Alarm analysis method and device, computer device and readable storage medium

Abstract

The application relates to an alarm analysis method and device, computer equipment and a readable storage medium. The method comprises the following steps: determining an analysis data set, performing clustering analysis based on the analysis data set, obtaining clustering results of the analysis data set in multiple clustering dimensions, and performing correlation analysis on the clustering results in each clustering dimension to obtain an alarm analysis result under the condition that a preset condition is met. The analysis data set comprises alarm data of each network element and log data corresponding to each alarm data. The method can be used for alarm analysis of the network element.

Description

TECHNICAL FIELD

[0001] The present application relates to the network technical field, in particular to an alarm analysis method and device, computer equipment and readable storage medium. BACKGROUND

[0002] In the communication field, network elements continuously generate a large amount of alarm data, and the large-scale alarm data brings a severe challenge for subsequent processing and analysis.

[0003] Taking a software control and virtualization technology-based wide area network architecture (Software-Defined Wide Area Network, SDWAN) as an example, the SDWAN is a virtual private network (Virtual Private Network, VPN) technology that applies software-defined networking (Software-Defined Networking, SDN) technology to a wide area network (Wide Area Network, WAN) scenario. The SDWAN provides intelligent network traffic management, multi-link load balancing, security reinforcement, application optimization, flexible network architecture, and unified management platform for enterprises, and helps enterprises build efficient, secure, and reliable enterprise networks. However, with continuous development, the monitoring data and alarm quantity of network elements in the SDWAN also increase.

[0004] Therefore, how to propose an alarm analysis method is an important technical problem in the field. SUMMARY

[0005] Therefore, it is necessary to provide an alarm analysis method, device, computer equipment, and readable storage medium capable of performing alarm analysis on network elements in view of the above technical problems.

[0006] In a first aspect, the present application provides an alarm analysis method, comprising:

[0007] determining an analysis data set; the analysis data set comprises alarm data of each network element and log data corresponding to each alarm data;

[0008] performing clustering analysis based on the analysis data set to obtain clustering results of the analysis data set in multiple clustering dimensions;

[0009] In the case of meeting a preset condition, performing correlation analysis on the clustering results in each clustering dimension to obtain an alarm analysis result.

[0010] In one of the embodiments, performing clustering analysis based on the analysis data set to obtain clustering results of the analysis data set in multiple clustering dimensions comprises:

[0011] determining each data vector in the analysis data set according to the analysis data set;

[0012] performing cluster analysis on each data vector to obtain a cluster result in each cluster dimension.

[0013] In one embodiment, the cluster analysis on each data vector obtains a cluster result in each cluster dimension, including:

[0014] determining a current cluster center corresponding to each cluster dimension according to each data vector;

[0015] determining a current cluster result corresponding to each cluster dimension according to each data vector and the current cluster center corresponding to each cluster dimension;

[0016] determining a cluster result in each cluster dimension according to the current cluster result corresponding to each cluster dimension.

[0017] In one embodiment, the determination of the cluster result in each cluster dimension according to the current cluster result corresponding to each cluster dimension includes:

[0018] updating the current cluster center corresponding to each cluster dimension according to the current cluster result corresponding to each cluster dimension to obtain a new cluster center corresponding to each cluster dimension;

[0019] returning to the step of determining a current cluster result corresponding to each cluster dimension according to each data vector and the current cluster center corresponding to each cluster dimension, with the new cluster center as the current cluster center, until a current cluster result corresponding to each cluster dimension when a stop condition is met is taken as the cluster result in each cluster dimension in the case of meeting the stop condition.

[0020] In one embodiment, the method further includes:

[0021] returning to the step of performing cluster analysis on the analysis data set to obtain a cluster result of the analysis data set in multiple cluster dimensions based on the analysis data set in the case of not meeting a preset condition until the preset condition is met.

[0022] In one embodiment, the method further includes:

[0023] determining a cluster evaluation parameter of each cluster result;

[0024] determining whether a preset condition is met according to the cluster evaluation parameter of each cluster result and a preset threshold.

[0025] In a second aspect, the application further provides an alarm analysis device, including:

[0026] The first determining module is configured to determine an analysis data set; the analysis data set comprises alarm data of each network element and log data corresponding to each alarm data;

[0027] The clustering module is configured to perform clustering analysis based on the analysis data set to obtain clustering results of the analysis data set in multiple clustering dimensions;

[0028] The analysis module is configured to perform correlation analysis on each clustering result to obtain an alarm analysis result when a preset condition is met.

[0029] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any of the above methods when executing the computer program.

[0030] In a fourth aspect, the present application further provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the steps of any of the above methods.

[0031] In a fifth aspect, the present application further provides a computer program product comprising a computer program, wherein the computer program is executed by a processor to implement the steps of any of the above methods.

[0032] The above alarm analysis method, device, computer device and readable storage medium can determine an analysis data set, and the analysis data set comprises alarm data of each network element and log data corresponding to each alarm data, so that clustering analysis based on the analysis data set can efficiently obtain clustering results of the analysis data set in multiple clustering dimensions. Further, correlation analysis on the clustering results in each clustering dimension can obtain a more accurate alarm analysis result under the support of the clustering results in multiple clustering dimensions when a preset condition is met, so as to achieve the purpose of alarm analysis on the network element. Furthermore, the alarm analysis result can not only help engineers quickly locate the fault cause and shorten the fault processing time, but also further evaluate the performance of the network, implement early warning and prevention for potential faults, and thus improve the security, stability and efficiency of the network. BRIEF DESCRIPTION OF DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the description of the embodiments of the present application or the related art will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0034] Figure 1 It is an application environment diagram of the alarm analysis method in an embodiment.

[0035] Figure 2 a flowchart of a process of an alarm analysis method in an embodiment;

[0036] Figure 3 a flowchart of a process of obtaining clustering results in an embodiment;

[0037] Figure 4 a flowchart of a process of obtaining clustering results in an embodiment;

[0038] Figure 5 a flowchart of a process of obtaining clustering results in an embodiment;

[0039] Figure 6 a flowchart of a process of clustering analysis in an embodiment;

[0040] Figure 7 a flowchart of a process of determining whether a preset condition is met in an embodiment;

[0041] Figure 8 a flowchart of a process of an alarm analysis method in an embodiment;

[0042] Figure 9 a flowchart of a process of an alarm analysis method in an embodiment;

[0043] Figure 10 a block diagram of an alarm analysis apparatus in an embodiment. DETAILED DESCRIPTION

[0044] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not used to limit the present application.

[0045] SDWAN in enterprise branch site deployment user terminal equipment (Customer Premise Equipment, CPE), through the controller in SDWAN and Internet link or local low-cost private line, create SDWAN tunnel between CPE and network service point (Point Of Presence, POP) gateway, so as to introduce the traffic of enterprise branch site into the network of operator POP point, POP will reflect the private network of enterprise to other CPE, realize the low-cost interconnection of branch site. In the process of business implementation, the controller in SDWAN issues configuration to CPE and POP, at the same time, CPE and POP also need to configure the response information of the controller and other network operation information, CPE and POP are collectively referred to as network elements, and the alarm information is mostly reflected in the configuration error and offline of network element. For SDWAN platform, with the increase of monitoring data and alarm quantity, how to quickly obtain timely and effective alarm, and mine valuable information from mass data to optimize the product is a big problem. Based on this, it is necessary to provide an alarm analysis method, which will be introduced below.

[0046] Figure 1 For the application environment diagram of the alarm analysis method in an embodiment, in an exemplary embodiment, a computer device is provided, which can be a server, and its internal structure diagram can be as shown in Figure 1 The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through the system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control ability. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store related data. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with the terminal outside through the network connection. The computer program is executed by the processor to realize an alarm analysis method.

[0047] Those skilled in the art can understand that Figure 1 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or less components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0048] The embodiment takes the method applied to the server as an example. It can be understood that the method can also be applied to the terminal, and can also be applied to a system including the terminal and the server, and is realized through the interaction of the terminal and the server. The terminal can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers. The server can be realized by an independent server or a server cluster composed of multiple servers.

[0049] Figure 2 For a flowchart of the alarm analysis method in an embodiment, in an exemplary embodiment, as shown in Figure 2 , an alarm analysis method is provided. Taking the computer device in Figure 1 as an example, the method is described as follows.

[0050] S201, determining an analysis data set; the analysis data set includes alarm data of each network element and log data corresponding to each alarm data.

[0051] In the embodiment, the analysis data set includes alarm data of each network element and log data corresponding to each alarm data. The network element is a basic unit in the communication network. In the following, each network element in the SDWAN platform will be taken as an example. It can be understood that each network element in the embodiment can also be a network element in other network architectures, and the embodiment is not limited thereto.

[0052] The alarm data of the network element is used to record the alarm situation of the network element. The alarm data includes, but is not limited to, at least one of the alarm time, the alarm type, the service type, the configuration type, the alarm number, and the alarm frequency. The service type refers to the service type of the network element when the alarm occurs, and the configuration type refers to the type configured by the network element when the alarm occurs.

[0053] The log data corresponding to the alarm data is the log data in the range near the alarm time. For example, the computer device can first obtain the alarm data of each network element, and obtain the log data in a first time range in which the alarm time is located according to the alarm time corresponding to the alarm data. The first time range can be set according to requirements, and the embodiment is not limited thereto.

[0054] The log data is used to record the running conditions such as events, operations, and state changes of the network element. The log data can include the log data of each network element, or the log data of the controller corresponding to each network element, and the embodiment is not limited thereto.

[0055] Further, the computer device can determine the analysis data set. Optionally, the computer device can obtain the analysis data set sent by the SDWAN platform, or obtain the initial data set and obtain the analysis data set after preprocessing the initial data set. The preprocessing includes, but is not limited to, data cleaning processing or screening processing.

[0056] For example, a computer device can use the alarm data of each network element as the original dataset, count the number of alarms according to the service type, and then add the log data in the range of the alarm time to the dataset to form an analysis dataset.

[0057] S202, perform cluster analysis based on the analysis dataset to obtain the clustering results of the analysis dataset under multiple clustering dimensions.

[0058] In this embodiment, the clustering dimension refers to the dimension that needs to be clustered in the analysis dataset, which can be set according to requirements. The following will use four dimensions as examples: alarm time, alarm count, service type, and configuration type.

[0059] Optionally, the computer equipment can perform cluster analysis on the analysis dataset using a preset clustering algorithm, dividing each data point in the analysis dataset into a corresponding clustering dimension to obtain the clustering results of the analysis dataset across multiple clustering dimensions. The clustering results include which clustering dimension each alarm data point and its corresponding log data belongs to. Preset clustering algorithms include, but are not limited to, density-based spatial clustering of applications with noise (DBSCAN algorithm), Gaussian mixture model-based clustering algorithms, K-medoids clustering algorithms, or K-means clustering algorithms.

[0060] S203, under the premise of meeting the preset conditions, perform correlation analysis on the clustering results under each clustering dimension to obtain the alarm analysis results.

[0061] In this embodiment, after obtaining the clustering results for each clustering dimension, the computer device further determines whether preset conditions are met. These preset conditions are used to trigger correlation analysis. The preset conditions can be set according to requirements.

[0062] Optionally, the computer device can determine whether the preset conditions are met if all clustering results meet the requirements, or if a preset number of clustering results meet the requirements. Further optionally, the computer device can determine whether each clustering result meets the requirements based on the degree of clustering.

[0063] When the preset condition is met, it indicates that the clustering effect of the clustering result under each clustering dimension is good, and thus the computer device can further perform correlation analysis on the clustering result under each clustering dimension to obtain an alarm analysis result. The present embodiment does not limit the form of the alarm analysis result, which can be in the form of text or in the form of an image.

[0064] In one embodiment, the computer device can output the alarm analysis result, for example, can display the alarm analysis result, or push the alarm analysis result to the user in the form of a file.

[0065] Optionally, the computer device can display the clustering result under each clustering dimension through a preset chart to perform correlation analysis on the clustering result under each clustering dimension to obtain an alarm analysis result, which includes the preset chart. The preset chart includes but is not limited to a cross table and a scatter plot. In this way, the user can observe the distribution of the data set on different clustering dimensions through the preset chart.

[0066] Optionally, the computer device can input the clustering result under each clustering dimension into a trained analysis model to perform correlation analysis based on the clustering result under each clustering dimension by the analysis model, and output an alarm analysis result, which can include the potential relationship between the clustering results of different clustering dimensions.

[0067] In some embodiments, the computer device can first display the clustering result through a preset chart, and then perform correlation analysis on the preset chart to obtain an alarm analysis result, which can include the preset chart, or the potential relationship between the clustering results of different clustering dimensions determined based on the preset chart.

[0068] For example, when the alarm analysis result includes "2023-05-24 Resource pool A appears 5 times alarm type A", the user can check the stability of the configuration of the resource pool A through the alarm analysis result, and analyze the logical problem or performance problem.

[0069] For example, when the alarm analysis result includes "2023-04-27 10:00:01 and 2023-05-24 17:10:10 Resource pool B both appear alarm type B", the user can analyze the log data between the two occurrences of alarm type B of the same interface through the alarm analysis result, and more quickly locate the impact of other configurations during the period and the configuration type dependency relationship between the two alarms.

[0070] In the alarm analysis method, the analysis data set is determined, and the analysis data set includes alarm data of each network element and log data corresponding to each alarm data. Therefore, the clustering analysis is performed based on the analysis data set, and the clustering results of the analysis data set in multiple clustering dimensions are efficiently obtained. Further, the correlation analysis is performed on the clustering results in each clustering dimension under the condition that the preset condition is met. Therefore, the accurate alarm analysis result is obtained with the support of the clustering results in multiple clustering dimensions, so as to achieve the purpose of alarm analysis of the network element. Furthermore, the alarm analysis result can not only help engineers to quickly locate the fault cause and shorten the fault processing time, but also further evaluate the performance of the network, and realize early warning and prevention of potential faults, thereby improving the security, stability and efficiency of the network.

[0071] Figure 3 For a flowchart of obtaining the clustering result in one embodiment, in an exemplary embodiment, as shown in FIG. 2A, S202 includes S301-S302. Figure 3

[0072] S301, determining each data vector in the analysis data set according to the analysis data set.

[0073] S302, performing clustering analysis on each data vector to obtain the clustering result in each clustering dimension.

[0074] In this embodiment, optionally, the computer device can perform vectorization processing on the analysis data set to determine each data vector in the analysis data set.

[0075] Further, after obtaining each data vector in the analysis data set, the computer device can perform clustering analysis on each data vector to obtain the clustering result in each clustering dimension. For example, the computer device can perform clustering analysis on each data vector in the analysis data set by using a preset clustering algorithm, divide each data vector in the analysis data set into a corresponding clustering dimension, and obtain the clustering result of the analysis data set in multiple clustering dimensions. That is, the clustering result in each clustering dimension includes the data vector in the clustering dimension.

[0076] In the above embodiment, each data vector in the analysis data set is determined according to the analysis data set. Therefore, the clustering analysis is performed on each data vector, and the clustering result in each clustering dimension is efficiently obtained.

[0077] Figure 4 For another flowchart of obtaining the clustering result in one embodiment, in an exemplary embodiment, as shown in FIG. 2B, S302 includes S401-S403. Figure 4

[0078] ​​S401, determine the current cluster center corresponding to each cluster dimension according to each data vector.

[0079] In this embodiment, optionally, the computer device can randomly select the current cluster center from each data vector, the computer device can also determine the current cluster center corresponding to each cluster dimension from each data vector according to the input of the user, of course, the computer device can also determine the current cluster center corresponding to each cluster dimension according to each data vector through other manners, this embodiment does not make limitation.

[0080] Exemplarily, the computer device can select K data vectors from each data vector as the current cluster center corresponding to each cluster dimension respectively. In other words, in the initial case, the current cluster center corresponding to each cluster dimension includes K data vectors, and K is an integer greater than 0. It should be noted that the current cluster centers corresponding to each cluster dimension can be the same, different, or partially the same.

[0081] S402, determine the current cluster result corresponding to each cluster dimension according to each data vector and the current cluster center corresponding to each cluster dimension.

[0082] In this embodiment, optionally, the computer device can determine the distance between each data vector and the current cluster center corresponding to each cluster dimension to determine the current cluster result corresponding to each cluster dimension.

[0083] Further optionally, for each data vector in the analysis data set, the computer device can determine the distance between the data vector and the current cluster center corresponding to each cluster dimension, and assign the data vector to the nearest cluster dimension to update the current cluster result corresponding to the cluster dimension, until all data vectors in the analysis data set are assigned, and the current cluster result corresponding to each cluster dimension is obtained.

[0084] S403, determine the cluster result under each cluster dimension according to the current cluster result corresponding to each cluster dimension.

[0085] In this embodiment, optionally, the computer device can directly take the current cluster result corresponding to each cluster dimension as the cluster result under each cluster dimension, or the computer device can update the current cluster center corresponding to each cluster dimension according to the current cluster result corresponding to each cluster dimension, and return to step S402 to determine the cluster result under each cluster dimension, this embodiment does not make limitation.

[0086] In the above embodiment, since the current cluster center corresponding to each cluster dimension can be determined according to each data vector, according to each data vector and the current cluster center corresponding to each cluster dimension, the cluster analysis can be performed on each data vector to obtain the current cluster result corresponding to each cluster dimension, and further, according to the current cluster result corresponding to each cluster dimension, the cluster result under each cluster dimension can be efficiently and accurately determined.

[0087] Figure 5 For another flowchart for obtaining the cluster result in an embodiment, in an exemplary embodiment, as shown in FIG. 5, S403 includes S501-S502. Figure 5

[0088] S501, updating the current cluster center corresponding to each cluster dimension according to the current cluster result corresponding to each cluster dimension to obtain a new cluster center corresponding to each cluster dimension.

[0089] In the present embodiment, the computer device can obtain the current cluster result corresponding to each cluster dimension after S402, and then update the current cluster center corresponding to each cluster dimension according to the current cluster result corresponding to each cluster dimension to obtain a new cluster center corresponding to each cluster dimension.

[0090] Optionally, the computer device can update the current cluster center corresponding to each cluster dimension according to the centroid of the current cluster result corresponding to each cluster dimension to obtain a new cluster center corresponding to each cluster dimension.

[0091] Optionally, for each cluster dimension, the computer device can also calculate the mean of all data vectors in the current cluster result corresponding to the cluster dimension, and update the current cluster center corresponding to each cluster dimension according to the mean to determine the new cluster center corresponding to the cluster dimension. For example, the computer device can directly take the mean as the new cluster center corresponding to the cluster dimension.

[0092] S502, taking the new cluster center as the current cluster center, returning to the step of determining the current cluster result corresponding to each cluster dimension according to each data vector and the current cluster center corresponding to each cluster dimension, until the current cluster result corresponding to each cluster dimension when the stop condition is met is taken as the cluster result under each cluster dimension in the case of meeting the stop condition.

[0093] ​In this embodiment, the computer device takes the new cluster center obtained in S501 as the current cluster center, and returns to the step of S402, so as to determine the current clustering result corresponding to each clustering dimension according to each data vector and the current cluster center corresponding to each clustering dimension by the computer device, and update the current cluster center corresponding to each clustering dimension according to the current clustering result corresponding to each clustering dimension, to obtain the new cluster center corresponding to each clustering dimension, and so on until the stop condition is met. It can be understood that, since the current cluster center has changed, the current clustering result obtained after returning to the step of S402 will also change.

[0094] The stop condition can be set according to requirements. For example, the stop condition can be that the iteration number of the current cluster center reaches a preset number, or the difference between the new cluster center and the current cluster center is less than a preset difference, for example, the new cluster center and the current cluster center no longer change.

[0095] Further, in the case where the stop condition is met, the computer device directly takes the current clustering result corresponding to each clustering dimension when the stop condition is met as the clustering result under each clustering dimension.

[0096] The following is described in combination with an example. It is assumed that the stop condition is that the iteration number reaches 3 times, and for one of the clustering dimensions, the computer device first determines the current cluster center of the clustering dimension according to the analysis of the data vectors in the data set, denoted as cluster center A, and determines the current clustering result corresponding to the clustering dimension according to the data vectors and the cluster center A, denoted as current clustering result A.

[0097] Further, the computer device updates the cluster center A according to the current clustering result A, to obtain the new cluster center corresponding to the clustering dimension, denoted as cluster center B.

[0098] Then, the cluster center B is taken as the current cluster center, and the step of S402 is returned, so as to determine the current clustering result corresponding to the clustering dimension according to the data vectors and the cluster center B by the computer device, denoted as current clustering result B.

[0099] Further, the computer device updates the cluster center B according to the current clustering result B, to obtain the new cluster center corresponding to the clustering dimension, denoted as cluster center C.

[0100] Then, the cluster center C is taken as the current cluster center, and the step of S402 is returned, so as to determine the current clustering result corresponding to the clustering dimension according to the data vectors and the cluster center C by the computer device, denoted as current clustering result C.

[0101] Further, the computer device updates the cluster centers C according to the current clustering result C, to obtain new cluster centers corresponding to the clustering dimension, denoted as cluster centers D. At this time, the stop condition is met, and the computer device determines the current clustering result corresponding to the clustering dimension according to each data vector and the cluster centers D, denoted as clustering result D. Then, the clustering result D is taken as the clustering result of the clustering dimension.

[0102] It should be noted that the clustering result under each clustering dimension can be calculated separately or simultaneously. The stop condition of each clustering dimension can be the same or different, and the embodiment is not limited.

[0103] In the above embodiment, the current cluster centers corresponding to each clustering dimension are updated according to the current clustering result corresponding to each clustering dimension, to obtain new cluster centers corresponding to each clustering dimension. The new cluster centers are taken as the current cluster centers, and the step of determining the current clustering result corresponding to each clustering dimension according to each data vector and the current cluster center corresponding to each clustering dimension is returned, until the current clustering result corresponding to each clustering dimension when the stop condition is met is taken as the clustering result under each clustering dimension. In this way, the clustering result under each clustering dimension can be determined more accurately in the process of continuous iteration and update.

[0104] In order to more clearly introduce the clustering analysis process of the present application, the clustering analysis process of the present application is described in combination with Figure 6 . Figure 6 For a flowchart of the clustering analysis in an embodiment, in an exemplary embodiment, as shown in Figure 6 , the computer device first performs initialization, determines the number of clusters K, and randomly selects K data vectors in the analysis data set as the current cluster centers of each clustering dimension. Then, the computer device assigns data vectors. In the process of assigning data vectors, the computer device calculates the distance from each data vector in the analysis data set to each current cluster center, and assigns the data vector to the nearest current cluster center, to obtain the current clustering result of each clustering dimension. It can be understood that the current clustering result corresponding to each clustering dimension is a cluster. Further, the computer device determines new cluster centers for the clustering result corresponding to each clustering dimension, and judges whether the stop condition is met. If the stop condition is met, the current clustering result when the stop condition is met is taken as the clustering result of the clustering dimension. If the stop condition is not met, the step of assigning data vectors is returned until the stop condition is met.

[0105] In an exemplary embodiment, the above-mentioned alarm analysis method further includes the following steps:

[0106] In a case where the preset condition is not met, returning to the step of performing clustering analysis on the analysis data set to obtain clustering results of the analysis data set in multiple clustering dimensions until the preset condition is met.

[0107] In this embodiment, the computer device can determine that the preset condition is not met in a case where all the clustering results do not meet the requirement, or can determine that the preset condition is not met in a case where a preset number of clustering results do not meet the requirement.

[0108] Further, in a case where the preset condition is not met, it indicates that the clustering effect is not good enough, and therefore the computer device returns to the step S202 until the preset condition is met.

[0109] It should be noted that in the case of returning to the step S202, the computer device can re-determine the clustering results of all the clustering dimensions, or can re-determine the clustering results of only part of the clustering dimensions.

[0110] In the above embodiment, since the step of performing clustering analysis on the analysis data set to obtain clustering results of the analysis data set in multiple clustering dimensions until the preset condition is met is returned in a case where the preset condition is not met, whether to re-perform clustering analysis can be triggered flexibly by the preset condition, and the accuracy of the clustering results is improved.

[0111] Figure 7 A flowchart for determining whether the preset condition is met in an embodiment is shown in an exemplary embodiment, as shown in FIG. 7. Figure 7 The above alarm analysis method further includes S701 to S702.

[0112] S701, determining a clustering evaluation parameter of each clustering result.

[0113] In this embodiment, the clustering evaluation parameter represents the clustering effect of the clustering result. The clustering evaluation parameter includes but is not limited to a silhouette coefficient or a Davies-Bouldin index (DBI).

[0114] The following takes the clustering evaluation parameter including a within-cluster sum of squares (WCSS) as an example. The computer device can calculate the sum of squares of distances between each data vector in the clustering result and its corresponding cluster center as the within-cluster sum of squares. The smaller the within-cluster sum of squares, the more concentrated the data vectors in the clustering result, the higher the similarity in the clustering result, and the better the clustering effect.

[0115] S702, determining whether the preset condition is met according to the clustering evaluation parameter of each clustering result and a preset threshold.

[0116] In the embodiment, the preset threshold is set according to requirements. Alternatively, the computer device can determine that the preset condition is met in a case where the clustering evaluation parameter of at least one clustering result is less than the preset threshold. The computer device can also determine that the preset condition is met in a case where the clustering evaluation parameter of all clustering results is less than the preset threshold.

[0117] In the above embodiment, since the clustering evaluation parameter of each clustering result can be determined, and whether the preset condition is met can be determined according to the clustering evaluation parameter of each clustering result and the preset threshold, the clustering effect of the clustering result can be efficiently determined through the preset condition, and the correlation analysis is performed to obtain the alarm analysis result in the case where the clustering effect is good.

[0118] In order to more clearly introduce the alarm analysis method of the present application, the following Figure 8 and Figure 9 are described. Figure 8 A process schematic diagram of an alarm analysis method in one embodiment is shown in Figure 8 , in which the computer device can execute the alarm analysis method according to the following flow.

[0119] S801, determine an analysis data set; the analysis data set includes alarm data of each network element and log data corresponding to each alarm data.

[0120] S802, determine each data vector in the analysis data set according to the analysis data set.

[0121] S803, determine a current clustering center corresponding to each clustering dimension according to each data vector.

[0122] S804, determine a current clustering result corresponding to each clustering dimension according to each data vector and the current clustering center corresponding to each clustering dimension.

[0123] S805, update the current clustering center corresponding to each clustering dimension according to the current clustering result corresponding to each clustering dimension, to obtain a new clustering center corresponding to each clustering dimension.

[0124] S806, return to the step of determining the current clustering result corresponding to each clustering dimension according to each data vector and the current clustering center corresponding to each clustering dimension, with the new clustering center as the current clustering center, until the current clustering result corresponding to each clustering dimension at the time when the stop condition is met is taken as the clustering result under each clustering dimension in a case where the stop condition is met.

[0125] S807, determine a clustering evaluation parameter of each clustering result.

[0126] S808 determines whether the preset conditions are met based on the clustering evaluation parameters and preset thresholds of each clustering result.

[0127] S809, under the premise of meeting the preset conditions, performs correlation analysis on the clustering results under each clustering dimension to obtain the alarm analysis results.

[0128] S810, if the preset conditions are not met, return to the step of performing cluster analysis based on the analysis dataset to obtain the clustering results of the analysis dataset under multiple clustering dimensions, until the preset conditions are met.

[0129] The steps S801~S810 can be referred to the above embodiments, and will not be repeated here.

[0130] Figure 9 This is a schematic diagram of another alarm analysis method in one embodiment, such as... Figure 9 As shown, in an exemplary embodiment, the computer device first performs a data preprocessing process to determine the analysis dataset based on the alarm data and corresponding log data of each network element. Then, the computer device performs a clustering analysis process. In this process, the computer device selects a K value to perform clustering based on clustering dimensions, such as alarm time, alarm frequency, service type, and configuration type, to obtain the clustering results for each clustering dimension.

[0131] Next, the computer device enters the clustering effect evaluation process. In this process, the computer device determines whether the clustering results for each clustering dimension meet preset conditions. If the preset conditions are not met, it indicates poor clustering performance, and the computer device returns to the clustering analysis process, reselecting a K value and performing clustering based on the clustering dimensions. If the preset conditions are met, the computer device can perform correlation analysis on the clustering results for each clustering dimension to obtain alarm analysis results.

[0132] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0133] Based on the same inventive concept, the embodiments of the present application further provide an alarm analysis device for implementing the alarm analysis method described above. The implementation scheme of the device for solving the problem is similar to the implementation scheme described in the above method, so the specific limitations in one or more alarm analysis device embodiments provided below can refer to the limitations of the alarm analysis method described above, which will not be repeated here.

[0134] Figure 10 For a structural block diagram of the alarm analysis device in an embodiment, as shown in Figure 10 an exemplary embodiment, an alarm analysis device 1000 is provided, comprising: a first determination module 1001, a clustering module 1002 and an analysis module 1003, wherein:

[0135] The first determination module 1001 is configured to determine an analysis data set; the analysis data set comprises alarm data of each network element and log data corresponding to each alarm data;

[0136] The clustering module 1002 is configured to perform clustering analysis based on the analysis data set to obtain clustering results of the analysis data set in multiple clustering dimensions;

[0137] The analysis module 1003 is configured to perform correlation analysis on each clustering result to obtain an alarm analysis result when a preset condition is met.

[0138] In the above alarm analysis device, since the analysis data set can be determined, and the analysis data set comprises alarm data of each network element and log data corresponding to each alarm data, clustering analysis based on the analysis data set can efficiently obtain clustering results of the analysis data set in multiple clustering dimensions. Further, when a preset condition is met, correlation analysis on the clustering results in each clustering dimension can obtain a more accurate alarm analysis result with the support of the clustering results in multiple clustering dimensions, so as to achieve the purpose of alarm analysis of the network element. Furthermore, the alarm analysis result can not only help engineers quickly locate the fault cause and shorten the fault handling time, but also further evaluate the performance of the network, implement early warning and prevention for potential faults, and thus improve the security, stability and efficiency of the network.

[0139] Optionally, the clustering module 1002 comprises:

[0140] A determination unit configured to determine each data vector in the analysis data set according to the analysis data set.

[0141] A clustering unit configured to perform clustering analysis on each data vector to obtain clustering results in each clustering dimension.

[0142] Optionally, the clustering unit comprises:

[0143] The first determining sub-unit is configured to determine a current cluster center corresponding to each cluster dimension according to each data vector.

[0144] The second determining sub-unit is configured to determine a current cluster result corresponding to each cluster dimension according to each data vector and the current cluster center corresponding to each cluster dimension.

[0145] The third determining sub-unit is configured to determine the cluster result under each cluster dimension according to the current cluster result corresponding to each cluster dimension.

[0146] Optionally, the third determining sub-unit is configured to update the current cluster center corresponding to each cluster dimension according to the current cluster result corresponding to each cluster dimension, to obtain a new cluster center corresponding to each cluster dimension; and return the step of determining the current cluster result corresponding to each cluster dimension according to each data vector and the current cluster center corresponding to each cluster dimension, until the current cluster result corresponding to each cluster dimension when the stop condition is met is taken as the cluster result under each cluster dimension in the case where the stop condition is met.

[0147] Optionally, the alarm analysis apparatus 1000 further includes:

[0148] The returning module is configured to return the step of performing cluster analysis on the analysis data set to obtain the cluster result of the analysis data set under the plurality of cluster dimensions based on the analysis data set in the case where the preset condition is not met, until the preset condition is met.

[0149] Optionally, the alarm analysis apparatus 1000 further includes:

[0150] The second determining module is configured to determine a cluster evaluation parameter of each cluster result.

[0151] The third determining module is configured to determine whether the preset condition is met according to the cluster evaluation parameter of each cluster result and a preset threshold.

[0152] Each module in the alarm analysis apparatus described above can be realized by software, hardware and combinations thereof in whole or in part. Each module described above can be embedded in or independent of a processor in a computer device in hardware form, or can be stored in a memory in a computer device in software form, so as to be called and executed by a processor to perform the operations corresponding to each module.

[0153] In one embodiment, a computer device is provided, including a memory and a processor, the memory stores a computer program, and the processor implements the steps in each method embodiment described above when executing the computer program.

[0154] In an embodiment, a computer readable storage medium is provided, having stored thereon a computer program, which, when executed by a processor, implements the steps of any of the above method embodiments.

[0155] In an embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the steps of any of the above method embodiments.

[0156] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. Any reference to a memory, database or other medium used in the embodiments provided in the present application can include at least one of a non-volatile memory and a volatile memory. The non-volatile memory can include a read-only memory (ROM), a magnetic tape, a floppy disk, a flash memory, an optical storage, a high-density embedded non-volatile memory, a resistive random access memory (ReRAM), a magnetoresistive random access memory (MRAM), a ferroelectric random access memory (FRAM), a phase change memory (PCM), a graphene memory, etc. The volatile memory can include a random access memory (RAM) or an external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as a static random access memory (SRAM) or a dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., without being limited thereto.

[0157] Any technical features in the above embodiments can be combined, and for the sake of brevity, not all possible combinations are described above, however, any combination of these technical features is deemed to be within the scope of the present application.

[0158] The above embodiments only express several implementation manners of the present application, and the description is relatively specific and detailed, but it should not be understood as a limitation on the patent scope of the present application. It should be pointed out that, for ordinary skilled persons in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. An alarm analysis method characterized by, The method comprises: determining an analysis data set; the analysis data set comprises alarm data of each network element and log data corresponding to each of the alarm data; performing clustering analysis based on the analysis data set to obtain clustering results of the analysis data set in multiple clustering dimensions; in a case where a preset condition is met, performing correlation analysis on the clustering results in each of the clustering dimensions to obtain an alarm analysis result; the performing clustering analysis based on the analysis data set to obtain the clustering results of the analysis data set in multiple clustering dimensions comprises: determining each data vector in the analysis data set according to the analysis data set; determining a current clustering center corresponding to each of the clustering dimensions according to each of the data vectors; determining a current clustering result corresponding to each of the clustering dimensions according to each of the data vectors and the current clustering center corresponding to each of the clustering dimensions; updating the current clustering center corresponding to each of the clustering dimensions according to the current clustering result corresponding to each of the clustering dimensions to obtain a new clustering center corresponding to each of the clustering dimensions; returning to the determining of the current clustering result corresponding to each of the clustering dimensions according to each of the data vectors and the current clustering center corresponding to each of the clustering dimensions, until, in a case where a stop condition is met, taking the current clustering result corresponding to each of the clustering dimensions when the stop condition is met as the clustering result in each of the clustering dimensions.

2. The method of claim 1, wherein, The method further comprises: in a case where the preset condition is not met, returning to the performing clustering analysis based on the analysis data set to obtain the clustering results of the analysis data set in multiple clustering dimensions until the preset condition is met.

3. The method of claim 2, wherein, The method further comprises: determining a clustering evaluation parameter of each of the clustering results; determining whether the preset condition is met according to the clustering evaluation parameter of each of the clustering results and a preset threshold.

4. The method according to any one of claims 1 to 3, characterized in that, The determining of the analysis data set comprises: obtaining an initial data set; obtaining the analysis data set after preprocessing the initial data set.

5. An alarm analysis apparatus characterized by comprising: The device comprises: a first determining module configured to determine an analysis data set; the analysis data set comprises alarm data of each network element and log data corresponding to each of the alarm data; a clustering module configured to perform clustering analysis based on the analysis data set to obtain clustering results of the analysis data set in multiple clustering dimensions; an analysis module configured to, in a case where a preset condition is met, perform correlation analysis on the clustering results to obtain an alarm analysis result. The clustering module is configured to determine each data vector in the analysis dataset according to the analysis dataset; determine a current clustering center corresponding to each clustering dimension according to each data vector; determine a current clustering result corresponding to each clustering dimension according to each data vector and the current clustering center corresponding to each clustering dimension; update the current clustering center corresponding to each clustering dimension according to the current clustering result corresponding to each clustering dimension, to obtain a new clustering center corresponding to each clustering dimension; return to the step of determining the current clustering result corresponding to each clustering dimension according to each data vector and the current clustering center corresponding to each clustering dimension, with the new clustering center as the current clustering center, until a stop condition is met, and the current clustering result corresponding to each clustering dimension at the time when the stop condition is met is taken as the clustering result under each clustering dimension.

6. The apparatus of claim 5, wherein, The apparatus further includes: The returning module is configured to return to the step of performing clustering analysis based on the analysis dataset to obtain the clustering result of the analysis dataset under a plurality of clustering dimensions, until the preset condition is met, when the preset condition is not met.

7. The apparatus of claim 6, wherein, The apparatus further includes: The second determining module is configured to determine a clustering evaluation parameter of each clustering result. The third determining module is configured to determine whether the preset condition is met according to the clustering evaluation parameter of each clustering result and a preset threshold.

8. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the steps of the method in any one of claims 1 to 4.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 4.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 4.

Images