Fault network analysis method and device, electronic equipment and computer storage medium

Abstract

The invention provides a fault network analysis method and device, electronic equipment and a computer storage medium, and the method comprises the steps: collecting alarm data in real time, and carrying out the preprocessing of the alarm data for each piece of alarm data, and obtaining target alarm information; wherein the target alarm information comprises a time window to which the alarm data belongs, an application system to which the system alarm data belongs and an entity related to the alarm data; then, for each application system, performing association analysis on the alarm data according to the target alarm information, and combining to form an association scene; wherein the associated scene at least comprises a triggering sequence among a plurality of alarm data; and finally, for each application system, performing fault analysis according to the associated scene and the important node link map to obtain an analysis result. Wherein the important node link graph is constructed according to the key entity and the operation and maintenance knowledge graph, and the purpose of quickly and effectively analyzing the fault network is achieved.

Description

Technical Field

[0001] The present application relates to the technical field of abnormal analysis, and in particular to a method, device, electronic device and computer storage medium for analyzing a faulty network. Background Art

[0002] At present, faced with the increasingly complex architecture of banking systems and the ever-growing business scale, traditional alarm management methods are unable to effectively cope with the massive, diverse and dynamic nature of alarm information, resulting in slow root cause location and inefficient processing. Summary of the invention

[0003] In view of this, the present application provides a method, device, electronic device and computer storage medium for analyzing a faulty network, so as to analyze the faulty network quickly and effectively.

[0004] The first aspect of the present application provides a method for analyzing a faulty network, comprising:

[0005] Collect alarm data in real time;

[0006] For each of the alarm data, pre-process the alarm data to obtain target alarm information; wherein the target alarm information includes the time window to which the alarm data belongs, the application system to which the system alarm data belongs, and the entity involved in the alarm data;

[0007] For each application system, the alarm data is correlated and analyzed according to the target alarm information, and combined to form a correlation scenario; wherein the correlation scenario at least includes the triggering sequence between multiple alarm data;

[0008] For each application system, a fault analysis is performed according to the associated scenarios and important node link graphs to obtain analysis results; wherein the important node link graphs are constructed according to key entities and operation and maintenance knowledge graphs.

[0009] Optionally, the alarm data includes: alarm information and alarm time; and for each of the alarm data, preprocessing the alarm data to obtain target alarm information includes:

[0010] For each of the alarm data, according to the occurrence time of the alarm data, the alarm data is divided according to the preset time window to obtain the time window to which the alarm data belongs;

[0011] According to the alarm information in the alarm data, the alarm data is divided into application systems to obtain the application system to which the alarm data belongs;

[0012] For basic platform and network related alarm information, the alarm information is associated with the corresponding application system through the relevant configuration relationship in the configuration management system;

[0013] Determine the entity information to which the alarm information belongs through key information in the alarm information; wherein the entity information at least includes an instance;

[0014] An entity involved in the alarm data is determined according to the instance.

[0015] Optionally, the alarm data includes: alarm time, alarm type and alarm source. For each application system, the alarm data is subjected to correlation analysis according to target alarm information, and is combined to form a correlation scenario, including:

[0016] For each application system, the association relationship between alarm data is determined according to the alarm time, alarm type, alarm source and association rule network; wherein the association rule network is generated according to support and confidence;

[0017] Based on the correlation between the alarm data, the correlation between multiple alarm data caused by the same problem or event is merged to obtain the correlation scenario.

[0018] Optionally, for each application system, a fault analysis is performed according to the associated scenarios and important node link maps to obtain analysis results, including:

[0019] Take the intersection of entities involved in the alarm data in the associated scenario and the important node link graph to obtain the target entity;

[0020] Constructing a minimum fault subgraph according to the node relationship between the target entity and the important node link graph;

[0021] The analysis results are obtained based on the minimum fault subgraph.

[0022] Optionally, the important node link graph includes leaf nodes and non-leaf nodes, and the step of constructing a minimum fault subgraph according to the node relationship between the target entity and the important node link graph includes:

[0023] If all target entities are located at leaf nodes, the minimum fault subgraph is constructed according to the first processing method;

[0024] If all target entities are located at non-leaf nodes, the minimum fault subgraph is constructed according to the second processing method;

[0025] If some target entities are located at leaf nodes, the target entities located at leaf nodes are constructed according to the first processing method to obtain the first minimum fault subgraph, and the target entities located at non-leaf nodes are constructed according to the second processing method to obtain the second minimum fault subgraph; wherein, the first minimum fault subgraph has a higher priority than the second minimum fault subgraph in the root cause location process.

[0026] Optionally, if all target entities are located at leaf nodes, a minimum fault subgraph is constructed according to the first processing method, including:

[0027] For each target entity, select a link between the target entity and other key elements in the application system as a first link;

[0028] Construct a minimum fault subgraph based on all first links.

[0029] Optionally, if all target entities are located at non-leaf nodes, a minimum fault subgraph is constructed according to the second processing method, including:

[0030] Determine whether there is an intersection between each target entity and each important node link and the minimum distance between the target entity and the leaf node;

[0031] The link of the target entity that has the most intersections with the important node links and is closest to the leaf node is taken as the main link;

[0032] For each pending target entity, the link with the largest intersection between the important node link where the pending target entity is located and the main link and the longest length is taken as a branch link; wherein the pending target entity is other target entities except the target entity of the main link;

[0033] If the important node link where the target entity to be determined is located has no intersection with the main link, the shortest path between the target entity to be determined and the main link is used as a branch link;

[0034] Construct a minimum fault subgraph based on the main link and all branch links.

[0035] A second aspect of the present application provides a fault network analysis device, including:

[0036] A collection unit, used to collect alarm data in real time;

[0037] A preprocessing unit, configured to preprocess each of the alarm data to obtain target alarm information; wherein the target alarm information includes a time window to which the alarm data belongs, an application system to which the system alarm data belongs, and an entity involved in the alarm data;

[0038] A correlation analysis unit, for each application system, performs correlation analysis on the alarm data according to the target alarm information, and combines them into a correlation scenario; wherein the correlation scenario at least includes a triggering sequence between multiple alarm data;

[0039] The fault analysis unit is used to perform fault analysis on each application system according to the associated scenarios and important node link graphs to obtain analysis results; wherein the important node link graphs are constructed based on key entities and operation and maintenance knowledge graphs.

[0040] Optionally, the alarm data includes: alarm information and alarm time; the preprocessing unit includes:

[0041] A first dividing unit is used to divide each of the alarm data according to the occurrence time of the alarm data and the preset time window to obtain the time window to which the alarm data belongs;

[0042] A second division unit is used to divide the alarm data into application systems according to the alarm information in the alarm data to obtain the application system to which the alarm data belongs;

[0043] The first division unit is used to associate the alarm information related to the basic platform and the network with the corresponding application system through the relevant configuration relationship in the configuration management system;

[0044] A first determining unit, configured to determine entity information to which the alarm information belongs based on key information in the alarm information; wherein the entity information at least includes an instance;

[0045] The second determining unit is used to determine the entity involved in the alarm data according to the instance.

[0046] Optionally, the alarm data includes: alarm time, alarm type and alarm source, and the correlation analysis unit includes:

[0047] A third determination unit is used to determine the association relationship between the alarm data for each application system according to the alarm time, alarm type, alarm source and association rule network; wherein the association rule network is generated according to support and confidence;

[0048] The merging unit is used to merge the correlation relationships between multiple alarm data caused by the same problem or event based on the correlation relationships between the alarm data to obtain a correlation scenario.

[0049] Optionally, the fault analysis unit includes:

[0050] An intersection unit, used to take the intersection of entities and important node link graphs involved in the alarm data in the associated scenario to obtain a target entity;

[0051] A construction unit, used to construct a minimum fault subgraph according to the node relationship between the target entity and the important node link graph;

[0052] The fault analysis subunit is used to perform analysis according to the minimum fault subgraph to obtain analysis results.

[0053] Optionally, the important node link graph includes leaf nodes and non-leaf nodes, and the construction unit includes:

[0054] A first construction sub-unit is used to construct a minimum fault sub-graph according to a first processing method if all target entities are located at leaf nodes;

[0055] A second construction sub-unit is used to construct a minimum fault sub-graph according to a second processing method if all target entities are located at non-leaf nodes;

[0056] The third construction sub-unit is used to construct the first minimum fault sub-graph according to the first processing method for the target entities located at the leaf nodes if some target entities are located at the leaf nodes, and to construct the second minimum fault sub-graph according to the second processing method for the target entities located at the non-leaf nodes; wherein the first minimum fault sub-graph has a higher priority than the second minimum fault sub-graph in the root cause location process.

[0057] Optionally, the first construction subunit includes:

[0058] A link determination unit, configured to select, for each target entity, a link between the target entity and other key elements in the application system as a first link;

[0059] The first minimum fault subgraph generating unit is configured to construct a minimum fault subgraph according to all first links.

[0060] Optionally, the second construction subunit includes:

[0061] The fourth determination unit is used to determine whether there is an intersection between each target entity and each important node link and the minimum distance between the target entity and the leaf node;

[0062] A fifth determining unit, configured to use a link of the target entity that has the most intersections with the important node links and is closest to the leaf node as a main link;

[0063] A sixth determination unit is used to, for each undetermined target entity, use a link with the largest intersection between the important node link where the undetermined target entity is located and the main link and the longest length as a branch link; wherein the undetermined target entity is a target entity other than the target entity of the main link;

[0064] a seventh determination unit, configured to use the shortest path between the target entity to be determined and the main link as a branch link if the important node link where the target entity to be determined is located has no intersection with the main link;

[0065] The second minimum fault subgraph generating unit is used to construct a minimum fault subgraph according to the main link and all branch links.

[0066] A third aspect of the present application provides an electronic device, including:

[0067] one or more processors;

[0068] a storage device having one or more programs stored thereon;

[0069] When the one or more programs are executed by the one or more processors, the one or more processors implement the fault network analysis method as described in any one of the first aspects.

[0070] A fourth aspect of the present application provides a computer storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for analyzing a fault network as described in any one of the first aspects is implemented.

[0071] It can be seen from the above scheme that the present application provides a method, device, electronic device and computer storage medium for analyzing a fault network, which collects alarm data in real time, and pre-processes the alarm data for each of the alarm data to obtain target alarm information; wherein, the target alarm information includes the time window to which the alarm data belongs, the application system to which the system alarm data belongs, and the entity involved in the alarm data; then, for each application system, the alarm data is correlated and analyzed according to the target alarm information, and merged to form a correlation scenario; wherein, the correlation scenario at least includes the triggering sequence between multiple alarm data; finally, for each application system, a fault analysis is performed according to the correlation scenario and the important node link map to obtain an analysis result; wherein, the important node link map is constructed based on key entities and operation and maintenance knowledge maps, so as to achieve the purpose of quickly and effectively analyzing the fault network. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0073] Figure 1 A specific flow chart of a method for analyzing a faulty network provided in an embodiment of the present application;

[0074] Figure 2 A flowchart of a method for preprocessing alarm data provided by another embodiment of the present application;

[0075] Figure 3 A flowchart of a method for forming an associated scene provided in another embodiment of the present application;

[0076] Figure 4 A flowchart of a fault analysis method provided in another embodiment of the present application;

[0077] Figure 5 A schematic diagram of a fault network analysis device provided by another embodiment of the present application;

[0078] Figure 6 A schematic diagram of an electronic device for implementing a method for analyzing a faulty network provided in another embodiment of the present application. DETAILED DESCRIPTION

[0079] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0080] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0081] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0082] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0083] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0084] The present application embodiment provides a method for analyzing a faulty network. Figure 1 As shown, the specific steps include:

[0085] S101. Collect alarm data in real time.

[0086] In the specific implementation process of this application, when the system detects an abnormality in a preset indicator, the alarm identification mechanism will be triggered. This process mainly focuses on key indicators such as transaction volume, system success rate, business success rate, average response time, and average processing time. The system monitors these indicators in real time and compares them with preset thresholds or historical data. Once a significant deviation is found, alarm data will be generated. The alarm data contains key information such as abnormal indicators, degree of deviation, and time of occurrence, which provides an important basis for subsequent troubleshooting and emergency response. This alarm identification mechanism ensures the stability and continuity of the business system and helps to promptly discover and resolve potential problems.

[0087] S102: For each piece of alarm data, pre-process the alarm data to obtain target alarm information.

[0088] The target alarm information includes the time window to which the alarm data belongs, the application system to which the system alarm data belongs, and the entity involved in the alarm data.

[0089] Optionally, in another embodiment of the present application, the alarm data at least includes: alarm information and alarm time; an implementation of step S102, such as Figure 2 As shown, including:

[0090] S201 . For each alarm data, divide it into preset time windows according to the occurrence time of the alarm data to obtain the time window to which the alarm data belongs.

[0091] It can be understood that the purpose of dividing the time window is to capture and process the alarm data in real time. The monitoring system collects alarm information from different monitoring sources in real time, divides it according to the occurrence time of the alarm data according to the preset time window, and obtains the time window to which the alarm data belongs for subsequent analysis and processing.

[0092] It should be noted that the size of the time window can be adjusted according to actual needs, for example: 5 minutes, 10 minutes, etc., and is not limited here.

[0093] S202: Divide the alarm data into application systems according to the alarm information in the alarm data to obtain the application system to which the alarm data belongs.

[0094] The alarm information includes, but is not limited to, the alarm source, alarm type, affected system, etc., which are not limited here.

[0095] It is understandable that the alarm data is divided according to the application system. The alarm data usually involves multiple application systems. In order to locate the root cause of the fault more accurately, the alarm data is divided according to the application system by analyzing the alarm information in the alarm data.

[0096] S203: For alarm information related to the basic platform and the network, the alarm information is associated with the corresponding application system through the relevant configuration relationship in the configuration management system.

[0097] Specifically, for alarm information related to the basic platform and network, the alarm information is associated with the corresponding application system through the relevant configuration relationship in the configuration management system to ensure the comprehensiveness of the analysis.

[0098] S204: Determine the entity information to which the alarm information belongs based on the key information in the alarm information.

[0099] Among them, entity information at least includes instances. Key information in the alarm information includes but is not limited to service name, instance name, etc., which are not limited here. The key information is used to determine the entity type to which the alarm information belongs, such as service, instance, etc., for classification and organization. Each instance corresponds to a specific entity, such as a process on a server or an interface of a network device, to clarify the entity type to which it belongs.

[0100] S205: Determine the entity involved in the alarm data according to the instance.

[0101] S103: For each application system, correlation analysis is performed on the alarm data according to the target alarm information, and the correlation scenarios are formed by merging the alarm data.

[0102] The associated scenario at least includes a triggering sequence between multiple alarm data.

[0103] It should be noted that when multiple alarms appear in the system, correlation analysis mines the potential connections between these alarms and organizes them in a logical or chronological order to identify the root cause of the problem.

[0104] Optionally, in another embodiment of the present application, the alarm data includes at least: alarm time, alarm type and alarm source, and an implementation of step S103 is as follows: Figure 3 As shown, including:

[0105] S301. For each application system, determine the association relationship between alarm data according to the alarm time, alarm type, alarm source and association rule network.

[0106] Among them, the association rule network is generated based on support and confidence.

[0107] In the specific implementation process of the application, the alarm data may be cleaned, including but not limited to, to obtain key information such as the alarm time, type, and source.

[0108] Secondly, association rules are generated according to support and confidence, an association rule network is generated, and the association rule network is displayed visually to reveal the potential connections between alarms.

[0109] S302: Based on the correlation relationship between the alarm data, the correlation relationships between multiple alarm data caused by the same problem or event are merged to obtain a correlation scenario.

[0110] In the associated scenario, the triggering sequence, causal relationship and mutual influence between alarms can be seen. This process helps operation and maintenance personnel to quickly locate problems, reduce the interference of redundant alarms, and improve the efficiency of fault handling.

[0111] S104. For each application system, perform fault analysis based on associated scenarios and important node link maps to obtain analysis results.

[0112] Among them, the important node link map is constructed based on the key entities and operation and maintenance knowledge map. The important node link map includes at least one important node link.

[0113] In the specific implementation process of this application, we first clarify the focus of the alarm, including servers, network equipment, databases, middleware, application systems, etc., which are not limited here. After that, by sorting out the entities, we lay the foundation for the subsequent link map construction and alarm analysis. We obtain the latest full upstream and downstream link relationships between these entities from the operation and maintenance knowledge graph.

[0114] Among them, the operation and maintenance knowledge graph is a graph data structure that contains all entities and their relationships in the system. It can help us understand the dependencies and impact paths between entities. By querying the knowledge graph, we can obtain the connection relationship between each entity and other entities, including upstream and downstream dependencies, and filter out the links related to the alarm-focused entities to build an important node link graph. Focus on the entities and links related to the alarm to reduce the complexity and resource consumption of subsequent analysis. The screening process can be based on factors such as entity type, business importance, and historical alarm data. This effectively improves the accuracy of root cause location and greatly shortens the troubleshooting time.

[0115] Optionally, in another embodiment of the present application, an implementation of step S104 is as follows: Figure 4 As shown, it also includes:

[0116] S401. Take the intersection of entities involved in the alarm data in the associated scene and the important node link graph to obtain the target entity.

[0117] S402: Construct a minimum fault subgraph based on the node relationship between the target entity and the important node link graph.

[0118] Among them, the important node link map includes leaf nodes and non-leaf nodes. Leaf nodes can be specific faulty devices, abnormal indicators, error logs, etc., which are not limited here. For example, in a service system, a leaf node can be a specific server IP with a problem, a process ID with excessive CPU usage, or a log file path containing error information. In the important node link map of the root cause, non-leaf nodes may represent services, modules, system components, or abstract concepts. For example, in a microservice architecture, non-leaf nodes can be the names of various microservices, which act as parent nodes and connect to leaf nodes representing specific faults or abnormal situations.

[0119] Optionally, in another embodiment of the present application, the important node link graph includes leaf nodes and non-leaf nodes, and an implementation of step S402 includes:

[0120] If all target entities are located at leaf nodes, the minimum fault subgraph is constructed according to the first processing method; if all target entities are located at non-leaf nodes, the minimum fault subgraph is constructed according to the second processing method; if some target entities are located at leaf nodes, the target entities located at the leaf nodes are constructed according to the first processing method to obtain the first minimum fault subgraph, and the target entities located at the non-leaf nodes are constructed according to the second processing method to obtain the second minimum fault subgraph.

[0121] Among them, the first minimum fault subgraph has a higher priority than the second minimum fault subgraph in the root cause location process.

[0122] In the specific implementation process of the present application, an implementation method of the first processing method includes: for each target entity, selecting a link between the target entity and other key elements in the application system as a first link; and constructing a minimum fault subgraph based on all first links.

[0123] Among them, other key elements include but are not limited to other alarms, abnormal indicators or equipment, which are not limited here.

[0124] In the specific implementation process of the present application, an implementation method of the second processing method determines whether there is an intersection between each target entity and each important node link and the minimum distance between the target entity and the leaf node; the link of the target entity that has the most intersections with the important node links and is closest to the leaf node is taken as the main link; for each pending target entity, the link with the largest intersection and the longest length between the important node link where the pending target entity is located and the main link is taken as the branch link; wherein the pending target entity is the target entity other than the target entity of the main link; if the important node link where the pending target entity is located has no intersection with the main link, the shortest path between the pending target entity and the main link is taken as the branch link; and a minimum fault subgraph is constructed based on the main link and all branch links.

[0125] S403: Analyze according to the minimum fault subgraph to obtain analysis results.

[0126] Specifically, if the minimum fault subgraph is constructed by the first processing method with all target entities located at leaf nodes, then the earliest alarm time of each target entity in the time window is calculated, and the earliest alarm time is used as the basis for locating the root cause of the fault. If the minimum fault subgraph is constructed by the second processing method with all target entities located at non-leaf nodes, the distance of each target entity from the leaf node of the link in the minimum fault subgraph is calculated. The smaller the distance, the higher the priority of the root cause. When the distance is the same, the earliest alarm time of the target entity in the time window is compared. The earlier it appears, the higher the priority.

[0127] If some target entities are located at leaf nodes, the target entities located at leaf nodes are constructed according to the first processing method to obtain the first minimum fault subgraph, and the target entities located at non-leaf nodes are constructed according to the second processing method to obtain the second minimum fault subgraph. The implementation method of obtaining the analysis result by analyzing the minimum fault subgraph is the same as above, and the first minimum fault subgraph has a higher priority than the second minimum fault subgraph in the root cause location process.

[0128] By constructing the minimum fault subgraph of a single application system, the root cause of the fault is accurately located. Whether the target entity is located entirely at leaf nodes, non-leaf nodes, or partially at leaf nodes, the algorithm can handle it flexibly according to the specific situation and determine the priority of the root cause based on the distance and alarm time within the time window. The unique advantages of this application in handling complex fault scenarios are of great significance for improving operation and maintenance efficiency and reducing the impact of faults.

[0129] It can be seen from the above scheme that the present application provides a method for analyzing a fault network, which collects alarm data in real time, and pre-processes the alarm data for each alarm data to obtain target alarm information; wherein, the target alarm information includes the time window to which the alarm data belongs, the application system to which the system alarm data belongs, and the entity involved in the alarm data; then, for each application system, the alarm data is correlated and analyzed according to the target alarm information, and merged to form a correlation scenario; wherein the correlation scenario at least includes the triggering sequence between multiple alarm data; finally, for each application system, a fault analysis is performed according to the correlation scenario and the important node link map to obtain an analysis result; wherein, the important node link map is constructed based on key entities and operation and maintenance knowledge maps, so as to achieve the purpose of quickly and effectively analyzing the fault network.

[0130] The present application embodiment provides a device for analyzing a faulty network, such as Figure 5 As shown, specifically including:

[0131] The collection unit 501 is used to collect alarm data in real time.

[0132] The preprocessing unit 502 is used to preprocess each alarm data to obtain target alarm information.

[0133] The target alarm information includes the time window to which the alarm data belongs, the application system to which the system alarm data belongs, and the entity involved in the alarm data.

[0134] Optionally, in another embodiment of the present application, the alarm data includes: alarm information and alarm time; an implementation of the preprocessing unit 502 includes:

[0135] The first dividing unit is used to divide each alarm data according to the occurrence time of the alarm data and the preset time window to obtain the time window to which the alarm data belongs.

[0136] The second division unit is used to divide the alarm data into application systems according to the alarm information in the alarm data to obtain the application system to which the alarm data belongs.

[0137] The divided unit is used to associate the alarm information related to the basic platform and the network with the corresponding application system through the relevant configuration relationship in the configuration management system.

[0138] The first determining unit is used to determine the entity information to which the alarm information belongs according to the key information in the alarm information.

[0139] The entity information at least includes an instance.

[0140] The second determining unit is used to determine the entity involved in the alarm data according to the instance.

[0141] For the specific working process of the units disclosed in the above embodiments of the present application, please refer to the corresponding method embodiments, such as Figure 2 As shown, no further description is given here.

[0142] The correlation analysis unit 503 is used to perform correlation analysis on the alarm data according to the target alarm information for each application system, and merge them into a correlation scenario.

[0143] The associated scenario at least includes a triggering sequence between multiple alarm data.

[0144] Optionally, in another embodiment of the present application, the alarm data includes: alarm time, alarm type and alarm source, and the correlation analysis unit 503 includes:

[0145] The third determining unit is used to determine the association relationship between the alarm data for each application system according to the alarm time, alarm type, alarm source and the association rule network.

[0146] Among them, the association rule network is generated based on support and confidence.

[0147] The merging unit is used to merge the correlation relationships between multiple alarm data caused by the same problem or event based on the correlation relationships between the alarm data to obtain a correlation scenario.

[0148] For the specific working process of the units disclosed in the above embodiments of the present application, please refer to the corresponding method embodiments, such as Figure 3 As shown, no further description is given here.

[0149] The fault analysis unit 504 is used to perform fault analysis on each application system according to the associated scenarios and important node link maps to obtain analysis results.

[0150] Among them, the important node link graph is constructed based on the key entity and operation and maintenance knowledge graph.

[0151] For the specific working process of the units disclosed in the above embodiments of the present application, please refer to the corresponding method embodiments, such as Figure 1 As shown, no further description is given here.

[0152] Optionally, in another embodiment of the present application, an implementation of the fault analysis unit 504 includes:

[0153] The intersection unit is used to take the intersection of the entities involved in the alarm data in the associated scene and the important node link graph to obtain the target entity.

[0154] The construction unit is used to construct a minimum fault subgraph according to the node relationship between the target entity and the important node link graph.

[0155] The fault analysis subunit is used to perform analysis according to the minimum fault subgraph to obtain analysis results.

[0156] For the specific working process of the units disclosed in the above embodiments of the present application, please refer to the corresponding method embodiments, such as Figure 4 As shown, no further description is given here.

[0157] Optionally, in another embodiment of the present application, the important node link graph includes leaf nodes and non-leaf nodes, and an implementation of the construction unit includes:

[0158] The first construction sub-unit is used to construct a minimum fault sub-graph according to a first processing method if all target entities are located at leaf nodes.

[0159] The second construction sub-unit is used to construct a minimum fault sub-graph according to the second processing method if all target entities are located at non-leaf nodes.

[0160] The third construction sub-unit is used to construct the first minimum fault sub-graph according to the first processing method for the target entities located at the leaf nodes if some target entities are located at the leaf nodes, and to construct the second minimum fault sub-graph according to the second processing method for the target entities located at the non-leaf nodes.

[0161] Among them, the first minimum fault subgraph has a higher priority than the second minimum fault subgraph in the root cause location process.

[0162] For the specific working process of the units disclosed in the above embodiments of the present application, please refer to the corresponding method embodiments, such as Figure 5 As shown, no further description is given here.

[0163] Optionally, in another embodiment of the present application, the implementation of the first construction subunit includes:

[0164] The link determination unit is used to select, for each target entity, a link between the target entity and other key elements in the application system as a first link.

[0165] The first minimum fault subgraph generating unit is configured to construct a minimum fault subgraph according to all first links.

[0166] The specific working process of the units disclosed in the above embodiments of the present application can be found in the corresponding method embodiments, which will not be repeated here.

[0167] Optionally, in another embodiment of the present application, the implementation of the second construction subunit includes:

[0168] The fourth determination unit is used to determine whether there is an intersection between each target entity and each important node link and the minimum distance between the target entity and the leaf node.

[0169] The fifth determining unit is used to select the link of the target entity that has the most intersections with the important node links and is closest to the leaf node as the main link.

[0170] The sixth determining unit is used to, for each target entity to be determined, select a link having the largest intersection between an important node link where the target entity to be determined is located and a main link and having the largest length as a branch link.

[0171] The undetermined target entity is other target entities except the target entity of the main link.

[0172] The seventh determining unit is configured to use the shortest path between the target entity to be determined and the main link as a branch link if the important node link where the target entity to be determined is located has no intersection with the main link.

[0173] The second minimum fault subgraph generating unit is used to construct a minimum fault subgraph according to the main link and all branch links.

[0174] The specific working process of the units disclosed in the above embodiments of the present application can be found in the corresponding method embodiments, which will not be repeated here.

[0175] It can be seen from the above scheme that the present application provides an analysis device for a fault network, wherein the collection unit 501 collects alarm data in real time, and the preprocessing unit 502 preprocesses the alarm data for each alarm data to obtain target alarm information; wherein the target alarm information includes the time window to which the alarm data belongs, the application system to which the system alarm data belongs, and the entity involved in the alarm data; then, the association analysis unit 503 performs association analysis on the alarm data for each application system according to the target alarm information, and merges them into an associated scenario; wherein the associated scenario at least includes the triggering sequence between multiple alarm data; finally, the fault analysis unit 504 performs fault analysis on each application system according to the associated scenario and the important node link map to obtain an analysis result; wherein the important node link map is constructed based on key entities and the operation and maintenance knowledge map, so as to achieve the purpose of quickly and effectively analyzing the fault network.

[0176] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0177] Another embodiment of the present application provides an electronic device, such as Figure 6 As shown, including:

[0178] One or more processors 601 .

[0179] The storage device 602 stores one or more programs.

[0180] When the one or more programs are executed by the one or more processors 601 , the one or more processors 601 implement the fault network analysis method as described in any one of the above embodiments.

[0181] Another embodiment of the present application provides a computer storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the method for analyzing a fault network as described in any one of the above embodiments is implemented.

[0182] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0183] It should be noted that the computer-readable medium mentioned above in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0184] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0185] Another embodiment of the present application provides a computer program product. When the computer program product is executed, it is used to execute the above-mentioned fault network analysis method.

[0186] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, the above-mentioned functions defined in the method of the embodiment of the present application are executed.

[0187] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in this application is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing this application.

[0188] Although several specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present application. Certain features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination.

[0189] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of application involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above application concept. For example, the above features are replaced with (but not limited to) technical features with similar functions applied in the present application.

Claims

1. A method for analyzing a faulty network, characterized in that: include: Collect alarm data in real time; For each of the alarm data, pre-process the alarm data to obtain target alarm information; wherein the target alarm information includes the time window to which the alarm data belongs, the application system to which the system alarm data belongs, and the entity involved in the alarm data; For each application system, the alarm data is correlated and analyzed according to the target alarm information, and combined to form a correlation scenario; wherein the correlation scenario at least includes the triggering sequence between multiple alarm data; For each application system, a fault analysis is performed according to the associated scenarios and important node link graphs to obtain analysis results; wherein the important node link graphs are constructed according to key entities and operation and maintenance knowledge graphs.

2. The fault network analysis method according to claim 1, characterized in that: The alarm data includes: alarm information and alarm time; for each of the alarm data, the alarm data is preprocessed to obtain target alarm information, including: For each of the alarm data, according to the occurrence time of the alarm data, the alarm data is divided according to the preset time window to obtain the time window to which the alarm data belongs; According to the alarm information in the alarm data, the alarm data is divided into application systems to obtain the application system to which the alarm data belongs; For basic platform and network related alarm information, the alarm information is associated with the corresponding application system through the relevant configuration relationship in the configuration management system; Determine the entity information to which the alarm information belongs through key information in the alarm information; wherein the entity information at least includes an instance; An entity involved in the alarm data is determined according to the instance.

3. The fault network analysis method according to claim 1, characterized in that: The alarm data includes: alarm time, alarm type and alarm source. For each application system, the alarm data is analyzed for correlation according to the target alarm information and combined to form a correlation scenario, including: For each application system, the association relationship between alarm data is determined according to the alarm time, alarm type, alarm source and association rule network; wherein the association rule network is generated according to support and confidence; Based on the correlation between the alarm data, the correlation between multiple alarm data caused by the same problem or event is merged to obtain the correlation scenario.

4. The method for analyzing a faulty network according to claim 1, characterized in that: For each application system, a fault analysis is performed according to the associated scenarios and important node link maps to obtain analysis results, including: Take the intersection of entities involved in the alarm data in the associated scenario and the important node link graph to obtain the target entity; Constructing a minimum fault subgraph according to the node relationship between the target entity and the important node link graph; The analysis results are obtained based on the minimum fault subgraph.

5. The method for analyzing a faulty network according to claim 4, characterized in that: The important node link graph includes leaf nodes and non-leaf nodes, and the minimum fault subgraph is constructed according to the node relationship between the target entity and the important node link graph, including: If all target entities are located at leaf nodes, the minimum fault subgraph is constructed according to the first processing method; If all target entities are located at non-leaf nodes, the minimum fault subgraph is constructed according to the second processing method; If some target entities are located at leaf nodes, the target entities located at leaf nodes are constructed according to the first processing method to obtain the first minimum fault subgraph, and the target entities located at non-leaf nodes are constructed according to the second processing method to obtain the second minimum fault subgraph; wherein, the first minimum fault subgraph has a higher priority than the second minimum fault subgraph in the root cause location process.

6. The method for analyzing a faulty network according to claim 5, characterized in that: If all target entities are located at leaf nodes, a minimum fault subgraph is constructed according to the first processing method, including: For each target entity, select a link between the target entity and other key elements in the application system as a first link; Construct a minimum fault subgraph based on all first links.

7. The method for analyzing a faulty network according to claim 5, characterized in that: If all target entities are located at non-leaf nodes, a minimum fault subgraph is constructed according to the second processing method, including: Determine whether there is an intersection between each target entity and each important node link and the minimum distance between the target entity and the leaf node; The link of the target entity that has the most intersections with the important node links and is closest to the leaf node is taken as the main link; For each pending target entity, the link with the largest intersection between the important node link where the pending target entity is located and the main link and the longest length is taken as a branch link; wherein the pending target entity is other target entities except the target entity of the main link; If the important node link where the target entity to be determined is located has no intersection with the main link, the shortest path between the target entity to be determined and the main link is used as a branch link; Construct a minimum fault subgraph based on the main link and all branch links.

8. A fault network analysis device, characterized in that: include: A collection unit, used to collect alarm data in real time; A preprocessing unit, configured to preprocess each of the alarm data to obtain target alarm information; wherein the target alarm information includes a time window to which the alarm data belongs, an application system to which the system alarm data belongs, and an entity involved in the alarm data; A correlation analysis unit, for each application system, performs correlation analysis on the alarm data according to the target alarm information, and combines them into a correlation scenario; wherein the correlation scenario at least includes a triggering sequence between multiple alarm data; The fault analysis unit is used to perform fault analysis on each application system according to the associated scenarios and important node link graphs to obtain analysis results; wherein the important node link graphs are constructed based on key entities and operation and maintenance knowledge graphs.

9. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the fault network analysis method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: A computer program is stored thereon, wherein when the computer program is executed by a processor, the method for analyzing a fault network as claimed in any one of claims 1 to 7 is implemented.

Images