Alarm association relationship mining method and device, storage medium and program product

Abstract

The invention provides an alarm association relationship mining method and device, a storage medium and a program product, and relates to the field of data mining, and the method can realize improvement and optimization of a classical association relationship algorithm. The method comprises the following steps: acquiring a network element alarm data set in a preset time period; the network element alarm data set comprises alarm items generated by the network element equipment with the incidence relation; determining an alarm frequent item set based on the network element alarm data set; the alarm frequent item set comprises at least one alarm combination item; the alarm combination item meets at least one of the following conditions: the occurrence frequency of the alarm combination item is greater than a first threshold; the first association strength between the alarm items of the alarm combination item is greater than a second threshold value; and determining an alarm association rule set of the network element equipment based on the alarm frequent item set. The invention aims to solve the problem that the existing association relationship mining method is difficult to meet the demand of mining associated faults in the telecommunication operation and maintenance field and is difficult to accurately analyze the alarm association relationship in the field.

Description

Technical Field

[0001] The present application relates to the field of data mining, and in particular to an alarm association relationship mining method, device, storage medium and program product. Background Art

[0002] At present, the communication networks of telecom operators are becoming more complex, which has brought about a series of problems such as frequent failures, massive alarms, difficult identification and positioning, complex coordination and time-consuming processing. Therefore, in order to accelerate fault recovery and business assurance, intelligent, accurate and fast alarm analysis tools are urgently needed.

[0003] Traditional association mining methods (for example, association mining methods based on frequent item set mining algorithms such as Apriori or FP-growth) have been successfully applied in traditional industries (such as shopping behavior analysis, search engine recommendation, etc.). However, due to the great differences between the telecommunications operation and maintenance field and traditional industries, directly applying traditional association mining methods to alarm analysis in the telecommunications operation and maintenance field will result in low analysis efficiency and poor accuracy. Summary of the invention

[0004] The present application provides an alarm correlation mining method, device, storage medium and program product, which optimize the existing correlation mining method and can accurately and efficiently analyze the alarm correlation in the field of telecommunications operation and maintenance.

[0005] In a first aspect, the present application provides a method for mining alarm association relationships, comprising:

[0006] A network element alarm data set within a preset time period is obtained; the network element alarm data set includes alarm items generated by network element devices with an associated relationship; based on the network element alarm data set, an alarm frequent item set is determined; the alarm frequent item set includes at least one alarm combination item; the alarm combination item satisfies at least one of the following conditions: the occurrence frequency of the alarm combination item is greater than a first threshold; the first correlation strength between the alarm items of the alarm combination item is greater than a second threshold; based on the alarm frequent item set, a set of alarm association rules for the network element device is determined.

[0007] It is understandable that in the scenario of alarm correlation analysis in the field of telecommunications operation and maintenance, the occurrence of failures is often a low-probability event. If the traditional correlation mining method is used to exclude alarm items less than the threshold from the frequent item set, it will affect the accuracy of the alarm analysis. Therefore, the alarm correlation mining method provided by the present application, when constructing a frequent item set, not only takes into account the frequency of occurrence of frequent alarm items, but also takes into account the strength of association between alarm items, and can retain low-probability events with low frequency of occurrence but high strength of association with other alarm items. In this way, the alarm association rule set for network element equipment determined by the frequent item set constructed based on the method provided by the present application will not exclude low-probability associated faults, can meet the needs of mining associated faults in the field of telecommunications operation and maintenance, and can accurately and efficiently analyze the alarm correlation in the field of telecommunications operation and maintenance.

[0008] In a possible implementation manner, the first correlation strength between the alarm items of the alarm combination item is determined based on the probability of occurrence of other alarm items in the alarm combination item when any alarm item in the alarm combination item occurs.

[0009] Another possible implementation method is to determine an alarm frequent item set based on a network element alarm data set, including: determining a first network element alarm transaction set based on the network element alarm data set; each first network element alarm transaction in the first network element alarm transaction set includes at least one alarm item occurring in a network element device within a set time window; determining a first candidate alarm frequent item set based on the occurrence frequency of each alarm item in the first network element alarm transaction set, and arranging the alarm items in the first candidate alarm frequent item set according to the occurrence frequency; determining an alarm frequent item set based on the first candidate alarm frequent item set.

[0010] Another possible implementation manner is to determine an alarm frequent item set based on a first candidate alarm frequent item set, including: combining alarm items in the first candidate alarm frequent item set to generate a second candidate alarm frequent item set, the second candidate alarm frequent item set including at least one candidate alarm combination item; for each candidate alarm combination item in the second candidate alarm frequent item set, determining at least one alarm combination item according to an occurrence frequency of the candidate alarm combination item and a first correlation strength between alarm items of the candidate alarm combination item, and determining at least one alarm combination item to form an alarm frequent item set.

[0011] Another possible implementation method is to determine an alarm frequent item set based on a first candidate alarm frequent item set, including: determining high-frequency items in the first candidate alarm frequent item set, where high-frequency items are alarm items whose occurrence frequency is greater than a preset threshold; for each first network element alarm transaction in the first network element alarm transaction set, filtering out alarm items other than high-frequency items in each first network element alarm transaction to obtain a second network element alarm transaction set; arranging the alarm items in the second network element alarm transaction according to the frequency of occurrence; traversing each second network element alarm transaction in the second network element alarm transaction set, and constructing a frequent pattern tree according to the arrangement order of the alarm items in the second network element alarm transaction; and determining at least one alarm frequent item set based on the frequent pattern tree.

[0012] Another possible implementation method is to determine a set of alarm association rules for network element equipment based on a set of frequent alarm items, including: for each alarm combination item in the set of frequent alarm items, determining a second association strength between alarm items in the alarm combination item; and determining a set of alarm association rules for network element equipment based on alarm combination items whose second association strength is greater than a third threshold.

[0013] In another possible implementation, the second correlation strength between the alarm items in the alarm combination item is determined based on the degree to which the occurrence of any alarm item in the alarm combination item increases the occurrence probability of other alarm items in the alarm combination item.

[0014] In another possible implementation, for each alarm association rule in the alarm association rule set, determine whether each alarm association rule has a time causal relationship; and determine a final alarm association rule set based on the alarm association rules having a time causal relationship.

[0015] Another possible implementation method is to determine whether there is a time causal relationship between each alarm association rule, including: when the alarm association rule includes a first alarm item and a second alarm item, determining the occurrence frequency of a first event and the occurrence frequency of a second event; the first event is that the occurrence time of the first alarm item is earlier than the occurrence time of the second alarm item; the second event is that the occurrence time of the second alarm item is earlier than the occurrence time of the first alarm item; when the difference between the occurrence frequency of the first event and the occurrence frequency of the second event is greater than a fourth threshold, determining that the alarm association rules have a time causal relationship.

[0016] Another possible implementation method is to obtain a network element alarm data set within a preset time period, including: obtaining an original network element alarm data set within a preset time period; performing noise filtering on the original network element alarm data to obtain a network element alarm data set; the noise filtering is used to filter out interference alarm data in the original network element alarm data set.

[0017] In another possible implementation, the network element alarm data set includes alarm data of different professions.

[0018] In another possible implementation, the alarm frequent itemset is a two-item set.

[0019] In a second aspect, the present application provides an alarm association relationship mining device, comprising: an acquisition module and a processing module; wherein the acquisition module is used to acquire a network element alarm data set within a preset time period; the network element alarm data set includes alarm items generated by network element devices with an associated relationship; the processing module is used to determine an alarm frequent item set based on the network element alarm data set; the alarm frequent item set includes at least one alarm combination item; the alarm combination item satisfies at least one of the following conditions: the occurrence frequency of the alarm combination item is greater than a first threshold; the first association strength between the alarm items of the alarm combination item is greater than a second threshold; based on the alarm frequent item set, determine the alarm association rule set for the network element device.

[0020] In a possible implementation manner, the first correlation strength between the alarm items of the alarm combination item is determined based on the probability of occurrence of other alarm items in the alarm combination item when any alarm item in the alarm combination item occurs.

[0021] Another possible implementation method is a processing module, which is specifically used to determine a first network element alarm transaction set based on a network element alarm data set; each first network element alarm transaction in the first network element alarm transaction set includes at least one alarm item occurring in a network element device within a set time window; based on the occurrence frequency of each alarm item in the first network element alarm transaction set, a first candidate alarm frequent item set is determined, and the alarm items in the first candidate alarm frequent item set are arranged according to the occurrence frequency; based on the first candidate alarm frequent item set, an alarm frequent item set is determined.

[0022] In another possible implementation manner, the processing module is specifically used to combine the alarm items in the first candidate alarm frequent item set to generate a second candidate alarm frequent item set, the second candidate alarm frequent item set including at least one candidate alarm combination item; for each candidate alarm combination item in the second candidate alarm frequent item set, at least one alarm combination item is determined according to the occurrence frequency of the candidate alarm combination item and the first correlation strength between the alarm items of the candidate alarm combination item, and at least one alarm combination item is determined to form an alarm frequent item set.

[0023] Another possible implementation method is a processing module that is specifically used to determine high-frequency items in a first candidate alarm frequent item set, where high-frequency items are alarm items whose occurrence frequency is greater than a preset threshold; for each first network element alarm transaction in the first network element alarm transaction set, filter out alarm items other than high-frequency items in each first network element alarm transaction to obtain a second network element alarm transaction set; arrange the alarm items in the second network element alarm transaction according to the frequency of occurrence; traverse each second network element alarm transaction in the second network element alarm transaction set, and construct a frequent pattern tree according to the arrangement order of the alarm items in the second network element alarm transaction; and determine at least one alarm frequent item set based on the frequent pattern tree.

[0024] In another possible implementation, the processing module is specifically used to determine the second correlation strength between the alarm items in the alarm combination item for each alarm combination item in the alarm frequent item set; based on the alarm combination items whose second correlation strength is greater than the third threshold, determine the alarm association rule set for the network element device.

[0025] In another possible implementation, the second correlation strength between the alarm items in the alarm frequent item is determined based on the degree to which the occurrence of any alarm item in the alarm combination item increases the occurrence probability of other alarm items in the alarm combination item.

[0026] In another possible implementation, the processing module is further configured to determine, for each alarm association rule in the alarm association rule set, whether there is a time causal relationship between each alarm association rule; and determine a final alarm association rule set based on the alarm association rules having a time causal relationship.

[0027] Another possible implementation method is a processing module, which is specifically used to determine the occurrence frequency of a first event and the occurrence frequency of a second event when the alarm association rule includes a first alarm item and a second alarm item; the first event is that the occurrence time of the first alarm item is earlier than the occurrence time of the second alarm item; the second event is that the occurrence time of the second alarm item is earlier than the occurrence time of the first alarm item; when the difference between the occurrence frequency of the first event and the occurrence frequency of the second event is greater than a fourth threshold, determine that the alarm association rules have a time causal relationship.

[0028] Another possible implementation method is to obtain an original network element alarm data set within a preset time period; perform noise filtering on the original network element alarm data to obtain a network element alarm data set; the noise filtering is used to filter out interference alarm data in the original network element alarm data set.

[0029] In another possible implementation, the network element alarm data set includes alarm data of different professions.

[0030] In another possible implementation, the alarm frequent itemset is a two-item set.

[0031] In a third aspect, the present application provides an electronic device, comprising: a processor and a memory; the memory stores instructions executable by the processor; when the processor is configured to execute the instructions, the electronic device implements the method of the first aspect above.

[0032] In a fourth aspect, the present application provides a readable storage medium, which includes: software instructions; when the software instructions are executed in an electronic device, the electronic device implements the method of the first aspect above.

[0033] In a fifth aspect, the present application provides a chip system, which is applied to an alarm association mining device; the chip system includes one or more interface circuits and one or more processors. The interface circuit and the processor are interconnected through a line; the interface circuit is used to receive a signal from a memory of the alarm association mining device and send a signal to the processor, the signal including a computer instruction stored in the memory. When the processor executes the computer instruction, the electronic device executes the method of the first aspect above.

[0034] In a sixth aspect, the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the steps of the related method described in the first aspect above to implement the method of the first aspect above.

[0035] The beneficial effects of the second to sixth aspects mentioned above refer to the corresponding description of the first aspect and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A flowchart of a method for mining alarm association relationships provided in this application;

[0037] Figure 2 A flowchart of another alarm association relationship mining method provided by this application;

[0038] Figure 3 A schematic diagram of constructing a frequent pattern tree provided in this application;

[0039] Figure 4 A flowchart of another method for mining alarm association relationships provided by this application;

[0040] Figure 5 A flowchart of another method for mining alarm association relationships provided by this application;

[0041] Figure 6 A comparison chart of the calculation time before and after filtering interference alarms provided by this application;

[0042] Figure 7A schematic diagram of the alarm / work order percentage and improvement percentage before and after an improved method provided in this application;

[0043] Figure 8 A schematic diagram of the composition of an alarm association relationship mining device provided in this application;

[0044] Fig. 9 A schematic diagram of the composition of an electronic device provided in this application. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0046] It should be noted that, in the embodiments of the present application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplarily" or "for example" is intended to present related concepts in a specific way.

[0047] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0048] In order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical items or similar items with basically the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order.

[0049] 5G networks face many problems, such as frequent failures, massive alarms, difficult identification and positioning, complex coordination, and time-consuming processing, due to multiple levels and diverse professions. In order to accelerate fault recovery and service assurance, intelligent, accurate, and fast alarm analysis tools are urgently needed to support the operation and maintenance work of business departments. In this context, 5G network service platform fault positioning requires the use of intelligent means to mine cross-domain correlation relationships between alarms, discover strong correlation rules in the data, and guide the business.

[0050] Traditional association mining methods (for example, association mining methods based on frequent item set mining algorithms such as Apriori or FP-growth) have been successfully applied in traditional industries (such as shopping behavior analysis, search engine recommendation, etc.). In traditional association mining applications, the construction of frequent item sets is the premise and basis for the successful application of the entire algorithm. Frequent item sets represent a set of frequently occurring transactions. If the frequency or probability of one or more transactions occurring at the same time is large, then this or these transactions are considered to constitute frequent items, and the frequency of occurrence of this or these transactions (associations) is defined as support. However, the associated transactions mined by the method of constructing frequent item sets based on support greater than a preset threshold are not suitable for alarm analysis in the field of telecommunications operation and maintenance. Since faults in the field of telecommunications operation and maintenance are usually low-probability events, the probability of associated faults associated with faults is even lower. Traditional association mining methods will exclude low-probability associated faults from frequent item sets, affecting the overall effect of mining associated faults; resulting in low analysis efficiency and poor accuracy.

[0051] In summary, there is an urgent need for a data mining algorithm for alarm association relationships applicable to the field of telecommunications operation and maintenance. Based on this, the embodiment of the present application provides an alarm association mining method. When constructing frequent item sets, this method not only takes into account the occurrence frequency (support) of alarm frequent items, but also takes into account the strength of association between alarm items, and can retain low-probability events with low occurrence frequency but high strength of association with other alarm items. In this way, the alarm association rule set for network element equipment determined based on the frequent item set constructed on the basis of satisfying at least one of the support condition and the association strength condition will not exclude low-probability associated faults, which can meet the needs of mining associated faults in the field of telecommunications operation and maintenance, and can accurately and efficiently analyze the alarm association relationship in the field of telecommunications operation and maintenance.

[0052] The alarm association relationship mining method provided in the embodiment of the present application can be executed by an electronic device.

[0053] Exemplarily, the electronic device may be a server, for example, a single server, or a server cluster composed of multiple servers. In some implementations, the server cluster may also be a distributed cluster.

[0054] Exemplarily, the electronic device may be a terminal device, such as a mobile phone, a tablet computer, a desktop, a laptop, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a cellular phone, a personal digital assistant (PDA), an augmented reality (AR) or virtual reality (VR) device, etc. The embodiment of the present application does not impose any special restrictions on the specific form of the terminal device.

[0055] Figure 1 A flowchart of a method for mining alarm association relationships provided by an embodiment of the present application is shown below. Figure 1 As shown, the alarm association relationship mining method provided by the present application specifically includes the following steps:

[0056] S101. Obtain a network element alarm data set within a preset time period.

[0057] The network element alarm data set includes alarm items generated by network element devices that have an associated relationship.

[0058] The associated network element devices refer to the network element devices that have physical connection, service logic or timing relationship.

[0059] In some embodiments, a configuration management database (CMDB) may be constructed to store and manage network element devices with associated relationships.

[0060] Exemplarily, a CMDB is established using database technology to centrally store and manage network element device information. In the CMDB, a unique identifier is assigned to each network element device, such as a device ID or serial number, for subsequent association and query. According to business requirements and network architecture, association rules between network elements are formulated. These rules can be formulated based on physical connections, business logic, and timing relationships between devices. Based on the association rules, an association field is added to each network element device data table stored in the CMDB. The association field stores the device ID or serial number of the network element device that has an association relationship with the network element device.

[0061] Optionally, before establishing the CMDB, network element resource information can be collected from various network management systems, monitoring systems and the devices themselves, including device name, model, IP address, MAC address, port information, configuration parameters, etc., and the CMDB can be built based on the collected network element resource information.

[0062] In some embodiments, the above step S101 can be implemented as the following steps:

[0063] S1011. Obtain an original network element alarm data set within a preset time period.

[0064] Exemplarily, within a preset time period, alarm information collected from all network element devices in the associated network element devices is processed with a unified alarm description and a unified sampling period to serve as an original network element alarm data set.

[0065] Exemplarily, each item of network element alarm data in the original network element alarm data set includes: the device from which the alarm information comes, the type of alarm information, the alarm time, and whether it has been processed.

[0066] S1012. Perform noise filtering on the original network element alarm data to obtain a network element alarm data set; the noise filtering is used to filter out interference alarm data in the original network element alarm data set.

[0067] Exemplarily, existing expert experience, dispatch dimensions, alarm level dimensions, etc. are used to remove interfering alarm data; for example, when multiple alarms occur at the same time, only one valid alarm is retained and other invalid alarms are filtered out.

[0068] In some embodiments, the network element alarm data set includes alarm data of different professions.

[0069] Exemplarily, different majors include: Fifth-Generation mobile communication technology (5G) wireless, transmission, and dynamic environment.

[0070] S102: Determine alarm frequent itemsets based on the network element alarm data set.

[0071] The alarm frequent item set includes at least one alarm combination item; the alarm combination item satisfies at least one of the following conditions: the occurrence frequency of the alarm combination item is greater than a first threshold; the first correlation strength between the alarm items of the alarm combination item is greater than a second threshold.

[0072] The first correlation strength between the alarm items of the alarm combination item is determined based on the probability of occurrence of other alarm items in the alarm combination item when any alarm item in the alarm combination item occurs.

[0073] Exemplarily, the occurrence frequency of the alarm combination item and the first correlation strength between the alarm items of the alarm combination item are determined based on the following formula (1):

[0074]

[0075] Where X represents one of the alarm items in the alarm combination, Y represents another alarm item in the alarm combination, P(X∩Y) represents the occurrence frequency of the alarm combination, P(X|Y) represents the probability of another alarm X occurring when alarm Y in the alarm combination occurs, S 阈值 represents the first threshold, A 阈值 Indicates the second threshold.

[0076] For example, the alarm combination item includes alarm A and alarm B, that is, {alarm A, alarm B}, and the network element alarm data set is shown in Table 1. Specifically, according to Table 1, alarm A occurred 5 times in total, with an occurrence frequency P(A)=5 / 6, and alarm A and alarm B occurred 2 times in the same time period, with an occurrence frequency P(A∩B) of 2 / 6. Then the probability of alarm B occurring when alarm A occurs (that is, P(B|A)) is P(A∩B) / P(A)=(2 / 6) / (5 / 6)=0.4, that is, the first correlation strength between the alarm items of the alarm combination item is 0.4.

[0077] Table 1 Network element alarm data set

[0078] Alarm transaction ID Alarm item type T1 Alarm A, Alarm B T2 Alarm A T3 Alarm B T4 Alarm A, Alarm B T5 Alarm A T6 Alarm A

[0079] It is understandable that in the field of telecommunications operation and maintenance, there is a problem that the probability P(X) of event X occurring in an alarm event is too small, resulting in the alarm-related event P(X∩Y) being too small and not being paid attention to. This situation is specifically manifested as follows: although the probability P(X) of event X occurring is small, when event X occurs, there is always a high probability that event Y will occur. Often in this case, the conditional probability P(Y|X) = P(X∩Y) / P(X) is large, so the embodiment of the present application incorporates the conditional probability, that is, the above-mentioned first association strength, into one of the conditions for constructing frequent item sets to increase the attention paid to low-probability related events.

[0080] In some embodiments, Figure 2 As shown, the above step S102 specifically includes the following steps S1021 to S1023:

[0081] S1021. Determine a first network element alarm transaction set based on a network element alarm data set.

[0082] Each first network element alarm transaction in the first network element alarm transaction set includes at least one alarm item occurring in a network element device within a set time window.

[0083] In some embodiments, a sliding time window algorithm is used to divide the alarm items in the network element alarm data set into various first network element alarm transactions according to a set time window, and the collection of various network element alarm transactions constitutes a first network element alarm transaction set.

[0084] For example, when collecting alarm items of a unified network element set, the preset time is 10 days, and the duration of the time sliding window is set to 1 day. As shown in Table 2, the first first network element transaction T1 includes alarm A and alarm B; the second first network element transaction T2 includes alarm A and alarm C; the third first network element transaction T3 includes alarm B and alarm C; the fourth first network element transaction T4 includes alarm A, alarm B, and alarm D; the fifth first network element transaction T5 includes alarm C and alarm D.

[0085] Table 2 First network element alarm transaction set

[0086] Alarm transaction ID Alarm item type T1 Alarm A, Alarm B T2 Alarm A, Alarm C T3 Alarm B, Alarm C T4 Alarm A, Alarm B, Alarm D T5 Alarm C, Alarm D

[0087] S1022: Determine a first candidate alarm frequent item set based on the occurrence frequency of each alarm item in the first network element alarm transaction set.

[0088] The alarm items in the first candidate alarm frequent item set are arranged according to the occurrence frequency.

[0089] In some embodiments, the occurrence frequency of each alarm item in the first network element alarm transaction set is determined based on the ratio of the number of occurrences of each alarm item in the first network element alarm transaction set to the total number of alarm items in the first network element alarm transaction set.

[0090] For example, according to Table 2, Table 3 is calculated, the occurrence frequency of alarm A is P(A)=3 / 5=0.6; by analogy, the occurrence frequency of alarm B is 0.6, the occurrence frequency of alarm C is 0.6, and the occurrence frequency of alarm D is 0.4. They are arranged according to the occurrence frequency as alarm A, alarm B, alarm C, and alarm D. That is, the first candidate alarm frequent item set is {{alarm A}, {alarm B}, {alarm C}, {alarm D}}.

[0091] Table 3 Alarm item occurrence frequency table

[0092] Alarm item type Frequency Alarm A 0.6 Alarm B 0.6 Alarm C 0.6 Alarm D 0.4

[0093] S1023: Determine an alarm frequent itemset based on the first candidate alarm frequent itemset.

[0094] In some embodiments, based on the first candidate alarm frequent itemset, determining the alarm frequent itemset may be combined with an Apriori Algorithm (Apriroi) algorithm or a Frequent Pattern Growth (FP-Growth) algorithm.

[0095] The following describes the implementation methods of determining the alarm frequent itemsets described above in combination with different algorithms.

[0096] (I) Apriroi algorithm

[0097] Exemplarily, a specific implementation method of determining the alarm frequent itemsets in combination with the Apriroi algorithm includes steps a1 to a2.

[0098] a1. Combining the alarm items in the first candidate alarm frequent itemset to generate a second candidate alarm frequent itemset, wherein the second candidate alarm frequent itemset includes at least one candidate alarm combination item.

[0099] In some embodiments, the alarm items in the first candidate alarm frequent item set are combined. The second candidate alarm frequent item set can be obtained by combining two of them, and each candidate alarm combination item includes two alarm items. The second candidate alarm frequent item set can be obtained by combining three of them, and each candidate alarm combination item includes three alarm items. There is no limit on the number of items in the candidate alarm combination items.

[0100] For example, according to the first candidate alarm frequent item set generated in the above S102B, {{alarm A}, {alarm B}, {alarm C}, {alarm D}}, the alarm items therein are combined in pairs to obtain the second candidate alarm frequent item set {{alarm A, alarm B}, {alarm A, alarm C}, {alarm A, alarm D}, {alarm B, alarm C}, {alarm B, alarm D}, {alarm C, alarm D}}.

[0101] a2. For each candidate alarm combination item in the second candidate alarm frequent item set, determine at least one alarm combination item according to the occurrence frequency of the candidate alarm combination item and the first correlation strength between the alarm items of the candidate alarm combination item to form an alarm frequent item set.

[0102] In some embodiments, the first correlation strength between the alarm items of the candidate alarm combination item includes the correlation strength between each alarm item of the candidate alarm combination item and other alarm items.

[0103] For example, according to Table 2, the occurrence frequency of {alarm A, alarm B} is 2, and the occurrence frequency is P(A∩B)=2 / 5=0.4; the occurrence frequency of {alarm A, alarm C} is 1, and the occurrence frequency is P(A∩C)=1 / 5=0.2; the occurrence frequency of {alarm A, alarm D} is 1, and the occurrence frequency is P(A∩D)=1 / 5=0.2; the occurrence frequency of {alarm B, alarm C} is 1, and the occurrence frequency is P(B∩C)=1 / 5=0.2.

[0104] For example, the first association strength of {alarm A, alarm B} includes the association strength from alarm A to alarm B, that is, P(B|A)=P(A∩B) / P(A)=0.4 / 0.6=0.667; it also includes the association strength from alarm B to alarm A, that is, P(A|B)=P(A∩B) / P(B)=0.4 / 0.6=0.667.

[0105] The occurrence frequencies of all candidate alarm combination items and the first correlation strengths between the alarm items of the candidate alarm combination items calculated according to Table 2 are shown in Table 4.

[0106] Table 4 Occurrence frequency and first association strength table

[0107]

[0108]

[0109] Exemplarily, a candidate alarm combination item that satisfies an occurrence frequency greater than a first threshold is an alarm combination item or a candidate alarm combination item that satisfies an association strength greater than a second threshold is an alarm combination item. At least one alarm combination item is determined to form an alarm frequent item set.

[0110] For example, the first threshold is set to 0.3, and the second threshold is set to 0.4. According to Table 4, the alarm frequent itemset is {{A, B}, {B, A}, {D, A}, {D, B}, {D, C}}.

[0111] In some embodiments, the alarm frequent item sets mined by the Apriroi algorithm include 1-item sets, 2-item sets, 3-item sets, etc. Since 3-item sets and above can be understood as multiple combinations based on 2-item sets, it is optional to retain only 2-item sets to facilitate subsequent time series analysis of the root causes of the alarm items.

[0112] (II) FP-Growth Algorithm

[0113] Exemplarily, the specific steps of determining the alarm frequent itemsets in combination with the FP-Growth algorithm include steps b1 to b4.

[0114] b1. Determine a high-frequency item in the first candidate alarm frequent item set, where the high-frequency item is an alarm item whose occurrence frequency is greater than a preset threshold.

[0115] For example, based on the first candidate alarm frequent item set generated in S1022 as {{alarm A}, {alarm B}, {alarm C}, {alarm D}}, and setting the threshold to 0.2, the high-frequency items are {alarm A}, {alarm B}, {alarm C}.

[0116] b2. For each first network element alarm transaction in the first network element alarm transaction set, filter out alarm items other than high-frequency items in each first network element alarm transaction to obtain a second network element alarm transaction set; and arrange the alarm items in the second network element alarm transaction according to the occurrence frequency.

[0117] For example, according to each network element alarm transaction in Table 2, alarm D is filtered out to obtain a second network element alarm transaction set. The second network element alarm transaction set is shown in Table 5.

[0118] Table 5 Second network element alarm transaction set

[0119] Alarm transaction ID Alarm item type T1 Alarm A, Alarm B T2 Alarm A, Alarm C T3 Alarm B, Alarm C T4 Alarm A, Alarm B T5 Alarm C

[0120] b3. Traverse each second network element alarm transaction in the second network element alarm transaction set, and construct a frequent pattern tree according to the arrangement order of the alarm items in the second network element alarm transaction.

[0121] For example, according to each second network element alarm transaction in Table 5, a frequent pattern tree is constructed from top to bottom, and each node represents a type of alarm item. Specifically, Figure 3 As shown, the root node is null, and paths are constructed from the root node to node A and then to node B, from the root node to node A and then to node C, from node B to node C, and from the root node to node C. For each path, if there is no path before, a new path is constructed, and if there is a path, the relevant node mark is increased by 1.

[0122] b4. Based on the frequent pattern tree, determine at least one alarm frequent item set.

[0123] In some embodiments, based on the frequent pattern tree, the alarm frequent item sets are recursively mined. Specifically, the conditional pattern base of each leaf node is searched upward, and the frequency and the first association strength of each node in the conditional pattern base co-occurring with the leaf node are determined. If one of them is satisfied, it can be retained.

[0124] In some embodiments, the alarm frequent item sets recursively mined out in the FP-Growth algorithm include 1-item sets, 2-item sets, 3-item sets, etc. Since 3-item sets and above can be understood as multiple combinations based on 2-item sets, it is optional to retain only 2-item sets to facilitate subsequent time series analysis of the root causes of the alarm items.

[0125] This application has made a lot of optimizations to the FP-Growth algorithm and the Apriori algorithm, both of which have achieved significant results. In the actual case of facing large data sets, the FP-Growth algorithm does not need to generate candidate sets, and its efficiency will be higher than that of the Apriori algorithm.

[0126] S103: Determine an alarm association rule set of the network element device based on the alarm frequent item set.

[0127] In some embodiments, the above step S103 can be implemented as the following steps:

[0128] S1031. For each alarm combination item in the alarm frequent item set, determine a second correlation strength between alarm items in the alarm combination item.

[0129] The second correlation strength between the alarm items in the alarm combination item is determined based on the degree of improvement in the probability of occurrence of other alarm items in the alarm combination item caused by the occurrence of any alarm item in the alarm combination item. The improvement reflects the correlation between the alarm items in the alarm combination item, and the higher the improvement is, the higher the positive correlation is.

[0130] For example, assume that the above {alarm A, alarm B} is an alarm combination item in the alarm frequent item set finally determined in step S102. As shown in Table 1, the occurrence frequency P(A) of alarm A is 5 / 6, and the occurrence frequency P(B) of alarm B is 3 / 6. Then the second correlation strength is the increase in the probability of occurrence of alarm B due to the occurrence of alarm A, that is, P(A∩B) / P(A) / P(B)=(2 / 6) / (5 / 6) / (3 / 6)=0.8.

[0131] S1032: Determine an alarm association rule set for the network element device based on the alarm combination item whose second association strength is greater than a third threshold.

[0132] Exemplarily, the second correlation strength between the alarm items in the alarm combination item is determined based on the following formula (2):

[0133]

[0134] Where P(X∩Y) represents the occurrence frequency of the alarm combination item, P(X) represents the occurrence frequency of one of the alarm items in the alarm combination item, P(Y) represents the occurrence frequency of another alarm item in the alarm combination item, and L 阈值 Indicates the third threshold.

[0135] It can be understood that the second association strength reflects the correlation between the alarm items in the alarm combination items. Therefore, the embodiment of the present application determines the alarm association rule set based on the alarm combination items whose second association strength is greater than the third threshold, and can accurately mine the association rules with strong correlation to improve the accuracy and efficiency of alarm association rule mining of network element equipment.

[0136] In some embodiments, Figure 4 As shown, the above method also includes the following steps:

[0137] S104: For each alarm association rule in the alarm association rule set, determine whether each alarm association rule has a temporal causal relationship.

[0138] In some embodiments, when the alarm association rule includes the first alarm item and the second alarm item, the above step S104 can be implemented as the following steps:

[0139] S1041. Determine the occurrence frequency of the first event and the occurrence frequency of the second event.

[0140] The first event is that the occurrence time of the first alarm item is earlier than the occurrence time of the second alarm item; the second event is that the occurrence time of the second alarm item is earlier than the occurrence time of the first alarm item.

[0141] S1042: When the difference between the occurrence frequency of the first event and the occurrence frequency of the second event is greater than a fourth threshold, determine that there is a temporal causal relationship between the alarm association rules.

[0142] Exemplarily, the judgment result that the difference between the occurrence frequency of the first event and the occurrence frequency of the second event is greater than the fourth threshold is determined based on the following formula (3):

[0143] P(t x <t y )-P(t x ≥t y )>T 阈值 Formula (3)

[0144] Among them, t x Represents the occurrence time of the first alarm item, t y Represents the occurrence time of the second alarm item, P(t x <t y ) represents the frequency of the first event, P(t x ≥t y ) represents the frequency of the second event, T 阈值 Indicates the fourth threshold.

[0145] In some embodiments, it is determined whether the difference between the occurrence frequency of the first event and the occurrence frequency of the second event is greater than a fourth threshold based on the occurrence time of the alarm item in the network element alarm data set.

[0146] For example, the alarm association rule set is {{alarm A, alarm B}, {alarm B, alarm A}, {alarm B, alarm C}}, the fourth threshold is 0.2, and the occurrence times of alarm A, alarm B, and alarm C are shown in Table 6 below, then P(t A <=t B )-P(t A >t B )=1 / 4-2 / 4=-0.25, which does not meet the condition that the difference is greater than the fourth threshold value. Therefore, there is no time causal relationship between alarm A and alarm B, where A is the cause and B is the effect. {alarm A, alarm B} is eliminated. P(t B <=t A )-P(t B >t A)=2 / 4-1 / 4=0.25; the difference value satisfies the condition that it is greater than the fourth threshold value, so there is a time causal relationship between alarm B and alarm A, where B is the cause and A is the effect, and {alarm B, alarm A} is retained; similarly, since P(t B <=t C )-P(t B >t C )=1 / 4-0=0.25, {alarm B, alarm C} are retained.

[0147] Table 6 Alarm association rule occurrence timetable

[0148] date Alarm item type Time when the alarm occurs 2024.12.01 Alarm A, Alarm B Alarm A: 12:00, Alarm B: 12:15 2024.12.02 Alarm B, Alarm C Alarm B: 15:12, Alarm C: 14:40 2024.12.03 Alarm A, Alarm B Alarm B: 8:10, Alarm A: 9:25 2024.12.05 Alarm A, Alarm B Alarm B: 12:10, Alarm A: 12:47

[0149] S105 . Determine a final alarm association rule set based on the alarm association rules having a temporal causal relationship.

[0150] Exemplarily, based on the alarm association rules that are retained due to the above temporal causal relationship, the final alarm association rule set is determined to be {{alarm B, alarm A}, {alarm B, alarm C}}.

[0151] It is understandable that the traditional association rule algorithm mainly focuses on and analyzes the association relationship between item sets, but does not pay much attention to the directionality of the associated events (causal logic relationship), and does not judge the directionality of the associated events based on the time when the events occurred. However, in the root cause analysis scenario of faults and alarms, the time of occurrence of the event is the basis for analyzing and judging the causal logic relationship of the alarm event; therefore, in order to fully explore the causal relationship between alarms, after establishing the alarm association rule set, the present application can mine alarm association rules with time causal relationships based on the occurrence time of the alarm items included in the alarm association rules, thereby improving the accuracy of alarm association rule mining.

[0152] The following is an introduction to the alarm correlation mining method of the present application embodiment with reference to a specific embodiment. The specific implementation process of the method is as follows: Figure 5 shown.

[0153] S501: Preprocessing of alarm data.

[0154] In some embodiments, alarm data preprocessing includes: constructing association relationships between network element devices to collect original network element alarm data sets, filtering interference alarm data, and establishing a time sliding window and constructing a numerical vector.

[0155] Exemplarily, network element devices with associated relationships are stored and managed by building a CMDB or other means.

[0156] Exemplarily, a time sliding window is established based on the occurrence time of alarm information collected by associated network element devices, and a numerical vector is constructed based on the frequency of occurrence of alarm data.

[0157] Exemplarily, interference alarms are filtered based on the mature experience of existing operation and maintenance experts, and interference alarms include: derivative alarms, non-dispatch alarms, and invalid alarms.

[0158] For example, Table 7-1 shows the number of original alarms for a month and the number of alarms after filtering out derivative alarms and non-dispatched alarms through operation and maintenance experience. It can be seen that the number of original alarms for a month is 64,327,260. It takes a lot of resources to calculate tens of millions of alarms. The number of alarms filtered through operation and maintenance experience has dropped significantly to only 1,236,840, which not only improves the calculation efficiency but also eliminates a large number of interference alarms for the subsequent extraction of association rules. Table 7-2 is an example of original alarms, including derivative alarms and non-dispatched alarms. Table 7-3 is an example of alarms after filtering out derivative alarms and non-dispatched alarms with the help of operation and maintenance expert experience.

[0159] Table 7-1 Alarm quantity statistics

[0160] Original alarm / item After filtering / article 64327260 1236840

[0161] Table 7-2 Original alarm examples

[0162]

[0163] Table 7-3 Alarm examples after filtering

[0164]

[0165]

[0166] like Figure 6 As shown, Figure 6 The comparison chart of the computing time (hours) before and after filtering interference alarms with the help of the experience of operation and maintenance experts shows that the computing time is greatly shortened from the original 7*24 hours to the current 3*24 hours, which greatly improves the computing efficiency while keeping the machine configuration unchanged.

[0167] S502: Construct alarm frequent itemsets using an optimized method.

[0168] In some embodiments, for alarm items in the same time window, after calculating the first correlation strength between the alarm items and the joint occurrence frequency of the alarm items and other alarm items, an alarm frequent item set is constructed based on alarm combination items that meet one of the following conditions: the occurrence frequency is greater than a first threshold or the first correlation strength is greater than a second threshold.

[0169] For example, Table 8-1 shows the statistics of the number of alarm combination items in the alarm frequent item set constructed by the classic algorithm and the alarm frequent item set constructed by the optimized method. It can be clearly seen that the number of alarm combination items in the optimized alarm frequent item set has increased significantly. Some alarms that were not originally in the alarm frequent item set have also been added to the alarm frequent item set by adding the first correlation strength. After verification by the operation and maintenance personnel, most of the newly added alarm frequent items have a low frequency of occurrence. Once they appear, they will cause a large number of derivative failures, which is difficult to troubleshoot in the past. This also verifies the feasibility of our algorithm. Table 8-2 shows an example of an alarm frequent item set that is not optimized. The construction condition is to judge items with a higher frequency of occurrence. Table 8-3 shows an example of an alarm frequent item set that is optimized. Comparing Table 8-2 and Table 8-3, it can be seen from Table 8-2 that the joint occurrence frequency of the alarm combination items in the frequent item set is greater than 0.02, while Table 8-3 adds the first correlation strength. The ones with large first correlation strength require our special attention. It can be clearly seen that some valid alarm items with a small joint occurrence frequency (<0.005) are also added to avoid missing some small probability faults.

[0170] Table 8-1 Statistics of alarm combination items before and after optimization

[0171] Frequent itemsets / items that are not optimally constructed Frequent item sets / items constructed after optimization 844 1431

[0172] Table 8-2 Example of warning frequent item sets that are not optimized

[0173]

[0174]

[0175] Table 8-3 Example of optimized alarm frequent item sets

[0176]

[0177] S503: Construct an alarm association rule set.

[0178] In some embodiments, for each alarm combination item in the alarm frequent item set, a second correlation strength between alarm items in the alarm combination item is determined; based on the alarm combination items whose second correlation strength is greater than a third threshold, an alarm correlation rule set for the network element device is determined.

[0179] S504: Output the time causal analysis results.

[0180] In some embodiments, when the alarm association rules include a first alarm item and a second alarm item, the occurrence frequency of a first event and the occurrence frequency of a second event are determined; the first event is that the occurrence time of the first alarm item is earlier than the occurrence time of the second alarm item; the second event is that the occurrence time of the second alarm item is earlier than the occurrence time of the first alarm item; when the difference between the occurrence frequency of the first event and the occurrence frequency of the second event is greater than a fourth threshold, it is determined that the alarm association rules have a time causal relationship, and the final set of alarm association rules with a time causal relationship is output.

[0181] For example, in a wireless large-scale fault processing application, if the time causal analysis algorithm based on correlation is not used, 41,227,669 association rules will be generated, resulting in a large number of root cause false alarms; while the time causal analysis algorithm based on correlation will generate 304 accurate rules. In a transmission large-scale fault processing application, the algorithm can compress 2,471,278 association rules containing a large number of non-causal relationships into 62 valid causal association rules, thereby truly realizing effective causal inference. Table 9-1 is a statistical analysis of the number of rules in two scenarios. The original alarm number is the full alarm of two months, which is a comparison of wireless large-scale faults, transmission large-scale faults, and the two scenarios before and after adding time causal relationships. From the number, it can be seen that the association rule method using only the classic algorithm contains a large number of association rules that do not have a causal relationship with the alarm occurrence time, while after adding the time series causal relationship, the rules that do not have a causal relationship with the alarm occurrence time are significantly compressed. Table 9-2 is an example of rules before correlation causal analysis. It contains both valid causal association rules and invalid causal association rules. Table 9-3 is an example of rules after correlation causal analysis. A large number of rules that do not contain time series causal relationships that appear in Table 9-2 have been effectively eliminated.

[0182] Table 9-1 Statistics of the number of rules in two scenarios

[0183] Pre-processing rules / rules for time series causality Time series causal relationship processing rules / clauses Scenario 41,227,669 304 Large-scale wireless failure 2,471,278 62 Transmission Mass Failure

[0184] Table 9-2 Example of rules before associating causality

[0185]

[0186] Table 9-3 Example of rules after causal analysis

[0187]

[0188]

[0189] The classic association rule algorithm only uses support, confidence and other discrimination indicators, which cannot provide obvious differentiation for alarm combination items with temporal causal relationships, and thus cannot fully eliminate rules without temporal causal relationships. The temporal causal analysis algorithm can effectively mine the causal relationships, so that the original tens of millions of rules that the operation and maintenance personnel had no clue about are reduced to only a few hundred after the temporal causal relationship processing, which greatly improves the review efficiency of the operation and maintenance personnel, and can provide timely feedback to the alarm system to achieve dynamic alarm compression.

[0190] Exemplarily, Table 10 is an example of the compression rate of dynamic and wireless professional alarm dispatch orders after the improved association mining method was used and applied to work order compression in 2022 and during the same period without using the improved algorithm. Figure 7 Schematic diagram of the alarm / work order percentage and improvement percentage before and after adopting the improved method.

[0191] Table 10 Example of compression rate of synchronous dynamic ring and wireless professional alarm dispatch before and after improvement

[0192]

[0193] In some embodiments, the present application provides an alarm association relationship mining device. The health status assessment device may include one or more functional modules for implementing the alarm association relationship mining method of the above method embodiment.

[0194] For example, Figure 8 A schematic diagram of the composition of an alarm association relationship mining device provided for an embodiment of the present application. The health status assessment device 600 includes: an acquisition module 601 and a processing module 602. Among them, the acquisition module 601 is used to obtain a network element alarm data set within a preset time period; the network element alarm data set includes alarm items generated by network element devices with an associated relationship; the processing module 602 is used to determine an alarm frequent item set based on the network element alarm data set; the alarm frequent item set includes at least one alarm combination item; the alarm combination item satisfies at least one of the following conditions: the occurrence frequency of the alarm combination item is greater than the first threshold; the first correlation strength between the alarm items of the alarm combination item is greater than the second threshold; based on the alarm frequent item set, determine the alarm association rule set for the network element device.

[0195] In a possible implementation manner, the first correlation strength between the alarm items of the alarm combination item is determined based on the probability of occurrence of other alarm items in the alarm combination item when any alarm item in the alarm combination item occurs.

[0196] Another possible implementation method, processing module 602, is specifically used to determine a first network element alarm transaction set based on a network element alarm data set; each first network element alarm transaction in the first network element alarm transaction set includes at least one alarm item occurring in a network element device within a set time window; based on the occurrence frequency of each alarm item in the first network element alarm transaction set, a first candidate alarm frequent item set is determined, and the alarm items in the first candidate alarm frequent item set are arranged according to the occurrence frequency; based on the first candidate alarm frequent item set, an alarm frequent item set is determined.

[0197] In another possible implementation, the processing module 602 is specifically configured to combine the alarm items in the first candidate alarm frequent item set to generate a second candidate alarm frequent item set, where the second candidate alarm frequent item set includes at least one candidate alarm combination item; for each candidate alarm combination item in the second candidate alarm frequent item set, determine at least one alarm combination item according to the occurrence frequency of the candidate alarm combination item and the first correlation strength between the alarm items of the candidate alarm combination item, determine at least one alarm combination item, and form an alarm frequent item set.

[0198] Another possible implementation method is that the processing module 602 is specifically used to determine the high-frequency items in the first candidate alarm frequent item set, and the high-frequency items are alarm items whose occurrence frequency is greater than a preset threshold; for each first network element alarm transaction in the first network element alarm transaction set, filter out other alarm items except the high-frequency items in each first network element alarm transaction to obtain a second network element alarm transaction set; arrange the alarm items in the second network element alarm transaction according to the frequency of occurrence; traverse each second network element alarm transaction in the second network element alarm transaction set, and construct a frequent pattern tree according to the arrangement order of the alarm items in the second network element alarm transaction; based on the frequent pattern tree, determine at least one alarm frequent item set.

[0199] In another possible implementation, processing module 602 is specifically used to determine the second correlation strength between the alarm items in the alarm combination item for each alarm combination item in the alarm frequent item set; based on the alarm combination items whose second correlation strength is greater than the third threshold, determine the alarm association rule set for the network element device.

[0200] In another possible implementation, the second correlation strength between the alarm items in the alarm frequent item is determined based on the degree to which the occurrence of any alarm item in the alarm combination item increases the occurrence probability of other alarm items in the alarm combination item.

[0201] In another possible implementation, the processing module 602 is further configured to determine, for each alarm association rule in the alarm association rule set, whether each alarm association rule has a temporal causal relationship; and determine a final alarm association rule set based on the alarm association rules having a temporal causal relationship.

[0202] Another possible implementation method, processing module 602, is specifically used to determine the occurrence frequency of a first event and the occurrence frequency of a second event when the alarm association rule includes a first alarm item and a second alarm item; the first event is that the occurrence time of the first alarm item is earlier than the occurrence time of the second alarm item; the second event is that the occurrence time of the second alarm item is earlier than the occurrence time of the first alarm item; when the difference between the occurrence frequency of the first event and the occurrence frequency of the second event is greater than a fourth threshold, determine that the alarm association rules have a time causal relationship.

[0203] Another possible implementation method is to obtain module 601, which is specifically used to obtain the original network element alarm data set within a preset time period; perform noise filtering on the original network element alarm data to obtain the network element alarm data set; the noise filtering is used to filter out the interference alarm data in the original network element alarm data set.

[0204] In another possible implementation, the network element alarm data set includes alarm data of different professions.

[0205] In another possible implementation, the alarm frequent itemset is a two-item set.

[0206] In an exemplary embodiment, the embodiment of the present application further provides an electronic device, which may be the alarm association relationship mining device in the above method embodiment. Fig. 9 The following is a schematic diagram of the composition of an electronic device provided in an embodiment of the present application. Fig. 9 As shown, the electronic device may include: a processor 701 and a memory 702; the memory 702 stores instructions executable by the processor 701; when the processor 701 is configured to execute the instructions, the electronic device or network device or manager implements the method described in the aforementioned method embodiment.

[0207] In an exemplary embodiment, the present application also provides a readable storage medium on which program instructions are stored; when the program instructions are executed by a computer, the computer implements the method described in the foregoing embodiment. The readable storage medium may be a non-temporary readable storage medium, for example, a non-temporary readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device.

[0208] In an exemplary embodiment, the embodiment of the present application further provides a computer program product. When the computer program product is run on a computer, the computer executes the above-mentioned related method steps to implement the alarm association relationship mining method in the above-mentioned embodiment.

[0209] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for mining alarm association relationships, characterized in that: The method comprises: Acquire a network element alarm data set within a preset time period; the network element alarm data set includes alarm items generated by network element devices having an associated relationship; Based on the network element alarm data set, an alarm frequent item set is determined; the alarm frequent item set includes at least one alarm combination item; the alarm combination item satisfies at least one of the following conditions: the occurrence frequency of the alarm combination item is greater than a first threshold; the first correlation strength between the alarm items of the alarm combination item is greater than a second threshold; Based on the alarm frequent itemsets, an alarm association rule set of the network element device is determined.

2. The method according to claim 1, characterized in that The first correlation strength between the alarm items of the alarm combination item is determined based on the probability of occurrence of other alarm items in the alarm combination item when any one alarm item in the alarm combination item occurs.

3. The method according to claim 1, characterized in that The determining of the alarm frequent itemsets based on the network element alarm data set includes: Determine a first network element alarm transaction set based on the network element alarm data set; each first network element alarm transaction in the first network element alarm transaction set includes at least one alarm item occurring in the network element device within a set time window; Determine a first candidate alarm frequent item set based on the occurrence frequency of each alarm item in the first network element alarm transaction set, wherein the alarm items in the first candidate alarm frequent item set are arranged according to the occurrence frequency; Based on the first candidate alarm frequent itemset, the alarm frequent itemset is determined.

4. The method according to claim 3, characterized in that The determining the alarm frequent itemset based on the first candidate alarm frequent itemset includes: Combining the alarm items in the first candidate alarm frequent item set to generate a second candidate alarm frequent item set, wherein the second candidate alarm frequent item set includes at least one candidate alarm combination item; For each of the candidate alarm combination items in the second candidate alarm frequent item set, at least one alarm combination item is determined according to the occurrence frequency of the candidate alarm combination item and the first association strength between the alarm items of the candidate alarm combination item to form the alarm frequent item set.

5. The method according to claim 3, characterized in that: The determining the alarm frequent itemset based on the first candidate alarm frequent itemset includes: Determine a high-frequency item in the first candidate alarm frequent item set, wherein the high-frequency item is an alarm item whose occurrence frequency is greater than a preset threshold; For each first network element alarm transaction in the first network element alarm transaction set, filtering out other alarm items except the high-frequency item in each first network element alarm transaction to obtain a second network element alarm transaction set; the alarm items in the second network element alarm transaction are arranged according to the occurrence frequency; Traversing each of the second network element alarm transactions in the second network element alarm transaction set, and constructing a frequent pattern tree according to the arrangement order of the alarm items in the second network element alarm transaction; Based on the frequent pattern tree, the at least one alarm frequent itemset is determined.

6. The method according to claim 1, characterized in that The step of determining a set of alarm association rules for a network element device based on the alarm frequent item set includes: For each alarm combination item in the alarm frequent item set, determining a second correlation strength between alarm items in the alarm combination item; Based on the alarm combination items whose second association strength is greater than a third threshold, an alarm association rule set for the network element device is determined.

7. The method according to claim 6, characterized in that The second correlation strength between the alarm items in the alarm combination item is determined based on the degree to which the occurrence of any alarm item in the alarm combination item increases the occurrence probability of other alarm items in the alarm combination item.

8. The method according to claim 1, characterized in that The method further comprises: For each alarm association rule in the alarm association rule set, determining whether each alarm association rule has a temporal causal relationship; Based on the alarm association rules having the temporal causal relationship, a final alarm association rule set is determined.

9. The method according to claim 8, characterized in that Determining whether each of the alarm association rules has a temporal causal relationship includes: In the case where the alarm association rule includes a first alarm item and a second alarm item, determining the occurrence frequency of a first event and the occurrence frequency of a second event; the first event is that the occurrence time of the first alarm item is earlier than the occurrence time of the second alarm item; the second event is that the occurrence time of the second alarm item is earlier than the occurrence time of the first alarm item; When the difference between the occurrence frequency of the first event and the occurrence frequency of the second event is greater than a fourth threshold, it is determined that the alarm association rule has a temporal causal relationship.

10. The method according to claim 1, characterized in that The obtaining of a network element alarm data set within a preset time period includes: Obtaining the original network element alarm data set within a preset time period; The original network element alarm data is subjected to noise filtering processing to obtain the network element alarm data set; the noise filtering processing is used to filter out interference alarm data in the original network element alarm data set.

11. The method according to claim 1, characterized in that: The network element alarm data set includes alarm data of different professions.

12. The method according to claim 1, characterized in that The alarm frequent itemset is a two-item set.

13. An electronic device, characterized in that: The electronic device comprises: a processor and a memory; The memory stores instructions executable by the processor; When the processor is configured to execute the instructions, the electronic device implements the method according to any one of claims 1 to 12.

14. A readable storage medium, characterized in that: The readable storage medium includes: software instructions; When the software instructions are executed in an electronic device, the electronic device implements the method according to any one of claims 1 to 12.

15. A computer program product, characterized in that The computer program product comprises: computer instructions; When the computer instructions are executed in an electronic device, the electronic device is enabled to implement the method according to any one of claims 1 to 12.

Images