Transmission network fault positioning method, system and device and storage medium

Abstract

The invention discloses a transmission network fault positioning method, system and device and a storage medium, and relates to the field of communication, and the method comprises the steps: firstly, collecting network data to construct a multi-granularity network topology model, then obtaining original alarm data, analyzing the topology association relationship between alarms, and obtaining a multi-granularity network topology model; and mining horizontal peer association and vertical upstream and downstream association among the alarm objects, and identifying multi-alarm data of each alarm object. Thirdly, constructing an associated alarm directed graph based on the multi-alarm data, and performing associated alarm compression on the associated alarm directed graph to obtain a compressed alarm set; and finally, constructing an alarm propagation graph based on the compressed alarm set and the multi-granularity network topology model, querying the alarm propagation graph through a reverse hierarchical sorting algorithm, and determining a root alarm. According to the method, through innovative methods such as topological modeling, association mining, graph compression and reverse sequencing, alarm data and a topological structure are closely combined, an alarm propagation rule is analyzed, and fault root causes are diagnosed.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a transmission network fault location method, system, device and storage medium. Background Art

[0002] With the continuous expansion of network scale and the increasing variety of services, the fault diagnosis and location of transmission networks are facing unprecedented challenges. Traditional network fault location mainly relies on the experience of operation and maintenance personnel, who manually analyze massive amounts of alarm data to gradually find the root cause of the fault. This method is not only inefficient, but also easily affected by human factors, making it difficult to cope with the current complex and changing network environment. Summary of the invention

[0003] The present application provides a transmission network fault location method and system for improving the efficiency and accuracy of fault troubleshooting.

[0004] In a first aspect, the present application provides a transmission network fault location method, the method comprising: Collect physical connection data, logical connection data and service bearer relationship data in the transmission network, and build a multi-granularity network topology model based on the physical connection data, logical connection data and service bearer relationship data; Obtain the original alarm data in the transmission network, and analyze the topological association between different alarms based on the original alarm data and the multi-granularity network topology model; Mining the topological associations between different alarms to obtain horizontal peer associations and vertical upstream and downstream associations between the alarm objects, and based on the identification of horizontal peer associations and vertical upstream and downstream associations, determining the multiple alarm data of each alarm object within a specific time window; A related alarm directed graph is constructed based on multiple alarm data, and related alarms are compressed based on the related alarm directed graph to obtain a compressed alarm set; An alarm propagation graph is constructed based on the compressed alarm set and the multi-granularity network topology model, and the alarm propagation graph is queried through a reverse hierarchical sorting algorithm to determine the root alarm.

[0005] By adopting the above technical solution, a multi-granularity network topology model is constructed by collecting physical connection data, logical connection data and service bearer relationship data in the transmission network. This model not only reflects the physical connection relationship between network devices, but also depicts the protocol communication association between logical network elements and the bearer mapping relationship of service data in the network. Compared with a single physical topology, the multi-granularity network topology model fully expresses the network connection semantics at different semantic granularities such as devices, network elements, and services, providing richer context information for subsequent refined alarm correlation analysis.

[0006] Based on the multi-granularity network topology model, the present invention performs a topological correlation analysis on the acquired original alarm data. By mapping the alarms to the corresponding entities in the topological model, extracting the topological correlation features of the alarms under multi-granularity semantics, and calculating the topological correlations between different alarms, the semantic dependencies between the alarms are revealed. Compared with traditional methods, the correlation analysis of the present invention is not limited to the alarm content itself, but makes full use of the topological context of the alarm, and mines the horizontal same-level correlations and vertical upstream and downstream correlations between alarms. This multi-dimensional correlation mechanism can deeply characterize the propagation impact of alarms in complex network topologies, and provide more comprehensive semantic constraints for fault tracing.

[0007] By introducing a time window, the present invention can identify multiple alarm sequences for each alarm object. These multiple alarm data are constructed into a related alarm directed graph, which intuitively expresses the causal semantics between alarms. On this basis, an innovative method for compression of related alarms is proposed. This method uses a graph clustering algorithm to discover the associated cluster structure between alarms, and through homogeneity analysis and redundant filtering, it realizes double-layer compression of intra-cluster and inter-cluster alarms, while retaining the key alarm semantics to the maximum extent, greatly reducing the data scale for subsequent processing. Compared with existing alarm compression methods, the present invention fully considers the global correlation of the graph structure, and the accuracy and efficiency of alarm compression are higher.

[0008] Finally, the compressed alarm set is mapped to the multi-granularity network topology to construct an alarm propagation graph. This graph model intuitively depicts the propagation path and diffusion range of alarms in the network. Based on this, a reverse hierarchical sorting algorithm is designed. This algorithm makes full use of the hierarchical semantics of the multi-granularity topology, and recursively screens out the root alarms with the maximum propagation strength by tracing back the key propagation path, starting from the leaf alarm node. Compared with forward search, reverse sorting can quickly lock the most suspicious root cause alarm in massive alarm data, and give the diagnostic confidence through the scoring mechanism, which greatly improves the efficiency and accuracy of fault location.

[0009] In a second aspect of the present application, a transmission network fault location system is provided, the system comprising: A multi-granularity network topology model building module is used to collect physical connection data, logical connection data and service bearer relationship data in the transmission network, and build a multi-granularity network topology model based on the physical connection data, logical connection data and service bearer relationship data; A topology correlation analysis module is used to obtain the original alarm data in the transmission network and analyze the topology correlation between different alarms based on the original alarm data and the multi-granularity network topology model; The multi-alarm data determination module is used to mine the topological associations between different alarms, obtain the horizontal same-level associations and vertical upstream and downstream associations between the mined alarm objects, and determine the multi-alarm data of each alarm object within a specific time window based on the identification of the horizontal same-level associations and vertical upstream and downstream associations; The associated alarm compression module is used to construct an associated alarm directed graph based on multiple alarm data, and to compress the associated alarm directed graph based on the associated alarm directed graph to obtain a compressed alarm set; The root alarm determination module is used to construct an alarm propagation graph based on the compressed alarm set and the multi-granularity network topology model, and query the alarm propagation graph through a reverse hierarchical sorting algorithm to determine the root alarm.

[0010] In a third aspect of the present application, a computer storage medium is provided, wherein the computer storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the above method steps.

[0011] In the fourth aspect of the present application, an electronic device is provided, including a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes the above method.

[0012] In summary, one or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: 1. By collecting physical connection data, logical connection data and service bearer relationship data in the transmission network, a multi-granularity network topology model is constructed. This model not only reflects the physical connection relationship between network devices, but also depicts the protocol communication association between logical network elements and the bearer mapping relationship of service data in the network. Compared with a single physical topology, the multi-granularity network topology model fully expresses the network connection semantics at different semantic granularities such as devices, network elements, and services, providing richer context information for subsequent refined alarm correlation analysis.

[0013] 2. First, the present application performs baseline calibration on the real-time response signal data to obtain preliminary response signal data. Baseline calibration is a key link in signal processing, and its purpose is to eliminate interference such as DC components and drift in the signal, so that the signal always fluctuates around the zero point. Through baseline calibration, interferences such as low-frequency noise and baseline drift in the real-time response signal data are effectively suppressed, the dynamic range of the signal is expanded, and the signal-to-noise ratio is significantly improved. The preliminary response signal data is more "pure" than the original data, which lays a good foundation for subsequent processing. Secondly, the preliminary response signal data is filtered to obtain the target real-time response signal. Filtering is a key means to further improve the signal quality on the basis of baseline calibration. Through filtering, impurities such as high-frequency noise and random interference remaining in the preliminary response signal data are "filtered" out, and the smoothness and continuity of the signal are enhanced. The target real-time response signal is the "result" after filtering, which faithfully reflects the real response characteristics of the object under test, and provides high-quality data support for subsequent feature extraction, pattern recognition and other analyses.

[0014] 3. The present application clusters the related alarm directed graph through a graph clustering algorithm to obtain multiple related clusters. Graph clustering is an important method for graph data analysis, and its purpose is to divide closely related nodes into the same cluster according to the association relationship between the nodes, forming several internally compact and externally distant related clusters. Through graph clustering, the related alarm directed graph is divided into multiple "small groups", the correlation between members within each group is strong, and the correlation between different groups is weak. This process is like "grouping like" for alarms, making subsequent intra-cluster compression and inter-cluster compression more targeted. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A schematic diagram of a flow chart of a transmission network fault location method provided in an embodiment of the present application; Figure 2 An architecture diagram of a transmission network fault location system provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0016] In order to enable technicians in this field to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments.

[0017] In the description of the embodiments of the present application, words such as "for example" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "for example" or "for example" is intended to present related concepts in a specific way.

[0018] In the description of the embodiments of the present application, the term "multiple" means two or more. For example, multiple devices refer to two or more devices, and multiple screen terminals refer to two or more screen terminals. In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "include", "comprise", "have" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0019] In order to facilitate understanding of the method and system provided by the embodiments of the present application, before introducing the embodiments of the present application, the background of the embodiments of the present application is first introduced.

[0020] In today's rapidly developing information age, the network has become a key infrastructure supporting all walks of life. With the continuous expansion of network scale and the increasing variety of services, the complexity of the transmission network has increased exponentially. In such a complex network environment, fault problems seem to have become commonplace. However, the occurrence of network failures will not only lead to business interruptions, but also cause a large amount of economic losses and even have an adverse impact on social stability. Therefore, quickly and accurately diagnosing and locating network failures has become a severe challenge for operation and maintenance personnel.

[0021] For a long time, traditional network fault location has mainly relied on the professional experience and intuition of operation and maintenance personnel. When a network failure occurs, the operation and maintenance personnel need to manually collect and analyze a large amount of alarm data, judge the possible cause of the failure based on personal experience, and gradually find the root cause of the failure. Although this manual diagnosis method can solve the problem to a certain extent, its low efficiency and high labor cost make it difficult to meet the current network operation and maintenance needs.

[0022] After the background introduction of the above content, those skilled in the art can understand the problems existing in the prior art. The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments.

[0023] On this basis, the present application embodiment provides a transmission network fault location method, see Figure 1 , Figure 1 A flow chart of a transmission network fault location method provided in an embodiment of the present application, which method can be implemented by a computer program or can be run as an independent tool application, includes: S101, collecting physical connection data, logical connection data and service bearer relationship data in the transmission network, and building a multi-granularity network topology model based on the physical connection data, logical connection data and service bearer relationship data; Specifically, in order to fully characterize the connection semantics of the transmission network, the present invention first collects the physical connection data, logical connection data and service bearer relationship data in the transmission network. Among them, the physical connection data reflects the physical link connection relationship between network devices, such as optical fiber, cable, etc.; the logical connection data represents the logical communication association between network devices based on specific protocols, such as the routing relationship of the IP layer, the tunnel relationship of the MPLS layer, etc.; the service bearer relationship data describes the mapping relationship between network service data and network entities, such as the network nodes and links through which the service data flow passes.

[0024] After completing data collection, the present invention constructs a multi-granularity network topology model based on physical connection data, logical connection data and service bearer relationship data. Specifically, first, the underlying physical topology map is generated according to the physical connection data, the nodes represent network devices, and the edges represent physical links between devices. Then, on the basis of the physical topology map, logical connection relationships are added according to the logical connection data to form a logical topology map. The nodes in the logical topology map represent logical network elements on network devices, such as router interfaces at the IP layer, LSP endpoints at the MPLS layer, etc.; the edges in the logical topology map represent communication associations between logical network elements, such as routing at the IP layer, tunnels at the MPLS layer, etc. Finally, according to the service bearer relationship data, the service data flow is mapped in the logical topology map to form a service bearer topology map. The service bearer topology map intuitively shows the transmission path and bearer relationship of service data on logical network elements and physical devices. By integrating information in multiple dimensions of physical connection, logical connection and service bearer, the multi-granularity network topology model forms a comprehensive and three-dimensional network connection view.

[0025] Based on the above embodiment, as an optional embodiment, a multi-granularity network topology model is constructed based on physical connection data, logical connection data and service bearer relationship data, including: S201, constructing a physical connection topology based on physical connection data; Specifically, the physical connection topology reflects the actual physical connection relationship between network devices and is the lowest-level infrastructure view of the network. The specific process of constructing the physical connection topology is as follows: First, extract the key elements in the physical connection data, including device name, device type, interface information, link information, etc. Then, construct an undirected graph with the device as the node and the physical link between the devices as the edge. The attributes of each node include the device name, device type, and location of the computer room, and the attributes of each edge include link bandwidth, link type, fiber length, etc. Next, perform connectivity analysis on the constructed undirected graph to identify the physically connected subnets in the network, and divide the subnets into different levels based on the size of the subnets, node type distribution, and other characteristics. Finally, consider the network scale, topology, geographical distribution, and other factors, and optimize the layout of the physical connection topology so that it can intuitively and orderly present the hierarchical structure of the physical composition of the network.

[0026] S202, constructing a logical connection topology based on the logical connection data; Specifically, first, the device nodes in the physical connection topology are divided according to logical rules such as location proximity, functional similarity, and role consistency to form several logical device groups. The physical devices in each logical device group are logically regarded as a whole. Then, taking the logical device group as a unit, the key attributes (such as bandwidth, number of ports, protocol type, IP address segment, etc.) of the physical device nodes in each group are extracted, and these attributes are aggregated and fused to generate a logical network element with comprehensive attributes. Each logical network element corresponds to a logical device group and inherits the underlying characteristics of the physical device nodes in the group. In this way, multiple physical device nodes are abstracted and summarized into a logical unit, which greatly simplifies the representation granularity of the network. Next, the connectivity relationship between different logical network elements is analyzed. If there are hierarchical physical links between the physical devices contained in two logical network elements, a logical connection is established between the two logical network elements. The newly generated logical connection will carry the aggregated traffic of these physical links, and its attributes (such as bandwidth, etc.) depend on the superposition of the underlying physical link attributes. This step realizes the high-level description of the interconnection relationship between network areas. Furthermore, considering the hierarchical distribution of logical network elements in the network, logical network elements are divided into different layers such as core layer, aggregation layer, access layer, etc., forming a hierarchical topology of the logical network. This hierarchical semantics helps to understand the functional positioning and action boundaries of each part of the network.

[0027] S203, constructing a service bearer relationship topology based on the service bearer relationship data; Specifically, first, the metadata of each business node in the network is aggregated and collected, including key attributes such as the name, type, user group, service content, and performance requirements of the business. These metadata outline the outline characteristics of each business. Then, the interaction between different businesses is deeply analyzed to refine the business dependency data. Specifically, the resource requirements generated by a business for other businesses in order to realize its own services are sorted out, as well as the services provided by the business to other businesses. These data reflect the service supply and consumption relationship between businesses and reveal the directionality of business interactions.

[0028] On the basis of obtaining business attribute metadata and business dependency data, the business is abstracted into topological nodes, and the bearer relationship between the businesses is abstracted into directed edges, thereby constructing the business bearer relationship topology. In this topology, the starting point of each directed edge represents the service provider, the end point represents the service demander, and the weight attribute on the edge reflects the service dependency strength. Further analyze and calculate the key parameters of the business bearer relationship topology. For example, calculate the in-degree and out-degree of each business node. The in-degree reflects the degree of dependence of the business on external services, and the out-degree reflects the popularity of the services provided by the business to the outside world; calculate the betweenness centrality of each business node to reflect the critical degree of the business in the entire business network; calculate the quality attributes such as latency, packet loss rate, and jitter of each business link to characterize the health level of the business interaction channel. Next, use the business bearer relationship topology to carry out business anomaly propagation analysis. When a business node or link fails, deduce the diffusion path of the fault impact in the topology and identify the affected associated businesses. Then take targeted anomaly demarcation and isolation measures to curb the spread of faults and ensure the continuity of core businesses.

[0029] S204, vertically integrate the physical connection topology, the logical connection topology, and the service bearing topology to obtain a multi-granularity network topology model.

[0030] Specifically, on the basis of constructing the physical connection topology, logical connection topology and service bearing topology in the present invention, the three topologies are further vertically integrated to finally obtain a multi-granularity network topology model. The construction of the multi-granularity network topology model aims to connect the physical perspective, logical perspective and service perspective of network management, form a panoramic information map of the network, and realize the full-dimensional visualization, global perception and full-process closed loop of network operation and maintenance.

[0031] S102, obtaining original alarm data in the transmission network, and analyzing the topological association relationship between different alarms based on the original alarm data and the multi-granularity network topology model; Specifically, after constructing the multi-granularity network topology model, the present invention further obtains the original alarm data in the transmission network. The original alarm data is the log information automatically generated by the network equipment or monitoring system when an abnormal situation is detected, which contains multiple attributes such as the time when the alarm occurs, the alarm source, the alarm type, the alarm level, and the alarm content. These alarm data contain important clues to the occurrence of network failures and are the basis for fault diagnosis.

[0032] After obtaining the original alarm data, the present invention analyzes the topological association relationship between different alarms based on the original alarm data and the multi-granularity network topology model. Specifically, first, according to the alarm source information in the alarm data, each alarm is mapped to the corresponding network entity in the multi-granularity network topology model to determine the location coordinates of the alarm in the physical layer, logical layer and business layer. Then, based on the multi-granularity network topology model, the topological features of the alarm at different semantic granularities are extracted, such as the connection relationship of the alarm source in the physical topology, the dependency relationship in the logical topology, the transmission relationship in the business topology, etc. Next, the topological correlation between different alarms is calculated, considering the semantic association of the alarm source in multiple dimensions such as physical topology, logical topology, and business topology, and the horizontal peer relationship and vertical upstream and downstream relationship between alarms are characterized.

[0033] By analyzing the topological association relationship between alarms, the present invention makes full use of the semantic attributes of alarm data and the structural semantics of network topology, revealing the mutual influence and propagation rules of alarms in complex network environments. Compared with the method of association based solely on alarm content, topological association analysis takes into account the network environment and contextual semantics of alarm generation, and can deeply understand the internal connection between alarms and discover the association patterns hidden behind massive alarm data.

[0034] Based on the above embodiment, as an optional embodiment, the topological association relationship between different alarms is analyzed based on the original alarm data and the multi-granularity network topology model, including: S301, extracting the original alarm data attributes to obtain key alarm attributes, and according to the key alarm attributes, associating each alarm with the topological entity of the corresponding granularity level in the multi-granularity network topology model to form an "alarm-topological entity" mapping table; Specifically, on the basis of constructing a multi-granularity network topology model in the present invention, the topological association relationship between different alarms is further analyzed based on the original alarm data and the multi-granularity network topology model. The purpose of analyzing the topological association relationship of alarms is to reveal the network semantic basis for the generation of alarms and to explore the position and role of alarms in the overall network, so as to more comprehensively grasp the essential connotation of alarms and more accurately implement the traceability analysis and impact assessment of alarms. This is a key step in achieving the transition from alarm management to network management.

[0035] The first step in analyzing the topological association between different alarms is to extract the attributes of the original alarm data and obtain the key alarm attributes. Specifically, from the massive and complex alarm information flow, identify and filter the key metadata of the alarm, such as the time when the alarm was generated, the network element where the alarm was generated, the name of the alarm, the level of the alarm, the description of the alarm, etc. These key attributes outline the basic outline of each alarm and are the basis for further association analysis.

[0036] After the key alarm attributes are extracted, the multi-granularity network topology model can be used to associate each alarm with the topological entity of the corresponding granularity level. Specifically, the key alarm attributes are analyzed to determine whether the alarm is caused by a physical layer fault, a logical layer fault, or a service layer fault, and then the alarm is mapped to the corresponding network element node or link of the physical connection topology, logical connection topology, or service bearer topology. Through this semantic association of "alarm-topology entity", each alarm is given network topology semantics, so that it can be directly mapped with the physical world, logical world, and service world of the network.

[0037] When implementing the association mapping between alarms and topological entities, it is necessary to make full use of the unified mapping identification mechanism in the multi-granularity network topology model. The key attributes of each alarm often carry some identification information that can indicate its network affiliation, such as device name, port number, IP address, VLAN ID, subnet ID, service ID, etc. These identification information correspond to the mapping identifiers of each node and link in the multi-granularity network topology model. By comparing and analyzing the alarm attribute identifier and the topology mapping identifier, the alarm can be quickly and accurately associated with the corresponding topological entity.

[0038] After the association mapping between alarms and topological entities is completed, an "alarm-topological entity" mapping table is formed. This mapping table records the topological node or link to which each alarm belongs, as well as the topological granularity level of the belonging relationship. By querying the "alarm-topological entity" mapping table, you can quickly locate the "identity coordinates" of each alarm in the physical world, logical world, and business world, and trace its network semantic origin.

[0039] S302, traversing each alarm in the "alarm-topology entity" mapping table to extract the associated features of each alarm in the multi-granularity topology environment, and obtaining an alarm topology feature vector; Specifically, on the basis of forming the "alarm-topology entity" mapping table, the present invention further traverses each alarm in the "alarm-topology entity" mapping table, extracts the associated features of each alarm in a multi-granularity topological environment, and finally obtains the alarm topology feature vector. The purpose of extracting the alarm topology feature vector is to depict the network semantic portrait of the alarm from a multi-dimensional perspective, quantify the status attributes of the alarm in the global network, and lay a mathematical foundation for in-depth analysis of the internal associations of different alarms.

[0040] The specific steps to extract the alarm topology feature vector are as follows: First, traverse the "alarm-topology entity" mapping table and analyze the topology belonging of each alarm one by one. By querying the mapping table, determine the topology granularity level (physical layer, logical layer or business layer) to which the current alarm is mapped, as well as the specific topological node or link to which it belongs.

[0041] After the topological affiliation of the alarm is clarified, the associated features of the alarm can be extracted from the network topology of the corresponding granularity. Specifically, there are two types of features: one is the attribute features of the alarm itself, such as the alarm level, type, occurrence time, duration, etc. These features describe the severity and urgency of the alarm itself; the other is the attribute features of the topological entity to which the alarm belongs, such as the centrality, clustering coefficient, load capacity, etc. of the entity, which reflect the importance of the network location where the alarm occurs.

[0042] When extracting the alarm's own attribute characteristics, focus on the OID (Object Identifier) ​​information generated by the alarm. OID is the unique identifier of the alarm and carries many key attributes of the alarm. By parsing the alarm OID, the alarm's level, type, occurrence time and other characteristic parameters can be accurately extracted.

[0043] When extracting the attribute features of the entity to which the alarm belongs, make full use of the multi-granularity network topology model to perform multi-level and multi-perspective topological calculations. For example, in the physical connection topology, calculate the point degree centrality of the device node where the alarm is located to evaluate the connectivity importance of the device in the network; in the logical connection topology, calculate the betweenness centrality of the logical link where the alarm is located to judge the key influence of the logical link on the operation of the entire network; in the business bearer topology, analyze the impact of the health status of the business link where the alarm is located on the service level of related core businesses. By comprehensively evaluating the correlation characteristics of alarms at different topological granularities, the network semantic status of alarms can be fully reflected.

[0044] After extracting the associated features of the alarm, the alarm topology feature vector can be constructed. From a mathematical point of view, the alarm topology feature vector is a multidimensional quantity, and each dimension corresponds to a topological associated feature parameter of the alarm. For example, the feature vector of an alarm can be expressed as (level = important, type = link interruption, occurrence time = 2022-01-01 12:00:00, physical connectivity = 5, logical betweenness = 0.8, business health = 0.6, ...). Through this vectorized representation, the originally semantically ambiguous alarms are given rigorous mathematical connotations. Mathematical operations such as similarity calculation and cluster analysis can be performed between the feature vectors of different alarms to reveal the intrinsic connection between the alarms.

[0045] S303: Calculate the topological semantic correlation between different alarms based on the alarm topology feature vector, and determine the topological association relationship between different alarms based on the correlation.

[0046] Specifically, after extracting the topological feature vector of each alarm, the present invention further calculates the topological semantic correlation between different alarms based on the alarm topological feature vector, and determines the topological association relationship between different alarms based on the correlation. The purpose of analyzing the topological association relationship of different alarms is to reveal the internal connection behind seemingly independent alarms and find the "culprit" behind the alarm blowout, so as to carry out coordinated disposal of alarms from a global perspective and root cause, and avoid local treatment of treating the symptoms without addressing the root cause.

[0047] The specific steps for calculating the topological semantic correlation between different alarms are as follows: First, based on the alarm topological feature vector constructed above, calculate the similarity between different alarm feature vectors. Common similarity calculation methods include Euclidean distance, cosine similarity, Pearson correlation coefficient, etc. Among them, Euclidean distance describes the proximity of two vectors in spatial position. The smaller the distance, the more similar the two alarms are in topological features; cosine similarity describes the consistency of the two vectors in direction. The greater the similarity, the more consistent the feature distribution trends of the two alarms; Pearson correlation coefficient describes the linear correlation between the two vectors. The larger the coefficient, the positive correlation between the features of the two alarms.

[0048] In actual calculations, a variety of similarity metrics are used to comprehensively evaluate the topological semantic relevance of alarms. For example, if the spatial distance between alarm A and alarm B is 0.1, the directional similarity is 0.9, and the correlation coefficient is 0.8, it can be determined that alarm A and alarm B have a high topological correlation, and their roles in the network topology are very similar, and the time, cause, and impact of their occurrence are also likely to be similar. On the contrary, if the topological features of two alarms are very different, it means that their locations in the network are far apart, and the possibility of being associated with each other is very small.

[0049] When calculating alarm similarity, we should make full use of the hierarchical characteristics of multi-granularity network topology and examine the feature correlation at different granularities. The lower the granularity level, the higher the weight of similarity should be. For example, if the features of two alarms in the physical layer topology are very similar, the features in the logical layer topology are relatively similar, and the features in the service layer topology are quite different, the feature similarity of the physical layer topology should be given priority. This is because the physical connection of the network is the basis of the logical connection and service bearing, and the association of the physical layer can often be transmitted to the upper layer network. Therefore, the physical topology similarity should be the primary basis for judging the relevance of alarms.

[0050] By calculating the similarity of the alarm topology feature vectors, the degree of relevance of different alarms in network semantics can be characterized. Generally speaking, alarm pairs whose feature similarity exceeds the preset threshold can be considered to have a significant topological correlation. These related alarms are close in location in the network topology, and the causes and impacts of the faults are also likely to be the same. For these related alarms, it is necessary to coordinate analysis and joint processing to find out the "black hands" behind the scenes and avoid multiple governance and capriciousness.

[0051] S103, mining the topological associations between different alarms to obtain horizontal peer associations and vertical upstream and downstream associations between the mined alarm objects, and determining multiple alarm data of each alarm object within a specific time window based on the identification of the horizontal peer associations and the vertical upstream and downstream associations; Specifically, based on the multi-granularity network topology model, the adjacency matrix between network entities is constructed to characterize the connection relationship between network entities in the physical layer, logical layer, and business layer. Then, the alarm data is mapped to the adjacency matrix to form the association matrix between alarm objects. Next, association rule mining algorithms such as Apriori and FP-Growth are applied to find frequently co-occurring alarm association patterns in the association matrix and calculate their support and confidence. The support indicates the frequency of the association pattern in all alarms, and the confidence indicates the conditional probability that when one alarm exists, another alarm also appears. By setting the thresholds of support and confidence, the strongly associated alarm patterns are screened out to form a candidate set of horizontal peer associations and vertical upstream and downstream associations. Finally, combined with the network topology structure and business application semantics, the candidate associations are further evaluated and filtered to remove redundant or invalid associations and obtain the final set of horizontal peer associations and vertical upstream and downstream associations.

[0052] Mining the horizontal peer associations and vertical upstream and downstream associations between alarm objects can provide a deep understanding of the propagation mode and impact range of alarms in the network topology. Horizontal peer associations reveal the mutual influence and causal relationship between alarms at the same level, which helps to discover large-scale, batch-produced similar faults; vertical upstream and downstream associations depict the dependency and transmission relationship between alarms at different levels, which helps to trace the propagation path of faults at various network levels. Operation and maintenance personnel can use this association information to quickly determine the severity and impact range of the fault, identify the common root causes of batch alarms, infer the propagation path of the fault in the network, and then take targeted fault isolation and repair measures.

[0053] After mining the associations between alarm objects, the present invention further identifies multiple alarm data of each alarm object within a specific time window based on horizontal peer associations and vertical upstream and downstream associations. By setting a sliding time window, all alarm data falling within the window is collected, and the alarms are clustered using the association information, and multiple alarms with strong associations are aggregated into a multiple alarm sequence of an alarm object. This step can effectively compress the size of alarm data, convert scattered alarm items into compact alarm object representations, and retain the temporal characteristics and association semantics of the alarms.

[0054] It should be noted that "multiple alarm data" refers to a set of alarm data associated with an alarm object within a specific time window. These alarm data are obtained by mining the horizontal peer associations and vertical upstream and downstream associations between alarm objects.

[0055] Specifically, horizontal peer association refers to the association between different alarm objects in the same layer of the network topology. For example, in a certain layer of the transmission network (such as the IP layer or the optical layer), if there is a connection relationship between two network elements and they both have alarms at a similar time, there may be a horizontal peer association between the two alarm objects. Identifying horizontal peer associations helps to discover related alarms within the same layer and reveal the scope of fault impact in a local area.

[0056] Vertical upstream and downstream association refers to the association between alarm objects at different levels of the network topology. For example, if an interruption alarm occurs on a port of the underlying optical network, an interruption alarm may also occur on the port of the IP network router carried on it, and there is a vertical upstream and downstream association between the two. Identifying vertical upstream and downstream associations helps to discover cross-level alarm propagation paths and reveal the vertical impact of faults.

[0057] By mining horizontal peer associations and vertical upstream and downstream associations, other alarm objects closely related to a certain alarm object can be identified, and then the multiple alarm data of the alarm object in a specific time window (such as a period of time before and after the fault occurs) can be determined. These multiple alarm data reflect the time correlation between the alarm object and its related alarms, which helps to fully understand the fault context environment in which the alarm object is located.

[0058] For example, assuming that within a specific time window, through association mining, it is identified that alarm object A has horizontal peer associations with alarm objects B, C, and D, and vertical upstream and downstream associations with alarm objects E and F, then A's multi-alarm data includes A's own alarms and the related alarms of B, C, D, E, and F. These alarm data together constitute A's "one relative and two friends", reflecting A's "fault family tree", and provide rich clues for in-depth analysis of A's fault causes and impacts.

[0059] S104, constructing a related alarm directed graph based on the multiple alarm data, and compressing the related alarm directed graph based on the related alarm directed graph to obtain a compressed alarm set; Specifically, first, the multiple alarm sequences of each alarm object are represented as a node in the associated alarm directed graph. Then, the association relationship between the alarm sequences of different alarm objects is analyzed, including horizontal peer association and vertical upstream and downstream association. For horizontal peer association, that is, the concurrent or sequential relationship between alarms of different network elements, undirected edges are added between corresponding nodes to represent the peer influence between these alarm objects. For vertical upstream and downstream association, that is, the causal or transitive relationship between alarms at different network levels, directed edges are added between corresponding nodes, and the direction of the edge points from the cause alarm to the result alarm, indicating the propagation path of the alarm in the network. The weight value of the edge is calculated according to the strength of association or the degree of dependence. The greater the strength of association, the higher the weight value. In this way, the scattered multi-alarm data is integrated into a compact associated alarm directed graph, which completely retains the semantic characteristics and temporal characteristics of the alarm data, and at the same time reveals the complex topological association and logical dependency between alarms.

[0060] Based on the above embodiment, as an optional embodiment, a related alarm directed graph is constructed based on multiple alarm data, including: S401, extracting nodes from multiple alarm data to obtain alarm nodes; Specifically, we traverse multiple alarm data and analyze the basic information of each alarm record one by one. Alarm records usually contain key fields such as the unique identifier of the alarm, alarm name, alarm level, alarm description, alarm occurrence time, and alarm clearing time. This information is like the "identity card" of the alarm, and is an important clue to identify and distinguish different alarms.

[0061] When analyzing alarm records, different alarm instances are extracted based on the uniqueness of the alarm ID. Each alarm instance is considered a basic node in the directed graph of associated alarms. The attribute information of the node includes the alarm ID, alarm name, alarm level, etc. These attributes will be used as the "label" of the node for subsequent association analysis and graph algorithm design.

[0062] In order to ensure the accuracy and completeness of node extraction, the original alarm data needs to be cleaned and normalized. Alarm data cleaning mainly processes "dirty data" such as noise, missing values, and outliers in alarm records to improve data quality. Common cleaning methods include field completion, outlier removal, and duplicate item merging. Alarm data normalization extracts the format and content of alarms, eliminates heterogeneous differences between different alarm sources, and forms a unified alarm instance representation.

[0063] Through the above process, each alarm instance in the multi-alarm data is extracted as an independent node. These nodes are the basic "building blocks" of the directed graph of associated alarms and contain rich semantic information.

[0064] S402, performing node association on the alarm nodes based on multiple alarm data to obtain association edges between the alarm nodes; Based on the alarm nodes obtained above, the association strength between different nodes is calculated. The association strength describes the semantic relevance between two nodes and reveals the influence of one node on another. The calculation of association strength needs to comprehensively consider the multi-dimensional attributes of the node, such as alarm level, alarm type, alarm frequency, alarm clearing time, etc., to reflect the static characteristics of node association. At the same time, it is also necessary to analyze the evolution trajectory of the node in time, such as the order of occurrence of alarms, the duration of alarms, the occurrence cycle of alarms, etc., so as to depict the dynamic characteristics of node association.

[0065] For example, if the alarm level of node A is higher than that of node B, and the occurrence time of node A is earlier than that of node B, it can be inferred that node A may be the cause or precursor of node B, and the correlation strength between the two nodes is relatively high. For another example, if the alarm types of nodes C and D are the same, and the occurrence frequency of the two is close and the duration is similar, it can be inferred that the correlation strength between nodes C and D is relatively high, and there may be a common root cause behind them. Of course, the determination of node association also relies on expert experience and domain knowledge. Simple data calculation can only provide a reference, and human wisdom is also needed to train, calibrate and interpret the association model.

[0066] When calculating the node association strength, the present invention innovatively introduces network topology features. The above steps have obtained the topological feature vector and topological association of each alarm, and these factors are also included in the calculation of association strength. Intuitively speaking, if two nodes are close in position in the network topology, the connected devices and links are similar, and the services and customers involved are highly overlapping, their association strength will be greatly improved. This is because the network topology is a carrier where elements such as devices, links, protocols, and services are interwoven, and the associations in the topology can often transmit and amplify the semantic connections between nodes. The topological perspective allows the analysis of node associations to stand on the global commanding heights and see the "barrel effect" behind local alarms.

[0067] By comprehensively considering the static properties, dynamic characteristics and topological factors of the alarm nodes, the strength of the association between nodes can be comprehensively evaluated.

[0068] S403: construct an associated alarm directed graph based on associated edges between alarm nodes and the alarm nodes.

[0069] Specifically, first, with the alarm node as the basic element and the associated edge as the connecting link, the classical definition of graph theory is used to standardize the mathematical form of the associated alarm directed graph. Let the alarm node set be V, the associated edge set be E, and the associated alarm directed graph be G=(V, E). Here, V={v1, v2, ..., vn}, where vi represents the i-th alarm node and n is the total number of nodes; E={e1, e2, ..., em}, where ej represents the j-th directed edge and m is the total number of edges. Each edge ej has its starting point and end point, which correspond to the two nodes connected by the edge, and the direction of the edge points from the starting point to the end point. In this way, the mathematical model of the associated alarm directed graph is strictly defined through elements such as nodes, edges, directions, and weights. Secondly, starting from the alarm nodes and associated edges, the data structure of the associated alarm directed graph is constructed. Common graph data structures include adjacency matrices and adjacency lists. The adjacency matrix is ​​a two-dimensional array, the rows and columns of the matrix correspond to the nodes of the graph, and the matrix elements indicate whether there are edges connecting the nodes and the weight of the edges. The adjacency list is a linked list array, each element of the array represents a node, and the edges connected to the node form a linked list. The advantages and disadvantages of the two data structures depend on the scale and sparsity of the graph. When the number of nodes is large and the number of edges is relatively small, the adjacency list can save more storage; when the graph is dense, the adjacency matrix is ​​more naturally expressed. Again, based on the defined data structure, the extracted alarm nodes and associated edges are loaded into it, thereby constructing a directed graph of associated alarms in memory.

[0070] Based on the above embodiment, as an optional embodiment, the associated alarm directed graph is compressed based on the associated alarm directed graph to obtain a compressed alarm set, including: S601, clustering the associated alarm directed graph by using a graph clustering algorithm to obtain multiple associated clusters; Specifically, starting from the topological structure of the graph, the closeness of the nodes in the graph is examined. The closeness can be measured by indicators such as the degree of a node, the distance between nodes, and the betweenness of nodes. Generally speaking, nodes in the same association cluster tend to have a higher degree of closeness. They are closer in the graph and have denser connections. Based on this prior knowledge, a clustering method based on connected subgraphs can be used, such as the famous Girvan-Newman algorithm.

[0071] S602, analyzing the internal alarms of each associated cluster, determining the semantic redundancy of the internal alarm nodes, and determining the compressible homogeneous alarms in the internal alarms based on the semantic redundancy; Specifically, a semantic analysis is performed on the internal alarm nodes to determine whether there is redundancy in the semantic information in the internal alarm nodes. Semantic redundancy refers to the situation where the semantic meanings of network faults reflected by multiple alarm nodes are repeated or similar. The purpose of semantic redundancy analysis is to find compressible homogeneous alarms. Then, based on the results of the semantic redundancy analysis, compressible homogeneous alarms in the internal alarms are determined. Homogeneous alarms refer to alarms with the same or similar semantic information. These alarms reflect faults of the same type or at the same location in the network and can be compressed without losing the key information required for fault location. The method for determining compressible homogeneous alarms is to extract semantic features for each alarm node, calculate the semantic similarity between different alarm nodes, and if the semantic similarity is higher than a threshold, determine these alarm nodes as compressible homogeneous alarms.

[0072] S603, compressing internal alarms of the associated cluster based on compressible homogeneous alarms to obtain a compressed simplified alarm sequence within the cluster; Specifically, a compressible set of homogeneous alarms is obtained for each associated cluster. These homogeneous alarms are highly similar in semantics and carry mostly overlapping information, so they can be safely compressed. The purpose of compression is to minimize the number of alarms while minimizing information loss, thereby reducing the complexity of alarm processing.

[0073] Secondly, cluster the compressible homogeneous alarms. Since homogeneous alarms are similar in semantic features, the clustering process can be very efficient. Common clustering algorithms such as K-Means and DBSCAN can be applied. The goal of clustering is to divide homogeneous alarms with high semantic redundancy and strong mutual substitution into the same cluster, and each cluster can be represented by its central alarm. The number of clusters can be adaptively determined based on the scale and distribution of homogeneous alarms, or an upper threshold can be set.

[0074] Then, for each homogeneous alarm cluster, its central alarm is selected as the representative of the cluster to form a compressed and streamlined alarm sequence within the cluster. The so-called central alarm is the alarm with the highest average similarity with other alarms in the cluster, which best represents the semantic characteristics of the cluster. The process of selecting the central alarm is actually to further refine the essence in the homogeneous alarm cluster and remove relatively marginal alarms. Through this step, each homogeneous alarm cluster is condensed into a most representative alarm that carries the core semantic information of the cluster.

[0075] Finally, the condensed alarm sequences of all associated clusters are merged in the order of timestamps to form the final compressed alarm sequence of the associated cluster.

[0076] S604, performing homogeneity condition analysis on each association cluster, determining homogeneous association clusters among multiple association clusters, and compressing the homogeneous association clusters to obtain an aggregated alarm cluster; First, it is necessary to extract the feature vector of each association cluster. The feature vector of the association cluster integrates information from multiple dimensions, such as the scale, duration, alarm type distribution, and alarm attribute distribution of the association cluster. These features reflect the aggregation pattern of the association cluster in terms of time, space, type, and attribute. Through methods such as aggregation functions, statistical indicators, and distribution fitting, the multidimensional features of the association cluster are encoded into a compact vector representation to prepare for subsequent homogeneity analysis.

[0077] Based on the feature vectors of the associated clusters, the similarity between the associated clusters is calculated. Common similarity metrics include Euclidean distance, cosine similarity, Jaccard coefficient, etc. Similarity quantifies the proximity of the associated clusters in the multidimensional feature space. The higher the similarity, the more likely the failure modes and business scenarios expressed by the associated clusters are highly correlated. The similarity matrix can be used to characterize the homogeneity structure of the entire associated cluster set.

[0078] According to the preset homogeneity condition threshold, homogeneous association clusters are determined. The homogeneity condition comprehensively considers the feature similarity and business relevance of the association cluster. Association clusters that meet the feature similarity threshold (such as 0.8) and business relevance requirements (such as "the same business system") are identified as homogeneous association clusters. They are highly consistent in failure mode and business semantics and can be further compressed and merged. The setting of the homogeneity threshold requires a trade-off between compression rate and information fidelity, which is to maximize the merging of homogeneous clusters while avoiding the loss of key information due to excessive compression.

[0079] The identified homogeneous association clusters are compressed to form aggregated alarm clusters. The compression strategy can select the central cluster of the homogeneous association cluster as the representative of the aggregated cluster, or generate a new aggregated cluster to integrate the characteristics of the homogeneous association cluster. The alarm sequence of the aggregated alarm cluster is obtained by merging the simplified alarm sequence of the homogeneous association cluster, and the timestamp can be the earliest or latest timestamp of the homogeneous association cluster. At this point, the original massive alarm data is summarized into a few highly summarized and information-dense aggregated alarm clusters, and the alarm simplification process is completed. The compression of homogeneous association clusters can be performed recursively, and a sub-form aggregated cluster structure is constructed in multiple rounds and at multiple granularities.

[0080] S605 , integrating the compressed simplified alarm sequence within the cluster with the aggregated alarm cluster to obtain a compressed alarm set.

[0081] Specifically, the compressed simplified alarm sequence within each associated cluster is obtained. These simplified alarm sequences are obtained by compressing the homogeneous alarms within the associated clusters, and each associated cluster corresponds to a simplified alarm sequence. The simplified alarm sequence retains the core alarm information within the associated cluster, eliminates redundant homogeneous alarms, and greatly reduces the number of alarms. Secondly, the formed aggregated alarm cluster is obtained from step S604. The aggregated alarm cluster is obtained by compressing multiple homogeneous associated clusters, and each aggregated alarm cluster can be regarded as a representative of multiple homogeneous associated clusters. The aggregated alarm cluster realizes alarm simplicity at the cross-associated cluster level, and aggregates the homogeneous alarm patterns scattered in different associated clusters into a high-level alarm cluster. The aggregated alarm cluster further refines the core pattern of the alarm data and reflects a higher-level fault summary. Then, the simplified alarm sequence and the aggregated alarm cluster are integrated in the order of timestamps to form a compressed alarm set. Specifically, the simplified alarm sequence of each associated cluster is traversed and inserted into the compressed alarm set in the order of timestamps. For the aggregated alarm cluster, select its timestamp (which can be the earliest or latest timestamp) and insert it into the compressed alarm set in timestamp order. Through this timestamp alignment method, the compressed alarm set not only retains the time order of the streamlined alarm sequence, but also reflects the cross-cluster summary of the aggregated alarm cluster.

[0082] S105, constructing an alarm propagation graph based on the compressed alarm set and the multi-granularity network topology model, and querying the alarm propagation graph through a reverse hierarchical sorting algorithm to determine the root alarm.

[0083] Specifically, after completing the compression of associated alarms, the present invention further constructs an alarm propagation graph based on the compressed alarm set and the multi-granularity network topology model. The alarm propagation graph is a multi-level, multi-perspective fault propagation model that integrates the associated semantics and timing features in the compressed alarm set on the basis of the multi-granularity network topology model. It uses network entities as nodes, physical connections, logical dependencies, and business associations between entities as edges, maps compressed alarms to corresponding entity nodes, and timestamps nodes and edges according to the order in which the alarms occur, ultimately forming a heterogeneous information network that is unified in time and space and rich in semantics.

[0084] The key to constructing an alarm propagation graph is to fully integrate the semantic features of the compressed alarm set and the structural features of the network topology, and uniformly characterize the dynamic process of fault propagation in three dimensions: time, space, and semantics. Specifically, based on the multi-granularity network topology model, the network entities of the physical layer, logical layer, and business layer are abstracted as unified nodes, and the connection relationships of different granularity levels are abstracted as unified edges. Then, the alarm nodes in the compressed alarm set are mapped to the corresponding entity nodes, and the alarm type, alarm level, etc. of the nodes are marked according to the semantic attributes of the alarm. Next, according to the associated edges and directions between the alarm nodes, corresponding logical edges are established between the entity nodes to characterize the propagation path and impact range of the alarm in the network. At the same time, the timestamp of the alarm occurrence is attached to the alarm node and the propagation edge to characterize the temporal characteristics of fault propagation. Finally, based on the end-to-end path of the business data flow, the cross-layer propagation edges are associated and merged to construct a unified alarm propagation graph, which intuitively presents the full picture of fault propagation under multi-granularity semantics.

[0085] Based on the alarm propagation graph, the present invention queries the alarm propagation graph through a reverse hierarchical sorting algorithm to finally determine the root alarm. The root alarm is the source of all subsequent alarms and represents the ultimate goal of fault diagnosis. The basic idea of ​​the reverse hierarchical sorting algorithm is to start from the leaf node of the alarm propagation graph, hierarchically trace back and sort the alarm nodes in the opposite direction of the alarm propagation, until the source alarm located at the most upstream and without a parent node is found. Specifically, the leaf nodes are first sorted based on the timestamp of the alarm node, and the latest leaf node is regarded as the starting point of the backtracking. Then, according to the direction of the alarm propagation edge, all the parent nodes of the current node are identified, and the parent nodes are sorted based on the semantic attributes and weights of the edge, giving priority to the parent nodes with high alarm levels and strong association strength. Then, the above sorting process is recursively repeated for the preferred parent node and its subgraph until a source alarm without a parent node is found, or the entire propagation graph is traversed. In the backtracking process, a pruning strategy is used to dynamically maintain an optimal root alarm set to avoid repeated searches and invalid searches and improve query efficiency. Finally, the root alarm set is further screened and evaluated based on business semantics, and the final root alarm is determined by comprehensively considering factors such as the fault impact scope, fault duration, and alarm level.

[0086] Based on the above embodiment, as an optional embodiment, querying the alarm propagation graph through a reverse hierarchical sorting algorithm to determine the root alarm includes: S701, calculating the weight of each directed edge of the alarm propagation graph to obtain the propagation edge weight of each directed edge; Specifically, the propagation edge weight comprehensively considers multiple factors, such as the correlation of alarm types, the time difference of alarm occurrence, the similarity of alarm attributes, etc. These factors reflect the degree of influence of the antecedent alarm on the consequence alarm from different perspectives. For example, the higher the correlation of alarm types, the smaller the time difference, and the greater the attribute similarity, the stronger the influence of the antecedent alarm on the consequence alarm, and the greater the propagation edge weight should be.

[0087] In a specific embodiment, each directed edge in the alarm propagation graph is traversed to extract corresponding alarm attribute information, such as alarm type, timestamp, alarm attribute, etc. Using these attribute information, the propagation edge weight of each directed edge is calculated according to the set formula or algorithm. Common calculation methods include weighted summation, geometric mean, function mapping, etc. For example, indicators such as alarm type correlation, inverse of time difference, attribute similarity, etc. can be weighted summed to obtain the propagation edge weight. The distribution of weights needs to be adjusted according to business scenarios and expert experience to accurately reflect the impact mechanism of alarm propagation.

[0088] During the calculation process, you need to pay attention to the handling of some special cases. For example, for directed edges with too large a time difference, their propagation impact may already be very weak, and they need to be given a smaller weight or ignored directly. For another example, for certain key alarm types, their propagation impact may be extremely important, and they need to be given a higher weight. These special treatments can be achieved by setting thresholds, introducing business rules, etc.

[0089] By calculating edge by edge, we can finally get the propagation edge weight of each directed edge in the alarm propagation graph. These weights numerically represent the impact strength between alarms, just like the "measurement" of alarm propagation. The larger the propagation edge weight, the stronger the impact of the antecedent alarm on the consequence alarm, and the more critical its role in alarm propagation. Conversely, the smaller the weight, the weaker the impact of the antecedent alarm on the consequence alarm, and the less important its role in alarm propagation.

[0090] The introduction of propagation edge weights transforms the alarm propagation graph from an unweighted graph to a weighted graph, increasing the accuracy and depth of alarm propagation analysis. Based on the propagation edge weights, the importance indexes of alarm nodes, such as in-degree weight and out-degree weight, can be calculated to characterize the different roles of alarms in propagation, such as "source", "transit" and "convergence". This provides a quantitative basis for the subsequent determination of root alarms, making the determination of root alarms more accurate and objective.

[0091] S702, starting from the terminal leaf node of the alarm propagation graph, traverse the directed edges in reverse order to determine the propagation alarm node in the alarm propagation graph, and determine the terminal alarm node and all upstream alarm propagation nodes upstream of the terminal alarm node according to the propagation alarm node; Specifically, it is necessary to clarify the topological structure of the alarm propagation graph and find all the terminal leaf nodes. Terminal leaf nodes refer to nodes with no outgoing edges but only incoming edges in the alarm propagation graph, representing the end point of alarm propagation. These terminal leaf nodes are the starting point of reverse traversal, just like the "downstream exit" of alarm propagation.

[0092] Starting from each terminal leaf node, traverse the alarm propagation graph in reverse along the incoming edge. During the traversal process, determine the direct upstream node of the current node according to the direction of the directed edge. The direct upstream node refers to the node that is directly connected to the current node by an incoming edge, representing the direct "predecessor" alarm of the current node. Mark the direct upstream node as a propagation alarm node, indicating that it plays a "propagation" role in alarm propagation. Continue to traverse in reverse along the incoming edge of the propagation alarm node, and recursively determine the propagation alarm node further upstream until you reach a node without an incoming edge (i.e., the source node) or a node that has been traversed (i.e., a loop is formed). During the traversal process, record each propagation alarm node and the upstream and downstream relationships between them to generate a directed subgraph of the propagation alarm node. This subgraph depicts the complete propagation path from the terminal leaf node to the source node.

[0093] Repeat the above reverse traversal process for each terminal leaf node to obtain directed subgraphs of multiple propagation alarm nodes. Merge these subgraphs to obtain a directed graph of propagation alarm nodes covering all terminal leaf nodes. This directed graph reveals the overall context of alarm propagation and presents a complete causal chain from the terminal to the source.

[0094] During the reverse traversal process, you need to pay attention to the handling of some special cases. For example, when encountering a loop, you need to avoid repeated traversal, which can be handled by marking or pruning. For another example, when multiple upstream nodes converge to the same node, you need to comprehensively consider the impact of each upstream node and select the propagation path with the strongest impact. These special treatments can be achieved by setting traversal rules, introducing priorities, etc.

[0095] Through reverse traversal, the propagation alarm nodes in the alarm propagation graph, as well as the terminal alarm nodes and all their upstream propagation alarm nodes are finally determined. These nodes and their upstream and downstream relationships outline the backbone network of alarm propagation and reveal the key links of alarm causal transmission. The terminal alarm node represents the appearance of the problem, while the upstream propagation alarm node reveals the deep-seated cause of the problem. Through this causal chain, operation and maintenance personnel can analyze the root causes of alarms more comprehensively and systematically from the outside to the inside, following the cause and effect.

[0096] S703, sorting the upstream propagation alarm nodes according to the propagation edge weights, taking the upstream propagation alarm node with the largest propagation edge weight as the root alarm node, and determining the root alarm according to the alarm node.

[0097] Specifically, it is necessary to first extract the propagation edge weight of each upstream propagation alarm node. The propagation edge weight is calculated in step S701 and reflects the influence strength between alarm nodes. For each upstream propagation alarm node, find its corresponding incoming edge and extract the corresponding propagation edge weight value. These weight values ​​are like the "importance index" of the upstream nodes, quantifying their influence in alarm propagation.

[0098] According to the extracted propagation edge weight values, all upstream propagation alarm nodes are sorted. The sorting adopts the descending rule, that is, the larger the propagation edge weight, the higher the ranking. Nodes with large propagation edge weights mean that they have strong influence and play a key role in alarm propagation, and are more likely to be the root cause of the problem. Through sorting, upstream propagation alarm nodes are arranged in order from high to low importance, forming an orderly "importance queue".

[0099] The first node in the sorted upstream alarm propagation node queue, that is, the node with the largest propagation edge weight, is determined as the root alarm node. The root alarm node is the node with the greatest influence and the most likely to cause alarms among all upstream alarm propagation nodes, just like the "key hub" in the alarm propagation network. It carries the most alarm "flow" and is the "source of the problem". Determining the root alarm node means grasping the "bull's nose" of the problem, laying the foundation for subsequent root cause analysis and fault diagnosis.

[0100] Based on the determined root alarm node, the root alarm is further determined. The root alarm is the starting alarm corresponding to the root alarm node and causes the entire alarm propagation. It is the root cause of the problem. By associating the attribute information of the root alarm node, such as the alarm type, alarm object, alarm details, etc., a complete description of the root alarm is generated. This root alarm is like a "diagnostic report" that points out the essence of the problem and provides a basis for the operation and maintenance personnel to "prescribe the right medicine".

[0101] In the process of sorting and determining the root alarm, it is necessary to pay attention to the handling of some special cases. For example, when the propagation edge weights of multiple upstream propagation alarm nodes are the same and tied for first place, it is necessary to introduce other evaluation indicators, such as node degree, time sequence, etc., to further refine the sorting until the only root alarm node is determined. For another example, when the root alarm node corresponds to multiple alarms, it is necessary to comprehensively analyze the impact of each alarm and select the most critical and representative alarm as the root alarm.

[0102] See also Figure 2 , Figure 2 An architecture diagram of a transmission network fault location system provided in an embodiment of the present application, the transmission network fault location system may include: A multi-granularity network topology model building module 1 is used to collect physical connection data, logical connection data and service bearer relationship data in the transmission network, and build a multi-granularity network topology model based on the physical connection data, logical connection data and service bearer relationship data; A topology association analysis module 2 is used to obtain original alarm data in the transmission network and analyze the topology association between different alarms based on the original alarm data and a multi-granularity network topology model; The multi-alarm data determination module 3 is used to mine the topological association relationship between different alarms, obtain the horizontal same-level association and the vertical upstream and downstream association between the mined alarm objects, and determine the multi-alarm data of each alarm object within a specific time window based on the horizontal same-level association and the vertical upstream and downstream association identification; The associated alarm compression module 4 is used to construct an associated alarm directed graph based on multiple alarm data, and to compress the associated alarm directed graph based on the associated alarm directed graph to obtain a compressed alarm set; The root alarm determination module 5 is used to construct an alarm propagation graph based on the compressed alarm set and the multi-granularity network topology model, and query the alarm propagation graph through a reverse hierarchical sorting algorithm to determine the root alarm.

[0103] Please refer to Figure 3 The application also discloses an electronic device. Figure 3 The electronic device 300 may include: at least one processor 301 , at least one network interface 304 , a user interface 303 , a memory 305 , and at least one communication bus 302 .

[0104] The communication bus 302 is used to realize the connection and communication between these components.

[0105] The user interface 303 may include a display screen (Display) and a camera (Camera). Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0106] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0107] Among them, the processor 301 may include one or more processing cores. The processor 301 uses various interfaces and lines to connect various parts in the entire server, and executes various functions of the server and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 305, and calling data stored in the memory 305. Optionally, the processor 301 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field~Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 301 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 301, and it can be implemented separately through a chip.

[0108] The memory 305 may include a random access memory (RAM) or a read-only memory (Read~Only Memory). The memory 305 includes a non-transitory computer-readable medium. The memory 305 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 305 may optionally be at least one storage system located away from the aforementioned processor 301. Refer to Figure 3 , the memory 305 as a computer storage medium may include an operating system, a network communication module, a user interface module and an application program of a transmission network fault location method.

[0109] exist Figure 3In the electronic device 300 shown, the user interface 303 is mainly used to provide an input interface for the user and obtain the data input by the user; and the processor 301 can be used to call the application program storing the road assessment method in the memory 305. When executed by one or more processors 301, the electronic device 300 executes one or more methods in the above-mentioned embodiments. It should be noted that for the aforementioned method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited to the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required for the present application. In the above embodiments, the description of each embodiment has its own emphasis. For the parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0110] In the several implementations provided in this application, it should be understood that the disclosed system can be implemented in other ways. For example, the system embodiments described above are only schematic, such as the division of units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interfaces, and the indirect coupling or communication connection of the system or unit can be electrical or other forms.

[0111] The present application also provides a computer storage medium that can store multiple instructions, which are suitable for being loaded and executed by a processor as described above. Figure 1 The road assessment method of the embodiment shown in the figure can be found in the specific implementation process. Figure 1 The specific description of the illustrated embodiment will not be repeated here.

[0112] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0113] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory and includes N instructions for a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: various media that can store program codes, such as USB flash drives, mobile hard drives, magnetic disks or optical disks.

[0114] The above are only exemplary embodiments of the present disclosure and cannot be used to limit the scope of the present disclosure. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the disclosure of the specification and the truth of practice, those skilled in the art will easily think of other embodiments of the present disclosure.

[0115] This application is intended to cover any variation, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the art not described in the present disclosure. The description and examples are to be regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. A transmission network fault location method, characterized in that: The method comprises: Collecting physical connection data, logical connection data and service bearer relationship data in the transmission network, and building a multi-granularity network topology model based on the physical connection data, the logical connection data and the service bearer relationship data; Acquire original alarm data in the transmission network, and analyze the topological association relationship between different alarms based on the original alarm data and the multi-granularity network topology model; Mining the topological association relationship between the different alarms to obtain horizontal peer associations and vertical upstream and downstream associations between the mined alarm objects, and determining multiple alarm data of each alarm object within a specific time window based on the horizontal peer associations and the vertical upstream and downstream associations; Constructing an associated alarm directed graph based on the multiple alarm data, and compressing the associated alarm directed graph based on the associated alarm directed graph to obtain a compressed alarm set; An alarm propagation graph is constructed based on the compressed alarm set and the multi-granularity network topology model, and the alarm propagation graph is queried through a reverse hierarchical sorting algorithm to determine the root alarm.

2. The method according to claim 1, characterized in that The constructing of a multi-granularity network topology model based on the physical connection data, the logical connection data and the service bearer relationship data includes: constructing a physical connection topology based on the physical connection data; Building a logical connection topology based on the logical connection data; Constructing a service bearer relationship topology based on the service bearer relationship data; The physical connection topology, the logical connection topology, and the service bearing topology are vertically integrated to obtain the multi-granularity network topology model.

3. The method according to claim 1, characterized in that The analyzing the topological association relationship between different alarms based on the original alarm data and the multi-granularity network topology model includes: Extracting the original alarm data attributes to obtain key alarm attributes, and associating each alarm with a topological entity of a corresponding granularity level in the multi-granularity network topology model according to the key alarm attributes to form an "alarm-topological entity" mapping table; Traversing each alarm in the "alarm-topology entity" mapping table to extract the associated features of each alarm in a multi-granularity topology environment, and obtaining an alarm topology feature vector; Based on the alarm topology feature vector, the topological semantic correlation between different alarms is calculated, and the topological association relationship between different alarms is determined based on the correlation.

4. The method according to claim 1, characterized in that: The constructing a directed graph of associated alarms based on the multiple alarm data includes: Extracting nodes from the multiple alarm data to obtain alarm nodes; Performing node association on the alarm nodes based on the multiple alarm data to obtain association edges between the alarm nodes; The associated alarm directed graph is constructed based on the associated edges between the alarm nodes and the alarm nodes.

5. The method according to claim 1, characterized in that The step of compressing the associated alarm directed graph based on the associated alarm directed graph to obtain a compressed alarm set includes: Clustering the associated alarm directed graph using a graph clustering algorithm to obtain multiple associated clusters; Analyze the internal alarms of each of the associated clusters to determine the semantic redundancy of the internal alarm nodes, and determine the compressible homogeneous alarms in the internal alarms based on the semantic redundancy; Compressing the internal alarms of the associated cluster based on the compressible homogeneous alarms to obtain a compressed simplified alarm sequence within the cluster; Performing homogeneity condition analysis on each of the association clusters, determining homogeneous association clusters among the multiple association clusters, and compressing the homogeneous association clusters to obtain an aggregated alarm cluster; The compressed condensed alarm sequence within the cluster is integrated with the aggregated alarm cluster to obtain the compressed alarm set.

6. The method according to claim 1, characterized in that The constructing an alarm propagation graph based on the compressed alarm set and the multi-granularity network topology model includes: Mapping the compressed alarm set to the multi-granularity network topology model to obtain a multi-granularity mapping relationship table between the compressed alarm set and the multi-granularity network topology model; The alarm propagation graph is constructed based on the multi-granularity mapping relationship table and the compressed alarm set.

7. The method according to claim 1, characterized in that The querying the alarm propagation graph by using a reverse hierarchical sorting algorithm to determine the root alarm includes: Calculate the weight of each directed edge of the alarm propagation graph to obtain the propagation edge weight of each directed edge; Starting from the terminal leaf node of the alarm propagation graph, traversing the directed edges in reverse order, determining the propagation alarm node in the alarm propagation graph, and determining the terminal alarm node and all upstream propagation alarm nodes upstream of the terminal alarm node according to the propagation alarm node; The upstream propagation alarm nodes are sorted according to the propagation edge weights, the upstream propagation alarm node with the largest propagation edge weight is used as a root alarm node, and the root alarm is determined according to the alarm node.

8. A transmission network fault location system, characterized in that: Applied to the user end, the system includes: A multi-granularity network topology model building module, used to collect physical connection data, logical connection data and service bearer relationship data in the transmission network, and build a multi-granularity network topology model based on the physical connection data, the logical connection data and the service bearer relationship data; A topology association analysis module, used to obtain original alarm data in the transmission network, and analyze the topology association between different alarms based on the original alarm data and the multi-granularity network topology model; A multiple alarm data determination module is used to mine the topological association relationship between the different alarms, obtain the horizontal same-level association and the vertical upstream and downstream association between the mined alarm objects, and determine the multiple alarm data of each alarm object within a specific time window based on the horizontal same-level association and the vertical upstream and downstream association identification; An associated alarm compression module, used for constructing an associated alarm directed graph based on the multiple alarm data, and performing associated alarm compression on the associated alarm directed graph based on the associated alarm directed graph to obtain a compressed alarm set; The root alarm determination module is used to construct an alarm propagation graph based on the compressed alarm set and the multi-granularity network topology model, and query the alarm propagation graph through a reverse hierarchical sorting algorithm to determine the root alarm.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: It includes a processor, a memory and a transceiver, the memory is used to store instructions, the transceiver is used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes the method according to any one of claims 1 to 7.

Images