comprises at least one of the following: Based on the second event information, update the event flow list; Display the event flow list; The event flow list is used to maintain the first event information and / or the second event information; The event flow list includes at least one event information; any one of the event information includes at least one of the following: alarm type, alarm time, alarm content, alarm attribute, and identification information.

5. The method according to claim 1, characterized in that The performing event grouping on the second event information to obtain an event information set includes: Based on a preconfigured grouping rule, grouping the second event information into groups to obtain the event information set; The grouping rules are configured based on various attribute dimensions of the root alarm information.

6. The method according to claim 5, characterized in that The method further comprises: Displaying the grouping rule; The grouping rules include: sequence set grouping rules and frequent item set division rules; or sequence set grouping rules.

7. The method according to any one of claims 1 to 6, characterized in that: The root cause location and / or situation analysis of the event information set based on the frequent item mining principle includes: Acquire sequence feature data in the event information set; Based on the frequent item mining principle, the sequence feature data is mined and sorted for frequent items to obtain a first frequent item set list corresponding to the event information set; Based on the number of events in each frequent itemset and the support of the itemset, statistical data of each event in the first frequent itemset list is counted; Simplifying the first frequent item set list based on the statistical data to obtain a second frequent item set list; Determine the root cause event voting count and / or situation analysis voting count of the second frequent item set list to obtain a voting count result; Based on the voting counting results, the root cause event and / or situation analysis results are determined.

8. The method according to claim 7, characterized in that The frequent item mining and sorting of the sequence feature data based on the frequent item mining principle to obtain a first frequent item set list corresponding to the event information set includes: Based on the frequent item mining principle, using the support condition corresponding to the event information set and the sequence feature data, determining a third frequent item set list; The frequent itemsets are sorted based on the first appearance time of each frequent itemset in the third frequent itemset list to obtain the first frequent itemset list.

9. The method according to claim 7, characterized in that: The counting of the statistical data of each event in the first frequent item set list based on the number of events in each frequent item set and the item set support includes: For any frequent item set in the first frequent item set list, determining whether the frequent item set is a subset of the determined item set; When the frequent item set is a subset of the determined item set, for any event in the frequent item set, statistical data between the event and each subset are counted; The statistical data includes at least one of the following: a first count of events occurring in each subset, a second count of events not occurring in each subset, the number of subsets, and the number of subsets with the same first item.

10. The method according to claim 7, characterized in that The simplifying the first frequent item set list based on the statistical data to obtain a second frequent item set list includes: For any event, when the statistical data meets the first condition, the event is discarded; The first condition includes: the first count is greater than a first preset multiple, and the third count is greater than a second preset multiple; wherein the third count is related to discarding the frequent item set of the event.

11. The method according to claim 7, characterized in that The step of determining the root cause event voting count and / or situation analysis voting count of the second frequent item set list to obtain the voting count result includes: Based on a preset first rule, voting and counting the events in the second frequent item set list are performed to obtain the voting and counting result, wherein the first rule includes: a root cause event voting rule and / or a situation analysis voting rule; and / or, Obtain the result of the user's voting and counting process on the events in the second frequent item set list.

12. The method according to claim 11, characterized in that The first rule also includes: a positioning analysis and determination condition; wherein the positioning analysis and determination condition is obtained based on the root cause event voting result and / or the situation analysis and determination voting result.

13. The method according to claim 7, characterized in that The method further comprises: Displays root cause events and / or situation analysis results.

14. An information processing device, characterized in that: The device comprises: An information analysis module, used for performing event analysis on the real-time network information flow to obtain first event information; An information acquisition module, used for obtaining the non-real-time information associated with the first event information, and obtaining the second event information; An event grouping module, used for grouping the second event information to obtain an event information set; The judgment and analysis module is used to locate the root cause and / or conduct situation judgment and analysis on the event information set based on the principle of frequent item mining.

15. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the method according to any one of claims 1 to 13.

16. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 13 is implemented.

17. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 13 is implemented.

Images