Alarm information processing method and device and nonvolatile storage medium

Abstract

The invention discloses an alarm information processing method and device and a nonvolatile storage medium. The method comprises the following steps: acquiring alarm information generated by a plurality of alarm devices, and classifying the alarm information according to the types of the alarm devices; target alarm information corresponding to each type of alarm equipment is collected based on the time sliding window, and the target alarm information is alarm information corresponding to the time range indicated by the time sliding window; based on the topological relation between the target alarm information and the network equipment, a causal graph is constructed, and the causal graph is used for indicating the causal relation of information propagation between the target alarm information; and determining key alarm information based on the causal graph. The technical problem of low processing efficiency caused by incapability of accurately identifying key alarm information of multiple pieces of alarm information due to neglect of a causal relationship between the alarm information in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular, to a method and device for processing alarm information and a non-volatile storage medium. Background Art

[0002] With the continuous advancement of information construction, network equipment (for example, network equipment in campus networks) has shown a trend of diversified brands and models and increasing numbers. The use of network equipment has not only improved the quality of network services, but also provided more abundant application scenarios for education and scientific research. In the campus network environment, network equipment includes routers, switches, wireless controllers, wireless access points, etc. These devices may generate various alarm information such as fault alarms, performance alarms, and security alarms during operation. These alarm information is crucial to maintaining the normal operation of the network. They can reflect abnormal conditions in the network and help operation and maintenance personnel quickly locate problems and take corresponding measures. However, with the increase of network equipment, the number of alarm information has also increased exponentially. The processing method of alarm information in the related technology depends on the experience and knowledge of the operation and maintenance personnel, and requires manual filtering and analysis of alarm information one by one. It is difficult to adapt to the alarm processing needs in large-scale complex network environments. For massive alarm information, the workload of operation and maintenance personnel is increased, and the causal relationship between alarm information is ignored, so that the key alarm information that generates multiple alarm information cannot be accurately identified, resulting in the technical problem of low efficiency in alarm information processing.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method, device and non-volatile storage medium for processing alarm information, so as to at least solve the technical problem in the related art that the causal relationship between the alarm information is ignored, thereby failing to accurately identify the key alarm information of multiple alarm information, resulting in low processing efficiency.

[0005] According to one aspect of an embodiment of the present application, a method for processing alarm information is provided, including: obtaining alarm information generated by multiple alarm devices, and classifying the alarm information according to the type of alarm device; collecting target alarm information corresponding to each type of alarm device based on a time sliding window, wherein the target alarm information is alarm information corresponding to a time range indicated by the time sliding window; constructing a causal graph based on the target alarm information and the topological relationship between network devices, wherein the causal graph is used to indicate the causal relationship of information propagation between target alarm information; and determining key alarm information based on the causal graph.

[0006] In some embodiments of the present application, the method also includes: obtaining the size of a first time sliding window in the time sliding window, wherein the first time sliding window is any sliding window in the time sliding window; determining the size of a second time sliding window based on the size of the first time sliding window, a first coefficient and a second coefficient for controlling the degree of adjustment, and a functional relationship between an event interval corresponding to the first time sliding window, an event interval after smoothing, and an event frequency change rate, wherein the second time sliding window is the next time sliding window of the first time sliding window.

[0007] In some embodiments of the present application, the topological relationship between network devices is determined in the following manner: obtaining a network device table for storing network device information, a topology group table for storing topology group information, and a network device connection relationship table for storing network device connection relationships in a database, wherein the topology group information refers to the grouping information of the network devices, and the network devices in the same group are regarded as a topology group. Each preset time period, the network device table, the topology group table, and the network device connection relationship table are updated based on the latest connection relationship between the network devices collected by the data collector; the topological relationship between the network devices is determined based on the network device table, the topology group table, and the network device connection relationship table.

[0008] In some embodiments of the present application, a causal graph is constructed based on target alarm information and the topological relationship between network devices, including: obtaining a network topology graph based on the topological relationship between network devices, wherein the network topology graph is used to display the topological connection relationship between all network devices, and each topological node in the network topology graph corresponds to a network device; determining a network alarm topology graph based on the target alarm information and the network topology graph, wherein the network alarm topology graph is used to indicate the topological connection relationship between target alarm devices that generate target alarm information, and each topological node in the network alarm topology graph corresponds to a target alarm device; determining connected components of the network alarm topology graph; and constructing a causal graph based on the connected components. In some embodiments of the present application, a causal graph is constructed based on connected components, including: when multiple connected components can be connected through a first topological node, the first topological node is used as the first root node, and the multiple connected components are merged to obtain a connected subgraph, wherein the first topological node is any topological node that exists in the network topology graph and does not exist in the network alarm topology graph; a causal graph corresponding to the connected subgraph is constructed based on the first queue, the first access set, the first edge set, the connected subgraph and the first root node, wherein the first queue, the first access set and the first edge set are initially empty; the following process is iterated until each topological node in the connected subgraph is traversed, and the causal graph corresponding to the connected subgraph is obtained based on the first access set and the first edge set after the iteration is completed: the first root node is added to the first queue and the first access set; the first root node is removed from the first queue, and the second topological node is added to the first queue and the first access set, wherein the second topological node is a topological node that has a first topological connection edge with the first root node in the connected subgraph; the first topological connection edge is added to the first edge set, and the second topological node is used as a new root node.

[0009] In some embodiments of the present application, a causal graph is constructed based on connected components, including: when multiple connected components cannot be connected through a third topological node, determining the degree of each topological node in a first connected component, and using a fourth topological node as a second root node of the first connected component, wherein the third topological node is any topological node that exists in the network topology graph and does not exist in the network alarm topology graph, the third topological node is any topological node in the network alarm topology graph, the fourth topological node is the topological node with the largest degree in the first connected component, and the first connected component is any connected component that cannot be connected through the third topological node; based on the second queue, the second access set, the second edge set, and the first connected component and The second root node constructs a causal graph corresponding to the first connected component, wherein the second queue, the second access set, and the second edge set are initially empty; iterate the following process until each topological node in the first connected component is traversed, and obtain the causal graph corresponding to the first connected component based on the second access set and the second edge set after the iteration: add the second root node to the second queue and the second access set; remove the second root node from the second queue, and add the fifth topological node to the second queue and the second access set, wherein the fifth topological node is a topological node in the first connected component that has a second topological connection edge with the second root node; add the second topological connection edge to the second edge set, and use the fifth topological node as the new second root node.

[0010] In some embodiments of the present application, critical alarm information is determined based on a causal graph, including: determining the alarm device corresponding to the first storage location in the access set corresponding to the causal graph as the critical alarm device; and determining the target alarm information corresponding to the critical alarm device as the critical alarm information.

[0011] In some embodiments of the present application, the method also includes: determining a sub-alarm device associated with a critical alarm device based on an edge set corresponding to a causal graph; determining multiple sub-alarm devices of the same critical alarm device as an alarm set; generating an alarm prompt based on the alarm set, and pushing the alarm prompt to a user terminal, wherein the alarm prompt includes at least the critical alarm device and the critical alarm information, as well as multiple sub-alarm devices in the alarm set and the target alarm information corresponding to each sub-alarm device.

[0012] According to another aspect of an embodiment of the present application, there is also provided an alarm information processing device, including: an acquisition module, used to acquire alarm information generated by multiple alarm devices, and classify the alarm information according to the type of alarm device; a collection module, used to collect target alarm information corresponding to each type of alarm device based on a time sliding window, wherein the target alarm information is alarm information corresponding to the time range indicated by the time sliding window; a construction module, used to construct a causal graph based on the target alarm information and the topological relationship between network devices, wherein the causal graph is used to indicate the causal relationship of information propagation between target alarm information; a determination module, used to determine key alarm information based on the causal graph.

[0013] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, in which a program is stored, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the above-mentioned method for processing alarm information.

[0014] According to another aspect of an embodiment of the present application, an electronic device is further provided, including: a memory and a processor, the processor being configured to run a program stored in the memory, wherein the above-mentioned method for processing alarm information is executed when the program is run.

[0015] According to another aspect of an embodiment of the present application, a computer program product is also provided, including computer instructions, which implement the above-mentioned method for processing alarm information when the computer instructions are executed by a processor.

[0016] In an embodiment of the present application, the alarm information generated by multiple alarm devices is obtained, and the alarm information is classified according to the type of alarm device; the target alarm information corresponding to each type of alarm device is collected based on a time sliding window, wherein the target alarm information is the alarm information corresponding to the time range indicated by the time sliding window; a causal graph is constructed based on the target alarm information and the topological relationship between the network devices, wherein the causal graph is used to indicate the causal relationship of information propagation between the target alarm information; a method of determining key alarm information based on the causal graph is adopted, the target alarm information corresponding to each type of alarm device is collected through a sliding window, and then a causal graph is constructed based on the target alarm information and the topological relationship between the network devices, so as to determine the key alarm information from the causal graph, thereby achieving the purpose of paying attention to the correlation between the alarm information and accurately identifying the key alarm information that generates multiple alarm information, thereby solving the technical problem in the related art that the causal relationship between the alarm information is ignored, and thus the key alarm information of multiple alarm information cannot be accurately identified, resulting in low processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 It is a hardware structure block diagram of a computer terminal for implementing a method for processing alarm information provided in an embodiment of the present application;

[0019] Figure 2 is a flowchart of a method for processing alarm information provided according to an embodiment of the present application;

[0020] Figure 3 It is a flowchart for determining a topological relationship between network devices provided according to an embodiment of the present application;

[0021] Figure 4 is a flowchart of another method for processing alarm information provided in an embodiment of the present application;

[0022] Figure 5 It is a structural diagram of an alarm information processing device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0024] The information collected in the embodiments of the present application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or reject automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] In the related art, the alarm information processing method ignores the causal relationship between the alarm information, and thus cannot accurately identify the key alarm information of multiple alarm information, resulting in a technical problem of low processing efficiency. In order to solve this problem, the embodiment of the present application provides a relevant solution, which is described in detail below.

[0027] According to an embodiment of the present application, an embodiment of a method for processing alarm information is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] The method embodiments provided in the embodiments of the present application can be executed in a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing a method for processing alarm information. Figure 1 As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0029] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As involved in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0030] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the method for processing alarm information in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned method for processing alarm information is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0031] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0032] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0033] In the above-mentioned operating environment, an embodiment of the present application provides an embodiment of a method for processing alarm information. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0034] like Figure 2FIG. 1 is a flowchart of a method for processing alarm information according to an embodiment of the present application, including:

[0035] Step 202: Acquire alarm information generated by multiple alarm devices, and classify the alarm information according to the types of alarm devices.

[0036] The following are specific embodiments:

[0037] Acquire alarm information generated by different alarm devices corresponding to device logs, measurement tools, and network management systems, and classify the alarm information. Specifically, classify the acquired alarm information according to the type of alarm device (such as routers, switches, wireless controllers, etc.), and aggregate multiple alarm information corresponding to each type of alarm device. The alarm device is the network device that generates the alarm information.

[0038] Step 204: collect target alarm information corresponding to each type of alarm device based on the time sliding window, wherein the target alarm information is alarm information corresponding to the time range indicated by the time sliding window.

[0039] In the technical solution provided in step 204, the sizes of different time sliding windows can be determined in the following manner: obtaining the size of the first time sliding window in the time sliding window, wherein the first time sliding window is any sliding window in the time sliding window; determining the size of the second time sliding window based on the size of the first time sliding window, the first coefficient and the second coefficient for controlling the adjustment degree, the event interval corresponding to the first time sliding window, the smoothed event interval, and the event frequency change rate, wherein the second time sliding window is the next time sliding window of the first time sliding window. By dynamically adjusting the time sliding window, it is possible to adapt to the change of alarm frequency in different network environments, and improve the flexibility and real-time performance of alarm information processing.

[0040] The following are specific embodiments:

[0041] For all alarm information corresponding to each type of alarm device, segment collection is performed based on the sliding time window to collect target alarm information corresponding to each type of alarm device. The target alarm information is the alarm information corresponding to the time range indicated by the time sliding window, that is, the time sliding window is constantly changing, and each time the alarm information corresponding to the time range indicated by the current time sliding window is collected. For example, the first time sliding window is any sliding window in the time sliding window, and the size of the second time sliding window (the next time sliding window of the first time sliding window) is determined by the size of the first time sliding window, the first coefficient and the second coefficient for controlling the degree of adjustment, the event interval corresponding to the first time sliding window, the smoothed event interval, and the function relationship between the event frequency change rate. The above event refers to the alarm device generating alarm information, and one time corresponds to the generation of one alarm information. The above function relationship can be determined by the following formula:

[0042] ,

[0043] in, Indicates the size of the second time sliding window, Indicates the second time, Indicates the size of the first sliding window, that is, yes The previous time, Indicates the first time, and represents the coefficient used to control the adjustment degree, which is preset, namely the first coefficient and the second coefficient used to control the adjustment degree. express The time interval between events, Represents the smoothed The time interval between events, represents the rate of change of event frequency, It represents the maximum value between 1 and the event frequency change rate.

[0044] Step 206: construct a causal graph based on the target alarm information and the topological relationship between the network devices, wherein the causal graph is used to indicate the causal relationship of information propagation between the target alarm information.

[0045] In the technical solution provided in step 206, the topological relationship between network devices is determined in the following manner: a network device table for storing network device information, a topological group table for storing topological group information, and a network device connection relationship table for storing network device connection relationships are obtained from a database, wherein the topological group information refers to the grouping information of network devices, and the network devices in the same group are regarded as a topological group. The network device table, the topological group table, and the network device connection relationship table are updated based on the latest connection relationship between network devices collected by the data collector at each preset time period; the topological relationship between network devices is determined based on the network device table, the topological group table, and the network device connection relationship table. This method can update the connection status of network devices in real time, ensuring that the constructed cause-effect diagram accurately reflects the current network topology.

[0046] The following are specific embodiments:

[0047] like Figure 3 As shown, it is a flowchart of determining the topological relationship between network devices according to an embodiment of the present application. Figure 3 As shown, the database contains three data tables, namely, a network device table for storing network device information, a topology group table for storing topology group information, and a network device connection relationship table for storing network device connection relationships. Topology group information refers to the grouping information of network devices. Network devices in the same group are regarded as a topology group. For example, in a campus network, all network devices in a teaching building are regarded as a topology group, and these network devices have the same topology group identifier. The network device table contains fields including at least device identifier, device name, device IP address, and device type. The topology group table includes at least device identifier and topology group identifier. The network device connection relationship table includes at least upstream device identifier, downstream device identifier, device identifier, and device-associated topology group identifier. The three tables are associated through device identifiers, and the topological relationship between network devices is finally determined based on the three tables. Based on the topological relationship between network devices, a network topology diagram is obtained. The network topology diagram shows the topological connection relationship between each network device and the upstream and downstream devices connected thereto. A topological node in the network topology diagram corresponds to a network device, and the network device and the corresponding upstream device and downstream device are connected through topological connection edges. When a data packet starts from the initial network device, is forwarded by a series of network devices, and finally reaches the destination network device, for any intermediate network device, the previous device that forwards the data packet to it is called its upstream device. The upstream device is the device that is closer to the initial network device on the data transmission path. For any intermediate network device, the subsequent network device that receives the data packet and continues to pass it downward is called its downstream device. The downstream device is the device that is closer to the destination network device on the data transmission path.

[0048] In order to ensure the accuracy of the topological relationship between network devices, the latest connection relationship between network devices is collected based on the data collector regularly (for example, every 10 minutes) (for example, the connection information of all network devices in the campus network is collected), wherein the latest connection relationship between network devices refers to the device identifier of the adjacent device (i.e., the upstream device and the downstream device) that has a connection relationship with the network device in the current time period, and the network device table, the topology group table, and the network device connection relationship table are updated based on the collected latest connection relationship between network devices. Specifically: the data collector sends a connection information acquisition request message (the connection message is the above-mentioned latest connection relationship between network devices) to the agent process of the network device, and the request message follows the Simple Network Management Protocol (SNMP), and the agent process obtains the object identifier (OID) of the network device from the Management Information Base (MIB) database, encapsulates the object identifier as connection information, and returns it to the data collector. The network device table, the topology group table, and the network device connection relationship table are updated based on the connection information.

[0049] There are many ways to implement constructing a causal graph based on target alarm information and the topological relationship between network devices, for example: obtaining a network topology graph based on the topological relationship between network devices, wherein the network topology graph is used to display the topological connection relationship between all network devices, and each topological node in the network topology graph corresponds to a network device; determining a network alarm topology graph based on the target alarm information and the network topology graph, wherein the network alarm topology graph is used to indicate the topological connection relationship between target alarm devices that generate target alarm information, and each topological node in the network alarm topology graph corresponds to a target alarm device; determining connected components of the network alarm topology graph; and constructing a causal graph based on the connected components.

[0050] In the above steps, there are many ways to implement the construction of a causal graph based on connected components. For example, when multiple connected components can be connected through a first topological node, the first topological node is used as the first root node, and the multiple connected components are merged to obtain a connected subgraph, wherein the first topological node is any topological node that exists in the network topological graph and does not exist in the network alarm topological graph; a causal graph corresponding to the connected subgraph is constructed based on the first queue, the first access set, the first edge set, the connected subgraph and the first root node, wherein the first queue, the first access set and the first edge set are initially empty; the following process is iterated until each topological node in the connected subgraph is traversed, and the causal graph corresponding to the connected subgraph is obtained based on the first access set and the first edge set after the iteration is completed: the first root node is added to the first queue and the first access set; the first root node is removed from the first queue, and the second topological node is added to the first queue and the first access set, wherein the second topological node is a topological node that has a first topological connection edge with the first root node in the connected subgraph; the first topological connection edge is added to the first edge set, and the second topological node is used as a new root node.

[0051] In the case where multiple connected components cannot be connected through the third topological node, the degree of each topological node in the first connected component is determined, and the fourth topological node is used as the second root node of the first connected component, wherein the third topological node is any topological node that exists in the network topological graph and does not exist in the network alarm topological graph, the third topological node is any topological node in the network alarm topological graph, the fourth topological node is the topological node with the largest degree in the first connected component, and the first connected component is any connected component that cannot be connected through the third topological node; constructing the first connected component based on the second queue, the second access set, the second edge set, and the first connected component and the second root node A corresponding causal graph, wherein the second queue, the second access set, and the second edge set are initially empty; iterate the following process until each topological node in the first connected component is traversed, and obtain the causal graph corresponding to the first connected component based on the second access set and the second edge set after the iteration: add the second root node to the second queue and the second access set; remove the second root node from the second queue, and add the fifth topological node to the second queue and the second access set, wherein the fifth topological node is a topological node that has a second topological connection edge with the second root node in the first connected component; add the second topological connection edge to the second edge set, and use the fifth topological node as the new second root node.

[0052] The following are specific embodiments:

[0053] First, determine the alarm devices corresponding to the target alarm information of the same type of alarm devices, and extract the association relationship between these alarm devices from the topological relationship between network devices, that is, separate the corresponding parts of these alarm devices from the network topology map to obtain the network alarm topology map. The network alarm topology map is a subgraph of the network topology map. Each type of alarm device corresponds to a network alarm topology map. Each topological node of the network alarm topology map corresponds to a target alarm device. The target alarm device of the network alarm topology map is connected to its corresponding upstream alarm device and downstream alarm device through topological connection edges. For example, the network topology map is ,in, Represents a network topology diagram. A collection of topological nodes representing network devices. Represents the set of topological connection edges. The set of target alarm devices corresponding to the target alarm information of the first type of alarm device (the first type of alarm device is any type of alarm device) in the topological node set of network devices is , , for The network alarm topology diagram of the first type of alarm equipment is ,in, The network alarm topology diagram showing the first type of alarm equipment. The set of target alarm devices corresponding to the target alarm information of the first type of alarm device (i.e., the set of topological nodes in the network alarm topology diagram of the first type of alarm device) is represented. Represents the set of topological connection edges in the network alarm topology graph of the first type of alarm equipment. Determine the connected components in the network alarm topology graph , The value of , is an integer greater than or equal to 1, ,in, This is the first connected components, Indicates A set of topological nodes of connected components, Indicates The topological connection edge set of the connected components is traversed through the topological nodes of the network topology graph except the network alarm topology graph. If there is a first topological node that can connect multiple connected components in the network alarm topology graph, the multiple connected components that can be connected are merged to obtain a new connected subgraph, and the first topological node is used as the root node (that is, the first root node mentioned above). The first topological node is any topological node that exists in the network topology graph but does not exist in the network alarm topology graph. For example, there is a first topological node Connected components can be connected ,in, No more than , then the connected components Merge to get a new connected subgraph . In the case where multiple connected components cannot be connected through the third topological node, the degree of each topological node in each connected component is calculated, and the topological node with the largest degree is selected as the root node of the connected component (i.e., the second root node mentioned above). If there are multiple topological nodes with the same degree, the topological node corresponding to the target alarm device with the smallest IP address is selected as the root node (i.e., the second root node mentioned above). The third topological node can be the first topological node, and the third topological node and the first topological node are any topological nodes that exist in the network topology map and do not exist in the network alarm topology map).

[0054] For the connected subgraphs obtained by merging multiple connected components or the connected components that cannot be merged, a causal graph is constructed based on the network topology graph to causal graph algorithm. The specific implementation process of the network topology graph to causal graph algorithm is as follows:

[0055] Constructing a queue , access the collection , and the edge set , initialize the queue , access collection , edge set , Indicates empty, i.e. queue , access the collection , and the edge set The initial state is empty. When constructing a causal graph for a connected subgraph obtained by merging multiple connected components, the queue is the first queue mentioned above. When constructing a causal graph for each connected component that cannot be merged, the queue is the second queue mentioned above. When constructing a causal graph for a connected subgraph obtained by merging multiple connected components, the access set is the first access set mentioned above. When constructing a causal graph for each connected component that cannot be merged, the access set is the second access set mentioned above. When constructing a causal graph for a connected subgraph obtained by merging multiple connected components, the edge set is the first edge set mentioned above. When constructing a causal graph for each connected component that cannot be merged, the edge set is the second edge set mentioned above. is any connected subgraph in the connected subgraph obtained by merging multiple connected components or any connected component in the connected components that cannot be merged. is the root node (the first root node corresponding to the connected subgraph or the second root node corresponding to each connected component that cannot be merged). Iterate the following process until all For each topological node in , based on the access set and edge set after the iteration, the causal graph corresponding to the connected subgraph or connected component is obtained: the root node Join the queue and access the collection In the case where the queue is not empty, the root node Remove it from the queue, and add the next topological node of the root node (when the root node is the first root node, the next topological node of the root node is the second topological node; when the root node is the second root node, the next topological node of the root node is the fifth topological node) to the queue and access set, where the next topological node of the root node is a topological node that has a topological connection edge with the root node in the connected subgraph or connected component (the topological connection edge for the first root node is the first topological connection edge, and the topological connection edge for the second root node is the second topological connection edge); add the topological connection edge to the edge set, and use the next topological node of the root node as the new root node. After the above iterations, the causal graph is obtained. ,in, express The corresponding causal diagram is, That is, the access collection after the iteration ends. That is, the edge set after the iteration ends.

[0056] Step 208: Determine key warning information based on the cause-effect diagram.

[0057] In the technical solution provided in step 208, there are multiple ways to implement determining key alarm information based on the causal graph, for example: taking the alarm device corresponding to the first storage location in the access set corresponding to the causal graph as the key alarm device; and determining the target alarm information corresponding to the key alarm device as the key alarm information.

[0058] After determining the key alarm information based on the cause-effect graph, determine the sub-alarm device associated with the key alarm device based on the edge set corresponding to the cause-effect graph; determine multiple sub-alarm devices of the same key alarm device as an alarm set; generate an alarm prompt based on the alarm set, and push the alarm prompt to the user terminal, wherein the alarm prompt includes at least the key alarm device and the key alarm information, as well as multiple sub-alarm devices in the alarm set and the target alarm information corresponding to each sub-alarm device.

[0059] The following are specific embodiments:

[0060] The alarm device corresponding to the first storage location in the access set corresponding to the causal graph (i.e., the target alarm device corresponding to the first root node or the target alarm device corresponding to the second root node) is taken as the key alarm device; the target alarm information corresponding to the key alarm device is determined as the key alarm information, that is, the first storage location in the access set, i.e., the root node in the connected subgraph or connected component, and the alarm device corresponding to the root node is taken as the key alarm device, i.e., the alarm device that generates the root cause alarm information. For each causal graph, the sub-alarm devices associated with the key alarm device are determined based on the edge set corresponding to the causal graph, and multiple sub-alarm devices of the same key alarm device are determined as an alarm set to achieve alarm simplicity. For example, the target alarm information corresponding to an alarm device of a type is collected based on a time sliding window as follows: , where A represents the target warning information set, Indicates Item warning information, is an integer greater than 1, and the corresponding target alarm device is ,in, To produce the The target alarm device set of the target alarm information, For the corresponding A target warning device. For key warning information, It is a key alarm device. In the edge set corresponding to the causal graph, there is arrive The path composed of the corresponding topological edges is considered and Related, will and The corresponding target alarm device and The target alarm devices corresponding to all topological nodes on the path from the corresponding topological node back to the root node are determined as sub-alarm devices. arrive as well as and In and The size relationship is: Less than and is greater than 1, Less than , all sub-alarm devices are regarded as an alarm set, an alarm prompt is generated based on the alarm set, and the alarm prompt is pushed to the user terminal, wherein the alarm prompt includes at least multiple sub-alarm devices in the alarm set and target alarm information corresponding to each sub-alarm device (including at least device identifier, device name, device IP address, and device identifier of the corresponding key alarm device), as well as key alarm devices and key alarm information (including at least device identifier, device name, and device IP address) associated with multiple sub-alarm devices in the alarm set.

[0061] The present application also provides a flowchart of another method for processing alarm information. Figure 4 As shown, first, the alarm information generated by the corresponding different alarm devices in the device log, measurement tools and network management system is obtained, and the alarm information is classified. For each type of alarm information, the target alarm information corresponding to each type of alarm device is collected based on the sliding window (i.e., the above-mentioned time sliding window), and the root cause analysis is performed to construct a causal graph (i.e., the above-mentioned causal graph is constructed based on the target alarm information and the topological relationship between the network devices). Alarm simplification is achieved based on the constructed causal graph, and an alarm is issued (i.e., the above-mentioned multiple sub-alarm devices of the same key alarm device are determined as an alarm set; an alarm prompt is generated based on the alarm set, and the alarm prompt is pushed to the user terminal). The specific implementation method of each of the above steps has been described in detail in the above-mentioned embodiments and will not be repeated here.

[0062] The present application also provides a schematic diagram of a structure of a device for processing alarm information, such as Figure 5 As shown, including:

[0063] The acquisition module 502 is used to acquire the alarm information generated by multiple alarm devices and classify the alarm information according to the types of the alarm devices.

[0064] The collection module 504 is used to collect target alarm information corresponding to each type of alarm device based on the time sliding window, wherein the target alarm information is alarm information corresponding to the time range indicated by the time sliding window.

[0065] The construction module 506 is used to construct a causal graph based on the target alarm information and the topological relationship between the network devices, wherein the causal graph is used to indicate the causal relationship of information propagation between the target alarm information.

[0066] The construction module 506 is also used to obtain a network device table for storing network device information, a topology group table for storing topology group information, and a network device connection relationship table for storing network device connection relationships in a database, wherein the topology group information refers to the grouping information of the network device, and the network devices in the same group are regarded as a topology group. The network device table, the topology group table, and the network device connection relationship table are updated based on the latest connection relationship between the network devices collected by the data collector at each preset time period; the topological relationship between the network devices is determined based on the network device table, the topology group table, and the network device connection relationship table.

[0067] The construction module 506 is also used to obtain a network topology map based on the topological relationship between network devices, wherein the network topology map is used to display the topological connection relationship between all network devices, and each topological node in the network topology map corresponds to a network device; determine the network alarm topology map based on the target alarm information and the network topology map, wherein the network alarm topology map is used to indicate the topological connection relationship between the target alarm devices that generate the target alarm information, and each topological node in the network alarm topology map corresponds to a target alarm device; determine the connected components of the network alarm topology map; and construct a causal graph based on the connected components.

[0068] The construction module 506 is also used to, when multiple connected components can be connected through the first topological node, use the first topological node as the first root node and merge the multiple connected components to obtain a connected subgraph, wherein the first topological node is any topological node that exists in the network topological graph and does not exist in the network alarm topological graph; construct a causal graph corresponding to the connected subgraph based on the first queue, the first access set, the first edge set, the connected subgraph and the first root node, wherein the first queue, the first access set and the first edge set are initially empty; iterate the following process until each topological node in the connected subgraph is traversed, and obtain the causal graph corresponding to the connected subgraph based on the first access set and the first edge set after the iteration is completed: add the first root node to the first queue and the first access set; remove the first root node from the first queue, and add the second topological node to the first queue and the first access set, wherein the second topological node is a topological node that has a first topological connection edge with the first root node in the connected subgraph; add the first topological connection edge to the first edge set, and use the second topological node as the new root node.

[0069] The construction module 506 is also used to determine the degree of each topological node in the first connected component when multiple connected components cannot be connected through the third topological node, and use the fourth topological node as the second root node of the first connected component, wherein the third topological node is any topological node that exists in the network topology graph and does not exist in the network alarm topology graph, the third topological node is any topological node in the network alarm topology graph, the fourth topological node is the topological node with the largest degree in the first connected component, and the first connected component is any connected component that cannot be connected through the third topological node; based on the second queue, the second access set, the second edge set, and the first connected component and the second root node, the first connected component is constructed. A causal graph corresponding to a connected component, wherein the second queue, the second access set, and the second edge set are initially empty; iterate the following process until each topological node in the first connected component is traversed, and obtain the causal graph corresponding to the first connected component based on the second access set and the second edge set after the iteration: add the second root node to the second queue and the second access set; remove the second root node from the second queue, and add the fifth topological node to the second queue and the second access set, wherein the fifth topological node is a topological node that has a second topological connection edge with the second root node in the first connected component; add the second topological connection edge to the second edge set, and use the fifth topological node as the new second root node.

[0070] The determination module 508 is used to determine key warning information based on the cause-effect diagram.

[0071] The determination module 508 is further configured to determine the alarm device corresponding to the first storage location in the access set corresponding to the cause-effect graph as a key alarm device; and determine the target alarm information corresponding to the key alarm device as key alarm information.

[0072] It should be noted that Figure 5 The warning information processing device shown is used to execute Figure 2 The method of processing the warning information shown is therefore Figure 2 The relevant explanations in the method for processing the alarm information in are also applicable to the processing device for the alarm information and will not be repeated here.

[0073] It should be noted that the various modules in the above-mentioned alarm information processing device can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0074] The embodiment of the present application also provides a non-volatile storage medium, the non-volatile storage medium includes a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the above alarm information processing method. For example, the alarm information generated by multiple alarm devices is obtained, and the alarm information is classified according to the type of alarm device; based on the time sliding window, the target alarm information corresponding to each type of alarm device is collected, wherein the target alarm information is the alarm information corresponding to the time range indicated by the time sliding window; based on the target alarm information and the topological relationship between the network devices, a causal graph is constructed, wherein the causal graph is used to indicate the causal relationship of information propagation between the target alarm information; based on the causal graph, key alarm information is determined.

[0075] The embodiment of the present application also provides an electronic device, the electronic device includes a processor, the processor is used to run a program, wherein the above alarm information processing method is executed when the program is running. For example, the alarm information generated by multiple alarm devices is obtained, and the alarm information is classified according to the type of alarm device; based on the time sliding window, the target alarm information corresponding to each type of alarm device is collected, wherein the target alarm information is the alarm information corresponding to the time range indicated by the time sliding window; based on the target alarm information and the topological relationship between the network devices, a causal graph is constructed, wherein the causal graph is used to indicate the causal relationship of information propagation between the target alarm information; based on the causal graph, key alarm information is determined.

[0076] According to another aspect of the embodiment of the present application, a computer program product is also provided, including a computer program, which implements the above alarm information processing method when executed by a processor. For example, the alarm information generated by multiple alarm devices is obtained, and the alarm information is classified according to the type of alarm device; based on the time sliding window, the target alarm information corresponding to each type of alarm device is collected, wherein the target alarm information is the alarm information corresponding to the time range indicated by the time sliding window; based on the target alarm information and the topological relationship between the network devices, a causal graph is constructed, wherein the causal graph is used to indicate the causal relationship of information propagation between the target alarm information; based on the causal graph, key alarm information is determined.

[0077] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0078] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0079] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0080] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0081] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0082] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for processing alarm information, characterized in that: include: Acquire alarm information generated by multiple alarm devices, and classify the alarm information according to the types of alarm devices; Collecting target alarm information corresponding to each type of alarm device based on a time sliding window, wherein the target alarm information is alarm information corresponding to a time range indicated by the time sliding window; Constructing a causal graph based on the target alarm information and the topological relationship between the network devices, wherein the causal graph is used to indicate the causal relationship of information propagation between the target alarm information; Key warning information is determined based on the cause-effect diagram.

2. The method according to claim 1, characterized in that: The method further comprises: Obtain a size of a first time sliding window in the time sliding windows, wherein the first time sliding window is any one of the time sliding windows; The size of the second time sliding window is determined based on the size of the first time sliding window, the first coefficient and the second coefficient for controlling the degree of adjustment, and the functional relationship between the event interval corresponding to the first time sliding window, the smoothed event interval, and the event frequency change rate, wherein the second time sliding window is the next time sliding window of the first time sliding window.

3. The method according to claim 1, characterized in that The topological relationship between the network devices is determined in the following manner: Obtaining a network device table for storing network device information, a topology group table for storing topology group information, and a network device connection relationship table for storing network device connection relationships in a database, wherein the topology group information refers to grouping information of network devices, and network devices in the same group are regarded as a topology group. The network device table, the topology group table, and the network device connection relationship table are updated based on the latest connection relationship between network devices collected by the data collector at each preset time period; The topological relationship between the network devices is determined based on the network device table, the topology group table, and the network device connection relationship table.

4. The method according to claim 1, characterized in that The constructing a causal graph based on the target alarm information and the topological relationship between network devices includes: A network topology diagram is obtained based on the topological relationship between the network devices, wherein the network topology diagram is used to display the topological connection relationship between all network devices, and each topological node in the network topology diagram corresponds to a network device; Determine a network alarm topology map based on the target alarm information and the network topology map, wherein the network alarm topology map is used to indicate the topological connection relationship between the target alarm devices that generate the target alarm information, and each topological node of the network alarm topology map corresponds to a target alarm device; Determining connected components of the network alarm topology graph; The causal graph is constructed based on the connected components.

5. The method according to claim 4, characterized in that The constructing the causal graph based on the connected components comprises: In the case where multiple connected components can be connected through a first topological node, the first topological node is used as a first root node, and the multiple connected components are merged to obtain a connected subgraph, wherein the first topological node is any topological node that exists in the network topological graph and does not exist in the network alarm topological graph; Constructing a causal graph corresponding to the connected subgraph based on the first queue, the first access set, the first edge set, the connected subgraph and the first root node, wherein the first queue, the first access set and the first edge set are initially empty; Iterate the following process until each topological node in the connected subgraph is traversed, and obtain the causal graph corresponding to the connected subgraph based on the first access set and the first edge set after the iteration: Adding the first root node to the first queue and the first access set; Remove the first root node from the first queue, and add a second topological node to the first queue and the first access set, wherein the second topological node is a topological node having a first topological connection edge with the first root node in the connected subgraph; The first topological connection edge is added to the first edge set, and the second topological node is used as a new root node.

6. The method according to claim 4, characterized in that The constructing the causal graph based on the connected components comprises: In the case where multiple connected components cannot be connected through the third topological node, determine the degree of each topological node in the first connected component, and use the fourth topological node as the second root node of the first connected component, wherein the third topological node is any topological node that exists in the network topological graph and does not exist in the network alarm topological graph, the fourth topological node is the topological node with the largest degree in the first connected component, and the first connected component is any connected component that cannot be connected through the third topological node; Constructing a causal graph corresponding to the first connected component based on the second queue, the second access set, the second edge set, the first connected component and the second root node, wherein the second queue, the second access set and the second edge set are initially empty; Iterate the following process until each topological node in the first connected component is traversed, and obtain the causal graph corresponding to the first connected component based on the second access set and the second edge set after the iteration: Adding the second root node to the second queue and the second access set; Remove the second root node from the second queue, and add a fifth topological node to the second queue and the second access set, wherein the fifth topological node is a topological node having a second topological connection edge with the second root node in the first connected component; The second topological connection edge is added to the second edge set, and the fifth topological node is used as a new second root node.

7. The method according to claim 1, characterized in that Determining key alarm information based on the cause-effect diagram includes: The alarm device corresponding to the first storage location in the access set corresponding to the causal graph is used as the key alarm device; The target alarm information corresponding to the key alarm device is determined as the key alarm information.

8. The method according to claim 7, characterized in that The method further comprises: Determine, based on the edge set corresponding to the causal graph, a sub-alarm device associated with the key alarm device; Determine multiple sub-alarm devices of the same key alarm device as an alarm set; An alarm prompt is generated based on the alarm set, and the alarm prompt is pushed to the user terminal, wherein the alarm prompt includes at least the key alarm device and the key alarm information and the multiple sub-alarm devices in the alarm set and the target alarm information corresponding to each sub-alarm device.

9. A device for processing alarm information, characterized in that: include: An acquisition module, used to acquire alarm information generated by multiple alarm devices, and classify the alarm information according to the type of alarm device; A collection module, used to collect target alarm information corresponding to each type of alarm device based on a time sliding window, wherein the target alarm information is alarm information corresponding to a time range indicated by the time sliding window; A construction module, configured to construct a causal graph based on the target alarm information and the topological relationship between the network devices, wherein the causal graph is used to indicate the causal relationship of information propagation between the target alarm information; A determination module is used to determine key warning information based on the cause-effect diagram.

10. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the alarm information processing method according to any one of claims 1 to 8.

11. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the method for processing alarm information as described in any one of claims 1 to 8 when running.

12. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the method for processing alarm information described in any one of claims 1 to 8 is implemented.

Images