Fault diagnosis method, electronic equipment and storage medium

Abstract

The invention provides a fault diagnosis method, electronic equipment and a storage medium, and relates to but is not limited to the technical field of communication, and the fault diagnosis method comprises the steps: constructing an operation and maintenance knowledge graph based on a fault mode; obtaining a root cause alarm of a fault, and determining a target fault mode corresponding to the root cause alarm through the operation and maintenance knowledge graph; performing root cause diagnosis according to the target fault mode to obtain a fault root cause corresponding to a root cause alarm; and carrying out fusion processing on the fault root causes corresponding to the root cause alarms to obtain a target fault root cause. According to the scheme provided by the embodiment of the invention, the operation and maintenance knowledge graph based on the fault mode is constructed, the target fault mode corresponding to the root cause alarm of the fault can be determined by using the operation and maintenance knowledge graph, and then root cause diagnosis is performed according to the target fault mode to obtain the fault root cause. According to the scheme of the embodiment of the invention, the fault diagnosis efficiency and the automation of intelligent operation and maintenance can be greatly improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular to a fault diagnosis method, an electronic device, and a storage medium. Background Art

[0002] With the development of intelligent telecommunications network monitoring technology, the object of network monitoring is changing from alarms to faults, that is, intelligent fault systems. When a network fault occurs, a large number of alarms generated by the fault are first aggregated to generate a fault alarm. Then, the root cause alarm of the fault is inferred from the fault alarm, and only the root cause alarm is processed, thereby greatly reducing the number of dispatch orders. However, there may be multiple reasons for the same type of alarm. The root cause of the fault cannot be directly obtained through the root cause alarm alone. The operation and maintenance personnel still need to perform network analysis, and the efficiency of locating the root cause is heavily dependent on the experience of the operation and maintenance personnel. Therefore, only aggregating alarms into faults and recommending root cause alarms cannot achieve comprehensive intelligent network operation and maintenance. Summary of the invention

[0003] The embodiments of the present application provide a fault diagnosis method, an electronic device, and a storage medium, which can quickly locate the root cause of the fault corresponding to the root cause alarm and improve the intelligence of network operation and maintenance.

[0004] In a first aspect, an embodiment of the present application provides a fault diagnosis method, the method comprising:

[0005] Build an operation and maintenance knowledge graph based on failure modes;

[0006] Obtain at least one root cause alarm corresponding to the fault, and determine the target fault mode corresponding to each of the root cause alarms through the operation and maintenance knowledge graph;

[0007] For each of the root cause alarms, performing root cause diagnosis according to the target fault mode corresponding to the root cause alarm to obtain the root cause of the fault corresponding to the root cause alarm;

[0008] The root causes of the faults corresponding to the root cause alarms are fused to obtain the target root cause of the faults.

[0009] In a second aspect, an embodiment of the present application provides an electronic device, including:

[0010] one or more processors;

[0011] A memory having one or more programs stored thereon, when the one or more programs are executed by the one or more processors, the one or more processors implement the fault diagnosis method as described in the first aspect above.

[0012] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the program is executed by a processor, the fault diagnosis method as described in the first aspect above is implemented.

[0013] The fault diagnosis method, electronic device, and storage medium provided in the embodiments of the present application first construct an operation and maintenance knowledge graph based on the fault mode, and use the operation and maintenance knowledge graph to determine the target fault mode corresponding to the root cause alarm of the fault, and then perform root cause diagnosis according to the target fault mode to obtain the root cause of the fault corresponding to the root cause alarm; and then perform fusion processing on the root causes of the faults corresponding to the root cause alarms to obtain the target root cause of the fault. According to the solution of the embodiments of the present application, the efficiency of fault diagnosis and the automation of intelligent operation and maintenance can be greatly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings are used to provide a further understanding of the technical solution of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the technical solution of the present invention and do not constitute a limitation on the technical solution of the present invention.

[0015] Figure 1 It is a system architecture diagram provided by an embodiment of the present application;

[0016] Figure 2 It is a flowchart of a fault diagnosis method provided by an embodiment of the present application;

[0017] Figure 3 It is a schematic diagram of the operation and maintenance knowledge graph provided in the embodiment of the present application;

[0018] Figure 4 It is a flow chart of building an operation and maintenance knowledge graph based on failure modes provided in an embodiment of the present application;

[0019] Figure 5 It is a schematic diagram of the alarm relationship included in the fault mode provided in the embodiment of the present application;

[0020] Figure 6 It is a schematic diagram of knowledge mining of operation and maintenance knowledge graph provided by an embodiment of the present application;

[0021] Figure 7 It is a schematic diagram of the method of extracting operation and maintenance knowledge provided in an embodiment of the present application;

[0022] Figure 8 This is a schematic diagram of an example of an operation and maintenance knowledge graph provided in an embodiment of the present application;

[0023] Fig. 9 This is a flow chart of determining a target failure mode provided by an embodiment of the present application;

[0024] Fig.10This is a schematic diagram of a process flow of a root cause location operation provided by an embodiment of the present application;

[0025] Fig.11 It is a schematic diagram of the device structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0027] It should be understood that in the description of the embodiments of the present application, if there is a description of "first", "second", etc., it is only used for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or implicitly indicating the order of the indicated technical features. "At least one" means one or more, and "multiple" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the situation where A exists alone, A and B exist at the same time, and B exists alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any group of these items, including any group of single or plural items. For example, at least one of a, b and c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.

[0028] In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0029] The fault diagnosis method provided in the embodiment of the present application can be applied to the fault alarm monitoring and analysis scenarios of wireless communication networks, wherein the wireless communication networks include but are not limited to: Narrow Band-Internet of Things (NB-IoT), Global System for Mobile Communications (GSM), Enhanced Data rate for GSM Evolution (EDGE), Wideband Code Division Multiple Access (WCDMA), Code Division Multiple Access 2000 (CDMA2000), Time Division-Synchronization Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), fifth generation mobile communication (5G) mobile communication technology, sixth generation mobile communication (6G) mobile communication technology and subsequent evolution communication systems, and can also be applied to other wireless communication networks.

[0030] Figure 11 is a system architecture diagram provided by an embodiment of the present application, wherein the system includes a network system 1100, an alarm collection node 1200, and a fault diagnosis device 1300. The network system 1100 includes at least one network device, and each network device may generate alarm data during operation. The network device may be any object that needs to be managed in the network system. The network device may be implemented in software, for example, the network device may be a virtual machine, a container, an application, a service, a microservice, a module, a submodule, a class or a function, etc. The network device may be software running in one device or a collection of software running in multiple devices; the network device may also be implemented in hardware, for example, it may be a server, a base station, a switch, a router, a relay, a bridge, a firewall, a mobile terminal, a personal computer, a laptop computer, a disk, a solid state drive (SSD), a disk array (RAID), a storage area network (SAN), an Internet Protocol (IP) SAN, a Fiber Channel (FC) SAN, a network attached storage (NAS), a load balancer, a mobility management entity (MME), a home subscriber server (HSS), a serving-gateway (SGW), a packet data network gateway (PGW), a policy and charging rules function (PCRF) network element, an optical network terminal (ONT), an optical network unit (ONT), and a plurality of other network elements. Unit, ONU), optical splitter, IoT terminal, sensor, etc.; the network device can be implemented by an independent hardware, or by multiple hardwares connected through a wired or wireless network. This embodiment does not limit the specific form of the network device.

[0031] The alarm collection node 1200 is used to collect alarm data generated by network devices in the network system 1100. The alarm collection node 1200 is connected to the network system 1100 in communication. When any network device in the network system 1100 generates alarm data, the network device can send the alarm data to the alarm collection node 1200. The alarm collection node 1200 can receive the alarm data sent by the network device so as to subsequently send the alarm data to the fault diagnosis device 1300. It should be understood that the alarm collection node has a storage function, and the alarm collection node can store a large amount of alarm data from the network system through its own or external storage media. For example, the alarm collection node can specifically be a database, a hard disk, a database hard disk, a database, a file transfer protocol (File Transfer Protocol, FTP) server, a disk, an SSD, a RAID, a SAN, an IPSAN, a FC SAN, a NAS, etc.

[0032] The fault diagnosis device 1300 is used to execute the method provided in the embodiment of the present application. The fault diagnosis device 1300 can be connected to the alarm collection node 1200 in communication. The alarm collection node 1200 can send the alarm data collected from the network system 1100 to the fault diagnosis device 1300, and the fault diagnosis device 1300 can receive the alarm data sent by the alarm collection node 1200. The fault diagnosis device 1300 determines the root cause alarm of the fault according to the received alarm data, and uses the constructed operation and maintenance knowledge graph based on the fault mode to determine the target fault mode corresponding to the root cause alarm of the fault, and then determines the root cause of the fault according to the target fault mode.

[0033] The executor of the fault diagnosis method of the embodiment of the present application may be a terminal device, which may include but is not limited to: a personal computer, a handheld device or a portable device, a tablet device, a multi-processor system, a microprocessor-based system, a set-top box, a programmable consumer electronic device, a network PC, a minicomputer, a mainframe computer, a distributed computing environment including any of the above systems or devices, and the like.

[0034] The execution subject of the fault diagnosis method of the embodiment of the present application may also be a server. The server may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The embodiment of the present application does not limit the form of the subject of the execution method embodiment.

[0035] The methods provided by the embodiments of the present application can be described in the general context of computer executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0036] With the development of intelligent telecommunications network monitoring technology, the object of network monitoring is changing from alarms to faults, that is, intelligent fault systems. When a network fault occurs, a large number of alarms generated by the fault are first aggregated to generate a fault alarm. Then, the root cause alarm of the fault is inferred from the fault alarm, and only the root cause alarm is processed, thereby greatly reducing the number of dispatch orders. However, there may be multiple reasons for the same type of alarm. The root cause of the fault cannot be directly obtained through the root cause alarm alone. The operation and maintenance personnel still need to perform network analysis, and the efficiency of locating the root cause is heavily dependent on the experience of the operation and maintenance personnel. Therefore, only aggregating alarms into faults and recommending root cause alarms cannot achieve comprehensive intelligent network operation and maintenance.

[0037] Based on this, the embodiment of the present application provides a fault diagnosis method, an electronic device and a computer-readable storage medium, which can quickly locate the root cause of the fault corresponding to the root cause alarm, and improve the intelligence of network operation and maintenance. In the embodiment of the present application, a large amount of fault alarm data collected is aggregated through a fault diagnosis device, and typical fault scenarios, that is, fault modes, are extracted therefrom. The root cause diagnosis method for the same fault mode is consistent; and a large amount of fault diagnosis knowledge accumulated in the field of operation and maintenance is used to construct an operation and maintenance knowledge graph based on the fault mode. By using the operation and maintenance knowledge graph, the target fault mode corresponding to the root cause alarm of the fault can be determined, and then the root cause diagnosis is performed according to the target fault mode to obtain the root cause of the fault, thereby greatly improving the efficiency of fault diagnosis and realizing the automation of intelligent operation and maintenance.

[0038] Figure 2 FIG. 1 is a flow chart of a fault diagnosis method provided in an embodiment of the present application. Figure 2 As shown, the fault diagnosis method provided in the embodiment of the present application includes but is not limited to the following steps S100, S200, S300 and S400, and each step is introduced in turn below.

[0039] Step S100: construct an operation and maintenance knowledge graph based on failure modes.

[0040] The failure mode described in the embodiments of the present application is a typical failure scenario extracted based on a large amount of fault alarm data. For example, the failure mode may be that the optical module receives light beyond the limit, the splitter port signal is abnormal, and so on.

[0041] In an embodiment of the present application, an operation and maintenance knowledge graph is constructed with fault modes as nodes, and in the operation and maintenance knowledge graph, the fault mode node is used as the core node, and related nodes of the fault mode node are constructed around the fault mode node. These related nodes cover knowledge such as categories, phenomena, cases, diagnostic methods, causes, solutions, fault locations, etc. related to the fault mode, providing support for subsequent root cause diagnosis of the fault.

[0042] Figure 3 This is a schematic diagram of the operation and maintenance knowledge graph provided in the embodiment of the present application. Figure 3 As shown, the operation and maintenance knowledge graph includes a root cause alarm node and a fault mode node, and the root cause alarm node and the fault mode node are connected by an edge to indicate that the two have a corresponding relationship. The fault diagnosis method of the embodiment of the present application takes the root cause alarm as the starting point of fault diagnosis, uses the operation and maintenance knowledge graph to determine the target fault mode corresponding to the root cause alarm, and then performs root cause diagnosis according to the target fault mode to obtain the root cause of the fault.

[0043] It should be noted that Figure 3 The number of root cause alarm nodes and fault mode nodes is only for illustration. The number of root cause alarm nodes and fault mode nodes in the operation and maintenance knowledge graph can be multiple, and one root cause alarm node has a corresponding relationship with multiple fault mode nodes. Similarly, one fault mode node can also have a corresponding relationship with multiple root cause alarm nodes. The weight of the edge between the root cause alarm node and the fault mode node with a corresponding relationship represents the matching probability between the corresponding root cause alarm and the fault mode.

[0044] like Figure 3 As shown, the operation and maintenance knowledge graph also includes at least one of the following nodes: alarm analysis node, event query node, AI reasoning node, silent fault node, fault root cause node, solution node, fault location node, fault network element node, fault category node, fault phenomenon node, similar case node, and remark node. Among them, the alarm analysis node, event query node, AI reasoning node, and silent fault node are diagnostic analysis nodes, which are used to indicate the mapping rules of fault mode nodes and fault root cause nodes.

[0045] In the embodiment of the present application, the construction of the operation and maintenance knowledge graph can be combined with the fault diagnosis scenario, and with the help of business expert experience, the graph nodes and edges can be confirmed. The application scenario of the embodiment of the present application is an intelligent fault scenario based on alarms. Therefore, based on the alarms of fault aggregation, analysis can be performed step by step to find the root cause and solution of the fault. The graph ontology includes root cause alarm nodes and fault mode nodes, and includes nodes such as categories, phenomena, similar cases, alarm analysis, event query, AI reasoning, root causes of faults, solutions, and fault locations corresponding to the fault nodes.

[0046] Figure 4 This is a flow chart of constructing an operation and maintenance knowledge graph based on a fault mode provided in an embodiment of the present application. Figure 4 As shown, constructing an operation and maintenance knowledge graph based on a failure mode includes the following steps S101-S105:

[0047] Step S101, obtaining first historical alarm data of multiple historical faults;

[0048] Exemplarily, historical alarm data generated by the network system in a certain time period can be obtained, and then the above historical alarm data can be aggregated according to the time-space relationship or through an AI algorithm to obtain the first historical alarm data of multiple historical faults.

[0049] It should be noted that in a network system, the same type of fault may occur at different locations of the network, but the alarm types caused by the fault are often the same or similar, so these alarms can be aggregated into one fault alarm data through business and time constraints.

[0050] Step S102: cluster and extract the first historical alarm data of multiple historical faults to obtain multiple fault modes and second historical alarm data corresponding to each fault mode.

[0051] Exemplarily, based on the fault, the first historical alarm data of multiple historical faults are similarly calculated through an aggregation algorithm or a frequent item set algorithm to mine similar historical faults. Specifically, faults with similarity greater than a threshold can be extracted, and then the faults with similarity greater than the threshold are summarized to obtain the fault mode. The first historical alarm data of historical faults belonging to the same fault mode is obtained, and the second historical alarm data corresponding to the fault mode can be constructed.

[0052] Step S103: for each fault mode, determine the root cause alarm and non-root important alarm corresponding to the fault mode according to the second historical alarm data corresponding to the fault mode, and determine the fault root cause corresponding to the fault mode.

[0053] Exemplarily, the alarms of the fault mode may only contain root cause alarms and non-root important alarms, and the alarms that are not important for fault location can be filtered out in advance. In step S103, for each fault mode, the second historical alarm data corresponding to the fault mode can be first filtered, and only the important alarms corresponding to the fault mode are retained. Then, the root cause alarms are located based on the important alarms corresponding to the fault mode, and the root cause alarms corresponding to the fault mode are obtained. Important alarms other than root cause alarms are non-root important alarms. The root cause alarms corresponding to the fault mode can be determined using an AI algorithm or an alarm propagation relationship.

[0054] Exemplarily, the root cause of the fault corresponding to the fault mode can be determined by using alarm relationship, network performance indicators or AI algorithm, and each fault mode can correspond to multiple root causes.

[0055] After determining the root cause of the fault corresponding to the fault mode, a root cause node can be constructed in the operation and maintenance knowledge graph.

[0056] Figure 5 It is a schematic diagram of the alarm relationship included in the fault mode provided in the embodiment of the present application. Figure 5 The fault mode shown is "optical module receiving light exceeds the limit", the root cause alarm is "Ethernet interface input optical power exceeds the limit", and non-root major alarms include "Ethernet physical interface signal loss" and "Ethernet physical interface Ethernet" port is not connected. Based on the propagation relationship between the alarms included in the fault mode, the alarm relationship included in the fault mode can be obtained.

[0057] Step S104: take each fault mode as a fault mode node, take each root cause alarm as a root cause alarm node, and establish connecting edges between the fault mode nodes and the root cause alarm nodes having corresponding relationships to obtain an operation and maintenance knowledge graph.

[0058] It should be noted that one fault mode node may have a corresponding relationship with multiple root cause alarm nodes, and similarly, one root cause alarm node may have a corresponding relationship with multiple fault mode nodes.

[0059] Step S105: Determine the weight corresponding to each edge according to the matching probability between the fault mode and the root cause alarm.

[0060] In the embodiment of the present application, the edge between the fault mode node and the root cause alarm node has a weight attribute, and the weight value of the edge represents the matching probability of the root cause alarm and the corresponding fault mode. For example, the fault modes corresponding to the root cause alarm "loss of signal LOS alarm" include fault mode 1, fault mode 2 and fault mode 3, and the corresponding matching probabilities are 50%, 20% and 15%, that is, the weight of the edge between the root cause alarm node "loss of signal LOS alarm" and the fault mode 1 node is 50%, the weight of the edge between the root cause alarm node "loss of signal LOS alarm" and the fault mode 2 node is 20%, and the weight of the edge between the root cause alarm node "loss of signal LOS alarm" and the fault mode 3 node is 15%.

[0061] The matching probability of the root cause alarm and the corresponding fault mode can be obtained by counting the fault types corresponding to the root cause alarm. For example, among the collected historical fault alarm data, the root cause alarms of 100 historical faults are all "loss of signal LOS alarms", and 50 of them have been classified into fault mode 1 through clustering extraction in the previous step S102. Therefore, it can be determined that the matching probability of the root cause alarm "loss of signal LOS alarm" corresponding to fault mode 1 is 50%.

[0062] It should be noted that the weight of the edge between the fault mode node and the root cause alarm node can also be manually labeled, and this application does not impose any restrictions on this.

[0063] In an example of the present application, constructing an operation and maintenance knowledge graph based on a failure mode also includes the following steps S106 and S107:

[0064] Step S106: According to the root cause of the fault corresponding to the fault mode, a root cause node corresponding to the fault mode node is constructed in the operation and maintenance knowledge graph.

[0065] Step S107: construct a diagnosis and analysis node between the fault mode nodes and the fault root cause nodes having a corresponding relationship, wherein the diagnosis and analysis node includes at least one of the following: a silent fault node, an alarm analysis node, an event query node, and an artificial intelligence AI reasoning node.

[0066] It should be noted that in most cases, the root cause of the fault is related to the alarm of the fault, but in some scenarios, the root cause of the fault has no directly related alarm. For example, if there is no monitoring mechanism to output an alarm for a single board chip fault, there will be no product chip fault alarm, but the ports related to this single board and the services carried will generate alarms. This type of fault can be called a "silent fault". The fault location of a silent fault cannot be obtained by relying on the location of the root cause alarm, but through the alarms related to the fault, the convergence location of the related alarms can be queried through the network topology as the location of the fault.

[0067] In the process of building the operation and maintenance knowledge graph, if a certain fault mode is a silent fault, then the node of the fault mode is connected to a silent fault node through an edge. The silent fault node is used to indicate the mapping rule between the silent fault and the corresponding root cause of the fault. If the mapping rule indicated by the silent fault node can be satisfied, it can be determined that the root cause of the fault pointed to by the silent fault node is the root cause of the fault corresponding to the current fault.

[0068] The alarm analysis node is used to indicate the mapping rules between the fault alarm relationship and the root cause of the fault. For example, the root cause alarm is "optical module fault alarm (4203&138)", and the important alarm is "Ethernet physical interface signal loss (4203&8)". The relationship between the two is peer, that is, "4203&138-peer->4203&8". Through the above alarm relationship analysis, it can be determined that the root cause of the fault is "optical module abnormality" and the solution is "replace the optical module". Therefore, if the alarm of the current fault satisfies the above alarm relationship, that is, the mapping rule indicated by the alarm analysis node is satisfied, it can be determined that the root cause of the current fault is "optical module abnormality".

[0069] It should be noted that if the root cause of the fault cannot be located by relying on the fault alarm relationship, it is necessary to query other events and obtain the root cause of the fault through comprehensive analysis to end the diagnosis. For example, if the root cause alarm is "Ethernet physical interface signal loss (4203&8)", and there are no other important alarms, you can query the input optical power performance value of the alarm port. If the optical power performance value is less than the worst receiving sensitivity of the optical module, the root cause of the fault can be located as "the link loss of the alarm port is too large", and the solution is "need to check the corresponding optical fiber, repair or replace the optical fiber".

[0070] In the embodiment of the present application, in view of the situation that the root cause of the fault may not be obtained through the alarm analysis node, an event query node is constructed in the operation and maintenance knowledge graph, and the event query node is used to indicate the mapping rules of the associated event value of the fault and the root cause of the fault. For example, the root cause alarm of the current fault is "Ethernet physical interface signal loss (4203&8)", and there are no other important alarms, so the root cause of the fault may not be directly obtained through the alarm analysis node, and then based on the indication of the event query node, the associated event value of the current fault "input optical power performance value of the alarm port" is obtained. If the input optical power performance value of the alarm port is less than the worst receiving sensitivity of the optical module, the mapping rule indicated by the event query node is satisfied, and it can be determined that the root cause of the fault pointed to by the event query node is the root cause of the current fault, that is, "the link loss of the alarm port is too large".

[0071] It should be noted that the root cause location of some faults also requires the input of the associated event values ​​into the AI ​​model. The root cause of the fault can be inferred based on the output of the AI ​​model. Therefore, an AI reasoning node can be built in the operation and maintenance knowledge graph so that the associated event values ​​can be processed through the AI ​​reasoning node to obtain the corresponding root cause of the fault. For example, if the root cause alarm is "Ethernet physical interface signal loss (4203&8)", the optical power values ​​of the port at the alarm location before and after the alarm can be collected, and then based on the collected optical power values, the AI ​​model can be used for reasoning to further infer the root cause of the fault. The root cause of the fault may include the cause of the optical path fault being a loose pigtail, a broken pigtail, or an optical cable problem.

[0072] In an example of the present application, constructing an operation and maintenance knowledge graph based on a failure mode also includes the following step S108:

[0073] Step S108: construct a solution node and a fault location node corresponding to the fault root cause node in the operation and maintenance knowledge graph.

[0074] In this step, a solution node is constructed in the operation and maintenance knowledge graph to provide a solution corresponding to the root cause of the fault through the solution node. For example, the solution corresponding to the root cause of the fault "the link loss of the alarm port is too large" is "the corresponding optical fiber needs to be checked, repaired or replaced."

[0075] In this step, a fault location node is constructed in the operation and maintenance knowledge graph. Specifically, the location of the root cause alarm can be queried through the network topology to locate the fault location.

[0076] In an example of the present application, constructing an operation and maintenance knowledge graph based on a failure mode also includes the following step S109:

[0077] Step S109: For each fault mode node, construct at least one of the following nodes corresponding to the fault mode node in the operation and maintenance knowledge graph: a fault phenomenon description node, a fault category description node, or a case description node.

[0078] For example, we can use manual experience and document knowledge mining to obtain information such as fault phenomena, categories, and cases corresponding to the fault mode. For example, for structured documents (such as manual fault diagnosis experience), we use mapping to obtain knowledge; for semi-structured documents (such as work orders), we use formatted extraction to obtain knowledge; for unstructured data (such as fault cases, manuals), we use AI methods such as big models to extract knowledge and gradually improve the knowledge graph.

[0079] In an example of the present application, constructing an operation and maintenance knowledge graph based on a failure mode further includes the following step S110:

[0080] Step S110, determine the attributes of each fault mode node, wherein the attributes of the fault mode node include at least one of the following: a fault mode identifier, a fault mode name, a silent fault mode identifier, an urgency attribute, a processing priority attribute, a root cause alarm set, a non-root important alarm set, a network classification attribute, or an identifier of whether the fault can be repaired using a network manager.

[0081] The properties contained in the failure mode node can be shown in the following table:

[0082]

[0083]

[0084] Figure 6 This is a schematic diagram of the knowledge mining of the operation and maintenance knowledge graph provided in the embodiment of the present application. In order to improve the knowledge of the operation and maintenance knowledge graph, various types of knowledge required to build the operation and maintenance knowledge graph can be mined from various types of fault-related operation and maintenance documents, including graph nodes and node attributes. For structured data, mapping or manual extraction is used; for semi-structured data, formatting is used for extraction; and for unstructured data, AI algorithms are used for extraction.

[0085] Generally speaking, after accumulating experience, a large number of experience documents have been accumulated in typical technical fields. Among them, the structure of structured data is generally inconsistent with the structure of the knowledge graph. The content of structured data is generally more standardized and the semantics are clear. Knowledge can be extracted in a rule-based manner, that is, the input structured data is mapped or converted to the target structure of the knowledge graph. This process is essentially a shallow data conversion. For semi-structured and unstructured text documents, AI can be used for knowledge extraction. For example, the Jieba word segmentation technology is used with part-of-speech tagging to achieve fast and accurate word segmentation of text. On this basis, the BERT-BiLSMT-CRF model is used for sequence annotation to achieve named entity recognition, and then the BERT-BiGRU-ATT model is used to achieve entity relationship extraction of text. Figure 7 It is a schematic diagram of the method of extracting operation and maintenance knowledge provided in an embodiment of the present application.

[0086] In the embodiment of the present application, knowledge fusion is performed on the mined knowledge to construct an operation and maintenance knowledge graph. Because the sources of knowledge extraction are diverse, the knowledge obtained from different sources is not the same, which puts forward the demand for knowledge fusion. Knowledge fusion requires the completion of entity alignment and attribute fusion. Entity alignment is to identify the same entity from different sources. Attribute fusion is to identify different descriptions of the same attribute. Data values ​​from different sources usually have different formats, different units or different description forms, and need to be normalized to a unified format.

[0087] Entity alignment is to output unambiguous root cause entities for entity descriptions whose input is from different data sources, such as root cause entities extracted from work orders and root cause entities entered manually. This is because in different data sources, there may be different sentences describing the same root cause. Suppose we have two root cause descriptions: "Optical cable break" and "Optical fiber disconnected". Both sentences contain information that the root cause of the fault is "broken fiber", but they are described using different vocabulary and grammar. We can use a similarity-based sentence alignment method to calculate their similarity. Using a pre-trained Chinese word vector model, we can get the following results:

[0088] Optical cable break: [(0.15,0.20),(0.34,0.46)];

[0089] Fiber disconnection: [(0.18,0.25),(0.38,0.52)];

[0090] Use cosine similarity to calculate the similarity between two entities. Multiply the vectors of the two entities separately, add the results, and then divide by the product of the moduli of the two entity vectors, that is:

[0091] cosine_similarity=(v1·v2) / (||v1||·||v2||);

[0092] Among them, v1 represents the entity vector of "optical cable break", and v2 represents the entity vector of "optical fiber disconnection".

[0093] According to the similarity between "optical cable break" and "optical fiber disconnection", a certain threshold is set. If the similarity is greater than the threshold, it can be considered that they describe the same entity and entity alignment can be performed.

[0094] Figure 8 It is a schematic diagram of an example of the operation and maintenance knowledge graph provided in an embodiment of the present application. Figure 8 In the operation and maintenance knowledge graph shown, the fault mode nodes corresponding to fault modes 1-6, as well as the root cause alarm nodes "port disconnected alarm" and "signal loss LOS alarm" are shown. Among them, there is a connection edge between the root cause alarm node "signal loss LOS alarm" and the nodes of fault modes 1, 2, 3, 5, and 6, and the probability marked on the edge indicates the matching probability of the root cause alarm "signal loss LOS alarm" relative to fault modes 1, 2, 3, 5, and 6, which are 50%, 20%, 15%, 10%, and 5% respectively. ; There is a connection edge between the root cause alarm node "port disconnected alarm" and the nodes of fault modes 4 and 5, and the probability marked on the edge indicates the matching probability of the root cause alarm relative to fault modes 4 and 5, which are 80% and 20% respectively.

[0095] Figure 8In the operation and maintenance knowledge graph shown, the fault category description node and fault phenomenon description node corresponding to fault mode 1 are also shown. The fault category description node shows that the fault category of fault mode 1 is "status class"; the fault phenomenon description node shows that the fault phenomenon of fault mode 1 is "link terminal".

[0096] Figure 8 The operation and maintenance knowledge graph shown also shows multiple diagnostic analysis nodes, namely: the alarm analysis node "LOS alarm at both ends of the optical fiber" connected to the fault mode 1 node, the event query node "optical power query" connected to the fault mode 2 node, and the event query node "opposite network element status query" connected to the fault mode 3 node; under the fault mode 2 node, it also includes an "AI reasoning" node connected to the "optical power query" node.

[0097] Figure 8 In the operation and maintenance knowledge graph shown, multiple root cause nodes are also shown, namely: corresponding to the fault mode 1 node, the root cause node "fiber breakage" connected to the alarm analysis node "LOS alarm at both ends of the optical fiber"; corresponding to the fault mode 2 node, the root cause node "large link loss" connected to the event query node "optical power query", and the root cause node "loose pigtail" connected to the "AI reasoning" node; corresponding to the fault mode 3 node, the "opposite network element offline" node connected to the event query node "opposite network element status query".

[0098] Figure 8 The operation and maintenance knowledge graph shown also shows the solution node "Replace optical fiber" connected to the root cause nodes "optical fiber breakage", "loose pigtail", and "large link loss" respectively, and the solution node "Check the opposite network element" connected to the root cause node "opposite network element offline".

[0099] The embodiment of the present application provides an operation and maintenance knowledge graph architecture based on fault modes, which can be applied to intelligent fault systems. Based on fault modes, it integrates knowledge related to fault diagnosis, constructs an operation and maintenance knowledge graph, and realizes the automation of intelligent fault root cause location. The entity (i.e., node) types in the constructed operation and maintenance knowledge graph include alarms, fault modes, alarm analysis, event queries, AI reasoning, fault root causes, solutions, similar cases, etc.; wherein, the fault mode includes the root cause alarm type and the important alarm type of the fault, which are used to characterize a certain type of fault. The relevant knowledge of the operation and maintenance knowledge graph comes from historical fault data and artificial experience data such as case libraries, wherein the fault mode is obtained by mining historical fault data through algorithms such as clustering, and the fault mode includes the root cause alarm and important alarm of typical faults. In addition to the specific edge type, the node relationship of the operation and maintenance knowledge graph also contains probability information, which is mainly based on historical faults and the probability of the corresponding node having occurred. When making a specific diagnosis, the node with high probability can be selected to improve the efficiency of fault diagnosis.

[0100] Step S200: Obtain at least one root cause alarm corresponding to the fault, and determine the target fault mode corresponding to each root cause alarm through the operation and maintenance knowledge graph.

[0101] In this step, the root cause alarm of the fault is first located, and then the constructed operation and maintenance knowledge graph based on the fault mode can be used to find the fault mode corresponding to the root cause alarm of the current fault from the operation and maintenance knowledge graph, that is, the target fault mode; the root cause of the fault can be determined based on the target fault mode.

[0102] Exemplarily, in step S200, obtaining at least one root cause alarm corresponding to the fault may specifically include the following steps S210, S211, and S212:

[0103] Step S210, obtaining fault alarm data;

[0104] Step S211, screening the alarm data of the fault to obtain at least one important alarm of a sub-fault, wherein an alarm propagation relationship exists between the important alarms of the sub-faults;

[0105] Exemplarily, in step S211, the alarm data of the fault is screened to obtain an important alarm of at least one sub-fault, which may specifically include the following steps S2111, S2112 and S2113:

[0106] Step S2111 , performing aggregate fault processing on the received alarms according to the temporal and spatial relationship to obtain alarm data of at least one fault.

[0107] For example, cluster analysis may be performed on the received alarm data according to the alarm time and the location of the alarm in the network topology to find alarms with correlation, and the alarms with correlation may be clustered together as alarm data of a fault.

[0108] Step S2112, the aggregated alarm data is split according to the business dimension to obtain an alarm of at least one sub-fault, wherein an alarm propagation relationship exists between the alarms of the sub-faults.

[0109] In this step, the alarms with an alarm propagation relationship can be classified as alarms of a sub-fault according to the alarm propagation relationship. If there is no alarm propagation relationship between two alarms, it is determined that the two alarms belong to alarms of different sub-faults.

[0110] Step S2113: for each sub-fault alarm, filter the sub-fault alarm to obtain the important alarm of the sub-fault.

[0111] This step aims to filter out alarms that are irrelevant to fault root cause location and retain only alarms that are useful for fault root cause location, so as to improve the efficiency of fault root cause location.

[0112] Exemplarily, when there are a large number of alarms, the alarm set of the fault mode is used to filter out alarms that are not related to the root cause location of the fault. For example, the set of all alarms for the fault mode of the operation and maintenance speed map is S1, and the set of alarms included in the fault is S2. Then, only the alarms in set S1 are retained for the fault, and other alarms are filtered out.

[0113] Optionally, after filtering the alarms of the sub-faults, the method of the embodiment of the present application further includes the following step: adding an alarm corresponding to the sub-fault according to the alarm propagation relationship.

[0114] For scenarios where many or few fault alarms are aggregated, the alarm propagation relationship can be used to remove and add alarms. For example, the alarm propagation relationship is A->B->C, and there are only A and C in the fault. According to experience, if C appears, B must appear, so B is blocked or missed, and B needs to be added. The alarm B may be missed during fault aggregation due to the time window, or it may be blocked due to network management settings, resulting in the faulty system not receiving the alarm.

[0115] Step S212: Classify the important alarm of each sub-fault into root cause alarms and non-root important alarms.

[0116] The operation and maintenance knowledge graph provided in the embodiment of the present application includes multiple root cause alarm nodes and multiple fault mode nodes, and edges are set between the root cause alarm nodes and the fault mode nodes with corresponding relationships, and the weight of the edge represents the matching probability between the root cause alarm nodes and the fault mode nodes with corresponding relationships. Based on this, in step S200, the target fault mode corresponding to each root cause alarm is determined through the operation and maintenance knowledge graph. Specifically, the following steps S220, S221 and S222 can be performed for each root cause alarm to obtain the target fault mode corresponding to each root cause alarm:

[0117] Step S220, determining at least one first candidate failure mode corresponding to the root cause alarm and a matching probability corresponding to each first candidate failure mode based on the operation and maintenance knowledge graph;

[0118] Step S221, performing matching operations on each first candidate fault mode in order from high to low matching probability, wherein the matching operations include:

[0119] Determining a first matching degree between the root cause alarm and the first candidate failure mode;

[0120] When the first matching degree satisfies the first threshold, determining a second matching degree between the non-root important alarm and the first candidate fault mode;

[0121] When the second matching degree satisfies the second threshold, the first candidate fault mode is used as the second candidate fault mode; or, when the second matching degree satisfies the third threshold but does not satisfy the second threshold, the first candidate fault mode is used as the third candidate fault mode, wherein the first threshold is greater than the third threshold and the second threshold is greater than the third threshold;

[0122] Exemplarily, the attributes of each fault mode node include a root cause alarm set, and the first matching degree can be determined by the following steps:

[0123] Obtain a root cause alarm set corresponding to the first candidate failure mode;

[0124] The root cause alarm corresponding to the sub-fault is intersected with the root cause alarm set corresponding to the first candidate fault mode to obtain a first matching degree.

[0125] Specifically, the first matching degree is to match the root cause alarm set contained in the attributes of the fault mode with the root cause alarm set of the fault to be diagnosed. Optionally, Jaccard is used to calculate the matching degree, and the intersection of the root cause alarm set of the mode and the root cause alarm set of the fault is divided by the root cause alarm set of the mode to obtain the first matching degree. The following formula can be used as a reference:

[0126] The first matching degree=num(root cause alarm set of the pattern∩root cause alarm set of the fault) / num(root cause alarm set of the pattern).

[0127] Exemplarily, the attributes of each fault mode node include an important alarm set, and the second matching degree can be determined by the following steps:

[0128] Obtain an important alarm set corresponding to the first candidate failure mode;

[0129] The non-root important alarm corresponding to the sub-fault is intersected with the important alarm set corresponding to the first candidate fault mode to obtain a second matching degree.

[0130] Specifically, the first matching degree is to match the non-root important alarm set contained in the attributes of the fault mode with the non-root important alarm set of the fault to be diagnosed. Optionally, Jaccard is used to calculate the matching degree, and the intersection of the non-root important alarm set of the mode and the non-root important alarm set of the fault is divided by the non-root important alarm set of the mode to obtain the first matching degree. The following formula can be used as a reference:

[0131] The second matching degree=num(non-root important alarm set of the pattern∩non-root important root cause alarm set of the fault) / num(non-root important alarm set of the pattern).

[0132] Step S222: determine a target failure mode corresponding to the root cause alarm from the second candidate failure mode or the third candidate failure mode.

[0133] Exemplarily, determining a target failure mode corresponding to the root cause alarm from the second candidate failure mode or the third candidate failure mode includes:

[0134] In the case where there is at least one second candidate fault mode, each second candidate fault mode is used as a target fault mode corresponding to the root cause alarm;

[0135] or,

[0136] In the case that there is no second candidate failure mode, each third candidate failure mode is used as a target failure mode corresponding to the root cause alarm.

[0137] Exemplarily, the values ​​of the first threshold and the second threshold may both be 100%, and the value of the third threshold is a value lower than 100%, such as 80%.

[0138] When the first threshold and the second threshold are both 100%, that is, the matching degree between the root cause alarm and the non-root important alarm of the fault to be diagnosed and the second candidate fault mode is 100%, then the second candidate fault mode can be considered as a complete matching mode. For the third candidate fault mode, if the matching degree between the non-root important alarm of the fault to be diagnosed and the third candidate fault mode is lower than 100%, but still higher than the preset threshold (e.g., 80%), then the third candidate fault mode can be included in the suspected matching mode. In the process of determining the target fault mode, the second candidate fault mode is preferentially used as the target fault mode. If the second candidate fault mode does not exist, the third candidate fault mode is selected as the target fault mode.

[0139] Exemplarily, the method provided in the embodiment of the present application may further include the following step S230:

[0140] Step S230: If the second candidate failure mode or the third candidate failure mode does not exist, add the root cause alarm to the list of remaining root cause alarms.

[0141] In this step, if there is no second candidate fault mode or third candidate fault mode, that is, the root cause alarm cannot be successfully matched with all fault modes, it is considered that the current fault mode is incomplete and does not include the currently diagnosed fault scenario, so this root cause alarm is included in the "legacy root cause alarm list".

[0142] Fig. 9 This is a flow chart of determining a target failure mode provided by an embodiment of the present application. Fig. 9 In the example shown, determining the target failure mode includes the following steps:

[0143] Step S2401, obtaining the root cause alarm of the sub-fault;

[0144] Step S2402: Based on the operation and maintenance knowledge graph, determine a first candidate fault mode list corresponding to the root cause alarm, the first candidate fault mode list includes at least one first candidate fault mode, and sort all the first candidate fault modes in descending order according to the matching probability;

[0145] like Fig. 9 In the example, based on the operation and maintenance knowledge graph, n first candidate fault modes corresponding to the root cause alarm are obtained, and then the n first candidate fault modes are sorted in descending order according to the matching probability. The sorted n first candidate fault modes are recorded as first candidate fault mode #1, first candidate fault mode #1, ..., first candidate fault mode #n, and the first candidate fault mode #1, first candidate fault mode #1, ..., first candidate fault mode #n will be matched in sequence later.

[0146] Step S2403: obtaining a root cause alarm set corresponding to the first candidate fault mode #1, calculating a matching degree between the root cause alarm set corresponding to the first candidate fault mode #1 and the root cause alarm of the sub-fault, and obtaining a first matching degree;

[0147] Step S2404, determining whether the first matching degree is 100%, if so, executing step S2405, otherwise ending the matching operation on the first candidate fault mode #1, jumping to the first candidate fault mode #2, and performing the matching operation on the first candidate fault mode #2;

[0148] Step S2405: Obtain a non-root important alarm set corresponding to the first candidate fault mode #1, calculate a matching degree between the non-root important alarm set corresponding to the first candidate fault mode #1 and the non-root important alarm of the sub-fault, and obtain a second matching degree;

[0149] Step S2406, determining whether the second matching degree is greater than a preset threshold, if so, executing step S2407, otherwise ending the matching operation on the first candidate fault mode #1, jumping to the first candidate fault mode #2, and performing a matching operation on the first candidate fault mode #2;

[0150] Step S2407, determining whether the second matching degree is 100%, if so, adding the first candidate fault mode #1 to the second candidate fault mode list, otherwise, adding the first candidate fault mode #1 to the third candidate fault mode list;

[0151] At this point, the matching operation on the first candidate fault mode #1 is completed, and then the process jumps to the first candidate fault mode #2 and performs a matching operation on the first candidate fault mode #2. The subsequent matching operations on the first candidate fault mode #2, ..., and the first candidate fault mode #n are similar to the above steps S2403-S2407 and will not be repeated here.

[0152] After completing the matching operation of the n first candidate fault modes, outputting a final second candidate fault mode list and a final third candidate fault mode, so as to determine a final target fault mode based on the final second candidate fault mode list and the final third candidate fault mode list, specifically includes the following steps:

[0153] Step S2501, determine whether the second candidate fault mode list is empty, if not empty, use the fault mode in the second candidate fault mode list as the target fault mode, if empty, execute step S2502;

[0154] Step S2502, determining whether the third candidate failure mode list is empty, if not empty, taking the failure mode in the third candidate failure mode list as the target failure mode, if empty, executing step S2503;

[0155] Step S2503: Add the root cause alarm of the sub-fault to the list of remaining root cause alarms.

[0156] In the embodiment of the present application, the target fault mode corresponding to the fault is determined in combination with the root cause alarm and the non-root important alarm of the fault, so as to ensure that the target fault mode has a high degree of match with the fault whose root cause is to be determined, thereby ensuring the accuracy of subsequently determining the root cause of the fault using the target fault mode.

[0157] Step S300: For each root cause alarm, root cause diagnosis is performed according to the target fault mode corresponding to the root cause alarm to obtain the root cause of the fault corresponding to the root cause alarm.

[0158] Exemplarily, the operation and maintenance knowledge graph also includes a fault root cause node corresponding to the fault mode node, and the fault mode node and the fault root cause node having a corresponding relationship are connected through a diagnostic analysis node, wherein the diagnostic analysis node includes at least one of the following: an alarm analysis node, an event query node, and an AI reasoning node. Based on this, in step S300, root cause diagnosis is performed according to the target fault mode corresponding to the root cause alarm to obtain the fault root cause corresponding to the root cause alarm, which may specifically include the following step S310:

[0159] Step S310: performing root cause location operations for each target fault mode in order of matching degree from high to low.

[0160] It should be noted that the matching degree described in step S310 can be determined based on the matching degree of the non-root important alarm of the sub-fault and the non-root important alarm set included in the attribute of the target fault mode, that is, the second matching degree described in the previous step S221. It can be understood that the higher the matching degree, the higher the success rate of obtaining the root cause of the fault based on the corresponding fault mode, so the embodiment of the present application performs the root cause location operation for each target fault mode in order from high to low matching degree.

[0161] Fig.10 This is a schematic diagram of a process flow of the root cause location operation provided by the embodiment of the present application. Fig.10 In the example shown, the root cause location operation in the embodiment of the present application may include the following steps S311, S312 and S313:

[0162] Step S311: Perform alarm analysis on the sub-fault through the alarm analysis node corresponding to the target fault mode in the operation and maintenance knowledge graph to find the fault root cause that matches the alarm propagation relationship of the sub-fault;

[0163] Step S312: If no fault root cause matching the alarm propagation relationship of the sub-fault is found, based on the event query node corresponding to the target fault mode in the operation and maintenance knowledge graph, an event query analysis is performed on the sub-fault to determine the associated event value corresponding to the sub-fault, and the fault root cause corresponding to the sub-fault is determined according to the associated event value;

[0164] Step S313: If the root cause of the fault corresponding to the associated event value cannot be found, AI reasoning is performed on the associated event value based on the AI ​​reasoning node corresponding to the target fault mode in the operation and maintenance knowledge graph to obtain the root cause of the fault corresponding to the sub-fault.

[0165] Exemplarily, the diagnosis and analysis node also includes a silent fault node. Based on this, the root cause location operation may also include the following step S314:

[0166] Step S314: When there is a corresponding silent fault node for the target fault mode, find the fault root cause corresponding to the sub-fault based on the silent fault node.

[0167] Exemplarily, if the fault mode is a "silent fault", the above-mentioned fault location acquisition no longer uses the root cause alarm location, but uses the fault-related alarms and the network topology to query the convergence location of the related alarms as the fault location. The "silent fault" is a fault that does not generate an alarm that directly represents the fault. For example, the processing chip of the equipment board is abnormal. At this time, the equipment does not generate a chip abnormality alarm. For this scenario, although the board itself does not report a chip abnormality alarm, the ports and related services carried by the board will generate alarms. According to the fault mode, the root cause of the fault can be first located as a chip abnormality, and then the related alarms are used to query the common carrier board of these alarms using the network topology, and this board is used as the fault location.

[0168] Exemplarily, the method provided in the embodiment of the present application may further include the following step S320:

[0169] Step S320: When the root cause location operations corresponding to all target fault modes are completed and the root cause of the fault is not obtained, the root cause alarm is added to the list of remaining root cause alarms.

[0170] Exemplarily, the operation and maintenance knowledge graph also includes a solution node corresponding to the root cause of the fault, and a fault location node corresponding to the solution node; after obtaining the root cause of the aggregated fault, the method provided by the present application also includes the following steps:

[0171] Step S330: Based on the operation and maintenance knowledge graph, determine a solution corresponding to the root cause of the aggregate fault, and determine the fault location according to the solution corresponding to the root cause of the aggregate fault.

[0172] Combine the following Figure 8 The operation and maintenance knowledge graph shown is used to exemplify the method embodiment of the present application.

[0173] Taking the root cause alarm of the fault as "loss of signal LOS alarm" as an example, assuming that it has been determined that the target fault modes corresponding to the root cause alarm include fault mode 1, fault mode 2 and fault mode 3, and the matching degree is from high to low, which is fault mode 1, fault mode 2 and fault mode 3, then the process of determining the root cause of the fault according to the target fault mode may include the following steps:

[0174] Step S3101: Based on the alarm analysis node corresponding to fault mode 1 and the alarm of the current fault, determine whether there are LOS alarms at both ends of the optical fiber. If so, it can be determined that the root cause of the fault is "optical fiber breakage" and the corresponding solution is "replace the optical fiber".

[0175] Step S3102: If the condition that the root cause alarm is added to the legacy root cause alarm list is not met, then based on the event query node corresponding to fault mode 2, the optical power performance value of the alarm port is obtained. If the optical power performance value is less than the worst receiving sensitivity of the optical module, it can be determined that the root cause of the fault is "the link loss of the alarm port is too large", and the corresponding solution is "replace the optical fiber".

[0176] Step S3103: If the "optical power performance value of the alarm port" is greater than the worst receiving sensitivity of the module, then the optical power values ​​of the alarm port before and after the alarm are obtained, and then based on the optical power values ​​before and after the alarm, the AI ​​model is used for reasoning. According to the AI ​​reasoning result, it is determined that the root cause of the fault is "loose pigtail", and the corresponding solution is "replace the optical fiber".

[0177] Step S3104: If the root cause of the fault still cannot be obtained based on AI reasoning, then the event query node corresponding to fault mode 3 is used to obtain the status of the peer network element. If the status of the peer network element is the preset status, the root cause of the fault is determined to be "the peer network element is offline", and the corresponding solution is "check the peer network element".

[0178] Step S3105: If the root cause of the fault still cannot be obtained based on fault mode 3, the root cause alarm is added to the list of remaining root cause alarms.

[0179] S400 , performing fusion processing according to the fault root causes corresponding to the root cause alarms to obtain the target fault root cause.

[0180] Specifically, step S400 includes: fusing root causes of faults corresponding to multiple sub-faults to obtain a target root cause of faults.

[0181] The operation and maintenance knowledge graph of the embodiment of the present application also includes a solution node corresponding to the root cause of the fault, and a fault location node corresponding to the solution node; based on this, after obtaining the target root cause of the fault, it can also include the following steps: based on the operation and maintenance knowledge graph, determine the solution corresponding to the target root cause of the fault, and determine the fault location according to the solution corresponding to the target root cause of the fault.

[0182] After determining the root cause of the fault corresponding to the root cause alarm, the embodiment of the present application also performs fusion processing according to the root causes of the faults corresponding to the root cause alarms to obtain the final target root cause of the fault, so that the operation and maintenance personnel can troubleshoot the target root cause of the fault and improve the operation and maintenance efficiency.

[0183] The embodiment of the present application proposes a fault diagnosis method based on a knowledge graph to make full use of fault modes and operation and maintenance experience, build an operation and maintenance knowledge graph for intelligent faults, solve the problem of fault demarcation and positioning, and improve fault diagnosis efficiency.

[0184] The embodiment of the present application provides an operation and maintenance knowledge graph architecture based on fault modes, which is applied to intelligent fault systems. Based on fault modes, it integrates knowledge related to fault diagnosis, constructs an operation and maintenance knowledge graph, and realizes the automation of intelligent fault root cause location.

[0185] The embodiment of the present application constructs an operation and maintenance knowledge graph ontology based on intelligent fault scenarios. The ontology is graph-related entities, edges, and attributes of entities and edges. The graph ontology is suitable for fault diagnosis of intelligent faults. The entity types include alarms, fault modes, alarm analysis, event queries, AI reasoning, root causes of faults, solutions, similar cases, etc. The fault modes include root cause alarm types and important alarm types, which are used to characterize a certain type of fault.

[0186] Secondly, the embodiment of the present application obtains relevant knowledge of the operation and maintenance knowledge graph. The knowledge comes from historical fault data and artificial experience data such as case libraries, among which the fault mode is obtained by mining the historical fault data through algorithms such as clustering, and the fault mode includes the root cause alarms and important alarms of typical faults. The case library and other data are used to match the fault mode, supplemented by manual annotation, to improve the entities and side information of the knowledge graph, including alarm relationships, event queries, AI reasoning, root causes of faults, solutions, similar cases, etc.

[0187] In addition, the node relationship of the operation and maintenance knowledge graph in the embodiment of the present application, in addition to the specific edge type, also includes probability information, which is mainly based on the statistical probability of the corresponding node having occurred based on historical failures. During specific diagnosis, nodes with high probabilities are preferred to improve diagnostic efficiency.

[0188] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0189] It is further understood that, although the operations are described in a specific order in the drawings in the embodiments of the present disclosure, it should not be understood as requiring the operations to be performed in the specific order shown or in a serial order, or requiring the execution of all the operations shown to obtain the desired results. In certain environments, multitasking and parallel processing may be advantageous.

[0190] The present application also provides an electronic device, such as Fig.11 As shown, the electronic device 1400 includes:

[0191] one or more processors 1410;

[0192] The memory 1420 stores one or more programs. When the one or more programs are executed by the one or more processors 1410, the one or more processors 1410 implement the fault diagnosis method described in any one of the above embodiments.

[0193] The memory 1420, as a non-transient network system, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory 1420 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 1420 may optionally include a memory 1420 remotely arranged relative to the processor 1410, and these remote memories 1420 may be connected to the processor 1410 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0194] The memory 1420 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1420 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1420, and the processor 1410 calls and executes the methods of the embodiments of this application.

[0195] The processor 1410 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0196] In some embodiments, the electronic device further comprises:

[0197] Input / output interface, used to realize information input and output;

[0198] Communication interface, used to realize communication interaction between this device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0199] A bus that transmits information between various components of the device (e.g., processor 1410, memory 1420, input / output interface, and communication interface);

[0200] The processor 1410 , the memory 1420 , the input / output interface and the communication interface can be connected to each other in communication within the device via a bus.

[0201] An embodiment of the present application further provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the fault diagnosis method described in any of the above embodiments.

[0202] An embodiment of the present application also provides a computer program product, including a computer program or computer instructions, which are stored in a computer-readable storage medium. A processor of a computer device reads the computer program or computer instructions from the computer-readable storage medium, and the processor executes the computer program or computer instructions, so that the computer device executes the fault diagnosis method described in any of the above embodiments.

[0203] The system architecture and application scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of the system architecture and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are equally applicable to similar technical problems.

[0204] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0205] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0206] The above describes some embodiments of the present application with reference to the accompanying drawings, but does not limit the scope of the present invention. Any modification, equivalent substitution and improvement made by those skilled in the art without departing from the scope and essence of the present invention shall be within the scope of the present application.

Claims

1. A fault diagnosis method, the method comprising: Build an operation and maintenance knowledge graph based on failure modes; Obtain at least one root cause alarm corresponding to the fault, and determine the target fault mode corresponding to each of the root cause alarms through the operation and maintenance knowledge graph; For each of the root cause alarms, performing root cause diagnosis according to the target fault mode corresponding to the root cause alarm to obtain the root cause of the fault corresponding to the root cause alarm; The root causes of the faults corresponding to the root cause alarms are fused to obtain the target root cause of the faults.

2. The method according to claim 1, characterized in that The construction of the operation and maintenance knowledge graph based on the failure mode includes: Obtaining first historical alarm data of multiple historical faults; Clustering and extracting the first historical alarm data of the plurality of historical faults to obtain a plurality of fault modes and second historical alarm data corresponding to each of the fault modes; For each of the fault modes, determining the root cause alarm and non-root important alarm corresponding to the fault mode according to the second historical alarm data corresponding to the fault mode, and determining the root cause of the fault corresponding to the fault mode; Each fault mode is taken as a fault mode node, each root cause alarm is taken as a root cause alarm node, and an edge connecting the fault mode nodes and the root cause alarm nodes having a corresponding relationship is established to obtain the operation and maintenance knowledge graph; The weight corresponding to each edge is determined according to the matching probability between the fault mode and the root cause alarm.

3. The method according to claim 2, characterized in that The construction of the operation and maintenance knowledge graph based on the failure mode also includes: According to the root cause of the failure corresponding to the failure mode, construct a root cause node corresponding to the failure mode node in the operation and maintenance knowledge graph; A diagnosis and analysis node is constructed between the fault mode node and the fault root cause node having a corresponding relationship, wherein the diagnosis and analysis node includes at least one of the following: a silent fault node, an alarm analysis node, an event query node, and an artificial intelligence AI reasoning node.

4. The method according to claim 3, characterized in that: The construction of the operation and maintenance knowledge graph based on the failure mode also includes: A solution node and a fault location node corresponding to the fault root cause node are constructed in the operation and maintenance knowledge graph.

5. The method according to claim 2, characterized in that: The construction of the operation and maintenance knowledge graph based on the failure mode also includes: For each of the fault mode nodes, at least one of the following nodes corresponding to the fault mode node is constructed in the operation and maintenance knowledge graph: a fault phenomenon description node, a fault category description node, or a case description node.

6. The method according to claim 2, characterized in that The construction of the operation and maintenance knowledge graph based on the failure mode also includes: Determine the attributes of each of the fault mode nodes, wherein the attributes of the fault mode nodes include at least one of the following: a fault mode identifier, a fault mode name, a silent fault mode identifier, an urgency attribute, a processing priority attribute, a root cause alarm set, a non-root important alarm set, a network classification attribute, or an identifier of whether the fault can be repaired using a network manager.

7. The method according to claim 1, characterized in that The obtaining of at least one root cause alarm of a fault includes: Obtaining alarm data of the fault; Screening the alarm data of the fault to obtain at least one important alarm of a sub-fault, wherein an alarm propagation relationship exists between the important alarms of the sub-faults; The important alarm of each sub-fault is divided into a root cause alarm and a non-root important alarm.

8. The method according to claim 7, characterized in that The operation and maintenance knowledge graph includes a plurality of root cause alarm nodes and a plurality of fault mode nodes, an edge is provided between the root cause alarm nodes and the fault mode nodes having a corresponding relationship, and the weight of the edge represents the matching probability between the root cause alarm nodes and the fault mode nodes having a corresponding relationship; Determining the target failure mode corresponding to each of the root cause alarms through the operation and maintenance knowledge graph includes: Based on the operation and maintenance knowledge graph, determining at least one first candidate failure mode corresponding to the root cause alarm and a matching probability corresponding to each first candidate failure mode; According to the order of matching probability from high to low, matching operations are performed on each first candidate fault mode in turn, the matching operation comprising: determining a first matching degree between the root cause alarm and the first candidate fault mode; when the first matching degree satisfies a first threshold, determining a second matching degree between the non-root important alarm and the first candidate fault mode; when the second matching degree satisfies a second threshold, taking the first candidate fault mode as the second candidate fault mode, or when the second matching degree satisfies a third threshold but does not satisfy the second threshold, taking the first candidate fault mode as the third candidate fault mode, wherein the first threshold is greater than the third threshold, and the second threshold is greater than the third threshold; A target failure mode corresponding to the root cause alarm is determined from the second candidate failure mode or the third candidate failure mode.

9. The method according to claim 8, characterized in that The determining a target failure mode corresponding to the root cause alarm from the second candidate failure mode or the third candidate failure mode includes: In the case where there is at least one of the second candidate failure modes, taking each of the second candidate failure modes as a target failure mode corresponding to the root cause alarm; or, In the case that the second candidate failure mode does not exist, each of the third candidate failure modes is used as a target failure mode corresponding to the root cause alarm.

10. The method according to claim 8, characterized in that The attributes of each of the fault mode nodes include a root cause alarm set, and the first matching degree is determined by the following steps: Obtaining a root cause alarm set corresponding to the first candidate failure mode; The root cause alarm corresponding to the sub-fault is intersected with the root cause alarm set corresponding to the first candidate fault mode to obtain the first matching degree.

11. The method according to claim 8, characterized in that The attributes of each of the fault mode nodes include an important alarm set, and the second matching degree is determined by the following steps: Obtaining an important alarm set corresponding to the first candidate failure mode; The non-root important alarm corresponding to the sub-fault is intersected with the important alarm set corresponding to the first candidate fault mode to obtain the second matching degree.

12. The method according to claim 8, characterized in that The method further comprises: In the absence of the second candidate failure mode or the third candidate failure mode, the root cause alarm is added to a list of legacy root cause alarms.

13. The method according to claim 8, characterized in that The operation and maintenance knowledge graph also includes a fault root cause node corresponding to the fault mode node, and the fault mode node and the fault root cause node having a corresponding relationship are connected through a diagnosis analysis node, wherein the diagnosis analysis node includes at least one of the following: an alarm analysis node, an event query node, and an AI reasoning node; The performing root cause diagnosis according to the target fault mode to obtain the root cause of the fault includes: In order of the matching degree from high to low, root cause location operations are performed on each of the target fault modes in turn; The root cause location operation includes: Finding the root cause of the fault that matches the alarm propagation relationship of the sub-fault through the alarm analysis node corresponding to the target fault mode in the operation and maintenance knowledge graph; In the case that the root cause of the fault that matches the alarm propagation relationship of the sub-fault cannot be found, based on the event query node corresponding to the target fault mode in the operation and maintenance knowledge graph, the associated event value corresponding to the sub-fault is determined, and the root cause of the fault corresponding to the sub-fault is determined according to the associated event value; When the root cause of the fault corresponding to the associated event value cannot be found, AI reasoning is performed on the associated event value based on the AI ​​reasoning node corresponding to the target fault mode in the operation and maintenance knowledge graph to obtain the root cause of the fault corresponding to the sub-fault.

14. The method according to claim 13, characterized in that The diagnostic analysis node also includes a silent fault node; the root cause location operation also includes: In the case that there is a corresponding silent fault node for the target fault mode, the root cause of the fault corresponding to the sub-fault is searched based on the silent fault node.

15. The method according to claim 13 or 14, characterized in that The method further comprises: When the root cause locating operations corresponding to all target fault modes are completed and the root cause of the fault is not obtained, the root cause alarm is added to a list of remaining root cause alarms.

16. The method according to claim 13 or 14, characterized in that The step of fusing the root causes of the faults corresponding to the root cause alarms to obtain the target root cause of the faults includes: The root causes of the faults corresponding to the multiple sub-faults are fused to obtain the target root cause of the fault.

17. The method according to claim 16, characterized in that The operation and maintenance knowledge graph also includes a solution node corresponding to the root cause of the fault, and a fault location node corresponding to the solution node; After obtaining the target fault root cause, the method further includes: Based on the operation and maintenance knowledge graph, a solution corresponding to the target fault root cause is determined, and the fault location is determined according to the solution corresponding to the target fault root cause.

18. The method according to claim 7, characterized in that The screening of the alarm data of the fault to obtain an important alarm of at least one sub-fault includes: Performing aggregate fault processing on the received alarms according to the temporal and spatial relationship to obtain alarm data of at least one fault; Splitting the alarm data of the fault according to the business dimension to obtain an alarm of at least one sub-fault, wherein an alarm propagation relationship exists between the alarms of the sub-faults; For each sub-fault alarm, the sub-fault alarm is filtered to obtain an important alarm of the sub-fault.

19. An electronic device comprising: one or more processors; A memory having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the fault diagnosis method as described in any one of claims 1-18.

20. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the fault diagnosis method according to any one of claims 1 to 18.

Images