Optical transport network alarm prediction method and device

Abstract

The application provides an optical transmission network alarm prediction method and device, and relates to the technical field of data processing. The method comprises the following steps: acquiring performance monitoring data of an optical transmission network device and reported alarm information; performing alarm correlation processing and alarm label extraction according to the alarm data to obtain an alarm label vector; and performing alarm prediction through a random forest after aligning the performance data and the alarm label vector.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to an optical transmission network alarm prediction method and device. BACKGROUND

[0002] Optical transmission networks form the core of modern communication infrastructure, and play a vital role in backbone networks. In these networks, any service interruption can lead to significant business interruption and economic loss. In actual operation scenarios, it is often difficult for operation personnel to quickly and accurately locate and analyze the source of the fault in the face of complex network structures and variable fault modes. In this context, alarm information provides an important diagnostic tool that can extract key fault information from complex network environments. Real-time and accurate alarm analysis is critical to effective fault management, as it not only reveals abnormal states in the network in a timely manner, but also predicts potential fault points. In addition, systematic prediction analysis can identify potential network problems in advance and take appropriate preventive measures, thereby greatly reducing or avoiding the occurrence of faults. However, large-scale alarm data sets pose a serious challenge to automated analysis of operation.

[0003] Therefore, how to effectively perform alarm prediction for optical transmission networks has become a problem to be solved in the industry. SUMMARY

[0004] The present application provides an optical transmission network alarm prediction method and device to solve the problem of how to effectively perform alarm prediction for optical transmission networks in the prior art.

[0005] The present application provides an optical transmission network alarm prediction method, comprising:

[0006] Obtaining performance monitoring data of optical transmission network equipment and reported alarm information;

[0007] Performing alarm correlation processing and alarm label extraction according to the alarm data to obtain an alarm label vector;

[0008] Aligning the performance data and the alarm label vector, and performing alarm prediction by random forest.

[0009] According to the optical transmission network alarm prediction method provided by the present application, alarm correlation processing and alarm label extraction are performed according to the alarm data to obtain an alarm label vector, comprising:

[0010] Pretreating the alarm data, extracting alarm labels, and using the Apriori algorithm to identify the association rules between the alarm data to generate an association matrix;

[0011] The correlation between the alarms is embedded by point multiplication of the alarm label and the correlation matrix, and an alarm label vector is obtained.

[0012] According to the alarm prediction method of the optical transmission network provided by the application, the alarm data is preprocessed, and an alarm label is extracted, comprising:

[0013] According to the frequency and urgency of the alarm information, important alarm information is determined.

[0014] According to the positioning information and occurrence time of the important alarm information, an alarm label is generated.

[0015] According to the alarm prediction method of the optical transmission network provided by the application, the performance data and the alarm label vector are aligned, and the alarm prediction is performed through the random forest, comprising:

[0016] The multi-label alarm prediction is performed by using the random forest model, a plurality of decision trees are constructed, and the average result is obtained, so as to perform the multi-label alarm prediction.

[0017] The probability of occurrence of each alarm is predicted by the multi-output wrapper, and the occurrence probability of each alarm is output.

[0018] According to the alarm prediction method of the optical transmission network provided by the application, each element of the correlation matrix is calculated according to the following formula:

[0019] ;

[0020] Among them, and respectively represent different alarms, represent the alarm and the probability of occurrence of the alarm respectively represent the alarm and the probability of occurrence of the alarm.

[0021] The application also provides an alarm prediction device for an optical transmission network, comprising:

[0022] The acquisition module is used for acquiring performance monitoring data of the optical transmission network device and reported alarm information.

[0023] The extraction module is used for performing alarm correlation processing and alarm label extraction according to the alarm data, and obtaining an alarm label vector.

[0024] The alarm module is used for aligning the performance data and the alarm label vector, and performing alarm prediction through the random forest.

[0025] The device is also used for:

[0026] The alarm data is preprocessed, and an alarm label is extracted, and an association rule between the alarm data is identified using an Apriori algorithm to generate an association matrix;

[0027] The alarm label is dot multiplied with the association matrix to embed the correlation between the alarms to obtain an alarm label vector.

[0028] The application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the optical transmission network alarm prediction method of any of the above when executing the program.

[0029] The application also provides a non-transitory computer readable storage medium having a computer program stored thereon, and the computer program is executable by a processor to implement the optical transmission network alarm prediction method of any of the above.

[0030] The application also provides a computer program product including a computer program, and the computer program is executable by a processor to implement the optical transmission network alarm prediction method of any of the above.

[0031] The optical transmission network alarm prediction method and device provided by the application can convert alarm data into labels, use the alarm data as additional information of performance data to realize data fusion, use the alarm data and performance data at the same time by labeling, consider the dependency between them, provide more abundant context information for alarm prediction, and then use a random forest model to predict the alarm of the optical transmission network, evaluate the potential possibility and probability of failure of a transmission section. According to the prediction result, corresponding management measures are formulated to reduce or control the risk of failure and improve the efficiency and reliability of network operation. BRIEF DESCRIPTION OF DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0033] Figure 1 The optical transmission network alarm prediction method flowchart provided by the embodiment of the application;

[0034] Figure 2 The alarm prediction flowchart provided by the embodiment of the application;

[0035] Figure 3 The experimental result diagram provided by the embodiment of the application;

[0036] Figure 4 A structure schematic diagram of an optical transport network alarm prediction device provided by an embodiment of the present application is shown in the figure.

[0037] Figure 5 A structure schematic diagram of an electronic device provided by the present application is shown in the figure. DETAILED DESCRIPTION

[0038] In order to make the objectives, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below with reference to the drawings in the present application. Obviously, the described embodiments are some embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0039] Figure 1 A flowchart of an optical transport network alarm prediction method provided by an embodiment of the present application is shown in the figure, which includes the following steps. Figure 1

[0040] In step 110, performance monitoring data of an optical transport network device and reported alarm information are acquired.

[0041] The performance monitoring data of each transmission section in the optical transport network and the reported alarm information are collected. The alarm data usually includes alarm type, timestamp, location and other information; the performance monitoring data may include optical power, signal-to-noise ratio, crosstalk and other indicators.

[0042] The alarm data can be further preprocessed, including cleaning, formatting and standardization.

[0043] In step 120, alarm correlation processing and alarm label extraction are performed according to the alarm data, and an alarm label vector is obtained.

[0044] An association rule mining algorithm (such as Apriori algorithm) is used to identify and quantify the correlation between different alarms, and an alarm correlation matrix is constructed.

[0045] According to the occurrence frequency, urgency and influence range of the alarm and other attributes, key alarms are extracted and encoded into alarm label vectors. These label vectors will serve as the basis for subsequent analysis and prediction.

[0046] The alarm label vector is dot multiplied with the alarm correlation matrix to embed the correlation between alarms. In this way, the alarm label vector not only contains the state of a single alarm, but also reflects the mutual influence and dependence relationship between alarms.

[0047] ​Step 130, after aligning the performance data and the alarm label vector, perform alarm prediction through random forest.

[0048] Aligning the performance data with the alarm label vector according to the timestamp ensures consistency between the two in the time series. This allows the model to consider both performance indicators and alarm information simultaneously.

[0049] The aligned data is trained and predicted using a random forest model. Random forest improves the accuracy and robustness of prediction by constructing multiple decision trees.

[0050] During the training of each tree, randomness is introduced through bootstrap sampling and feature random selection, enhancing the model's generalization ability.

[0051] For multi-label alarm prediction, a multi-output wrapper is used to enable the model to predict the occurrence of multiple alarms simultaneously and output the probability of occurrence for each alarm.

[0052] Analyze the prediction results of the random forest model to assess the potential probability of failure of the transmission segment. Based on the prediction results, develop appropriate management measures to reduce or control the risk of failure, improve the efficiency and reliability of network operation.

[0053] In the embodiments of the present application, by converting alarm data into labels, it can be used as additional information of performance data, thereby realizing data fusion. Through labeling, alarm data and performance data can be used simultaneously, and the dependency between them is considered, providing richer context information for alarm prediction. Then, through the random forest model, the alarm prediction of the optical transmission network is performed, and the potential probability of failure of the transmission segment is evaluated. According to the prediction results, appropriate management measures are developed to reduce or control the risk of failure, improve the efficiency and reliability of network operation.

[0054] Optionally, according to the alarm data, alarm correlation processing and alarm label extraction are performed to obtain an alarm label vector, including:

[0055] Pretreat the alarm data, extract the alarm label, and use the Apriori algorithm to identify the association rules between the alarm data to generate an association matrix;

[0056] Dot multiply the alarm label with the association matrix to embed the correlation between alarms and obtain the alarm label vector.

[0057] In the embodiments of the present application, the alarm data is cleaned to remove invalid or erroneous records. The alarm data is formatted to ensure data consistency and processability.

[0058] According to the characteristics of the alarm data, such as alarm type, severity, occurrence time, etc., key information is extracted. These key information is encoded as alarm labels, each label representing a specific alarm characteristic.

[0059] The Apriori algorithm is applied to analyze the alarm data and find out the frequently occurring alarm combinations. According to the algorithm results, the association rules between alarms are determined, which can reveal the potential relationship between different alarms.

[0060] Using the identified association rules, an association matrix is constructed. The rows and columns of the matrix represent different alarm labels. The elements in the matrix represent the degree of association between alarm labels, and the larger the numerical value, the stronger the association.

[0061] Each alarm label vector is multiplied by the association matrix. The result of the dot product is a new vector, where each element represents an alarm label and contains information about the association of that alarm with other alarms. After the dot product operation, the alarm label vector obtained integrates the state of individual alarms and the correlation between alarms. This vector provides rich feature information for subsequent alarm prediction.

[0062] Using the alarm label vector as input, combined with performance data, alarm prediction is performed. Machine learning models such as random forest can be used to analyze these data and predict future possible alarms.

[0063] Figure 2 The alarm prediction process provided by the embodiments of the present application is shown in the schematic diagram as shown in Figure 2 The alarm data and performance data collected from the transmission section transceiver network element are shown in the schematic diagram, and the two types of data need to be processed separately: for performance data, only data cleaning and standardization are needed; for alarm data, after basic data preprocessing, alarm label extraction and alarm correlation embedding are needed.

[0064] In the embodiments of the present application, the alarm association: uses the Apriori algorithm to identify the association rules between alarms, generates an association matrix C, where each element C_(i,j) is calculated according to formula (1), representing the degree of association between different alarms.

[0065]

[0066] wherein, and represent different alarms, represent the probability of the occurrence of alarm and at the same time, represent the probability of the occurrence of alarm and separately.

[0067] Alarm label extraction: According to the frequency and urgency of the occurrence of the alarm, important alarms are extracted. The positioning information and occurrence time of the important alarms are combined to encode them into independent label vectors .

[0068] Alarm correlation embedding: The original alarm vector is multiplied with the alarm correlation matrix to embed the correlation between alarms. In the obtained alarm label vector , each element represents the weighted sum of the alarm state and its correlation strength, which deeply reflects the dependence and influence relationship between alarms, thereby making more accurate alarm prediction.

[0069] Optionally, after aligning the performance data and the alarm label vector, an alarm prediction is made by a random forest, including:

[0070] Multi-label alarm prediction is made using a random forest model, multiple decision trees are constructed and average results are obtained for multi-label alarm prediction;

[0071] The probability of occurrence of each alarm is predicted by a multi-output wrapper, and the probability of occurrence of each alarm is output.

[0072] In the embodiments of the present application, the random forest is an ensemble learning method that improves the accuracy and robustness of prediction by constructing multiple decision trees. Each decision tree uses a bootstrap sampling method to extract samples from the original data set during training, which increases the diversity of the model.

[0073] During the splitting process of each tree, a subset is randomly selected from all features for node splitting, which increases the generalization ability of the model.

[0074] By using a multi-output wrapper, the random forest model can simultaneously predict the occurrence of multiple alarms. The model can also output specific probabilities for the occurrence of each alarm, which improves the interpretability and practicality of the prediction results.

[0075] In the embodiments of the present application, the alarm prediction results are used to evaluate the potential possibility of failure of the transmission section in the optical transmission network. The consequences and probabilities of these potential risks are analyzed. According to the evaluation results, effective management measures are developed to reduce or control the risk of failure.

[0076] In an optional embodiment, the alarm data is mainly text data, and the performance data is monitoring numerical values. The two types of data cannot be fused, but have a high degree of correlation. Therefore, the alarm is used as a label of the performance data to simultaneously use the two types of data and consider the dependence between the two types of data.

[0077] Alarm correlation embedding: there is correlation between alarms, especially alarms triggered by the same type of fault. The correlation between alarms is embedded in the form of matrix and dot product, so that independent alarm labels become correlation alarm labels, thereby improving the accuracy of alarm prediction.

[0078] Figure 3 The experimental results provided by the embodiments of the present application are shown in the schematic diagram as shown in the figure Figure 3 , which includes the first five rows and five columns of the correlation matrix C. The values in the matrix have been normalized and sparsified. Each element in the matrix is calculated by formula (1) to quantify the correlation between the alarm and the alarm , The higher the value, the stronger the correlation.

[0079] In the embodiments of the present application, a random forest model is used for alarm prediction, and a multi-output wrapper is used to enable simultaneous prediction of multiple alarm labels. Thus, model management is simplified, and multiple alarms are processed and interpreted in a unified framework.

[0080] In an optional embodiment, four methods are compared by accuracy, F1 score, false positive rate, and false negative rate: random forest algorithm without considering alarm correlation, and random forest algorithm considering alarm correlation, extreme gradient boosting algorithm, and support vector machine algorithm.

[0081] Compared with the random forest algorithm considering alarm correlation and the random forest algorithm without considering alarm correlation, the embedding of alarm correlation can highlight the accuracy and F1 score, and the false positive rate is reduced by 0.0235 and the false negative rate is reduced by 0.0117.

[0082] Compared with all models considering alarm label correlation, random forest is superior to other models in various indicators. Notably, the false negative rate of all models considering alarm label correlation is 0. In the actual alarm prediction scenario, it is crucial to obtain low false positive rate and false negative rate. These rates ensure the timely capture of critical alarms, avoid operational interference and resource waste, and thus improve the response efficiency of the operation and maintenance team.

[0083] The optical transport network alarm prediction device provided by the present application is described below. The optical transport network alarm prediction device described below can be correspondingly referred to the optical transport network alarm prediction method described above.

[0084] Figure 4 The structure schematic diagram of the optical transport network alarm prediction device provided by the embodiments of the present application is shown in the figure Figure 4 , which includes:

[0085] The acquisition module 410 is configured to acquire performance monitoring data of an optical transmission network device and reported alarm information.

[0086] The extraction module 420 is configured to perform alarm correlation processing and alarm label extraction according to the alarm data, to obtain an alarm label vector.

[0087] The alarm module 430 is configured to perform alarm prediction by random forest after aligning the performance data and the alarm label vector.

[0088] The apparatus is also configured to:

[0089] The alarm data is preprocessed, and an alarm label is extracted, and an Apriori algorithm is used to identify the correlation rules between the alarm data, to generate a correlation matrix.

[0090] The alarm label is dot-multiplied with the correlation matrix, to embed the correlation between alarms, to obtain an alarm label vector.

[0091] According to the embodiment of the application, the alarm data is converted into a label, which can be used as additional information of the performance data, so as to realize data fusion. Through the labeling, the alarm data and the performance data can be simultaneously used, and the dependency relationship between them is considered, to provide richer context information for alarm prediction. Then, the random forest model is used to perform alarm prediction of the optical transmission network, to evaluate the potential possibility and probability of failure of a transmission section. According to the prediction result, corresponding management measures are formulated, to reduce or control the failure risk, and to improve the efficiency and reliability of network operation.

[0092] Figure 5 is a structural schematic diagram of an electronic device provided by the application, as Figure 5 shown, the electronic device can include a processor 510, a communications interface 520, a memory 530 and a communications bus 540, wherein the processor 510, the communications interface 520 and the memory 530 complete mutual communication through the communications bus 540. The processor 510 can invoke a logical instruction in the memory 530, to execute an optical transmission network alarm prediction method, which includes: acquiring performance monitoring data of an optical transmission network device and reported alarm information;

[0093] According to the alarm data, alarm correlation processing and alarm label extraction are performed, to obtain an alarm label vector.

[0094] After aligning the performance data and the alarm label vector, alarm prediction is performed by random forest.

[0095] In addition, the logic instructions in the memory 530 described above can be implemented in the form of a software function unit and sold or used as an independent product, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0096] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor to enable a computer to execute the optical transport network alarm prediction method provided by the above-mentioned methods. The method comprises: obtaining performance monitoring data of an optical transport network device and reported alarm information; performing alarm correlation processing and alarm label extraction according to the alarm data to obtain an alarm label vector; and performing alarm prediction by random forest after aligning the performance data and the alarm label vector.

[0097] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor to enable a computer to execute the optical transport network alarm prediction method provided by the above-mentioned methods. The method comprises: obtaining performance monitoring data of an optical transport network device and reported alarm information; performing alarm correlation processing and alarm label extraction according to the alarm data to obtain an alarm label vector; and performing alarm prediction by random forest after aligning the performance data and the alarm label vector.

[0098] The device embodiments described above are only schematic, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, that is, they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the present embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0099] Those skilled in the art can clearly understand the technical solutions of the various embodiments from the above description of the embodiments, and the various embodiments can be implemented by means of software with the necessary general hardware platforms, and of course, can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that makes a contribution, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0100] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for some technical features therein; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method of alarm prediction in an optical transport network, characterized by, The method comprises the following steps: obtaining performance monitoring data of an optical transmission network device and reported alarm information; performing alarm correlation processing and alarm label extraction according to the alarm data to obtain an alarm label vector; aligning the performance data and the alarm label vector, and then performing alarm prediction through a random forest; wherein the alarm correlation processing and the alarm label extraction according to the alarm data to obtain the alarm label vector comprise: preprocessing the alarm data, extracting alarm labels, and using an Apriori algorithm to identify the correlation rules between the alarm data to generate a correlation matrix; point-multiplying the alarm labels and the correlation matrix to embed the correlation between alarms and obtain the alarm label vector; wherein the preprocessing of the alarm data and the extraction of the alarm labels comprise: determining important alarm information according to the frequency and urgency of the alarm information; generating alarm labels according to the positioning information and occurrence time of the important alarm information; wherein the aligning of the performance data and the alarm label vector, and then the performing of alarm prediction through a random forest comprise: performing multi-label alarm prediction using a random forest model, constructing multiple decision trees and obtaining average results to perform multi-label alarm prediction; predicting the probability of occurrence of each alarm through a multi-output wrapper and outputting the probability of occurrence of each alarm.

2. The optical transport network alarm prediction method of claim 1, wherein, Each element of the correlation matrix is calculated according to the following formula: ； wherein, and respectively represent different alarms, representing an alarm and the probability of the simultaneous occurrence of, and respectively represent alarms and the probability of the individual occurrence of.

3. An optical transport network alarm prediction apparatus, characterized by, The method comprises the following steps: an acquisition module for acquiring performance monitoring data of an optical transmission network device and reported alarm information; an extraction module for performing alarm correlation processing and alarm label extraction according to the alarm data to obtain an alarm label vector; an alarm module for aligning the performance data and the alarm label vector, and then performing alarm prediction through a random forest; wherein the device is further configured to: preprocess the alarm data, extract alarm labels, and use an Apriori algorithm to identify the correlation rules between the alarm data to generate a correlation matrix; point-multiply the alarm labels and the correlation matrix to embed the correlation between alarms and obtain the alarm label vector; wherein the device is further configured to: determine important alarm information according to the frequency and urgency of the alarm information; generate alarm labels according to the positioning information and occurrence time of the important alarm information; wherein the device is further configured to: perform multi-label alarm prediction using a random forest model, construct multiple decision trees and obtain average results to perform multi-label alarm prediction; predict the probability of occurrence of each alarm through a multi-output wrapper and output the probability of occurrence of each alarm.

4. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the optical transmission network alarm prediction method according to any one of claims 1 to 2 when executing the program. 5.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the optical transmission network alarm prediction method according to any one of claims 1 to 2.

6. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the optical transmission network alarm prediction method according to any one of claims 1 to 2.

Images