Root alarm analysis method and device based on time sequence

Abstract

The invention discloses a root alarm analysis method and device based on a time sequence, and the method comprises the steps: segmenting historical alarms in a time dimension, so as to carry out the grouping of the historical alarms, and obtaining a historical event set feature library; taking the historical alarms in the feature library as root nodes, identifying a root derivative relationship between the historical alarms, and establishing an initialized derivative relationship graph; and based on an alarm list to which historical events in the historical event set feature library belong, deleting derivative relationships among alarms without inevitable derivative relationships in the derivative relationship graph, and outputting an alarm derivative relationship graph. The root alarm of the network equipment can be quickly found, the maintenance efficiency is improved, and the operation cost is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of network equipment alarm analysis, and in particular to a root alarm analysis method and device based on time series. Background Art

[0002] With the rapid development of Internet applications, operators' demands for network equipment alarms and rapid fault location based on alarms are also increasing.

[0003] In the prior art, the time dimension of alarm generation is not considered. For example, when a link alarm is generated, the service alarm on the link will also be generated at the same time. The main means is to use an artificial rule base or deep learning method to generate an alarm derivative tree for alarm analysis. The disadvantage is that it takes a long time to discover the root alarm, which is not conducive to maintenance and has high costs.

[0004] Therefore, how to quickly discover the root cause of alarms in network devices is a technical problem that urgently needs to be solved. Summary of the invention

[0005] The main purpose of the present invention is to provide a root alarm analysis method and device based on time series, which can quickly find the root alarm of network equipment, improve maintenance efficiency and reduce operating costs.

[0006] In a first aspect, the present application provides a root alarm analysis method based on time series, wherein the method comprises the steps of:

[0007] Segment the historical alarms in the time dimension to group the historical alarms and obtain a historical event set feature library;

[0008] Taking the historical alarms in the feature library as root nodes, identifying the root-derivative relationships between the historical alarms, and establishing an initialized derivative relationship graph;

[0009] Based on the alarm list to which the historical events belong in the historical event set feature library, the derivative relationships between the alarms that do not have necessary derivative relationships in the derivative relationship graph are deleted, and the alarm derivative relationship graph is output.

[0010] In combination with the first aspect above, as an optional implementation method, based on the alarm derivation relationship diagram, the current alarms are differentially classified, and the alarm derivation relationship diagram is used to perform root-derivative relationship analysis, and the alarm derivation relationship diagram is updated according to the analysis results.

[0011] In combination with the first aspect above, as an optional implementation method, the current alarms generated by the communication object are sorted according to the alarm occurrence time;

[0012] Perform differential calculation on the sorted current alarms, and classify the current alarms according to the comparison result between the differential calculation difference and the configured threshold value to form an event set;

[0013] For the alarms in the event set, nodes are selected in the alarm derivation relationship graph to form an alarm derivation relationship subgraph;

[0014] Traversing the alarms in the event set and the alarm derivation relationship subgraphs to determine whether the current alarm is a root alarm;

[0015] If it is not a root alarm, the current alarm is added to the non-root alarm set, and the root alarm set is obtained by calculating the difference between the set formed by all alarms in the derivative relationship subgraph and the non-root alarm set;

[0016] The process of determining the derivation relationship between the alarms in the alarm set and deleting the alarms that do not have a necessary derivation relationship is performed to update the alarm derivation relationship diagram.

[0017] In combination with the first aspect above, as an optional implementation manner, a difference operation is performed on the start times of two alarms that are adjacent in order in the same alarm set to perform differential calculation.

[0018] In combination with the first aspect, as an optional implementation method, based on the alarm list to which the historical events in the historical event set feature library belong, any event set is taken from the alarm list, and all its alarm derivative relationship items are traversed;

[0019] Determining in the alarm derivation relationship graph whether the alarms in the alarm derivation relationship items are in the same alarm event set;

[0020] If it is determined that any of the alarms is not in the same event feature library, it is determined that there is no necessary derivative relationship between the alarms, and the relationship is added to the relationship item that needs to be deleted for deletion, until all event sets and relationship items are completely traversed, and the alarm derivative relationship graph is output.

[0021] In combination with the first aspect above, as an optional implementation method, if it is determined that there is no necessary derivative relationship between the alarms, the relationship item is marked as 0.

[0022] In combination with the first aspect above, as an optional implementation method, historical alarms are classified according to device objects, and the classified historical alarms are sorted according to alarm start time to obtain an ordered historical event alarm list;

[0023] Perform differential calculation on the historical alarms in the historical alarm list, divide the alarms whose difference values ​​of adjacent alarm occurrence times are greater than the set value into groups, and obtain a historical event set feature library, wherein the historical event set feature library is a collection of event sets, and the event set is a collection of alarms of occurred events.

[0024] In combination with the first aspect above, as an optional implementation method, all alarms in the feature library of the historical event set are traversed to obtain an alarm set;

[0025] Traversing the alarm set, taking each alarm as a vertex and other alarms as another vertex, to generate an alarm key;

[0026] Configure the same value for all alarm keys to indicate that there is a root-derived relationship between all vertices;

[0027] An initialized derivative relationship graph is established through the root-derivative relationship, wherein the derivative relationship graph is a directed graph in which a root-derivative relationship exists between alarms.

[0028] In combination with the first aspect above, as an optional implementation manner, identifying an alarm code in the alarm set;

[0029] The alarm keys with the same alarm code are deleted to optimize computing resources.

[0030] In a second aspect, the present application provides a root alarm analysis device based on time series, wherein the device comprises:

[0031] A processing module, which is used to segment the historical alarms in the time dimension to group the historical alarms and obtain a historical event set feature library;

[0032] An establishment module is used to identify the root-derived relationship between the historical alarms and establish an initialized derived relationship graph by taking the historical alarms in the feature library as root nodes;

[0033] The execution module is used to delete the derivative relationship between the alarms that do not have a necessary derivative relationship in the derivative relationship graph based on the alarm list to which the historical events belong in the historical event set feature library, and output the alarm derivative relationship graph.

[0034] The present application provides a root alarm analysis method and device based on time series, wherein the method includes the steps of: segmenting historical alarms in the time dimension to group the historical alarms to obtain a historical event set feature library; using the historical alarms in the feature library as root nodes, identifying the root-derivative relationships between historical alarms, and establishing an initialized derivative relationship graph; based on the alarm list to which the historical events belong in the historical event set feature library, deleting the derivative relationships between alarms that do not have a necessary derivative relationship in the derivative relationship graph, and outputting the alarm derivative relationship graph. The present application can quickly find the root alarms of network equipment, improve maintenance efficiency, and reduce operating costs.

[0035] It is to be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0037] Figure 1 A flow chart of a root alarm analysis method based on time series provided in an embodiment of the present application;

[0038] Figure 2 A schematic diagram of a root alarm analysis device based on time series provided in an embodiment of the present application;

[0039] Figure 3 A flow chart of establishing an event set provided in an embodiment of the present application;

[0040] Figure 4 This is a flow chart of the derivative relationship judgment provided in the embodiments of the present application. DETAILED DESCRIPTION

[0041] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0042] Furthermore, the drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. Some of the blocks shown in the drawings are functional entities and do not necessarily correspond to physically or logically separate entities.

[0043] The embodiments of the present application are further described in detail below in conjunction with the accompanying drawings.

[0044] Reference Figure 1 , Figure 1 FIG. 1 is a flow chart of a root alarm analysis method based on time series provided by the present invention, as shown in FIG. Figure 1 As shown, the method comprises the steps of:

[0045] Step S101: historical alarms are segmented in the time dimension to group the historical alarms and obtain a historical event set feature library.

[0046] Specifically, historical alarms are classified according to device objects, and the classified historical alarms are sorted according to alarm start time to obtain an ordered historical event alarm list;

[0047] Perform differential calculation on the historical alarms in the historical alarm list, and divide the alarms whose differential values ​​of adjacent alarm occurrence times are greater than the set value into groups (for example, there are four alarms ABCD, and the alarm start times are S1, S2, S3 and S4 respectively. Perform differential calculation between A and B. If they are less than the set value, they are divided into the same group of alarms. Then calculate the differential value of B and C. If they are less than, they are divided into the same group of alarms of A and B. If they are greater than the set value, a new group is created) to obtain a historical event set feature library, wherein the historical event set feature library is a collection of event sets, and the event set is a collection of alarms of events that occurred.

[0048] For ease of understanding, an example is given. Alarms are classified according to device objects, and the classified alarms are sorted according to the alarm start time to obtain an ordered alarm list. The alarms in the alarm list are differentially calculated. When the occurrence time differential value is greater than a configurable value, the alarms are divided into groups to obtain an event set S (it needs to be explained that multiple event sets are obtained). It can be understood that device objects such as OTN devices and PTN devices. Each device will have multiple alarms. Here, multiple alarms occurring in the device are grouped according to the time dimension (wherein the grouping method is that the time difference between two adjacent alarms in the same device is less than the set duration, such as 60s). It should also be noted that the ordered alarm list obtained here is also used in step S103 to delete the derivative relationship between alarms that do not have a necessary derivative relationship in the derivative relationship graph, that is, the alarm list to which the historical event belongs deletes the derivative relationship between alarms that do not have a necessary derivative relationship in the derivative relationship graph.

[0049] Step S102: Taking the historical alarms in the feature library as root nodes, identifying the root-derived relationships between the historical alarms, and establishing an initialized derived relationship graph.

[0050] Specifically, all alarms in the feature library of all historical event sets are traversed to obtain an alarm set; the alarm set is traversed, each alarm is taken as a vertex, and other alarms are taken as another vertex to generate an alarm key; all alarm keys are configured with the same value to indicate that there is a root-derivative relationship between all vertices; an initialized derivative relationship graph is established through the root-derivative relationship, wherein the derivative relationship graph is a directed graph in which there is a root-derivative relationship between alarms.

[0051] For ease of understanding, an example is given. All alarms in the event set are traversed to obtain a set of alarms. The set of alarms is traversed, with all alarms in the event set as vertices and other alarms as another vertex. For example, A, B, and C alarms form keys (A, B), (B, A), (A, C), (C, A), (B, C), and (C, B). The values ​​of all keys are configured to be 1, indicating that there is a root-derivative relationship between all vertices. It can be understood that all alarms in an event set are assumed to have a derivative relationship by default, that is, 1 is configured between alarms to obtain an initialized alarm derivative relationship graph. Subsequently, the derivative relationships between alarms that do not have a necessary derivative relationship in the derivative relationship graph are deleted to output the alarm derivative relationship graph.

[0052] Among them, the alarm codes in the alarm set are identified; the alarm keys with the same alarm code are deleted to optimize computing resources. It can be understood that deleting the keys of the combination of alarms with the same alarm code, that is, deleting the same alarm code in two groups, avoids repeated calculation of data with similar root-derived relationships between groups, and reduces the amount of calculation.

[0053] It should also be explained that the event set is a collection of alarms that only have events. The historical event library is a collection of event sets. The alarm derivation relationship graph is a directed graph with root-derivation relationships between alarms. The occurrence of alarm A must be accompanied by the occurrence of alarm B. Then there is a directed edge between A and B in the directed graph of root-derivation relationships. The root alarm can be understood as (A, B), for example. A is the root alarm and B is the derived alarm, that is, the occurrence of alarm A derives alarm B.

[0054] Step S103: Based on the alarm list to which the historical events belong in the historical event set feature library, the derivative relationships between the alarms that do not have necessary derivative relationships in the derivative relationship graph are deleted, and the alarm derivative relationship graph is output.

[0055] Specifically, based on the alarm list to which historical events belong in the historical event set feature library, any event set is taken out from the alarm list, and all its alarm derivative relationship items are traversed; in the alarm derivative relationship graph, it is determined whether the alarms in the alarm derivative relationship items are in the same alarm event set; if it is determined that any alarm between the alarms is not in the same event feature library, it is determined that there is no necessary derivative relationship between the alarms, and the relationship is added to the relationship item that needs to be deleted for deletion, until all event sets and relationship items are completely traversed, and the alarm derivative relationship graph is output.

[0056] For ease of understanding, an example is given. All historical event feature libraries are traversed, and for the two alarms in the alarm derivation relationship diagram, it is determined whether there is a direct derivation relationship between them. If alarm A is in the event set and alarm B is not in the event set, the mark (A, B) = 0, and delete items are added and deleted. The derivation relationship judgment action and the action of deleting the key marked as 0 are repeated until the end to obtain the alarm derivation relationship diagram.

[0057] In one embodiment, all historical event feature libraries are traversed, one event library of the historical event feature library is taken out, all derivative relationship items are traversed, and it is determined whether there is a derivative relationship between the alarm derivative relationship items in the actual event set; for two alarms in the alarm derivative relationship graph, it is determined whether there is a direct derivative relationship between them, and the alarm derivative relationship graph items are traversed.

[0058] An example of a direct derivative relationship is given to facilitate understanding:

[0059] If we split the four event sets according to the difference, they are (A, B, C)(B, C)(C), (A, B, D). 1):

[0061] [A,B]=1,[A,C]=1,[A,D]=1,[B,A]=1,[B,C]=1,[B,C]=1,[C,A]=1,[C,B]=1,[C,D]=1,[D,A]=1,[D,B]=1,[D,C]=1. 2):

[0063] The variable event set D is not in (A, B, C), so [A, D] = 0, [B, D] = 0, [C, D] = 0. Repeat 2) until all event sets are processed, and we get:

[0064] [A,D]=0,[B,D]=0,[C,D]=0,[B,A]=0,[C,B]=0,[C,A]=0[D,A]=1,[D,B]=1,[A,B]=1.

[0065] 3): (A, B, C)(B, C)(C), (A, B, D) If we find the intersection of each of them, C will exist in the intersection of other sets, but D does not exist. So D and one of A and B are indirectly derived. Since [A, B] = 1, we can determine that [D, A] = 1, [A, B] = 1, and C exists alone without being derived.

[0066] If the current alarm derivative relationship item, alarm A is in the event set, and alarm B is not in the event set, add the relationship item to the relationship item that needs to be deleted. If alarm A is in the event set, and alarm B is not in the event set, (A, B) = 0; traverse the alarm derivative relationship graph; in the derivative relationship item that needs to be deleted, (A, B) = 0.

[0067] Repeat the following actions: if the current alarm derives a relationship item, alarm A is in the event set, and alarm B is not in the event set, add the relationship item to the relationship item that needs to be deleted, and if alarm A is in the event set and alarm B is not in the event set, mark (A, B) = 0, until all event sets and relationship items are completely traversed, then the calculation of the alarm derivative relationship graph is completed, and this alarm derivative relationship graph is output.

[0068] It can be understood that the alarm derivation relationship graph initialized in step S102 is optimized, that is, it is determined whether there is a derivation relationship between the alarms in the event set. If not, they are deleted and only the alarms with derivation relationships are retained.

[0069] In one embodiment, after outputting the alarm derivation relationship graph, it includes: based on the alarm derivation relationship graph, differentially classifying the currently occurring alarms, and using the alarm derivation relationship graph to perform root-derivation relationship analysis, and updating the alarm derivation relationship graph according to the analysis results.

[0070] Specifically, the current alarms occurring in the communication object are sorted according to the alarm occurrence time; the sorted alarm list is differentially calculated (wherein, the differential calculation is two sorted alarms, T1 (the start time of the first alarm) minus T2 (the start time of the second alarm)) to classify the difference calculated to be less than the configured threshold value to form an event set; for the alarms in the event set, nodes are selected in the alarm derivative relationship graph to form an alarm derivative relationship subgraph; the alarms in the event set and the alarm derivative relationship subgraph are traversed to determine whether the current alarm is a root alarm; if it is not a root alarm, the current alarm is added to the non-root alarm set, and the set formed by all alarms in the derivative relationship subgraph is used to calculate the difference set with the non-root alarm set to obtain the root alarm set; the derivative relationship judgment process between the alarms in the root alarm set is performed and the alarms that do not have a necessary derivative relationship are deleted to update the alarm derivative relationship graph.

[0071] For the convenience of understanding the specific description, the current alarms occurring in the communication object are sorted according to the alarm occurrence time, the sorted current alarms are differentially calculated, and the current alarms are classified according to the comparison result of the differential calculation difference with the configured threshold value to form an event set.

[0072] For the alarms in the event set, select nodes in the alarm derivative relationship graph to form an alarm derivative relationship subgraph (that is, select an alarm in the event set. If the alarm exists in the alarm derivative relationship graph, add it to the alarm derivative relationship subgraph, and the relationship is also added to form a relationship subgraph). Traverse the alarms in the event set and the alarm derivative relationship subgraph. If for alarm M, B == M exists, then M is not a root alarm, and M is added to the non-root alarm set. Calculate the difference between the set formed by all alarms in the derivative relationship subgraph and the non-root alarm set (that is, the set of all alarms in the derivative relationship subgraph is Set1, and the non-root alarms form Set2, and the difference is equal to Set1-Set2), and get the root alarm set. Using the event set of the current alarm, execute the derivative relationship judgment action and the action of deleting the key marked as 0 to update the alarm derivative relationship graph.

[0073] In summary, this application extracts an event set through the historical alarm time series of the communication object, derives the alarm derivative relationship diagram according to the relationship logic of the alarms in the event set, and outputs the alarm derivative relationship diagram as the theoretical basis for the derivation of the current alarm root-derivative relationship. The current alarm time series data is sorted, differentially classified, and an event set is formed. Then, based on the derived root-derivative relationship diagram, the alarm root-derivative relationship in the current alarm is identified. Finally, the event set formed by the current alarm is used to update the alarm root-derivative relationship diagram. Rapid analysis and identification of alarm root-derivative relationships can help to quickly troubleshoot and locate equipment and network problems, and can effectively improve network maintenance efficiency and reduce operating costs.

[0074] Reference Figure 2 , Figure 2 FIG. 1 is a schematic diagram of a root alarm analysis device based on time series provided by the present invention, such as Figure 2 As shown, the device comprises:

[0075] Processing module 201 is used to segment the historical alarms in the time dimension to group the historical alarms and obtain a historical event set feature library.

[0076] Establishment module 202: It is used to use the historical alarms in the feature library as root nodes, identify the root-derived relationships between the historical alarms, and establish an initialized derived relationship graph.

[0077] Execution module 203 is used to delete the derivative relationship between alarms that do not have a necessary derivative relationship in the derivative relationship graph based on the alarm list to which the historical events belong in the historical event set feature library, and output the alarm derivative relationship graph.

[0078] Furthermore, in a possible implementation, the execution module is also used to differentially classify the currently occurring alarms based on the alarm derivation relationship diagram, and use the alarm derivation relationship diagram to perform root-derivative relationship analysis, and update the alarm derivation relationship diagram according to the analysis results.

[0079] Furthermore, in a possible implementation manner, the execution module is further configured to sort the current alarms generated by the communication object according to the alarm generation time;

[0080] Perform differential calculation on the sorted current alarms, and classify the current alarms according to the comparison result between the differential calculation difference and the configured threshold value to form an event set;

[0081] For the alarms in the event set, nodes are selected in the alarm derivation relationship graph to form an alarm derivation relationship subgraph;

[0082] Traversing the alarms in the event set and the alarm derivation relationship subgraphs to determine whether the current alarm is a root alarm;

[0083] If it is not a root alarm, the current alarm is added to the non-root alarm set, and the root alarm set is obtained by calculating the difference between the set formed by all alarms in the derivative relationship subgraph and the non-root alarm set;

[0084] The process of determining the derivation relationship between the alarms in the alarm set and deleting the alarms that do not have a necessary derivation relationship is performed to update the alarm derivation relationship diagram.

[0085] Furthermore, in a possible implementation manner, the processing module is further configured to perform a difference operation on the start times of two alarms that are adjacent in order in the same alarm set, so as to perform a difference calculation.

[0086] Furthermore, in a possible implementation manner, the processing module is further configured to take out any event set from the alarm list based on the alarm list to which the historical events in the historical event set feature library belong, and traverse all its alarm derivative relationship items;

[0087] Determining in the alarm derivation relationship graph whether the alarms in the alarm derivation relationship items are in the same alarm event set;

[0088] If it is determined that any of the alarms is not in the same event feature library, it is determined that there is no necessary derivative relationship between the alarms, and the relationship is added to the relationship item that needs to be deleted for deletion, until all event sets and relationship items are completely traversed, and the alarm derivative relationship graph is output.

[0089] Furthermore, in a possible implementation manner, the processing module is further configured to mark the relationship item as 0 if it is determined that there is no necessary derivative relationship between the alarms.

[0090] Furthermore, in a possible implementation manner, the processing module is further used to classify the historical alarms according to the device objects, and sort the classified historical alarms according to the alarm start time to obtain an ordered historical event alarm list;

[0091] Perform differential calculation on the historical alarms in the historical alarm list, divide the alarms whose difference values ​​of adjacent alarm occurrence times are greater than the set value into groups, and obtain a historical event set feature library, wherein the historical event set feature library is a collection of event sets, and the event set is a collection of alarms of occurred events.

[0092] Furthermore, in a possible implementation, a module is established, which is also used to traverse all alarms in the feature library of the historical event set to obtain an alarm set;

[0093] Traversing the alarm set, taking each alarm as a vertex and other alarms as another vertex, to generate an alarm key;

[0094] Configure the same value for all alarm keys to indicate that there is a root-derived relationship between all vertices;

[0095] An initialized derivative relationship graph is established through the root-derivative relationship, wherein the derivative relationship graph is a directed graph in which a root-derivative relationship exists between alarms.

[0096] Further, in a possible implementation manner, the processing module is further configured to identify an alarm code in the alarm set;

[0097] The alarm keys with the same alarm code are deleted to optimize computing resources.

[0098] Reference Figure 3 , Figure 3 The flowchart of establishing an event set provided by the present invention is shown as follows: Figure 3 As shown:

[0099] S301. Divide alarms into groups according to alarm objects.

[0100] S302: Sort the alarms of each object according to the alarm start time.

[0101] S303: Perform differential calculation on the alarm of each object, that is, for two ordered alarms, T1 (start time of the first alarm) minus T2 (start time of the second alarm).

[0102] S304: If the occurrence time difference value is greater than the configurable value 60S, the alarms are divided into groups to obtain an event set S.

[0103] Reference Figure 4 , Figure 4 The figure shows a flow chart of the derivative relationship judgment provided by the present invention, such as Figure 4 As shown:

[0104] S401, traverse all event sets in the historical event feature library, and record the event set as S.

[0105] S402: Take out any event library of the historical event feature library and traverse all derived relationship items.

[0106] S403, traverse the alarm derivative relationship graph items to determine whether there is a derivative relationship between the alarm derivative relationship items in the actual event set, that is, if the derivative relationship alarm A is in the event set S and the alarm B is not in the event set S, it is determined that there is no derivative relationship.

[0107] S404: Mark the alarm key without derivative relationship as (A, B)=0, and add it to the relationship item to be deleted.

[0108] Repeat the derivative relationship judgment step and the deletion operation until all event sets and relationship items are completely traversed, then the calculation of the alarm derivative relationship graph is completed and the alarm derivative relationship graph is output.

[0109] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.

Claims

1. A root alarm analysis method based on time series, characterized in that: include: Segment the historical alarms in the time dimension to group the historical alarms and obtain a historical event set feature library; Taking the historical alarms in the feature library as root nodes, identifying the root-derivative relationships between the historical alarms, and establishing an initialized derivative relationship graph; Based on the alarm list to which the historical events belong in the historical event set feature library, the derivative relationships between the alarms that do not have necessary derivative relationships in the derivative relationship graph are deleted, and the alarm derivative relationship graph is output.

2. The method according to claim 1, characterized in that After the output alarm derivation relationship diagram, it also includes: Based on the alarm derivation relationship diagram, the currently occurring alarms are differentially classified, and the alarm derivation relationship diagram is used to perform root-derivation relationship analysis, and the alarm derivation relationship diagram is updated according to the analysis results.

3. The method according to claim 2, characterized in that include: Sort the current alarms of the communication objects according to the alarm occurrence time; Perform differential calculation on the sorted current alarms, and classify the current alarms according to the comparison result between the differential calculation difference and the configured threshold value to form an event set; For the alarms in the event set, nodes are selected in the alarm derivation relationship graph to form an alarm derivation relationship subgraph; Traversing the alarms in the event set and the alarm derivation relationship subgraphs to determine whether the current alarm is a root alarm; If it is not a root alarm, the current alarm is added to the non-root alarm set, and the root alarm set is obtained by calculating the difference between the set formed by all alarms in the derivative relationship subgraph and the non-root alarm set; The process of determining the derivation relationship between the alarms in the alarm set and deleting the alarms that do not have a necessary derivation relationship is performed to update the alarm derivation relationship diagram.

4. The method according to claim 3, characterized in that The performing differential calculation on the sorted current alarms includes: A difference operation is performed on the start times of two adjacent alarms in the same alarm set to perform a difference calculation.

5. The method according to claim 1, characterized in that The step of deleting the derivative relationships between the alarms that do not have a necessary derivative relationship in the derivative relationship graph based on the alarm list to which the historical events belong in the historical event set feature library, so as to output the alarm derivative relationship graph, includes: Based on the alarm list to which the historical events belong in the historical event set feature library, any event set is taken from the alarm list, and all its alarm derivative relationship items are traversed; Determining in the alarm derivation relationship graph whether the alarms in the alarm derivation relationship items are in the same alarm event set; If it is determined that any of the alarms is not in the same event feature library, it is determined that there is no necessary derivative relationship between the alarms, and the relationship is added to the relationship item that needs to be deleted for deletion, until all event sets and relationship items are completely traversed, and the alarm derivative relationship graph is output.

6. The method according to claim 5, characterized in that Also includes: If it is determined that there is no necessary derivative relationship between the alarms, the relationship item is marked as 0.

7. The method according to claim 1, characterized in that The historical alarms are segmented in the time dimension to group the historical alarms to obtain a historical event set feature library, including: Classify historical alarms according to device objects, sort the classified historical alarms according to alarm start time, and obtain an ordered historical event alarm list; Perform differential calculation on the historical alarms in the historical alarm list, divide the alarms whose difference values ​​of adjacent alarm occurrence times are greater than the set value into groups, and obtain a historical event set feature library, wherein the historical event set feature library is a collection of event sets, and the event set is a collection of alarms of occurred events.

8. The method according to claim 1, characterized in that The process of taking the historical alarms in the feature library as root nodes, identifying the root-derived relationships between the historical alarms, and establishing an initialized derived relationship graph includes: Traverse all alarms in the feature library of historical event sets to obtain an alarm set; Traversing the alarm set, taking each alarm as a vertex and other alarms as another vertex, to generate an alarm key; Configure the same value for all alarm keys to indicate that there is a root-derived relationship between all vertices; An initialized derivative relationship graph is established through the root-derivative relationship, wherein the derivative relationship graph is a directed graph in which a root-derivative relationship exists between alarms.

9. The method according to claim 8, characterized in that Also includes: Identifying an alarm code in the alarm set; The alarm keys with the same alarm code are deleted to optimize computing resources.

10. A root alarm analysis device based on time series for implementing the root alarm analysis method based on time series according to any one of claims 1 to 9, characterized in that: include: A processing module, which is used to segment the historical alarms in the time dimension to group the historical alarms and obtain a historical event set feature library; An establishment module is used to identify the root-derived relationship between the historical alarms and establish an initialized derived relationship graph by taking the historical alarms in the feature library as root nodes; The execution module is used to delete the derivative relationship between the alarms that do not have a necessary derivative relationship in the derivative relationship graph based on the alarm list to which the historical events belong in the historical event set feature library, and output the alarm derivative relationship graph.

Images