Alarm root cause determination method and device, nonvolatile storage medium and electronic equipment

Abstract

The invention discloses an alarm root cause determination method and device, a nonvolatile storage medium and electronic equipment. The method comprises the steps that alarm data are acquired, and the alarm data comprise at least one alarm reason; determining an alarm event category corresponding to the alarm reason, and adding the alarm reason to an alarm reason set corresponding to the alarm event category; determining an alarm root cause probability corresponding to each alarm cause in the alarm cause set, the alarm root cause probability being a probability that the alarm cause is an alarm root cause of the alarm event category; and determining the alarm root cause corresponding to the alarm event category from the alarm cause set according to the alarm root cause probability corresponding to each alarm cause. The technical problem of low fault repair efficiency caused by the fact that multiple alarms can only be checked one by one to determine alarm reasons in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of alarm data processing, and in particular, to an alarm root cause determination method, device, non-volatile storage medium and electronic device. Background Art

[0002] When a base station fails, multiple alarms are usually triggered, and only a few of the multiple alarms are the root causes of the alarms that directly reflect the cause of the alarms. In the related art, since it is impossible to determine the root cause of the alarms among multiple alarms, each alarm can only be checked one by one when determining the cause of the base station alarm, which is inefficient.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method, device, non-volatile storage medium and electronic device for determining the root cause of an alarm, so as to at least solve the technical problem of low fault repair efficiency caused by the related art that only multiple alarms can be checked one by one to determine the cause of the alarm.

[0005] According to one aspect of an embodiment of the present application, a method for determining an alarm root cause is provided, comprising: obtaining alarm data, wherein the alarm data includes at least one alarm cause; determining an alarm event category corresponding to the alarm cause, and adding the alarm cause to an alarm cause set corresponding to the alarm event category; determining an alarm root cause probability corresponding to each alarm cause in the alarm cause set, wherein the alarm root cause probability is the probability that the alarm cause is an alarm root cause of the alarm event category; determining the alarm root cause corresponding to the alarm event category from the alarm cause set based on the alarm root cause probabilities corresponding to each alarm cause.

[0006] Optionally, determining the alarm event category corresponding to the alarm cause includes: determining the alarm cause set corresponding to each preset alarm event category; using a density clustering model and the alarm cause set to group and predict the alarm causes to obtain prediction results; and determining the alarm event category to which the alarm cause belongs based on the prediction results.

[0007] Optionally, determining the alarm event category to which the alarm cause belongs based on the prediction result includes: when the prediction result indicates that the alarm cause belongs to an alarm cause set, determining a preset alarm event category corresponding to the alarm cause set as the alarm event category to which the alarm cause belongs; when the prediction result indicates that the alarm cause does not belong to any alarm cause set, creating a new alarm event category as the alarm event category to which the alarm cause belongs, and adding the alarm cause to a newly created alarm cause set corresponding to the newly created alarm event category.

[0008] Optionally, the density clustering model is trained in the following manner: during the process of training the density clustering model, an evaluation index of the density clustering model is determined, wherein the evaluation index is used to reflect the clustering separation and closeness of the output results of the density clustering model; when the value of the evaluation index is within a preset value range, it is determined that the density clustering model training is completed.

[0009] Optionally, determining the alarm root cause probability corresponding to each alarm cause in the alarm cause set includes: determining a probability prediction model corresponding to each alarm event category, wherein the model type of the probability prediction model includes a gradient boosting decision tree model; determining the alarm root cause probability corresponding to each alarm cause in the alarm cause set through the probability prediction model.

[0010] Optionally, the probability prediction model is trained in the following manner: clustering the alarm data according to the density of historical alarm data to obtain multiple alarm data clusters, wherein each alarm data cluster corresponds to an alarm event category, and different alarm data clusters correspond to different alarm event categories, and the alarm data cluster includes alarm causes associated with the alarm event category; determining the probability prediction model corresponding to each alarm data cluster; and training the probability prediction model through the alarm data cluster.

[0011] Optionally, before clustering the alarm data according to the density of the alarm data, the method for determining the root cause of the alarm also includes: obtaining historical alarm data of the indoor base station, wherein the historical data includes at least one of the following: alarm information, indoor base station equipment information, manufacturer information, network element status information; and cleaning the historical alarm data.

[0012] Optionally, the method for determining the root cause of the alarm also includes: receiving an alarm cause deletion instruction; when it is determined that the alarm cause indicated by the alarm cause deletion instruction to be deleted is the root cause of the alarm, after deleting the alarm cause indicated by the alarm cause deletion instruction, taking the alarm cause with the highest root cause probability among the remaining alarm causes in the alarm cause set as the root cause of the alarm.

[0013] According to another aspect of an embodiment of the present application, there is also provided an alarm root cause determination device, including: a data acquisition module, used to obtain alarm data, wherein the alarm data includes at least one alarm cause; a data labeling module, used to determine the alarm event category corresponding to the alarm cause, and add the alarm cause to the alarm cause set corresponding to the alarm event category; determine the alarm root cause probability corresponding to each alarm cause in the alarm cause set, wherein the alarm root cause probability is the probability that the alarm cause is an alarm root cause of the alarm event category; determine the alarm root cause corresponding to the alarm event category from the alarm cause set based on the alarm root cause probability corresponding to each alarm cause; an alarm convergence module, used to display the alarm root cause corresponding to each alarm event category.

[0014] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, in which a program is stored, wherein when the program is running, a device where the non-volatile storage medium is located is controlled to execute the alarm root cause determination method.

[0015] According to another aspect of an embodiment of the present application, there is further provided an electronic device, including: a memory and a processor, the processor being configured to run a program stored in the memory, wherein the method for determining a root cause of an alarm is executed when the program is run.

[0016] According to another aspect of an embodiment of the present application, a computer program product is also provided, including a computer program, and the computer program implements the alarm root cause determination method when executed by a processor.

[0017] In an embodiment of the present application, the method of obtaining alarm data is adopted, wherein the alarm data includes at least one alarm cause; determining the alarm event category corresponding to the alarm cause, and adding the alarm cause to the alarm cause set corresponding to the alarm event category; determining the alarm root cause probability corresponding to each alarm cause in the alarm cause set, wherein the alarm root cause probability is the probability that the alarm cause is the alarm root cause of the alarm event category; determining the alarm root cause corresponding to the alarm event category from the alarm cause set based on the alarm root cause probability corresponding to each alarm cause, by classifying the alarm causes corresponding to different alarm event categories, and determining the alarm root cause in the alarm cause set corresponding to each alarm event category, the purpose of determining the alarm root cause corresponding to each alarm event category is achieved, thereby achieving the technical effect of efficiently troubleshooting and repairing faults, thereby solving the technical problem of low fault repair efficiency caused by only being able to troubleshoot multiple alarms one by one to determine the alarm cause in the related technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 It is a structural schematic diagram of a computer terminal (mobile terminal) provided according to an embodiment of the present application;

[0020] Figure 2 It is a flowchart of a method for determining the root cause of an alarm provided in an embodiment of the present application;

[0021] Figure 3 It is a flowchart of an alarm root cause determination process provided according to an embodiment of the present application;

[0022] Figure 4is a structural diagram of an alarm root cause determination device provided according to an embodiment of the present application;

[0023] Figure 5 It is a structural diagram of another alarm root cause determination device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0027] DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm: Density-Based Spatial Clustering of Applications with Noise is a density-based clustering algorithm that can identify clusters of any shape and has good robustness to noise and outliers. The algorithm marks core points, boundary points, and noise points, and then divides the core points and their neighborhood points into the same cluster. It does not need to pre-specify the number of clusters and is insensitive to outliers.

[0028] GBDT (Gradient Boosting Decision Tree) algorithm: Gradient Boosting Decision Tree algorithm is an ensemble learning algorithm. It obtains the final prediction result by superimposing the prediction results of multiple decision trees.

[0029] At present, the network management of indoor base stations manages base station products from multiple manufacturers, multiple types of equipment, and multiple equipment models. In the daily operation and maintenance of indoor base stations, there are phenomena such as a large number of equipment alarms, a variety of alarm types, and different alarm scenarios for multiple devices. Network management and maintenance personnel face the problems of high alarm complexity and low processing efficiency.

[0030] The commonly used method of locating the root cause of alarms based on knowledge graphs in related technologies requires artificially presetting the number of root causes of alarms and building a corresponding alarm knowledge graph library. However, there are many forms of network management products for indoor base stations, and the alarm dictionaries and alarm mechanisms of various products are different, and there are many root causes of alarms. Compared with traditional macro stations, the number of various types of indoor base station equipment in the existing network is relatively small, and the cycle for accumulating alarm data is relatively long. Considering the two characteristics of a large number of root causes of alarms and a small amount of historical training data, the cost of constructing a knowledge graph for indoor base station alarms is relatively high, and the accuracy of locating the root causes of alarms is not high. Therefore, the knowledge graph method is not suitable for the field of indoor base stations where the number of root causes of alarms is growing rapidly and the number of root cause alarms is large.

[0031] In addition to the alarm graph method, machine learning algorithms are often used in related technologies to share alarm root causes. The alarm root cause location method in related technologies focuses on root cause prediction, and does not classify which alarm root cause the non-root cause alarm belongs to. Operation and maintenance personnel cannot obtain the correlation between the root alarm and the derived alarm, and lose some fault information, which is not conducive to alarm fault processing.

[0032] In order to solve the above problems, relevant solutions are provided in the embodiments of the present application, which are described in detail below.

[0033] According to an embodiment of the present application, a method embodiment of a method for determining a root cause of an alarm is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0034] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for determining the root cause of an alarm. Figure 1As shown, the computer terminal 10 (or mobile device 10) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0035] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0036] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the alarm root cause determination method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned alarm root cause determination method is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0037] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0038] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0039] In the above operating environment, the embodiment of the present application provides a method for determining the root cause of an alarm, such as Figure 2 As shown, the method comprises the following steps:

[0040] Step S202, obtaining alarm data, wherein the alarm data includes at least one alarm reason;

[0041] In the technical solution provided in step S202, the alarm message body reported by the indoor base station can be collected in real time by the network management, and the alarm type can be determined. Among them, the alarm types include alarm clearing and alarm updating. In the case where the alarm type is alarm updating, the network management performs structured processing on the alarm message, and associates the reported alarm with the network management table to obtain the alarm and equipment characteristics required for model prediction, such as equipment model, equipment status, manufacturer and other information. In the case where the alarm type is alarm clearing, the alarm cause indicated by the alarm message body is deleted, and when the deleted alarm cause is the alarm root cause, the alarm root cause in the alarm cause set where the deleted alarm cause is located is re-determined.

[0042] Step S204, determining the alarm event category corresponding to the alarm cause, and adding the alarm cause to the alarm cause set corresponding to the alarm event category;

[0043] In the technical solution provided in step S204, the step of determining the alarm event category corresponding to the alarm cause includes: determining the alarm cause set corresponding to each preset alarm event category; using a density clustering model and the alarm cause set to group and predict the alarm causes to obtain a prediction result; and determining the alarm event category to which the alarm cause belongs based on the prediction result.

[0044] Specifically, the trained offline density clustering model can be called to calculate and store the grouping results of this alarm in real time, and mark the fault event category and fault event group ID. The density clustering model performs group prediction on the alarm data. If the alarm belongs to a noise point, it does not belong to any fault event. This alarm is marked as a root alarm, and the fault event group ID is marked as empty. If the alarm does not belong to a noise point, it belongs to a certain fault event. Query the network management whether there are active alarms of the same classification for the same base station. If so, use the same fault event group ID as the existing active alarms and mark them. If not, it means that there is only one alarm for the entire fault event, then mark this alarm as a root alarm, and generate a fault event group ID for marking.

[0045] The density clustering model is a model that clusters alarm causes by executing the DBSCAN algorithm based on the density of alarm causes in alarm data, without presetting the number of clusters. Specifically, in the field of cluster analysis, "density" is a clear and widely used concept, which refers to the density of data points in a specific spatial area. For the DBSCAN algorithm, density is measured by calculating the number of other data points contained in the neighborhood of a data point within a radius ε around it. If this number is at least the predefined minimum number of neighborhood points (MinPts), then the point is considered a "core point", indicating that there is a high-density area around it. In addition, the density of data can also be considered to refer to the density of alarm events in a certain feature space, which can be used to identify which alarms may belong to the same fault event, that is, the same cluster, and which may be isolated noise events. The use of this density concept helps the DBSCAN algorithm automatically discover the clustering structure of alarm data without pre-specifying the number of clusters, thereby providing a flexible and robust solution in the application of indoor base station alarm root cause positioning.

[0046] In addition, the density clustering model can identify clusters of any shape. At the same time, it has good robustness to noise and outliers. The model will automatically mark the noise points that cannot be clustered as -1.

[0047] As an optional implementation, the density clustering model can group and predict the alarm data in the following way:

[0048] Neighborhood query: For a new data point corresponding to the alarm cause in the alarm data, query other points in its ε neighborhood.

[0049] Core point check: Check whether the new data point meets the conditions for becoming a core point, that is, whether there are at least MinPts points in its neighborhood. If the new data point is a core point, it may belong to an existing cluster or form a new cluster.

[0050] Cluster belonging judgment: If the neighborhood of the new data point contains a core point from an existing cluster, the new data point will be added to the cluster. If there is no core point that meets the conditions in the neighborhood of the new data point, and it does not meet the core point conditions, it may be regarded as a boundary point or a noise point, or it can form a new cluster if the conditions are met.

[0051] Border point assignment: If a new data point is a border point and there is at least one core point from a cluster in its neighborhood, then the new data point will be assigned to that cluster.

[0052] In some embodiments of the present application, the step of determining the alarm event category to which the alarm cause belongs based on the prediction result includes: when the prediction result indicates that the alarm cause belongs to an alarm cause set, determining that the preset alarm event category corresponding to the alarm cause set is the alarm event category to which the alarm cause belongs; when the prediction result indicates that the alarm cause does not belong to any alarm cause set, creating a new alarm event category as the alarm event category to which the alarm cause belongs, and adding the alarm cause to a newly created alarm cause set corresponding to the newly created alarm event category.

[0053] As an optional implementation, the density clustering model is trained in the following manner: during the process of training the density clustering model, an evaluation index of the density clustering model is determined, wherein the evaluation index is used to reflect the clustering separation and closeness of the output results of the density clustering model; when the value of the evaluation index is within a preset value range, it is determined that the density clustering model training is completed.

[0054] In some embodiments of the present application, the above evaluation index may be a silhouette coefficient, a Calinski-Harabasz index, a Davies-Bouldin index, a Silhouette Coefficient, or other indexes to evaluate the quality of the clustering algorithm. When the silhouette coefficient is used as an evaluation index, the average distance a(i) from the alarm sample i to other alarm samples in the same cluster and the average distance b_ij from the sample i to all samples in other clusters C_j may be calculated first, and then the silhouette coefficient of each alarm sample i may be determined according to the following calculation formula:

[0055]

[0056] The closer the silhouette coefficient is to 1, the more reasonable the clustering of sample i is and the better the clustering effect is.

[0057] As an optional implementation, the global silhouette coefficient of the output clustering result can be further determined. The global silhouette coefficient is the average value of the silhouette coefficients of all samples. The closer the global silhouette coefficient is to 1, the better the clustering effect is; if it is close to -1, it indicates that the clustering effect is poor. If the clustering effect is not ideal, continue to adjust the model parameters until the model meets the standards. The above preset value range means that the absolute value of the difference between the global silhouette coefficient and 1 is less than a preset threshold.

[0058] Step S206, determining the alarm root cause probability corresponding to each alarm cause in the alarm cause set, wherein the alarm root cause probability is the probability that the alarm cause is an alarm root cause of the alarm event category;

[0059] In the technical solution provided in step S206, the step of determining the alarm root cause probability corresponding to each alarm cause in the alarm cause set includes: determining a probability prediction model corresponding to each alarm event category, wherein the model type of the probability prediction model includes a gradient boosting decision tree model; determining the alarm root cause probability corresponding to each alarm cause in the alarm cause set through the probability prediction model.

[0060] As an optional implementation, the probability prediction model is trained in the following manner: clustering the alarm data according to the density of the historical alarm data to obtain multiple alarm data clusters, wherein each alarm data cluster corresponds to an alarm event category, and different alarm data clusters correspond to different alarm event categories, and the alarm data cluster includes alarm causes associated with the alarm event category; determining the probability prediction model corresponding to each alarm data cluster; and training the probability prediction model through the alarm data cluster.

[0061] In some embodiments of the present application, before clustering the alarm data according to the density of the alarm data, the method for determining the root cause of the alarm also includes: obtaining historical alarm data of the indoor base station, wherein the historical data includes at least one of the following: alarm information, indoor base station equipment information, manufacturer information, network element status information; and cleaning the historical alarm data.

[0062] Specifically, when collecting historical alarm data, it is necessary to exclude the derived alarms and root alarms configured in the alarm rule base. Alarm data features include alarm level, alarm network element, alarm type, alarm name, alarm occurrence time, alarm clearing time, possible alarm cause, etc.; base station features include base station networking form, equipment network element, equipment model, manufacturer, equipment usage scenario, base station status and other data. Manually mark historical alarm data to indicate whether the alarm is a root cause alarm or a derived alarm, and the fault event id to which each alarm belongs.

[0063] When cleaning the data, it is necessary to remove outliers and missing values ​​from the data, and then normalize the data features to reduce the impact of different dimensions on the model. Then extract the features, extract the conversion time features, enumeration features, and high-frequency word features through mathematical transformation and encoding methods, and digitize the text features. After that, perform feature selection and use the principal component analysis method to select the most valuable feature variables to improve the generalization ability of the model and avoid overfitting of the model. Finally, divide the training set and test set for model training and model evaluation in subsequent steps.

[0064] In some embodiments of the present application, after the alarm data is clustered, the noise points marked as -1 in the training set are first discarded to avoid overfitting of subsequent model training. Secondly, the training set is split using the clustering results, and each type of fault event corresponds to a training set. Finally, fault event features are added to the training set, and a type of alarm for a device is regarded as a fault event, and the fault event id to which each alarm belongs is recorded.

[0065] It should be noted that the GBDT algorithm is an iterative and complex process. It combines the ideas of gradient descent and Boosting. It optimizes the objective function by constructing a series of decision trees to minimize the loss function of the sorting to achieve the prediction of the sorting. In the embodiment of the present application, the GBDT model can be used as a probability prediction model. And each type of alarm event category corresponds to a probability prediction model separately. In the process of training the model, a suitable model hyperparameter combination can be found by the cross-validation method. Model hyperparameters include the number of decision trees, the maximum depth of the tree, the learning rate, the boosting sampling ratio, and the regularization parameter weight.

[0066] Optionally, you can determine whether the training is complete by letting the probability prediction model predict the test set. The probability prediction model can calculate the score of each alarm in each group and determine the root cause of the alarm based on the ranking. The alarm with the highest score is the root cause alarm, and the other alarms are derivative alarms. Calculate the root cause alarm prediction precision (Precision) and recall (Recall) to evaluate the model results.

[0067] As an optional implementation method, the precision rate refers to how many samples are actually root cause alarms among the samples predicted to be root cause alarms; the recall rate refers to how many samples are predicted to be root cause alarms among the actual root cause alarms. There is a trade-off between precision and recall rate. Higher precision rate generally leads to lower recall rate, and vice versa. In the root cause alarm analysis scenario of indoor base stations, the number of root cause alarms is relatively small in the total number of alarms. It is acceptable for derivative alarms to be misjudged as root cause alarms, but root cause alarms misjudged as derivative alarms will seriously affect the operation and maintenance personnel's fault location and processing. Therefore, when training the probability prediction model, it is inclined to select a model with a higher recall rate.

[0068] Step S208: determining the alarm root cause corresponding to the alarm event category from the alarm cause set according to the alarm root cause probabilities corresponding to the respective alarm causes.

[0069] In the technical solution provided in step S208, the alarm root cause probabilities corresponding to the respective alarm causes may be sorted in descending order, and the alarm cause ranked first may be used as the alarm root cause.

[0070] In some embodiments of the present application, the method for determining the root cause of the alarm also includes: receiving an alarm cause deletion instruction; when it is determined that the alarm cause indicated by the alarm cause deletion instruction to be deleted is the root cause of the alarm, after deleting the alarm cause indicated by the alarm cause deletion instruction, taking the alarm cause with the highest root cause probability among the remaining alarm causes in the alarm cause set as the root cause of the alarm.

[0071] In some embodiments of the present application, there is also provided a Figure 3 The alarm root cause determination process is shown in the figure. Figure 3 As can be seen from the figure, the alarm root cause determination process includes the following steps:

[0072] Step S302, after receiving the real-time alarm information, determine the alarm type corresponding to the real-time alarm information, including clear alarm and new alarm, and if the alarm type is determined to be clear alarm, jump to step S304, and if the alarm type is determined to be a new alarm, jump to step S306;

[0073] Step S304, deleting the alarm cause indicated by the alarm information, and in the case where the deleted alarm cause is the alarm root cause, determining a new alarm root cause from the derived alarms of the alarm root cause, and jumping to step S308;

[0074] In the technical solution provided in step S304, after the alarm root cause is deleted, the alarm cause originally ranked second in the set where the alarm root cause belongs can be used as the alarm root cause of the alarm set.

[0075] Step S306, determine the alarm cause set where the alarm cause indicated by the alarm information is located through the clustering model and add it, then sort the alarm causes in the alarm cause set according to the root cause probability from large to small through the probability prediction model, and determine the alarm cause ranked first as the alarm root cause, and then jump to step S308;

[0076] Step S308: display the alarm root cause corresponding to each alarm event category, and converge the related derived alarms.

[0077] By adopting the method of obtaining alarm data, wherein the alarm data includes at least one alarm cause; determining the alarm event category corresponding to the alarm cause, and adding the alarm cause to the alarm cause set corresponding to the alarm event category; determining the alarm root cause probability corresponding to each alarm cause in the alarm cause set, wherein the alarm root cause probability is the probability that the alarm cause is the alarm root cause of the alarm event category; and determining the alarm root cause corresponding to the alarm event category from the alarm cause set based on the alarm root cause probability corresponding to each alarm cause. By classifying the alarm causes corresponding to different alarm event categories, and determining the alarm root cause in the alarm cause set corresponding to each alarm event category, the purpose of determining the alarm root cause corresponding to each alarm event category is achieved, thereby realizing the technical effect of efficiently troubleshooting and repairing faults, and further solving the technical problem of low fault repair efficiency caused by only being able to troubleshoot multiple alarms one by one to determine the alarm cause in the related technology.

[0078] In summary, although the related art also provides a method for determining the root cause of an alarm, the method for determining the root cause of an alarm in the related art does not group the fault events, and the indoor base station operation and maintenance personnel cannot obtain the correlation between the root cause alarm and the derived alarm. The method for determining the root cause of an indoor base station alarm that combines the DBSCAN clustering model and the GDBT sorting model provided in the embodiment of the present application first groups the alarms into fault events, and then predicts the root alarm of each group of alarms. This method does not predict the root cause of the alarm, but also provides the correlation between the root alarm and the derived alarm, providing more effective information to assist in manually solving the root cause of the alarm and improve the efficiency of alarm processing.

[0079] In addition, for the situation where the base station network management platform manages base stations of various forms and manufacturers, and there are many root causes for alarms, the method provided in the embodiment of the present application does not need to preset the number of root cause alarms, and can automatically identify the number of root causes. When the network management platform manages new forms of base stations, model iteration is required. The method of this patent requires less training data sets, less training time, and has lower iteration costs.

[0080] In addition, the indoor base station root cause determination method provided in the embodiment of the present application also has a certain degree of fault tolerance. When the root cause alarm prediction is wrong, after the operation and maintenance personnel clear the root cause alarm, the derivative alarm is not cleared, and the derivative alarm originally ranked second will be marked as the root cause alarm, and the network management will automatically trigger the alarm root cause prediction after receiving the same fault event alarm again, and predict the alarm root cause again.

[0081] An embodiment of the present application provides a device for determining a root cause of an alarm. Figure 4 is a schematic diagram of the structure of the device. Figure 4It can be seen that the device includes: a data acquisition module 40, which is used to obtain alarm data, wherein the alarm data includes at least one alarm cause; a data marking module 42, which is used to determine the alarm event category corresponding to the alarm cause, and add the alarm cause to the alarm cause set corresponding to the alarm event category; determine the alarm root cause probability corresponding to each alarm cause in the alarm cause set, wherein the alarm root cause probability is the probability that the alarm cause is the alarm root cause of the alarm event category; determine the alarm root cause corresponding to the alarm event category from the alarm cause set based on the alarm root cause probability corresponding to each alarm cause; an alarm convergence module 44, which is used to display the alarm root cause corresponding to each alarm event category.

[0082] In some embodiments of the present application, the step of the data labeling module 42 determining the alarm event category corresponding to the alarm cause includes: determining the alarm cause set corresponding to each preset alarm event category; using a density clustering model and the alarm cause set to group and predict the alarm causes to obtain a prediction result; and determining the alarm event category to which the alarm cause belongs based on the prediction result.

[0083] In some embodiments of the present application, the step of the data labeling module 42 determining the alarm event category to which the alarm cause belongs based on the prediction result includes: when the prediction result indicates that the alarm cause belongs to an alarm cause set, determining that the preset alarm event category corresponding to the alarm cause set is the alarm event category to which the alarm cause belongs; when the prediction result indicates that the alarm cause does not belong to any alarm cause set, creating a new alarm event category as the alarm event category to which the alarm cause belongs, and adding the alarm cause to a newly created alarm cause set corresponding to the newly created alarm event category.

[0084] In some embodiments of the present application, the density clustering model is trained in the following manner: during the training of the density clustering model, an evaluation index of the density clustering model is determined, wherein the evaluation index is used to reflect the clustering separation and closeness of the output results of the density clustering model; when the value of the evaluation index is within a preset value range, it is determined that the training of the density clustering model is completed.

[0085] In some embodiments of the present application, the step in which the data labeling module 42 determines the alarm root cause probability corresponding to each alarm cause in the alarm cause set includes: determining a probability prediction model corresponding to each alarm event category, wherein the model type of the probability prediction model includes a gradient boosting decision tree model; determining the alarm root cause probability corresponding to each alarm cause in the alarm cause set through the probability prediction model.

[0086] In some embodiments of the present application, the probability prediction model is trained in the following manner: clustering the alarm data according to the density of the historical alarm data to obtain multiple alarm data clusters, wherein each alarm data cluster corresponds to an alarm event category, and different alarm data clusters correspond to different alarm event categories, and the alarm data cluster includes alarm causes associated with the alarm event category; determining the probability prediction model corresponding to each alarm data cluster; and training the probability prediction model through the alarm data cluster.

[0087] In some embodiments of the present application, before clustering the alarm data according to the density of the alarm data, the alarm root cause determination device is also used to: obtain historical alarm data of the indoor base station, wherein the historical data includes at least one of the following: alarm information, indoor base station equipment information, manufacturer information, network element status information; and clean the historical alarm data.

[0088] In some embodiments of the present application, Figure 5 As shown, the alarm root cause determination device also includes an alarm cause deletion module 46, and the alarm cause deletion module 46 is used to: receive an alarm cause deletion instruction; when it is determined that the alarm cause to be deleted indicated by the alarm cause deletion instruction is the alarm root cause, after deleting the alarm cause indicated by the alarm cause deletion instruction, use the alarm cause with the highest root cause probability among the remaining alarm causes in the alarm cause set as the alarm root cause.

[0089] As an optional implementation, after determining the root cause of the alarm, the alarm cause deletion module 46 will jump to the alarm convergence module 44, and the alarm convergence module 44 will execute subsequent steps.

[0090] In some embodiments of the present application, the data acquisition module 40 can collect the alarm message body reported by the indoor base station in real time to determine the alarm type. The alarm types include three types of alarms: new, clear, and update. If the alarm type is new, jump to the data marking module 42. If the alarm type is clear, jump to the alarm cause deletion module 46. If the alarm type is update, jump to the alarm convergence module 44.

[0091] As an optional implementation, the data labeling module 42 also includes a data preprocessing unit, a grouping unit, a sorting model input parameter determination unit and a sorting unit.

[0092] The data preprocessing unit is used to call the data preprocessing method prepared offline to convert the real-time alarm information into an adaptive feature vector as an input parameter of the density clustering model.

[0093] The grouping unit is used to call the trained offline clustering model, calculate and store the grouping result of this alarm in real time. If the clustering calculation result of this alarm = -1, it means that this alarm belongs to a noise point and is not the same fault event as any other alarm. This alarm is marked as a root alarm, and the fault event group ID is marked as empty. Then jump directly to the alarm convergence module 44.

[0094] If the cluster calculation result of this alarm is not equal to -1, it means that this alarm can be clustered. Query the network management whether there is an active alarm of this classification for this base station. If there is an existing active alarm using the same fault event group ID, it is marked and enters the sorting model input parameter determination unit. If it does not exist, that is, there is only one alarm for the entire fault event, then mark this alarm as a root alarm and generate a fault event group ID for marking. Enter the alarm convergence module 44.

[0095] The sorting model input parameter determination unit is used to obtain all active alarms of this group of fault events according to the fault event group ID marked by the grouping unit, and construct a feature vector as the sorting model input parameter. First, obtain the full active alarm list of this alarm fault event group stored by the network management (real-time alarms are not stored at this time). Then query the system cache to obtain the alarm feature vector of the same fault event in the active alarm list, and together with the newly added alarm feature vector, form the sorting model input parameter and enter the sorting unit.

[0096] The sorting unit is used to call the trained offline sorting model to predict the score of each alarm, mark the root cause alarm label for the highest score, mark other alarms with derived alarm labels, and record the score of each alarm.

[0097] As an optional implementation, the alarm convergence module 44 is also used to converge the alarms according to the fault event group ID and whether it is a root cause alarm label. If the fault event group ID is not empty, it means that the fault event can be classified, and the alarm list displays the root cause alarm, but does not display the derivative alarm. Click the root cause alarm details page to view the list of derivative alarms associated with this root alarm. The derivative alarm list is sorted in descending order according to the score calculated by the sorting model, that is, the more important the derivative alarm is, the higher the ranking. If the fault event group ID is empty, it means that this alarm is a noise point and is not the same fault event as any alarm. The root cause of the fault event is not clear and the alarm cannot be classified, then the alarm list directly presents such alarms.

[0098] It should be noted that the various modules in the above-mentioned alarm root cause determination device can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0099] According to an embodiment of the present application, a non-volatile storage medium is also provided, in which a program is stored, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the following alarm root cause determination method: obtain alarm data, wherein the alarm data includes at least one alarm cause; determine the alarm event category corresponding to the alarm cause, and add the alarm cause to the alarm cause set corresponding to the alarm event category; determine the alarm root cause probability corresponding to each alarm cause in the alarm cause set, wherein the alarm root cause probability is the probability that the alarm cause is an alarm root cause of the alarm event category; determine the alarm root cause corresponding to the alarm event category from the alarm cause set based on the alarm root cause probabilities corresponding to each alarm cause.

[0100] According to an embodiment of the present application, an electronic device is also provided, including: a memory and a processor, the processor being used to run a program stored in the memory, wherein the following alarm root cause determination method is executed when the program is running: obtaining alarm data, wherein the alarm data includes at least one alarm cause; determining an alarm event category corresponding to the alarm cause, and adding the alarm cause to an alarm cause set corresponding to the alarm event category; determining an alarm root cause probability corresponding to each alarm cause in the alarm cause set, wherein the alarm root cause probability is the probability that the alarm cause is an alarm root cause of the alarm event category; determining the alarm root cause corresponding to the alarm event category from the alarm cause set based on the alarm root cause probabilities corresponding to each alarm cause.

[0101] According to an embodiment of the present application, a computer program product is also provided, including a computer program, which implements the following alarm root cause determination method when executed by a processor: obtaining alarm data, wherein the alarm data includes at least one alarm cause; determining an alarm event category corresponding to the alarm cause, and adding the alarm cause to an alarm cause set corresponding to the alarm event category; determining an alarm root cause probability corresponding to each alarm cause in the alarm cause set, wherein the alarm root cause probability is the probability that the alarm cause is an alarm root cause of the alarm event category; determining the alarm root cause corresponding to the alarm event category from the alarm cause set based on the alarm root cause probabilities corresponding to each alarm cause.

[0102] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0103] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0104] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0105] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0106] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0107] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for determining the root cause of an alarm, characterized in that: include: Acquire alarm data, wherein the alarm data includes at least one alarm reason; Determine the alarm event category corresponding to the alarm cause, and add the alarm cause to the alarm cause set corresponding to the alarm event category; Determine an alarm root cause probability corresponding to each alarm cause in the alarm cause set, wherein the alarm root cause probability is a probability that the alarm cause is an alarm root cause of the alarm event category; According to the alarm root cause probabilities corresponding to the respective alarm causes, the alarm root cause corresponding to the alarm event category is determined from the alarm cause set.

2. The method for determining the root cause of an alarm according to claim 1, characterized in that: Determine the alarm event category corresponding to the alarm cause, including: Determine the alarm cause set corresponding to each preset alarm event category; Using a density clustering model and the alarm cause set to group and predict the alarm causes, and obtain a prediction result; The alarm event category to which the alarm cause belongs is determined based on the prediction result.

3. The method for determining the root cause of an alarm according to claim 2, characterized in that: The alarm event category to which the alarm cause belongs is determined based on the prediction result, including: In a case where the prediction result indicates that the alarm cause belongs to the alarm cause set, determining that the preset alarm event category corresponding to the alarm cause set is the alarm event category to which the alarm cause belongs; When the prediction result indicates that the alarm cause does not belong to any of the alarm cause sets, the newly created alarm event category is the alarm event category to which the alarm cause belongs, and the alarm cause is added to the newly created alarm cause set corresponding to the newly created alarm event category.

4. The method for determining the root cause of an alarm according to claim 2, characterized in that: The density clustering model is trained in the following way: In the process of training the density clustering model, determining an evaluation index of the density clustering model, wherein the evaluation index is used to reflect the cluster separation and compactness of the output result of the density clustering model; When the value of the evaluation index is within a preset value range, it is determined that the training of the density clustering model is completed.

5. The method for determining the root cause of an alarm according to claim 1, characterized in that: Determining the alarm root cause probability corresponding to each alarm cause in the alarm cause set includes: Determine a probability prediction model corresponding to each of the alarm event categories, wherein the model type of the probability prediction model includes a gradient boosting decision tree model; The probability prediction model is used to determine the alarm root cause probability corresponding to each alarm cause in the alarm cause set.

6. The method for determining the root cause of an alarm according to claim 5, characterized in that: The probability prediction model is trained in the following way: Clustering the alarm data according to the density of the historical alarm data to obtain a plurality of alarm data clusters, wherein each of the alarm data clusters corresponds to an alarm event category, and different alarm data clusters correspond to different alarm event categories, and the alarm data clusters include alarm causes associated with the alarm event categories; Determine the probability prediction model corresponding to each of the alarm data clusters; The probability prediction model is trained using the alarm data cluster.

7. The method for determining the root cause of an alarm according to claim 6, characterized in that: Before clustering the alarm data according to the density of the alarm data, the alarm root cause determination method further includes: Acquire the historical alarm data of the indoor base station, wherein the historical alarm data includes at least one of the following: alarm information, indoor base station equipment information, manufacturer information, and network element status information; The historical alarm data is cleaned.

8. The method for determining the root cause of an alarm according to claim 1, characterized in that: The alarm root cause determination method further includes: Receive the alarm reason deletion instruction; When it is determined that the alarm cause to be deleted indicated by the alarm cause deletion instruction is the alarm root cause, after deleting the alarm cause indicated by the alarm cause deletion instruction, the alarm cause with the highest root cause probability among the remaining alarm causes in the alarm cause set is used as the alarm root cause.

9. An alarm root cause determination device, characterized in that: include: A data acquisition module, used to obtain alarm data, wherein the alarm data includes at least one alarm cause; A data labeling module, used to determine the alarm event category corresponding to the alarm cause, and add the alarm cause to the alarm cause set corresponding to the alarm event category; determine the alarm root cause probability corresponding to each alarm cause in the alarm cause set, wherein the alarm root cause probability is the probability that the alarm cause is the alarm root cause of the alarm event category; determine the alarm root cause corresponding to the alarm event category from the alarm cause set based on the alarm root cause probabilities corresponding to each alarm cause; The alarm convergence module is used to display the alarm root cause corresponding to each alarm event category.

10. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a program, wherein when the program is executed, the device where the non-volatile storage medium is located is controlled to execute the alarm root cause determination method according to any one of claims 1 to 8.

11. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the alarm root cause determination method according to any one of claims 1 to 8 when running.

12. A computer program product, characterized in that The method comprises a computer program, which, when executed by a processor, implements the method for determining the root cause of an alarm according to any one of claims 1 to 8.

Images