Method and device for analyzing a faulty network, electronic device and computer storage medium

Abstract

The application provides a fault network analysis method and device, electronic equipment and computer storage medium, real-time collection of alarm data, preprocessing of each alarm data, and obtaining of target alarm information; wherein the target alarm information includes a time window to which the alarm data belongs, an application system to which system alarm data belongs, and an entity involved in the alarm data; then, for each application system, the alarm data is associated and analyzed according to the target alarm information, and an associated scene is formed by merging; wherein the associated scene at least includes a trigger sequence between multiple alarm data; finally, for each application system, fault analysis is performed according to the associated scene and an important node link graph, and an analysis result is obtained; wherein the important node link graph is obtained by constructing a key entity and an operation and maintenance knowledge graph, so as to quickly and effectively analyze the fault network.

Description

Technical Field

[0001] This application relates to the field of anomaly analysis technology, and in particular to a method, apparatus, electronic device, and computer storage medium for analyzing fault networks. Background Technology

[0002] Currently, facing the increasingly complex architecture of banking systems and the ever-growing scale of business, traditional alarm management methods are struggling to effectively cope with the massive, diverse, and dynamic nature of alarm information, resulting in slow root cause identification and low processing efficiency. Summary of the Invention

[0003] In view of this, this application provides a method, apparatus, electronic device, and computer storage medium for analyzing faulty networks, enabling rapid and effective analysis of faulty networks.

[0004] The first aspect of this application provides a method for analyzing faulty networks, including:

[0005] Real-time collection of alarm data;

[0006] For each of the alarm data, the alarm data is preprocessed to obtain target alarm information; wherein, the target alarm information includes the time window to which the alarm data belongs, the application system to which the system alarm data belongs, and the entity involved in the alarm data;

[0007] For each application system, alarm data is correlated and analyzed based on target alarm information, and then merged to form a related scenario; wherein, the related scenario includes at least the triggering order of multiple alarm data;

[0008] For each application system, fault analysis is performed based on the associated scenarios and important node link graph to obtain analysis results; wherein, the important node link graph is constructed based on key entities and operation and maintenance knowledge graph.

[0009] Optionally, the alarm data includes: alarm information and alarm time; the step of preprocessing the alarm data for each alarm data to obtain target alarm information includes:

[0010] For each alarm data, the time window to which the alarm data belongs is divided according to the occurrence time of the alarm data and a preset time window is obtained;

[0011] Based on the alarm information in the alarm data, the alarm data is divided into application systems to obtain the application system to which the alarm data belongs;

[0012] For alarm information related to the basic platform and network, the alarm information is associated with the corresponding application system through the relevant configuration relationships in the configuration management system;

[0013] By using key information in the alarm message, the entity information to which the alarm message belongs is determined; wherein, the entity information includes at least an instance;

[0014] The entity involved in the alarm data is determined based on the example described.

[0015] Optionally, the alarm data includes: alarm time, alarm type, and alarm source. For each application system, the alarm data is analyzed for correlation based on the target alarm information, and the resulting correlation scenarios are formed, including:

[0016] For each application system, the correlation between alarm data is determined based on alarm time, alarm type, alarm source, and correlation rule network; wherein, the correlation rule network is generated based on support and confidence.

[0017] Based on the correlation between alarm data, the correlation between multiple alarm data caused by the same problem or event is merged to obtain the related scenarios.

[0018] Optionally, for each application system, fault analysis is performed based on the associated scenarios and important node link graphs to obtain analysis results, including:

[0019] The target entity is obtained by taking the intersection of the entity and important node link graph involved in the alarm data in the associated scenario;

[0020] Based on the node relationships in the link graph between the target entity and important nodes, construct a minimum fault subgraph;

[0021] The analysis results are obtained by analyzing the minimum fault subgraph.

[0022] Optionally, the important node link graph includes leaf nodes and non-leaf nodes, and the step of constructing a minimum fault subgraph based on the relationship between the target entity and the nodes in the important node link graph includes:

[0023] If all target entities are located in leaf nodes, then the minimum fault subgraph is constructed according to the first processing method;

[0024] If all target entities are located in non-leaf nodes, then the minimum fault subgraph is constructed according to the second processing method.

[0025] If some target entities are located in leaf nodes, the target entities located in leaf nodes are processed according to the first processing method to construct a first minimum fault subgraph, and the target entities located in non-leaf nodes are processed according to the second processing method to construct a second minimum fault subgraph; wherein, the first minimum fault subgraph has a higher priority than the second minimum fault subgraph in the root cause localization process.

[0026] Optionally, if all target entities are located in leaf nodes, then according to the first processing method, a minimum fault subgraph is constructed, including:

[0027] For each target entity, select the link between the target entity and other key elements in the application system as the first link;

[0028] Construct a minimum fault subgraph based on all first links.

[0029] Optionally, if all target entities are located in non-leaf nodes, then according to the second processing method, a minimum fault subgraph is constructed, including:

[0030] Determine whether there is an intersection between each target entity and each important node in the link, and the minimum distance between the target entity and the leaf node;

[0031] The link of the target entity that has the most intersections with the links of important nodes and is closest to the leaf node is taken as the main link;

[0032] For each undetermined target entity, the link with the largest intersection and the longest length between the important node link where the undetermined target entity is located and the main link is taken as the branch link; wherein, the undetermined target entity is any target entity other than the target entity on the main link;

[0033] If the important node link where the target entity is located has no intersection with the main link, then the shortest path between the target entity and the main link is taken as the branch link.

[0034] Construct a minimum fault subgraph based on the main link and all branch links.

[0035] A second aspect of this application provides an analysis apparatus for faulty networks, comprising:

[0036] The data acquisition unit is used to collect alarm data in real time.

[0037] A preprocessing unit is used to preprocess each alarm data to obtain target alarm information; wherein, the target alarm information includes the time window to which the alarm data belongs, the application system to which the system alarm data belongs, and the entity involved in the alarm data;

[0038] The correlation analysis unit is used to perform correlation analysis on alarm data based on target alarm information for each application system and merge them to form a correlation scenario; wherein, the correlation scenario includes at least the triggering order between multiple alarm data;

[0039] The fault analysis unit is used to perform fault analysis for each application system based on the associated scenarios and important node link graphs, and obtain analysis results; wherein, the important node link graphs are constructed based on key entities and operation and maintenance knowledge graphs.

[0040] Optionally, the alarm data includes: alarm information and alarm time; the preprocessing unit includes:

[0041] The first division unit is used to divide each alarm data according to the occurrence time of the alarm data according to a preset time window to obtain the time window to which the alarm data belongs.

[0042] The second division unit is used to divide the alarm data into application systems based on the alarm information in the alarm data, so as to obtain the application system to which the alarm data belongs;

[0043] The first division unit is used to associate alarm information related to the basic platform and network with the corresponding application system through the relevant configuration relationship in the configuration management system;

[0044] The first determining unit is used to determine the entity information to which the alarm information belongs by using key information in the alarm information; wherein, the entity information includes at least an instance;

[0045] The second determining unit is used to determine the entity involved in the alarm data based on the instance.

[0046] Optionally, the alarm data includes: alarm time, alarm type, and alarm source; the correlation analysis unit includes:

[0047] The third determining unit is used to determine the correlation between alarm data for each application system based on alarm time, alarm type, alarm source, and correlation rule network; wherein the correlation rule network is generated based on support and confidence.

[0048] The merging unit is used to merge the correlations between multiple alarm data caused by the same problem or event to obtain the associated scenario.

[0049] Optionally, the fault analysis unit includes:

[0050] The intersection unit is used to take the intersection of the entities involved in the alarm data and the important node link graph in the associated scenario to obtain the target entity;

[0051] The construction unit is used to construct a minimum fault subgraph based on the node relationships in the link graph between the target entity and important nodes;

[0052] The fault analysis subunit is used to analyze the minimum fault subgraph and obtain the analysis results.

[0053] Optionally, the important node link graph includes leaf nodes and non-leaf nodes, and the construction unit includes:

[0054] The first construction sub-unit is used to construct the minimum fault subgraph according to the first processing method if all target entities are located in leaf nodes.

[0055] The second construction sub-unit is used to construct the minimum fault subgraph according to the second processing method if all target entities are located in non-leaf nodes.

[0056] The third construction subunit is used to construct a first minimum fault subgraph for the target entities located in the leaf nodes according to the first processing method, and to construct a second minimum fault subgraph for the target entities located in the non-leaf nodes according to the second processing method; wherein, the first minimum fault subgraph has a higher priority than the second minimum fault subgraph in the root cause localization process.

[0057] Optionally, the first building subunit includes:

[0058] The link determination unit is used to select, for each target entity, the link between the target entity and other key elements in the application system as the first link;

[0059] The first minimum fault subgraph generation unit is used to construct a minimum fault subgraph based on all first links.

[0060] Optionally, the second building subunit includes:

[0061] The fourth determining unit is used to determine whether there is an intersection between each target entity and each important node in the link and the minimum distance between the target entity and the leaf node;

[0062] The fifth determining unit is used to select the target entity whose link has the most intersection with the important node links and is closest to the leaf node as the main link;

[0063] The sixth determining unit is used to determine, for each undetermined target entity, the link with the largest intersection and the longest length between the important node link where the undetermined target entity is located and the main link, as the branch link; wherein, the undetermined target entity is a target entity other than the target entity of the main link;

[0064] The seventh determining unit is used to determine the shortest path between the target entity and the main link as a branch link if the important node link where the target entity is located has no intersection with the main link.

[0065] The second minimum fault subgraph generation unit is used to construct the minimum fault subgraph based on the main link and all branch links.

[0066] A third aspect of this application provides an electronic device, comprising:

[0067] One or more processors;

[0068] A storage device on which one or more programs are stored;

[0069] When the one or more programs are executed by the one or more processors, the one or more processors implement the fault network analysis method as described in any one of the first aspects.

[0070] The fourth aspect of this application provides a computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the fault network analysis method as described in any one of the first aspects.

[0071] As can be seen from the above scheme, this application provides a method, apparatus, electronic device, and computer storage medium for analyzing faulty networks. It collects alarm data in real time, preprocesses each alarm data point to obtain target alarm information, whereby the target alarm information includes the time window to which the alarm data belongs, the application system to which the system alarm data belongs, and the entities involved in the alarm data. Then, for each application system, it performs correlation analysis on the alarm data based on the target alarm information, merging them to form a correlation scenario. The correlation scenario includes at least the triggering order between multiple alarm data points. Finally, for each application system, it performs fault analysis based on the correlation scenario and an important node link graph to obtain analysis results. The important node link graph is constructed based on key entities and an operation and maintenance knowledge graph, achieving the goal of quickly and effectively analyzing faulty networks. Attached Figure Description

[0072] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0073] Figure 1 A detailed flowchart of a fault network analysis method provided in an embodiment of this application;

[0074] Figure 2 A flowchart of a method for preprocessing alarm data provided in another embodiment of this application;

[0075] Figure 3 A flowchart illustrating a method for forming an associated scene, as provided in another embodiment of this application;

[0076] Figure 4 A flowchart illustrating a fault analysis method provided in another embodiment of this application;

[0077] Figure 5 A schematic diagram of a fault network analysis device provided in another embodiment of this application;

[0078] Figure 6 A schematic diagram of an electronic device for implementing a fault network analysis method, as provided in another embodiment of this application. Detailed Implementation

[0079] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0080] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0081] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0082] It should be noted that the concepts of "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0083] It should be noted that the terms "a" and "a plurality of" used in this application are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0084] This application provides a method for analyzing faulty networks, such as... Figure 1 As shown, the specific steps include:

[0085] S101. Real-time collection of alarm data.

[0086] In the specific implementation of this application, an alarm identification mechanism is triggered when the system detects an anomaly in a preset indicator. This process primarily focuses on key indicators such as transaction volume, system success rate, business success rate, average response time, and average processing time. The system monitors these indicators in real time and compares them with preset thresholds or historical data. Once a significant deviation is detected, alarm data is generated. The alarm data contains key information such as the abnormal indicator, the degree of deviation, and the time of occurrence, providing important evidence for subsequent troubleshooting and emergency response. This alarm identification mechanism ensures the stability and continuity of the business system and helps to promptly identify and resolve potential problems.

[0087] S102. For each alarm data, preprocess the alarm data to obtain the target alarm information.

[0088] The target alarm information includes the time window to which the alarm data belongs, the application system to which the system alarm data belongs, and the entity involved in the alarm data.

[0089] Optionally, in another embodiment of this application, the alarm data includes at least: alarm information and alarm time; one implementation of step S102 is as follows: Figure 2 As shown, it includes:

[0090] S201. For each alarm data, the alarm data is divided into preset time windows according to the occurrence time of the alarm data to obtain the time window to which the alarm data belongs.

[0091] Understandably, dividing time windows is for the purpose of capturing and processing alarm data in real time. The monitoring system collects alarm information from different monitoring sources in real time, and divides the alarm data according to the time of occurrence, according to the preset time window, to obtain the time window to which the alarm data belongs, so as to facilitate subsequent analysis and processing.

[0092] It should be noted that the size of the time window can be adjusted according to actual needs, such as 5 minutes, 10 minutes, etc., and there is no limit here.

[0093] S202. Based on the alarm information in the alarm data, divide the alarm data into application systems to obtain the application system to which the alarm data belongs.

[0094] The alarm information includes, but is not limited to, alarm source, alarm type, and affected systems. No specific restrictions are imposed here.

[0095] It is understandable that alarm data is divided according to application systems. Alarm data usually involves multiple application systems. In order to more accurately locate the root cause of the fault, the alarm data is divided according to application systems by parsing the alarm information in the alarm data.

[0096] S203. For alarm information related to the basic platform and network, the alarm information is associated with the corresponding application system through the relevant configuration relationships in the configuration management system.

[0097] Specifically, for alarm information related to the basic platform and network, the alarm information is associated with the corresponding application system through the relevant configuration relationships in the configuration management system to ensure the comprehensiveness of the analysis.

[0098] S204. Determine the entity information to which the alarm information belongs by using the key information in the alarm information.

[0099] The entity information includes at least one instance. Key information in the alarm message includes, but is not limited to, service name and instance name. The entity type to which the alarm message belongs is determined by the key information, such as service or instance, for categorization and organization. Each instance corresponds to a specific entity, such as a process on a server or an interface on a network device, clearly defining its entity type.

[0100] S205. Determine the entities involved in the alarm data based on the instance.

[0101] S103. For each application system, perform correlation analysis on alarm data based on target alarm information and merge them to form related scenarios.

[0102] Among them, the related scenarios include at least the triggering order of multiple alarm data.

[0103] It should be noted that when multiple alarms occur in the system, correlation analysis can identify the root cause of the problem by uncovering the potential connections between these alarms and organizing them in a logical or chronological order.

[0104] Optionally, in another embodiment of this application, the alarm data includes at least: alarm time, alarm type, and alarm source. One implementation of step S103 is as follows: Figure 3 As shown, it includes:

[0105] S301. For each application system, determine the correlation between alarm data based on alarm time, alarm type, alarm source, and correlation rule network.

[0106] The association rule network is generated based on support and confidence.

[0107] In the specific implementation of the application, key information such as alarm time, type, and source can be obtained by cleaning the alarm data, but not limited to this process.

[0108] Secondly, association rules are generated based on support and confidence, an association rule network is created, and the association rule network is visualized to reveal potential connections between alarms.

[0109] S302. Based on the correlation between alarm data, merge the correlation between multiple alarm data caused by the same problem or event to obtain the related scenario.

[0110] In the context of related scenarios, the triggering order, causal relationships, and mutual influences of alarms can be observed. This process helps operations and maintenance personnel quickly locate problems, reduce interference from redundant alarms, and improve the efficiency of fault handling.

[0111] S104. For each application system, conduct fault analysis based on the associated scenarios and important node link diagrams to obtain analysis results.

[0112] The important node link graph is constructed based on key entities and the operation and maintenance knowledge graph. Each important node link graph includes at least one important node link.

[0113] In the specific implementation process of this application, the focus of alarm attention is first clarified, including servers, network devices, databases, middleware, application systems, etc., without limitation here. Then, by sorting out the entities, the foundation is laid for subsequent link graph construction and alarm analysis. The latest full upstream and downstream link relationships between these entities are obtained from the operation and maintenance knowledge graph.

[0114] The operations and maintenance knowledge graph is a graph-like data structure containing all entities and their relationships within the system. It helps us understand the dependencies and impact paths between entities. By querying the knowledge graph, we can obtain the connections between each entity and other entities, including upstream and downstream dependencies, and filter out links related to entities of concern in alarms to construct a key node link graph. Focusing on entities and links related to alarms reduces the complexity and resource consumption of subsequent analysis. The filtering process can be based on factors such as entity type, business importance, and historical alarm data. This effectively improves the accuracy of root cause localization and significantly shortens the time required for troubleshooting.

[0115] Optionally, in another embodiment of this application, one implementation of step S104 is as follows: Figure 4 As shown, it also includes:

[0116] S401. Take the intersection of the entity and important node link graph involved in the alarm data in the associated scenario to obtain the target entity.

[0117] S402. Construct a minimum fault subgraph based on the node relationships in the link graph between the target entity and important nodes.

[0118] The critical node link graph includes leaf nodes and non-leaf nodes. Leaf nodes can be specific faulty devices, abnormal indicators, error logs, etc., without limitation. For example, in a service system, a leaf node could be the specific server IP address experiencing a problem, the process ID with excessive CPU usage, or the path to a log file containing error information. Non-leaf nodes in the root cause critical node link graph may represent services, modules, system components, or abstract concepts. For example, in a microservice architecture, non-leaf nodes could be the names of various microservices, which act as parent nodes, connecting to leaf nodes representing specific faults or abnormal situations.

[0119] Optionally, in another embodiment of this application, the important node link graph includes leaf nodes and non-leaf nodes. One implementation of step S402 includes:

[0120] If all target entities are located in leaf nodes, the minimum fault subgraph is constructed according to the first processing method; if all target entities are located in non-leaf nodes, the minimum fault subgraph is constructed according to the second processing method; if some target entities are located in leaf nodes, the target entities located in leaf nodes are constructed according to the first processing method to obtain the first minimum fault subgraph, and the target entities located in non-leaf nodes are constructed according to the second processing method to obtain the second minimum fault subgraph.

[0121] Among them, the first minimum fault subgraph has a higher priority than the second minimum fault subgraph in the root cause localization process.

[0122] In the specific implementation of this application, one embodiment of the first processing method includes: for each target entity, selecting a link between the target entity and other key elements in the application system as a first link; and constructing a minimum fault subgraph based on all first links.

[0123] Other key elements include, but are not limited to, other alarms, abnormal indicators or devices, which are not specified here.

[0124] In the specific implementation of this application, one embodiment of the second processing method is as follows: Determine whether there is an intersection between each target entity and each important node link, and the minimum distance between the target entity and the leaf node; designate the link of the target entity with the most intersections with important node links and closest to the leaf node as the main link; for each undetermined target entity, designate the link with the largest intersection and longest length between the undetermined target entity's important node link and the main link as the branch link; wherein, the undetermined target entity refers to other target entities besides the target entity in the main link; if the undetermined target entity's important node link has no intersection with the main link, then the shortest path between the undetermined target entity and the main link is designated as the branch link; construct a minimum fault subgraph based on the main link and all branch links.

[0125] S403. Analyze the minimum fault subgraph to obtain the analysis results.

[0126] Specifically, if the minimum fault subgraph is constructed using the first processing method, where all target entities are located in leaf nodes, then the earliest alarm time for each target entity within the time window is calculated, and the order of the earliest alarm times is used as the basis for root cause localization. If the minimum fault subgraph is constructed using the second processing method, where all target entities are located in non-leaf nodes, then the distance of each target entity from the leaf node of its link within the minimum fault subgraph is calculated. The smaller the distance, the higher the root cause priority. If the distances are the same, the earliest alarm time of the target entity within the time window is compared; the earlier the alarm occurs, the higher the priority.

[0127] If some target entities are located in leaf nodes, the target entities located in leaf nodes are processed using the first processing method to construct a first minimum fault subgraph, and the target entities located in non-leaf nodes are processed using the second processing method to construct a second minimum fault subgraph. The implementation method for obtaining the analysis results based on the minimum fault subgraphs is the same as above, and the first minimum fault subgraph has a higher priority than the second minimum fault subgraph in the root cause localization process.

[0128] By constructing a minimum fault subgraph for a single application system, the algorithm achieves precise localization of the root cause of a fault. Whether the target entity is entirely located in leaf nodes, non-leaf nodes, or partially located in leaf nodes, the algorithm can flexibly handle the situation according to the specific circumstances and determine the priority of the root cause based on distance and alarm time within a time window. This application's unique advantages in handling complex fault scenarios are of great significance for improving operational efficiency and reducing the impact of faults.

[0129] As can be seen from the above scheme, this application provides a method for analyzing fault networks. It collects alarm data in real time, preprocesses each alarm data point to obtain target alarm information, which includes the time window to which the alarm data belongs, the application system to which the system alarm data belongs, and the entities involved in the alarm data. Then, for each application system, it performs correlation analysis on the alarm data based on the target alarm information, merging them to form a correlation scenario. The correlation scenario includes at least the triggering order between multiple alarm data points. Finally, for each application system, it performs fault analysis based on the correlation scenario and the important node link graph to obtain the analysis results. The important node link graph is constructed based on key entities and an operation and maintenance knowledge graph, achieving the goal of quickly and effectively analyzing fault networks.

[0130] This application provides an analysis device for faulty networks, such as... Figure 5 As shown, it specifically includes:

[0131] The acquisition unit 501 is used to collect alarm data in real time.

[0132] The preprocessing unit 502 is used to preprocess each alarm data to obtain the target alarm information.

[0133] The target alarm information includes the time window to which the alarm data belongs, the application system to which the system alarm data belongs, and the entity involved in the alarm data.

[0134] Optionally, in another embodiment of this application, the alarm data includes: alarm information and alarm time; one implementation of the preprocessing unit 502 includes:

[0135] The first division unit is used to divide each alarm data according to the occurrence time of the alarm data and according to a preset time window to obtain the time window to which the alarm data belongs.

[0136] The second division unit is used to divide the alarm data into application systems based on the alarm information in the alarm data, so as to obtain the application system to which the alarm data belongs.

[0137] The first division unit is used to associate alarm information related to the basic platform and network with the corresponding application system through the relevant configuration relationships in the configuration management system.

[0138] The first determining unit is used to determine the entity information to which the alarm information belongs by using the key information in the alarm information.

[0139] The entity information includes at least instances.

[0140] The second determining unit is used to determine the entity involved in the alarm data based on the instance.

[0141] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, such as... Figure 2 As shown, it will not be elaborated further here.

[0142] The correlation analysis unit 503 is used to perform correlation analysis on alarm data based on target alarm information for each application system and merge them to form a correlation scenario.

[0143] Among them, the related scenarios include at least the triggering order of multiple alarm data.

[0144] Optionally, in another embodiment of this application, the alarm data includes: alarm time, alarm type, and alarm source; the correlation analysis unit 503 includes:

[0145] The third determining unit is used to determine the correlation between alarm data for each application system based on alarm time, alarm type, alarm source, and correlation rule network.

[0146] The association rule network is generated based on support and confidence.

[0147] The merging unit is used to merge the correlations between multiple alarm data caused by the same problem or event to obtain the associated scenario.

[0148] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, such as... Figure 3 As shown, it will not be elaborated further here.

[0149] The fault analysis unit 504 is used to perform fault analysis for each application system based on the associated scenarios and the link diagram of important nodes, and obtain the analysis results.

[0150] Among them, the important node link graph is constructed based on the key entities and the operation and maintenance knowledge graph.

[0151] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, such as... Figure 1 As shown, it will not be elaborated further here.

[0152] Optionally, in another embodiment of this application, one implementation of the fault analysis unit 504 includes:

[0153] The intersection unit is used to find the intersection of the entities involved in the alarm data and the important node link graph in the associated scenario to obtain the target entity.

[0154] The building unit is used to construct the minimum fault subgraph based on the node relationships in the link graph between the target entity and important nodes.

[0155] The fault analysis subunit is used to analyze the minimum fault subgraph and obtain the analysis results.

[0156] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, such as... Figure 4 As shown, it will not be elaborated further here.

[0157] Optionally, in another embodiment of this application, the important node link graph includes leaf nodes and non-leaf nodes. One implementation of the building unit includes:

[0158] The first construction sub-unit is used to construct the minimum fault subgraph according to the first processing method if all target entities are located in leaf nodes.

[0159] The second construction sub-unit is used to construct the minimum fault subgraph according to the second processing method if all target entities are located in non-leaf nodes.

[0160] The third construction subunit is used to construct a first minimum fault subgraph for the target entities located in the leaf nodes according to the first processing method, and to construct a second minimum fault subgraph for the target entities located in the non-leaf nodes according to the second processing method.

[0161] Among them, the first minimum fault subgraph has a higher priority than the second minimum fault subgraph in the root cause localization process.

[0162] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, such as... Figure 5 As shown, it will not be elaborated further here.

[0163] Optionally, in another embodiment of this application, the implementation of the first building subunit includes:

[0164] The link determination unit is used to select, for each target entity, the link between the target entity and other key elements in the application system as the first link.

[0165] The first minimum fault subgraph generation unit is used to construct a minimum fault subgraph based on all first links.

[0166] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, which will not be repeated here.

[0167] Optionally, in another embodiment of this application, the implementation of the second building subunit includes:

[0168] The fourth determining unit is used to determine whether there is an intersection between each target entity and each important node in the link and the minimum distance between the target entity and the leaf node.

[0169] The fifth determining unit is used to select the target entity whose link has the most intersection with the important node links and is closest to the leaf node as the main link.

[0170] The sixth determining unit is used to determine, for each undetermined target entity, the link with the largest intersection and the longest length between the important node link where the undetermined target entity is located and the main link, as the branch link.

[0171] Among them, the undetermined target entities are other target entities besides the target entities of the main link.

[0172] The seventh determining unit is used to determine the shortest path between the target entity and the main link as a branch link if the important node link where the target entity is located has no intersection with the main link.

[0173] The second minimum fault subgraph generation unit is used to construct the minimum fault subgraph based on the main link and all branch links.

[0174] For details on the specific working process of the units disclosed in the above embodiments of this application, please refer to the corresponding method embodiments, which will not be repeated here.

[0175] As can be seen from the above scheme, this application provides a fault network analysis device. The acquisition unit 501 collects alarm data in real time. The preprocessing unit 502 preprocesses the alarm data for each alarm data to obtain target alarm information. The target alarm information includes the time window to which the alarm data belongs, the application system to which the system alarm data belongs, and the entities involved in the alarm data. Then, the correlation analysis unit 503 performs correlation analysis on the alarm data for each application system based on the target alarm information and merges them to form a correlation scenario. The correlation scenario includes at least the triggering order between multiple alarm data. Finally, the fault analysis unit 504 performs fault analysis on each application system based on the correlation scenario and the important node link graph to obtain the analysis results. The important node link graph is constructed based on key entities and operation and maintenance knowledge graphs to achieve the purpose of quickly and effectively analyzing the fault network.

[0176] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0177] Another embodiment of this application provides an electronic device, such as... Figure 6 As shown, it includes:

[0178] One or more processors 601.

[0179] Storage device 602, on which one or more programs are stored.

[0180] When the one or more programs are executed by the one or more processors 601, the one or more processors 601 implement the fault network analysis method as described in any of the above embodiments.

[0181] Another embodiment of this application provides a computer storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the fault network analysis method as described in any of the above embodiments.

[0182] In the context of this application, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0183] It should be noted that the computer-readable medium described above in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0184] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0185] Another embodiment of this application provides a computer program product that, when executed, performs the above-described method for analyzing faulty networks.

[0186] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, it performs the functions defined in the methods of the embodiments of this application.

[0187] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in this application is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely exemplary forms of implementing this application.

[0188] While several specific implementation details are included in the foregoing discussion, these should not be construed as limiting the scope of this application. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0189] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described application concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions claimed in this application.

Claims

1. A method for analyzing faulty networks, characterized in that, include: Real-time collection of alarm data; For each of the alarm data, the alarm data is preprocessed to obtain target alarm information; wherein, the target alarm information includes the time window to which the alarm data belongs, the application system to which the alarm data belongs, and the entity involved in the alarm data; For each application system, alarm data is correlated and analyzed based on target alarm information, and then merged to form a related scenario; wherein, the related scenario includes at least the triggering order of multiple alarm data; For each application system, fault analysis is performed based on the associated scenarios and important node link graph to obtain analysis results; wherein, the important node link graph is constructed based on key entities and operation and maintenance knowledge graph; For each application system, fault analysis is performed based on the associated scenarios and important node link graphs to obtain analysis results. This includes: taking the intersection of the entities involved in the alarm data in the associated scenarios and the important node link graphs to obtain the target entity; constructing a minimum fault subgraph based on the relationship between the target entity and the nodes in the important node link graphs; and performing analysis based on the minimum fault subgraphs to obtain analysis results. The important node link graph includes leaf nodes and non-leaf nodes. The step of constructing a minimum fault subgraph based on the relationship between the target entity and the nodes in the important node link graph includes: if all target entities are located in leaf nodes, then a minimum fault subgraph is constructed according to a first processing method; if all target entities are located in non-leaf nodes, then a minimum fault subgraph is constructed according to a second processing method; if some target entities are located in leaf nodes, a first minimum fault subgraph is constructed for the target entities located in leaf nodes according to the first processing method, and a second minimum fault subgraph is constructed for the target entities located in non-leaf nodes according to the second processing method; wherein, the first minimum fault subgraph has a higher priority than the second minimum fault subgraph during root cause localization. If all target entities are located in leaf nodes, a minimum fault subgraph is constructed according to the first processing method, including: for each target entity, selecting the link between the target entity and other key elements in the application system as the first link; constructing a minimum fault subgraph based on all first links; if all target entities are located in non-leaf nodes, a minimum fault subgraph is constructed according to the second processing method, including: determining whether there is an intersection between each target entity and each important node link and the minimum distance between the target entity and the leaf node; taking the link of the target entity with the most intersection with the important node link and closest to the leaf node as the main link; for each undetermined target entity, taking the link with the largest intersection with the main link and the longest length between the undetermined target entity's important node link and the main link as the branch link; wherein, the undetermined target entity is any target entity other than the target entity in the main link; if the undetermined target entity's important node link has no intersection with the main link, taking the shortest path between the undetermined target entity and the main link as the branch link; constructing a minimum fault subgraph based on the main link and all branch links.

2. The method for analyzing faulty networks according to claim 1, characterized in that, The alarm data includes: alarm information and alarm time; for each piece of alarm data, the alarm data is preprocessed to obtain target alarm information, including: For each alarm data, the time window to which the alarm data belongs is divided according to the occurrence time of the alarm data and a preset time window is obtained; Based on the alarm information in the alarm data, the alarm data is divided into application systems to obtain the application system to which the alarm data belongs; For alarm information related to the basic platform and network, the alarm information is associated with the corresponding application system through the relevant configuration relationships in the configuration management system; By using key information in the alarm message, the entity information to which the alarm message belongs is determined; wherein, the entity information includes at least an instance; The entity involved in the alarm data is determined based on the example described.

3. The method for analyzing faulty networks according to claim 1, characterized in that, The alarm data includes: alarm time, alarm type, and alarm source. For each application system, the alarm data is correlated and analyzed based on the target alarm information to form related scenarios, including: For each application system, the correlation between alarm data is determined based on alarm time, alarm type, alarm source, and correlation rule network; wherein, the correlation rule network is generated based on support and confidence. Based on the correlation between alarm data, the correlation between multiple alarm data caused by the same problem or event is merged to obtain the related scenarios.

4. An analysis device for faulty networks, characterized in that, include: The data acquisition unit is used to collect alarm data in real time. A preprocessing unit is used to preprocess each alarm data to obtain target alarm information; wherein, the target alarm information includes the time window to which the alarm data belongs, the application system to which the alarm data belongs, and the entity involved in the alarm data; The correlation analysis unit is used to perform correlation analysis on alarm data based on target alarm information for each application system and merge them to form a correlation scenario; wherein, the correlation scenario includes at least the triggering order between multiple alarm data; The fault analysis unit is used to perform fault analysis for each application system based on the associated scenarios and important node link graphs, and obtain analysis results; wherein, the important node link graphs are constructed based on key entities and operation and maintenance knowledge graphs; The fault analysis unit includes: an intersection unit, a construction unit, and a fault analysis subunit; The intersection unit is used to take the intersection of the entities involved in the alarm data in the associated scenario and the important node link graph to obtain the target entity; The construction unit is used to construct a minimum fault subgraph based on the node relationships in the link graph between the target entity and important nodes; The fault analysis subunit is used to analyze the minimum fault subgraph to obtain the analysis results; If the important node link graph includes leaf nodes and non-leaf nodes, the construction unit includes: a first construction subunit, a second construction subunit, and a third construction subunit; The first construction subunit is used to construct a minimum fault subgraph according to the first processing method if all target entities are located in leaf nodes. The second construction sub-unit is used to construct the minimum fault subgraph according to the second processing method if all target entities are located in non-leaf nodes. The third construction subunit is used to construct a first minimum fault subgraph for the target entities located in the leaf nodes according to the first processing method if some target entities are located in the leaf nodes, and to construct a second minimum fault subgraph for the target entities located in the non-leaf nodes according to the second processing method; wherein, the first minimum fault subgraph has a higher priority than the second minimum fault subgraph in the root cause localization process. If all target entities are located in leaf nodes, then the first construction sub-unit includes: a link determination unit and a first minimum fault subgraph generation unit; The link determination unit is used to select, for each target entity, a link between the target entity and other key elements in the application system as the first link; The first minimum fault subgraph generation unit is used to construct a minimum fault subgraph based on all first links; If all target entities are located in non-leaf nodes, then the second construction sub-unit includes: a fourth determining unit, a fifth determining unit, a sixth determining unit, a seventh determining unit, and a second minimum fault subgraph generation unit; The fourth determining unit is used to determine whether there is an intersection between each target entity and each important node link and the minimum distance between the target entity and the leaf node. The fifth determining unit is used to take the link of the target entity that has the most intersection with the important node links and is closest to the leaf node as the main link. The sixth determining unit is used to, for each undetermined target entity, take the link with the largest intersection and the longest length between the important node link where the undetermined target entity is located and the main link as the branch link; wherein, the undetermined target entity is any target entity other than the target entity of the main link; The seventh determining unit is used to take the shortest path between the target entity and the main link as a branch link if the important node link where the target entity is located has no intersection with the main link. The second minimum fault subgraph generation unit is used to construct a minimum fault subgraph based on the main link and all branch links.

5. An electronic device, characterized in that, include: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the fault network analysis method as described in any one of claims 1 to 3.

6. A computer storage medium, characterized in that, It stores a computer program, wherein the computer program, when executed by a processor, implements the method for analyzing fault networks as described in any one of claims 1 to 3.

Images