Alarm analysis method and device, computer equipment and readable storage medium

Abstract

The invention relates to an alarm analysis method and device, computer equipment and a readable storage medium. The method comprises the steps of determining an analysis data set, performing clustering analysis based on the analysis data set to obtain clustering results of the analysis data set under a plurality of clustering dimensions, and performing correlation analysis on the clustering results under each clustering dimension to obtain an alarm analysis result under the condition that a preset condition is met. Wherein the analysis data set comprises alarm data of each network element and log data corresponding to each alarm data. Alarm analysis can be carried out on the network element by adopting the method.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to an alarm analysis method, apparatus, computer equipment and readable storage medium. Background Art

[0002] In the communications field, network elements continuously generate massive amounts of alarm data, and the huge amount of alarm data poses severe challenges to subsequent processing and analysis.

[0003] Taking the SDWAN (Software-Defined Wide Area Network) architecture based on software control and virtualization technology as an example, SDWAN is a virtual private network (VPN) technology that applies software-defined networking (SDN) technology to the WAN (Wide Area Network) scenario. SDWAN provides enterprises with intelligent network traffic management, multi-link load balancing, security reinforcement, application optimization, flexible network architecture and unified management platform capabilities to help enterprises build efficient, secure and reliable enterprise networks. However, with continuous development, the number of monitoring data and alarms of network elements in SDWAN is also increasing.

[0004] Therefore, how to propose an alarm analysis method is an important technical issue in this field. Summary of the invention

[0005] Based on this, it is necessary to provide an alarm analysis method, device, computer equipment and readable storage medium that can perform alarm analysis on network elements in response to the above technical problems.

[0006] In a first aspect, the present application provides an alarm analysis method, comprising:

[0007] Determine an analysis data set; the analysis data set includes alarm data of each network element and log data corresponding to each alarm data;

[0008] Perform cluster analysis based on the analysis data set to obtain clustering results of the analysis data set under multiple clustering dimensions;

[0009] When the preset conditions are met, correlation analysis is performed on the clustering results under each clustering dimension to obtain the alarm analysis results.

[0010] In one embodiment, cluster analysis is performed based on the analysis data set to obtain clustering results of the analysis data set under multiple clustering dimensions, including:

[0011] According to the analysis data set, determining each data vector in the analysis data set;

[0012] Cluster analysis is performed on each data vector to obtain the clustering results under each clustering dimension.

[0013] In one embodiment, cluster analysis is performed on each data vector to obtain clustering results under multiple clustering dimensions, including:

[0014] According to each data vector, determine the current cluster center corresponding to each cluster dimension;

[0015] Determine the current clustering result corresponding to each clustering dimension according to the current cluster center corresponding to each data vector and each clustering dimension;

[0016] According to the current clustering result corresponding to each clustering dimension, the clustering result under each clustering dimension is determined.

[0017] In one embodiment, according to the current clustering result corresponding to each clustering dimension, determining the clustering result under each clustering dimension includes:

[0018] According to the current clustering results corresponding to each clustering dimension, the current clustering center corresponding to each clustering dimension is updated to obtain a new clustering center corresponding to each clustering dimension;

[0019] The new cluster center is used as the current cluster center, and the current cluster center corresponding to each data vector and each cluster dimension is returned to determine the current clustering result corresponding to each clustering dimension, until a stopping condition is met, and the current clustering result corresponding to each clustering dimension when the stopping condition is met is used as the clustering result under each clustering dimension.

[0020] In one embodiment, the method further comprises:

[0021] In the case where the preset conditions are not met, the step of performing cluster analysis based on the analysis data set to obtain clustering results of the analysis data set under multiple clustering dimensions is returned until the preset conditions are met.

[0022] In one embodiment, the method further comprises:

[0023] Determine clustering evaluation parameters for each clustering result;

[0024] According to the clustering evaluation parameters and preset thresholds of each clustering result, it is determined whether the preset conditions are met.

[0025] In a second aspect, the present application also provides an alarm analysis device, comprising:

[0026] A first determination module is used to determine an analysis data set; the analysis data set includes alarm data of each network element and log data corresponding to each alarm data;

[0027] A clustering module is used to perform cluster analysis based on the analysis data set to obtain clustering results of the analysis data set under multiple clustering dimensions;

[0028] The analysis module is used to perform correlation analysis on each clustering result to obtain an alarm analysis result when the preset conditions are met.

[0029] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any of the above methods when executing the computer program.

[0030] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of any of the above methods when executed by a processor.

[0031] In a fifth aspect, the present application also provides a computer program product, including a computer program, which implements the steps of any of the above methods when executed by a processor.

[0032] The above-mentioned alarm analysis method, device, computer equipment and readable storage medium can determine the analysis data set, and the analysis data set includes the alarm data of each network element and the log data corresponding to each alarm data. Therefore, cluster analysis can be performed based on the analysis data set to efficiently obtain the clustering results of the analysis data set under multiple clustering dimensions. Furthermore, when the preset conditions are met, correlation analysis of the clustering results under each clustering dimension can obtain more accurate alarm analysis results with the support of the clustering results of multiple clustering dimensions, so as to achieve the purpose of alarm analysis on the network element. Furthermore, the alarm analysis results can not only help engineers quickly locate the cause of the fault and shorten the fault handling time, but also further evaluate the performance of the network, realize early warning and prevention of potential faults, and thus improve the security, stability and efficiency of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0034] FIG1 is a diagram of an application environment of an alarm analysis method according to an embodiment;

[0035] Figure 2 A flowchart of an alarm analysis method in one embodiment;

[0036] Figure 3 A schematic diagram of a process for obtaining a clustering result in one embodiment;

[0037] Figure 4 A schematic diagram of another process of obtaining a clustering result in an embodiment;

[0038] Figure 5 A schematic diagram of another process of obtaining a clustering result in an embodiment;

[0039] Figure 6 A schematic diagram of a cluster analysis process in one embodiment;

[0040] Figure 7 A schematic diagram of a process for determining whether a preset condition is met in one embodiment;

[0041] Figure 8 A process diagram of an alarm analysis method in an embodiment;

[0042] Fig. 9 A process diagram of yet another alarm analysis method in an embodiment;

[0043] Fig.10 FIG. 4 is a structural block diagram of an alarm analysis device in an embodiment. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0045] SDWAN deploys customer premise equipment (CPE) at the branch site of the enterprise. Through the controller in SDWAN and the Internet link or the local low-cost dedicated line, an SDWAN tunnel is created between the CPE and the network service provider point (POP) gateway, thereby introducing the traffic of the enterprise branch site into the operator's POP network. The POP reflects the enterprise's private network to other CPEs, realizing low-cost branch site interconnection. In the process of service implementation, the controller in SDWAN sends configurations to CPE and POP. At the same time, CPE and POP also need to send the response information configured by the controller and other information required for network operation and maintenance. CPE and POP are collectively referred to as network elements, and alarm information is mostly reflected in network element configuration errors and network element offline. For the SDWAN platform, with the increase in the number of monitoring data and alarms, how to quickly obtain timely and effective alarms and mine valuable information from massive data to optimize products is a major problem. Based on this, it is necessary to provide an alarm analysis method, which will be introduced below.

[0046] FIG. 1 is an application environment diagram of an alarm analysis method in an embodiment. In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG. The computer device includes a processor, a memory, an input / output interface (I / O for short) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store relevant data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, an alarm analysis method is implemented.

[0047] Those skilled in the art will understand that the structure shown in FIG. 1 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0048] This embodiment uses the method applied to a server as an example for illustration. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. The terminal can be, but is not limited to, various personal computers, laptops, smart phones, and tablet computers. The server can be implemented as an independent server or a server cluster consisting of multiple servers.

[0049] Figure 2 FIG. 1 is a flow chart of an alarm analysis method in an embodiment. In an exemplary embodiment, as shown in FIG. Figure 2 As shown, an alarm analysis method is provided, which is described by taking the method applied to the computer device in FIG. 1 as an example, and includes the following S201 to S203.

[0050] S201, determining an analysis data set; the analysis data set includes alarm data of each network element and log data corresponding to each alarm data.

[0051] In this embodiment, the analysis data set includes the alarm data of each network element and the log data corresponding to each alarm data. The basic unit in the network element communication network will be taken as an example below, and it can be understood that the network elements in this embodiment can also be network elements in other network architectures, and this embodiment is not limited to this.

[0052] The alarm data of the network element is used to record the alarm status of the network element. The alarm data includes but is not limited to at least one of the alarm time, alarm type, service type, configuration type, alarm number, and alarm frequency. Among them, the service type refers to the service type of the network element when the alarm occurs, and the configuration type refers to the type configured by the network element when the alarm occurs.

[0053] The log data corresponding to the alarm data is the log data in the vicinity of the alarm time. For example, the computer device may first obtain the alarm data of each network element, and obtain the log data in the first time range where the alarm time is located according to the alarm time corresponding to the alarm data. The first time range may be set as required, and this embodiment does not limit it.

[0054] The log data is used to record the events, operations, and state changes of the network elements. The log data may include the log data of each network element, or the log data of the controller corresponding to each network element, which is not limited in this embodiment.

[0055] Further, the computer device may determine the analysis data set. Optionally, the computer device may obtain the analysis data set sent by the SDWAN platform, or may obtain the initial data set, and obtain the analysis data set after preprocessing the initial data set. The preprocessing includes but is not limited to data cleaning processing or screening processing.

[0056] Exemplarily, the computer device may use the alarm data of each network element as the original data set, count the number of alarms by service type, and then add the log data in the vicinity of the alarm time to the data set to form an analysis data set.

[0057] S202: Perform cluster analysis based on the analysis data set to obtain clustering results of the analysis data set under multiple clustering dimensions.

[0058] In this embodiment, the clustering dimension refers to the dimension that needs to cluster the analysis data set, which can be set according to the requirements. The following will take the clustering dimension including alarm time, alarm number, business type, and configuration type as an example.

[0059] Optionally, the computer device can perform cluster analysis on the analysis data set by using a preset clustering algorithm, and divide each data in the analysis data set into a corresponding clustering dimension to obtain the clustering results of the analysis data set under multiple clustering dimensions. The clustering results include which clustering dimension each alarm data in the analysis data set and the corresponding log data belong to. The preset clustering algorithms include, but are not limited to, a density-based spatial clustering of applications with noise (DBSCAN algorithm), a clustering algorithm based on a Gaussian mixture model, a K-medoids clustering algorithm, or a K-means clustering algorithm.

[0060] S203: When a preset condition is met, a correlation analysis is performed on the clustering results under each clustering dimension to obtain an alarm analysis result.

[0061] In this embodiment, after obtaining the clustering results under each clustering dimension, the computer device will further determine whether the preset conditions are met. The preset conditions are used to trigger the correlation analysis. The preset conditions can be set according to the requirements.

[0062] Optionally, the computer device may determine that the preset condition is satisfied when all clustering results satisfy the requirement, or may determine that the preset condition is satisfied when a preset number of clustering results satisfy the requirement. Further optionally, the computer device may determine whether each clustering result satisfies the requirement by the clustering degree of the clustering result.

[0063] When the preset conditions are met, it means that the clustering effect of the clustering results under each clustering dimension is good. Therefore, the computer device can further perform correlation analysis on the clustering results under each clustering dimension to obtain an alarm analysis result. This embodiment does not limit the form of the alarm analysis result, which can be in the form of text or image.

[0064] In one embodiment, the computer device may output the alarm analysis result, for example, may display the alarm analysis result, or push the alarm analysis result to the user in the form of a file.

[0065] Optionally, the computer device can display the clustering results under each clustering dimension through a preset chart, so as to perform correlation analysis on the clustering results under each clustering dimension to obtain an alarm analysis result, and the alarm analysis result includes a preset chart. The preset chart includes but is not limited to a cross table and a scatter plot. In this way, the user can observe the distribution of the analysis data set in different clustering dimensions through the preset chart.

[0066] Optionally, the computer device may input the clustering results under each clustering dimension into a trained analysis model, so that the analysis model performs correlation analysis based on the clustering results under each clustering dimension and outputs an alarm analysis result, which may include potential relationships between clustering results of different clustering dimensions.

[0067] In some embodiments, the computer device may first display the clustering results through a preset chart, and then perform a correlation analysis on the preset chart to obtain an alarm analysis result. The alarm analysis result may include the preset chart, and may also include the potential relationship between the clustering results of different clustering dimensions determined based on the preset chart.

[0068] For example, taking the alarm analysis result including "2023-05-24 Resource pool A has 5 alarm type A" as an example, the user can use the alarm analysis result to specifically check the stability of the resource pool A configuration and analyze logical problems or performance problems.

[0069] Taking the alarm analysis result including "Alarm type B occurs in resource pool B at 2023-04-27 10:00:01 and 2023-05-24 17:10:10" as an example, users can use the alarm analysis result to analyze the log data between the two occurrences of alarm type B on the same interface, and more quickly locate the possible impact of other configurations during the period and the configuration type dependency relationship between the two alarms.

[0070] In the above alarm analysis method, since the analysis data set can be determined, and the analysis data set includes the alarm data of each network element and the log data corresponding to each alarm data, cluster analysis can be performed based on the analysis data set to efficiently obtain the clustering results of the analysis data set under multiple clustering dimensions. Furthermore, under the condition of meeting the preset conditions, correlation analysis of the clustering results under each clustering dimension can obtain more accurate alarm analysis results with the support of the clustering results of multiple clustering dimensions, so as to achieve the purpose of alarm analysis on the network element. Furthermore, the alarm analysis results can not only help engineers quickly locate the cause of the fault and shorten the fault handling time, but also further evaluate the performance of the network, realize early warning and prevention of potential faults, and thus improve the security, stability and efficiency of the network.

[0071] Figure 3 FIG. 1 is a flow chart of obtaining a clustering result in an embodiment. In an exemplary embodiment, as shown in FIG. Figure 3 As shown, S202 includes S301 to S302.

[0072] S301, determining each data vector in the analysis data set according to the analysis data set.

[0073] S302: Perform cluster analysis on each data vector to obtain clustering results under each clustering dimension.

[0074] In this embodiment, optionally, the computer device may perform vectorization processing on the analysis data set to determine each data vector in the analysis data set.

[0075] Furthermore, after obtaining each data vector in the analysis data set, the computer device can perform cluster analysis on each data vector to obtain clustering results under each clustering dimension. For example, the computer device can perform cluster analysis on each data vector in the analysis data set by using a preset clustering algorithm, and divide each data vector in the analysis data set into corresponding clustering dimensions to obtain clustering results of the analysis data set under multiple clustering dimensions. In other words, the clustering results under each clustering dimension include the data vector under the clustering dimension.

[0076] In the above embodiment, since each data vector in the analysis data set is determined according to the analysis data set, clustering results under each clustering dimension can be efficiently obtained by performing cluster analysis on each data vector.

[0077] Figure 4 FIG. 1 is a flow chart of another method for obtaining a clustering result in an embodiment. In an exemplary embodiment, as shown in FIG. Figure 4 As shown, S302 includes S401 to S403.

[0078] S401, determining the current cluster center corresponding to each cluster dimension according to each data vector.

[0079] In this embodiment, optionally, the computer device can randomly select the current cluster center from each data vector, and the computer device can also determine the current cluster center corresponding to each cluster dimension from each data vector based on the user's input. Of course, the computer device can also determine the current cluster center corresponding to each cluster dimension based on each data vector in other ways, and this embodiment does not impose any restrictions.

[0080] Exemplarily, the computer device may select K data vectors from each data vector as the current cluster center corresponding to each cluster dimension. In other words, initially, the current cluster center corresponding to each cluster dimension includes K data vectors, where K is an integer greater than 0. It should be noted that the current cluster centers corresponding to each cluster dimension may be the same, different, or partially the same.

[0081] S402, determining a current clustering result corresponding to each clustering dimension according to each data vector and the current cluster center corresponding to each clustering dimension.

[0082] In this embodiment, optionally, the computer device may determine the current clustering result corresponding to each clustering dimension based on the distance between each data vector and the current cluster center corresponding to each clustering dimension.

[0083] Further optionally, for each data vector in the analysis data set, the computer device can determine the distance between the data vector and the current cluster center corresponding to each clustering dimension, and assign the data vector to the clustering dimension with the nearest distance to update the current clustering result corresponding to the clustering dimension, until all data vectors in the analysis data set are assigned, and the current clustering result corresponding to each clustering dimension is obtained.

[0084] S403: Determine the clustering results under each clustering dimension according to the current clustering result corresponding to each clustering dimension.

[0085] In this embodiment, optionally, the computer device can directly use the current clustering result corresponding to each clustering dimension as the clustering result under each clustering dimension. The computer device can also update the current clustering center corresponding to each clustering dimension according to the current clustering result corresponding to each clustering dimension, and return to step S402 to determine the clustering result under each clustering dimension. This embodiment does not impose any restrictions.

[0086] In the above embodiment, since the current cluster center corresponding to each clustering dimension can be determined based on each data vector, therefore, based on the current cluster center corresponding to each data vector and each clustering dimension, each data vector can be clustered and analyzed to obtain the current clustering result corresponding to each clustering dimension. Furthermore, based on the current clustering result corresponding to each clustering dimension, the clustering result under each clustering dimension can be determined efficiently and accurately.

[0087] Figure 5 FIG. 1 is a flow chart of another method for obtaining a clustering result in an embodiment. In an exemplary embodiment, as shown in FIG. Figure 5 As shown, S403 includes S501 to S502.

[0088] S501: According to the current clustering results corresponding to each clustering dimension, the current cluster centers corresponding to each clustering dimension are updated to obtain new cluster centers corresponding to each clustering dimension.

[0089] In this embodiment, the computer device can obtain the current clustering result corresponding to each clustering dimension after S402. Then, the computer device will update the current clustering center corresponding to each clustering dimension according to the current clustering result corresponding to each clustering dimension to obtain a new clustering center corresponding to each clustering dimension.

[0090] Optionally, the computer device may update the current cluster center corresponding to each cluster dimension according to the centroid of the current clustering result corresponding to each cluster dimension, and obtain a new cluster center corresponding to each cluster dimension.

[0091] Optionally, for each clustering dimension, the computer device may also calculate the mean of all data vectors in the current clustering result corresponding to the clustering dimension, and update the current cluster center corresponding to each clustering dimension according to the mean to determine a new cluster center corresponding to the clustering dimension. For example, the computer device may directly use the mean as the new cluster center corresponding to the clustering dimension.

[0092] S502, taking the new cluster center as the current cluster center, returning the current cluster center corresponding to each data vector and each cluster dimension, and determining the current cluster result corresponding to each cluster dimension, until the stopping condition is met, and taking the current cluster result corresponding to each cluster dimension when the stopping condition is met as the cluster result under each cluster dimension.

[0093] In this embodiment, the computer device uses the new cluster center obtained in S501 as the current cluster center, and returns to step S402, so that the computer device determines the current cluster result corresponding to each cluster dimension according to the current cluster center corresponding to each data vector and each cluster dimension, and updates the current cluster center corresponding to each cluster dimension according to the current cluster result corresponding to each cluster dimension, and obtains the new cluster center corresponding to each cluster dimension, and repeats this process until the stop condition is met. It can be understood that since the current cluster center has changed, the current cluster result obtained after returning to step S402 will also change.

[0094] The stopping condition can be set as required. For example, the stopping condition can be that the number of iterations of the current cluster center reaches a preset number, or the difference between the new cluster center and the current cluster center is less than a preset difference, for example, the new cluster center and the current cluster center no longer change.

[0095] Furthermore, when the stopping condition is met, the computer device will directly use the current clustering result corresponding to each clustering dimension when the stopping condition is met as the clustering result under each clustering dimension.

[0096] The following is an introduction combined with an example. Assuming that the stopping condition is that the number of iterations reaches 3, for one of the clustering dimensions, the computer device first determines the current clustering center of the clustering dimension based on the data vectors in the analysis data set, recorded as clustering center A, and determines the current clustering result corresponding to the clustering dimension based on each data vector and clustering center A, recorded as current clustering result A.

[0097] Furthermore, the computer device will update the cluster center A according to the current clustering result A, and obtain a new cluster center corresponding to the clustering dimension, which is recorded as cluster center B.

[0098] Afterwards, cluster center B is used as the current cluster center, and the process returns to step S402, where the computer device determines the current clustering result corresponding to the clustering dimension based on each data vector and cluster center B, which is recorded as current clustering result B.

[0099] Furthermore, the computer device will update the cluster center B according to the current clustering result B to obtain a new cluster center corresponding to the clustering dimension, which is recorded as cluster center C.

[0100] Afterwards, the cluster center C is used as the current cluster center, and the process returns to step S402, so that the computer device determines the current clustering result corresponding to the clustering dimension according to each data vector and the cluster center C, which is recorded as the current clustering result C.

[0101] Furthermore, the computer device will update the cluster center C according to the current clustering result C to obtain a new cluster center corresponding to the clustering dimension, recorded as cluster center D. At this time, the stopping condition has been met, and the computer device determines the current clustering result corresponding to the clustering dimension according to each data vector and the cluster center D, recorded as cluster result D, and then uses the clustering result D as the clustering result of the clustering dimension.

[0102] It should be noted that the clustering results under each clustering dimension can be calculated separately or simultaneously. The stop conditions of each clustering dimension can be the same or different, which is not limited in this embodiment.

[0103] In the above embodiment, according to the current clustering results corresponding to each clustering dimension, the current cluster center corresponding to each clustering dimension is updated to obtain a new cluster center corresponding to each clustering dimension, and the new cluster center is used as the current cluster center, and the step of determining the current clustering result corresponding to each clustering dimension according to the current cluster center corresponding to each data vector and each clustering dimension is returned until the stopping condition is met, and the current clustering result corresponding to each clustering dimension when the stopping condition is met is used as the clustering result under each clustering dimension. In this way, the clustering results under each clustering dimension can be determined more accurately in the process of continuous iterative updating.

[0104] In order to more clearly introduce the cluster analysis process of this application, Figure 6 Provide explanation. Figure 6 FIG. 1 is a flow chart of cluster analysis in one embodiment. In an exemplary embodiment, as shown in FIG. Figure 6 As shown, the computer device is first initialized, determines the number of clusters K, and randomly selects K data vectors in the analysis data set as the current cluster center of each cluster dimension. After that, the computer device allocates data vectors. In the process of allocating data vectors, the computer device calculates the distance from each data vector in the analysis data set to each current cluster center, and allocates the data vector to the nearest current cluster center to obtain the current cluster result of each cluster dimension. It can be understood that the current cluster result corresponding to each cluster dimension is a cluster. Furthermore, the computer device determines a new cluster center for the cluster result corresponding to each cluster dimension, and determines whether the stop condition is met. If the stop condition is met, the current cluster result when the stop condition is met is used as the cluster result of the cluster dimension. If the stop condition is not met, return to the step of allocating data vectors until the stop condition is met.

[0105] In an exemplary embodiment, optionally, the above alarm analysis method further includes the following steps:

[0106] In the case where the preset conditions are not met, the step of performing cluster analysis based on the analysis data set to obtain clustering results of the analysis data set under multiple clustering dimensions is returned until the preset conditions are met.

[0107] In this embodiment, the computer device may determine that the preset condition is not satisfied when all clustering results do not satisfy the requirement, or may determine that the preset condition is not satisfied when a preset number of clustering results do not satisfy the requirement.

[0108] Furthermore, when the preset condition is not met, it means that the clustering effect is not good enough, so the computer device will return to step S202 until the preset condition is met.

[0109] It should be noted that, when the computer device returns to step S202 , it may re-determine the clustering results of all clustering dimensions, or may re-determine the clustering results of only some clustering dimensions.

[0110] In the above embodiment, since it is possible to return to the step of performing cluster analysis based on the analysis data set to obtain clustering results of the analysis data set under multiple clustering dimensions when the preset conditions are not met until the preset conditions are met, the preset conditions can be used to flexibly trigger whether to re-perform cluster analysis, thereby improving the accuracy of the clustering results.

[0111] Figure 7 FIG. 1 is a flow chart of determining whether a preset condition is satisfied in an embodiment. In an exemplary embodiment, Figure 7 As shown, the above alarm analysis method also includes S701 to S702.

[0112] S701, determining clustering evaluation parameters of each clustering result.

[0113] In this embodiment, the clustering evaluation parameter characterizes the clustering effect of the clustering result. The clustering evaluation parameter includes but is not limited to the silhouette coefficient or the Davies-Bouldin index (DBI).

[0114] The following example uses the clustering evaluation parameter including the Within - Cluster Sum of Squares (WCSS) as an example. The computer device can calculate the sum of squares of the distance between each data vector in the clustering result and its corresponding cluster center as the Within - Cluster Sum of Squares. The smaller the Within - Cluster Sum of Squares, the denser the data vectors in the clustering result, the higher the similarity in the clustering result, and the better the clustering effect.

[0115] S702: Determine whether a preset condition is met according to the clustering evaluation parameters and the preset threshold of each clustering result.

[0116] In this embodiment, the preset threshold is set according to the demand. Optionally, the computer device can determine that the preset condition is met when the clustering evaluation parameter of at least one clustering result is less than the preset threshold. The computer device can also determine that the preset condition is met when the clustering evaluation parameters of all clustering results are less than the preset threshold.

[0117] In the above embodiment, since the clustering evaluation parameters of each clustering result can be determined, and whether the preset conditions are met is determined based on the clustering evaluation parameters of each clustering result and the preset threshold, the clustering effect of the clustering results can be efficiently determined through the preset conditions, and when the clustering effect is good, correlation analysis can be performed to obtain the alarm analysis results.

[0118] In order to more clearly introduce the alarm analysis method of this application, Figure 8 and Fig. 9 Provide explanation. Figure 8 FIG. 1 is a process diagram of an alarm analysis method in an embodiment. Figure 8 As shown, the computer device can execute the alarm analysis method according to the following process.

[0119] S801, determining an analysis data set; the analysis data set includes alarm data of each network element and log data corresponding to each alarm data.

[0120] S802: Determine each data vector in the analysis data set according to the analysis data set.

[0121] S803: Determine the current cluster center corresponding to each cluster dimension according to each data vector.

[0122] S804: Determine the current clustering result corresponding to each clustering dimension according to the current cluster center corresponding to each data vector and each clustering dimension.

[0123] S805: According to the current clustering results corresponding to each clustering dimension, the current clustering center corresponding to each clustering dimension is updated to obtain a new clustering center corresponding to each clustering dimension.

[0124] S806, taking the new cluster center as the current cluster center, returning the current cluster center corresponding to each data vector and each cluster dimension, and determining the current cluster result corresponding to each cluster dimension, until the stopping condition is met, and taking the current cluster result corresponding to each cluster dimension when the stopping condition is met as the cluster result under each cluster dimension.

[0125] S807: Determine clustering evaluation parameters for each clustering result.

[0126] S808: Determine whether a preset condition is met according to the clustering evaluation parameters and the preset threshold of each clustering result.

[0127] S809: When the preset conditions are met, a correlation analysis is performed on the clustering results under each clustering dimension to obtain an alarm analysis result.

[0128] S810, when the preset condition is not met, returning to the step of performing cluster analysis based on the analysis data set to obtain clustering results of the analysis data set under multiple clustering dimensions until the preset condition is met.

[0129] The steps of S801 to S810 may refer to the above embodiment and will not be described in detail here.

[0130] Fig. 9 FIG. 1 is a process diagram of another alarm analysis method in an embodiment. Fig. 9 As shown, in an exemplary embodiment, the computer device first performs a data preprocessing process to determine an analysis data set based on the alarm data of each network element and the corresponding log data. Afterwards, the computer device performs a cluster analysis process, in which the computer device selects a K value to perform clustering based on clustering dimensions, for example, cluster analysis is performed based on four clustering dimensions, namely, alarm time, alarm number, service type, and configuration type, to obtain clustering results under each clustering dimension.

[0131] Next, the computer device enters the clustering effect evaluation process. In the clustering effect evaluation process, the computer device will determine whether the preset conditions are met based on the clustering results under each clustering dimension. If the preset conditions are not met, it means that the clustering effect is not good, and the computer device will return to the clustering analysis process and reselect the K value to perform clustering based on the clustering dimension. If the preset conditions are met, the computer device can perform correlation analysis on the clustering results under each clustering dimension to obtain an alarm analysis result.

[0132] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0133] Based on the same inventive concept, the embodiment of the present application also provides an alarm analysis device for implementing the above-mentioned alarm analysis method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in one or more alarm analysis device embodiments provided below can refer to the limitations on the alarm analysis method above, and will not be repeated here.

[0134] Fig.10 FIG. 1 is a structural block diagram of an alarm analysis device in an embodiment. In an exemplary embodiment, as shown in FIG. Fig.10 As shown, an alarm analysis device 1000 is provided, comprising: a first determination module 1001, a clustering module 1002 and an analysis module 1003, wherein:

[0135] The first determination module 1001 is used to determine an analysis data set; the analysis data set includes alarm data of each network element and log data corresponding to each alarm data;

[0136] Clustering module 1002, used to perform cluster analysis based on the analysis data set to obtain clustering results of the analysis data set under multiple clustering dimensions;

[0137] The analysis module 1003 is used to perform correlation analysis on each clustering result to obtain an alarm analysis result when a preset condition is met.

[0138] In the above-mentioned alarm analysis device, since the analysis data set can be determined, and the analysis data set includes the alarm data of each network element and the log data corresponding to each alarm data, therefore, cluster analysis is performed based on the analysis data set, and the clustering results of the analysis data set under multiple clustering dimensions can be efficiently obtained. Furthermore, under the condition of meeting the preset conditions, correlation analysis of the clustering results under each clustering dimension can obtain more accurate alarm analysis results with the support of the clustering results of multiple clustering dimensions, so as to achieve the purpose of alarm analysis on the network element. Furthermore, the alarm analysis results can not only help engineers quickly locate the cause of the fault and shorten the fault handling time, but also further evaluate the performance of the network, realize early warning and prevention of potential faults, and thus improve the security, stability and efficiency of the network.

[0139] Optionally, the clustering module 1002 includes:

[0140] The determination unit is used to determine each data vector in the analysis data set according to the analysis data set.

[0141] The clustering unit is used to perform cluster analysis on each data vector to obtain clustering results under each clustering dimension.

[0142] Optionally, the clustering unit includes:

[0143] The first determination subunit is used to determine the current cluster center corresponding to each cluster dimension according to each data vector.

[0144] The second determination subunit is used to determine the current clustering result corresponding to each clustering dimension according to the current cluster center corresponding to each data vector and each clustering dimension.

[0145] The third determining subunit is used to determine the clustering results under each clustering dimension according to the current clustering result corresponding to each clustering dimension.

[0146] Optionally, a third determination subunit is used to update the current clustering center corresponding to each clustering dimension according to the current clustering result corresponding to each clustering dimension, so as to obtain a new clustering center corresponding to each clustering dimension; taking the new clustering center as the current clustering center, returning the step of determining the current clustering result corresponding to each clustering dimension according to the current clustering center corresponding to each data vector and each clustering dimension, until a stopping condition is met, and taking the current clustering result corresponding to each clustering dimension when the stopping condition is met as the clustering result under each clustering dimension.

[0147] Optionally, the alarm analysis device 1000 further includes:

[0148] The return module is used to return to the step of performing cluster analysis based on the analysis data set to obtain clustering results of the analysis data set under multiple clustering dimensions when the preset conditions are not met, until the preset conditions are met.

[0149] Optionally, the alarm analysis device 1000 further includes:

[0150] The second determination module is used to determine the clustering evaluation parameters of each clustering result.

[0151] The third determination module is used to determine whether a preset condition is met according to the clustering evaluation parameters and the preset threshold of each clustering result.

[0152] Each module in the above alarm analysis device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0153] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0154] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0155] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0156] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0157] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0158] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An alarm analysis method, characterized in that: The method comprises: Determine an analysis data set; the analysis data set includes alarm data of each network element and log data corresponding to each of the alarm data; Performing cluster analysis based on the analysis data set to obtain clustering results of the analysis data set under multiple clustering dimensions; When the preset conditions are met, a correlation analysis is performed on the clustering results under each of the clustering dimensions to obtain an alarm analysis result.

2. The method according to claim 1, characterized in that: The cluster analysis is performed based on the analysis data set to obtain clustering results of the analysis data set under multiple clustering dimensions, including: According to the analysis data set, determining each data vector in the analysis data set; Cluster analysis is performed on each of the data vectors to obtain clustering results under each of the clustering dimensions.

3. The method according to claim 2, characterized in that The performing cluster analysis on each of the data vectors to obtain clustering results under the multiple clustering dimensions includes: Determine the current cluster center corresponding to each cluster dimension according to each of the data vectors; Determine a current clustering result corresponding to each clustering dimension according to each of the data vectors and the current cluster center corresponding to each of the clustering dimensions; According to the current clustering result corresponding to each clustering dimension, the clustering result under each clustering dimension is determined.

4. The method according to claim 3, characterized in that The determining the clustering result under each clustering dimension according to the current clustering result corresponding to each clustering dimension includes: According to the current clustering results corresponding to each clustering dimension, the current clustering center corresponding to each clustering dimension is updated to obtain a new clustering center corresponding to each clustering dimension; The new cluster center is used as the current cluster center, and the current cluster center corresponding to each of the data vectors and each of the cluster dimensions is returned to determine the current clustering result corresponding to each of the clustering dimensions, until a stopping condition is met, and the current clustering result corresponding to each of the clustering dimensions when the stopping condition is met is used as the clustering result under each of the clustering dimensions.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: If the preset condition is not met, return to the step of performing cluster analysis based on the analysis data set to obtain clustering results of the analysis data set under multiple clustering dimensions until the preset condition is met.

6. The method according to claim 5, characterized in that The method further comprises: Determining clustering evaluation parameters for each of the clustering results; Determine whether the preset condition is met according to the clustering evaluation parameter and the preset threshold of each clustering result.

7. An alarm analysis device, characterized in that: The device comprises: A first determination module is used to determine an analysis data set; the analysis data set includes alarm data of each network element and log data corresponding to each of the alarm data; A clustering module, used to perform cluster analysis based on the analysis data set to obtain clustering results of the analysis data set under multiple clustering dimensions; The analysis module is used to perform correlation analysis on each of the clustering results to obtain an alarm analysis result when a preset condition is met.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images