Root cause alarm positioning method for communication network alarm data

Abstract

The invention discloses a root cause alarm positioning method for communication network alarm data, and belongs to the technical field of communication network alarms, the root cause alarm positioning method for the communication network alarm data comprises the following steps: S1, data collection and preprocessing; s2, screening and classifying the processed data, and screening out irrelevant alarm information and important alarm information; s3, constructing a checking model, and training the constructed model; step S4, checking the alarm information screened out in the step S2 by using a trained model; step S5, constructing a retest verification model; through the troubleshooting model constructed in the positioning method, the alarm root cause in the communication network can be quickly analyzed and positioned, and meanwhile, through the retest verification model constructed in the method, the problem that when the alarm root cause is initially positioned, the alarm root cause is accurately positioned can be effectively solved. And misjudgment may occur due to incomplete information, limitation of an analysis method or external interference factors, so that the positioning accuracy is improved.

Description

Technical Field

[0001] The invention belongs to the technical field of communication network alarms, and in particular, relates to a method for locating a root cause alarm of communication network alarm data. Background Art

[0002] In recent years, communication networks have developed rapidly, the scale and complexity of networks have continued to increase, and the demand for network performance has also continued to increase, posing greater challenges to the quality of network operation and maintenance, and limiting the analytical methods that can be applied. In communication networks, abnormal situations are usually identified through alarms. A large-scale network can generate millions of alarms in a day. Due to the interconnected network structure, a single fault may trigger an alarm storm from multiple connected devices. Operation and maintenance personnel will analyze all relevant alarms and network information, and perform fault diagnosis based on rules or expert experience, which takes a lot of time, and only some alarms are interrelated. In fact, there are subsets of alarms in the network that are most important for fault location. These subsets are called root cause alarms. And because the communication network has an actual physical topology, it is necessary to identify root cause alarms from observable historical alarm data sets, fully explore the relationship between entities, and construct a relationship diagram between alarms.

[0003] A method and system for locating the root cause alarm of communication network alarm data was disclosed on 2024-06-07, with the publication number CN118158071A. The method includes: step 1: based on the data set of alarm log data, the influence effect intensity between alarm type variables is calculated; step 2: constructing an alarm influence relationship model for realizing data spatiotemporal coding in the overall architecture of the neural network; step 3: constructing a Hawkes process conditional intensity function model according to the alarm influence relationship model; step 4: according to the Hawkes process conditional intensity function model, using a scoring method based on BIC scoring to identify the causal relationship structure between events; step 5: if the task is root cause alarm location, the highest score influence relationship diagram is obtained according to the causal relationship structure between the identified events, and the root cause alarm location result is output according to the highest score influence relationship diagram. The method of the present invention can achieve efficient location of root cause alarms.

[0004] However, during the operation of the above alarm positioning method, when the root cause of the alarm is initially located, misjudgment may occur due to incomplete information, limitations of the analysis method or external interference factors, and the positioning accuracy may need to be further improved. Summary of the invention

[0005] Problem to be solved

[0006] In view of the problems raised in the prior art, the present invention provides a method for locating the root cause alarm of alarm data in a communication network.

[0007] Technical Solution

[0008] To solve the above problems, the present invention adopts the following technical solutions.

[0009] A method for locating the root cause alarm of communication network alarm data, the steps are as follows:

[0010] Step S1, data collection and preprocessing;

[0011] Step S2: Screen and classify the processed data to filter out irrelevant alarm information and important alarm information;

[0012] Step S3: construct a troubleshooting model and train the constructed model;

[0013] Step S4: Use the trained model to check the alarm information screened out in step S2;

[0014] Step S5, constructing a retest verification model;

[0015] Step S6: Use the constructed retest verification model to retest and verify the alarm information after investigation;

[0016] Step S7: After retesting and verifying, determine the root cause of the alarm, and use the analysis and positioning module to locate the alarm position.

[0017] Preferably, when the step S1 performs data collection and preprocessing, the data collection content includes:

[0018] Collect alarm data: collect and count alarm codes, alarm levels, and alarm occurrence times;

[0019] Collect equipment information data: collect information data statistics on the model, location, and configuration version of the equipment related to the alarm;

[0020] Collect network topology information data: collect information data statistics on the location, connection relationship and subnet of the alarm device in the communication network.

[0021] Furthermore, the step of constructing the screening model in step S3 includes:

[0022] S301, collecting alarm information from multiple communication networks, and performing data cleaning on the collected alarm information;

[0023] S302, converting the warning information after data cleaning into warning text, and performing standardization processing on the warning text;

[0024] S303, extracting key features from the warning text;

[0025] S304, extracting key features of devices and networks;

[0026] S305, combining the extracted alarm text features, device features, and network features into a feature vector for use as an input to the model;

[0027] S306, selecting a neural network model, and inputting the collected alarm information into the neural network model through a back propagation algorithm to train it;

[0028] S307. After multiple groups of training, a screening model is constructed.

[0029] Preferably, the step of constructing a retest verification model in step S5 includes:

[0030] S501, collecting historical alarm data and marking the collected alarm data;

[0031] S502, analyzing the distribution pattern of alarm data;

[0032] S503, extracting the characteristics of the alarm data;

[0033] S504, extracting device-related features and network features;

[0034] S505. Select a logistic regression model, input the extracted alarm data features, device-related features, and network features into the logistic regression model, and obtain a retest verification model after training.

[0035] Furthermore, the formula of the retest validation model is:

[0036] logit(P)=β0+β1x1+β2x2+…+β n x n

[0037] P is the alarm recurrence probability, x is the feature vector element, and β is the corresponding coefficient.

[0038] Furthermore, when cleaning the data in step S301, the cleaning steps are specifically as follows:

[0039] Remove duplicate alarm information: remove data caused by temporary fluctuations in equipment and false alarms in the alarm system during network operation;

[0040] Handling missing values: Fill in the alarm data that lacks key information in network operation.

[0041] Furthermore, the feature vector combined in step S305 includes: alarm type, alarm frequency, device model, device service life and average network traffic value.

[0042] Beneficial Effects

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] (1) The present invention can quickly analyze and locate the root cause of the alarm in the communication network through the troubleshooting model constructed in the positioning method. At the same time, through the retest verification model constructed in the method, it can effectively solve the problem of misjudgment when initially locating the root cause of the alarm due to incomplete information, limitations of the analysis method or external interference factors, thereby improving the positioning accuracy.

[0045] At the same time, through the retest verification module in this method, some complex alarm problems and causes involving the interaction of multiple factors can be effectively and accurately located, further improving the positioning accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments or exemplary embodiments of the present application, the drawings required for use in the embodiments or exemplary descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application and should not be regarded as limiting the scope. For ordinary technicians in this field, other drawings can be obtained according to the drawings without paying creative work.

[0047] Figure 1 is a system flow chart of the present invention;

[0048] Figure 2 This is a flowchart for constructing a troubleshooting model in the present invention;

[0049] Figure 3 The figure is a flow chart for constructing the retest verification model in the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Generally, the components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0051] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for protection, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0052] Example 1

[0053] like Figure 1As shown, a method for locating the root cause alarm of communication network alarm data, the steps are as follows:

[0054] Step S1, data collection and preprocessing: carefully check the detailed information of the alarm, including the alarm code, alarm level (such as urgent, important, minor, etc.), alarm occurrence time, etc.;

[0055] Step S2: Screen and classify the processed data to filter out irrelevant alarm information and important alarm information;

[0056] Step S3: construct a troubleshooting model and train the constructed model;

[0057] Step S4: Use the trained model to check the alarm information screened out in step S2;

[0058] Step S5, constructing a retest verification model;

[0059] Step S6: Use the constructed retest verification model to retest and verify the alarm information after investigation;

[0060] Step S7: After retesting and verifying, determine the root cause of the alarm, and use the analysis and positioning module to locate the alarm position.

[0061] When step S1 performs data collection and preprocessing, the data collection content includes:

[0062] Collect alarm data: collect and count alarm codes, alarm levels, and alarm occurrence times;

[0063] Collect equipment information data: collect information data statistics on the model, location, and configuration version of the equipment related to the alarm;

[0064] Collect network topology information data: collect information data statistics on the location, connection relationship and subnet of the alarm device in the communication network.

[0065] Reference Figure 2 The steps of constructing the troubleshooting model in step S3 include:

[0066] S301, collecting alarm information from multiple communication networks, and performing data cleaning on the collected alarm information;

[0067] S302, converting the warning information after data cleaning into warning text, and performing standardization processing on the warning text;

[0068] S303, extract key features from the alarm text: extract key features of the alarm, such as alarm type (hardware failure, software failure, network congestion, etc.), alarm frequency (the number of times the alarm occurs within a certain period of time), alarm time interval (the time difference between two adjacent alarms), etc.;

[0069] S304, extract key features of devices and networks: extract device-related features, including device model, device age, and device location (such as indoors, outdoors, and different computer room areas);

[0070] S305, combining the extracted alarm text features, device features, and network features into a feature vector for use as an input to the model;

[0071] S306, selecting a neural network model, and inputting the collected alarm information into the neural network model through a back propagation algorithm to train it, and adjusting the connection weights between neurons so that the output of the model is as close as possible to the actual root cause;

[0072] S307. After multiple groups of training, a screening model is constructed.

[0073] Reference Figure 3 The step of constructing the retest verification model in step S5 includes:

[0074] S501, collecting historical alarm data and marking the collected alarm data;

[0075] S502, analyzing the distribution pattern of alarm data;

[0076] S503, extracting the characteristics of the alarm data;

[0077] S504, extracting device-related features and network features;

[0078] S505. Select a logistic regression model, input the extracted alarm data features, device-related features, and network features into the logistic regression model, and obtain a retest verification model after training.

[0079] The formula for the test-retest validation model is:

[0080] logit(P)=β0+β1x1+β2x2+…+β n x n

[0081] P is the alarm recurrence probability, x is the feature vector element, and β is the corresponding coefficient.

[0082] When cleaning the data in step S301, the cleaning steps are specifically as follows:

[0083] Remove duplicate alarm information: remove data caused by temporary fluctuations in equipment and false alarms in the alarm system during network operation;

[0084] Handling missing values: Fill in the alarm data that lacks key information in network operation.

[0085] The feature vector combined in step S305 includes: alarm type, alarm frequency, device model, device age and average network traffic.

[0086] Through the troubleshooting model constructed in the positioning method, the root cause of the alarm in the communication network can be quickly analyzed and located. At the same time, through the retest verification model constructed in the method, the misjudgment that may occur when the root cause of the alarm is initially located due to incomplete information, limitations of the analysis method or external interference factors can be effectively solved, thereby improving the positioning accuracy.

[0087] At the same time, through the retest verification module in this method, some complex alarm problems and causes involving the interaction of multiple factors can be effectively and accurately located, further improving the positioning accuracy.

[0088] The above-mentioned embodiments only express the preferred implementation modes of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present invention. It should be pointed out that, for those skilled in the art, several modifications, improvements and substitutions can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention.

Claims

1. A method for locating the root cause alarm of communication network alarm data, characterized in that: Here are the steps: Step S1, data collection and preprocessing; Step S2: Screen and classify the processed data to filter out irrelevant alarm information and important alarm information; Step S3: construct a troubleshooting model and train the constructed model; Step S4: Use the trained model to check the alarm information screened out in step S2; Step S5, constructing a retest verification model; Step S6: Use the constructed retest verification model to retest and verify the alarm information after investigation; Step S7: After retesting and verifying, determine the root cause of the alarm, and use the analysis and positioning module to locate the alarm position.

2. A method for locating root cause alarms of communication network alarm data according to claim 1, characterized in that: When the step S1 performs data collection and preprocessing, the data collection content includes: Collect alarm data: collect and count alarm codes, alarm levels, and alarm occurrence times; Collect equipment information data: collect information data statistics on the model, location, and configuration version of the equipment related to the alarm; Collect network topology information data: collect information data statistics on the location, connection relationship and subnet of the alarm device in the communication network.

3. A method for locating root cause alarms of communication network alarm data according to claim 2, characterized in that: The step of constructing the troubleshooting model in step S3 includes: S301, collecting alarm information from multiple communication networks, and performing data cleaning on the collected alarm information; S302, converting the warning information after data cleaning into warning text, and performing standardization processing on the warning text; S303, extracting key features from the warning text; S304, extracting key features of devices and networks; S305, combining the extracted alarm text features, device features, and network features into a feature vector for use as an input to the model; S306, selecting a neural network model, and inputting the collected alarm information into the neural network model through a back propagation algorithm to train it; S307. After multiple groups of training, a screening model is constructed.

4. The root cause alarm location method of communication network alarm data according to claim 1, characterized in that: The step of constructing the retest verification model in step S5 includes: S501, collecting historical alarm data and marking the collected alarm data; S502, analyzing the distribution pattern of alarm data; S503, extracting the characteristics of the alarm data; S504, extracting device-related features and network features; S505. Select a logistic regression model, input the extracted alarm data features, device-related features, and network features into the logistic regression model, and obtain a retest verification model after training.

5. A method for locating the root cause alarm of communication network alarm data according to claim 4, characterized in that: The formula of the retest validation model is: log it(P)=β0+β1x1+β2x2+…+β n x n P is the alarm recurrence probability, x is the feature vector element, and β is the corresponding coefficient.

6. A method for locating root cause alarms of communication network alarm data according to claim 3, characterized in that: When cleaning the data in step S301, the cleaning steps are specifically as follows: Remove duplicate alarm information: remove data caused by temporary fluctuations in equipment and false alarms in the alarm system during network operation; Handling missing values: Fill in the alarm data that lacks key information in network operation.

7. A method for locating the root cause alarm of communication network alarm data according to claim 3, characterized in that: The feature vector combined in step S305 includes: alarm type, alarm frequency, device model, device service life and average network traffic value.

Images