Fault root cause positioning method, electronic equipment and device

Abstract

The invention provides a fault root cause positioning method, electronic equipment and a device, and the method comprises the steps: obtaining alarm data and a fault work order of network equipment, the alarm data comprises alarm moments and alarm types of a plurality of alarms for a fault of the network equipment, and the fault work order comprises a fault occurrence moment of the fault; according to the fault occurrence time and the alarm data, generating a time sequence alarm feature of the network equipment; generating alarm type embedding characteristics of the network equipment according to the alarm types of the plurality of alarms; inputting the time sequence alarm features and the alarm type embedding features into a fault root cause positioning model to obtain a fault root cause of the network equipment; wherein the fault root cause positioning model comprises a first encoder, a second encoder, a full connection layer and a classification layer. According to the scheme, the fault root cause positioning efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method for locating a root cause of a fault, an electronic device, and a device. Background Art

[0002] During the operation of network equipment, failures may occur, which will have an adverse impact on the stability and continuity of the mobile network.

[0003] Before and after a network device fails, a large amount of alarm data is usually received. The operator selectively sends a fault work order based on the alarm data, and then the maintenance personnel go to the site to troubleshoot and repair the fault according to the fault work order. Only after the maintenance personnel have troubleshooted and repaired the fault can they determine the root cause of the network device failure and take corresponding measures.

[0004] However, the above-mentioned method of locating the root cause of the fault mainly relies on the personal experience of the maintenance personnel, which is relatively inefficient. Summary of the invention

[0005] The present application provides a fault root cause location method, electronic equipment and device to solve the current problem of low efficiency in fault root cause location.

[0006] In a first aspect, the present application provides a method for locating a root cause of a fault, comprising:

[0007] Acquire alarm data and fault work orders of network devices, the alarm data including respective alarm times and alarm types of multiple alarms for faults of network devices, and the fault work orders including the time when the faults occurred;

[0008] Generate timing alarm features of network equipment based on fault occurrence time and alarm data;

[0009] Generate an embedded feature of an alarm type of a network device according to respective alarm types of a plurality of alarms;

[0010] The time series alarm features and alarm type are embedded into the features and input into the fault root cause location model to obtain the fault root cause of the network device;

[0011] The fault root cause location model includes a first encoder, a second encoder, a fully connected layer and a classification layer.

[0012] In a possible implementation, the time sequence alarm feature and the alarm type are embedded in the feature and input into the fault root cause location model to obtain the fault root cause of the network device, including:

[0013] Inputting the time series alarm feature into a first encoder to obtain a first encoding feature;

[0014] Inputting the alarm type embedded feature into a second encoder to obtain a second encoded feature;

[0015] Input the first encoding feature and the second encoding feature into the fully connected layer to obtain a fused feature;

[0016] The fused features are input into the classification layer to obtain the root cause of the failure of the network device.

[0017] In a possible implementation, the first encoder includes a first self-attention unit, a first convolution unit, a long short-term memory artificial neural network LSTM unit, and a second convolution unit connected in sequence, and the time series alarm feature is input into the first encoder to obtain a first encoding feature, including:

[0018] Performing a distillation operation on the time series warning feature according to the first self-attention unit to obtain a first warning feature;

[0019] Performing a convolution pooling operation on the first alarm feature according to the first convolution unit to obtain a second alarm feature;

[0020] Performing a time series feature extraction operation on the second alarm feature according to the LSTM unit to obtain a third alarm feature;

[0021] A convolution pooling operation is performed on the third alarm feature according to the second convolution unit to obtain a first coding feature.

[0022] In a possible implementation, the second encoder includes a second self-attention unit, a third convolution unit, a third self-attention unit, and a fourth convolution unit connected in sequence, and the alarm type embedding feature is input into the second encoder to obtain a second encoding feature, including:

[0023] Performing a distillation operation on the warning type embedding feature according to the second self-attention unit to obtain a fourth warning feature;

[0024] Performing a convolution pooling operation on the fourth alarm feature according to the third convolution unit to obtain a fifth alarm feature;

[0025] performing a distillation operation on the fifth warning feature according to the third self-attention unit to obtain a sixth warning feature;

[0026] A convolution pooling operation is performed on the sixth alarm feature according to the fourth convolution unit to obtain a second coding feature.

[0027] In a possible implementation, generating a timing alarm feature of a network device according to the fault occurrence time and the alarm data includes:

[0028] According to the fault occurrence time and the alarm data, among the multiple alarms, determine the alarm whose alarm time is in a first time period and the alarm whose alarm time is in a second time period, wherein the first time period is the time period from a first time before the fault occurrence time to the fault occurrence time, and the second time period is the time period from the fault occurrence time to a second time after the fault occurrence time;

[0029] Determine, according to the alarms in the first time period and the alarms in the second time period, first alarm frequency information of the alarms of each alarm type in the first time period and second alarm frequency information in the second time period;

[0030] A time series alarm feature is generated according to first alarm frequency information of alarms of each alarm type in a first time period and second alarm frequency information in a second time period.

[0031] In a possible implementation, determining first alarm frequency information of alarms of each alarm type in the first time period and second alarm frequency information in the second time period according to the alarms in the first time period and the alarms in the second time period includes:

[0032] For each alarm type, determining a first alarm of the alarm type from the alarms in the first time period, and determining a second alarm of the alarm type from the alarms in the second time period;

[0033] Determining the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm;

[0034] Determining the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm;

[0035] The continuous alarm includes two adjacent alarms, the alarm types of the two adjacent alarms are the same, and the time difference between the alarm times of the two adjacent alarms is less than or equal to the preset duration;

[0036] The first alarm frequency information includes the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm; the second alarm frequency information includes the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm.

[0037] In a possible implementation, generating a time series alarm feature according to first alarm frequency information of alarms of each alarm type in a first time period and second alarm frequency information in a second time period includes:

[0038] Generate a first time sequence alarm matrix according to the frequency of the first alarm and the frequency of the second alarm;

[0039] Generate a second timing alarm matrix according to the alarm interval of the first alarm and the alarm interval of the second alarm;

[0040] Generate a third time sequence alarm matrix according to the continuous alarm frequency of the first alarm and the continuous alarm frequency of the second alarm;

[0041] The first timing alarm matrix, the second timing alarm matrix and the third timing alarm matrix are fused to obtain timing alarm features.

[0042] In a possible implementation, generating an alarm type embedding feature of a network device according to the respective alarm types of a plurality of alarms includes:

[0043] Perform word segmentation processing on the title texts of the respective alarm types of multiple alarms to obtain multiple word segments;

[0044] For each segmented word, determine the text encoding of the segmented word according to the frequency of the segmented word appearing in multiple segmented words;

[0045] The text encodings of multiple word segments are vectorized to obtain the embedded features of the alarm type.

[0046] In a possible implementation, vectorization is performed on the text encodings of multiple word segments to obtain an embedded feature of the alarm type, including:

[0047] For each alarm type, a text encoding vector of the alarm is generated according to the text encoding of the segmented words included in the title text of the alarm type;

[0048] The text encoding vectors of the multiple alarms are respectively input into the continuous skip-word model, and the text encoding vectors of the multiple alarms are respectively embedded according to the continuous skip-word model to generate alarm type embedding features.

[0049] In a possible implementation, the fault root cause location model is trained based on sample alarm data, sample fault work orders, and fault root cause labels of multiple sample network devices.

[0050] In a second aspect, the present application provides an electronic device, including a memory, a transceiver, and a processor;

[0051] A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of a processor; and a processor for reading the computer program in the memory and performing the following operations:

[0052] Acquire alarm data and fault work orders of network devices, the alarm data including respective alarm times and alarm types of multiple alarms for faults of network devices, and the fault work orders including the time when the faults occurred;

[0053] Generate timing alarm features of network equipment based on fault occurrence time and alarm data;

[0054] Generate an embedded feature of an alarm type of a network device according to respective alarm types of a plurality of alarms;

[0055] The time series alarm features and alarm type are embedded into the features and input into the fault root cause location model to obtain the fault root cause of the network device;

[0056] The fault root cause location model includes a first encoder, a second encoder, a fully connected layer and a classification layer.

[0057] In a possible implementation, the time sequence alarm feature and the alarm type are embedded in the feature and input into the fault root cause location model to obtain the fault root cause of the network device, including:

[0058] Inputting the time series alarm feature into a first encoder to obtain a first encoding feature;

[0059] Inputting the alarm type embedded feature into a second encoder to obtain a second encoded feature;

[0060] Input the first encoding feature and the second encoding feature into the fully connected layer to obtain a fused feature;

[0061] The fused features are input into the classification layer to obtain the root cause of the failure of the network device.

[0062] In a possible implementation, the first encoder includes a first self-attention unit, a first convolution unit, an LSTM unit, and a second convolution unit connected in sequence, and the time series alarm feature is input into the first encoder to obtain a first encoding feature, including:

[0063] Performing a distillation operation on the time series warning feature according to the first self-attention unit to obtain a first warning feature;

[0064] Performing a convolution pooling operation on the first alarm feature according to the first convolution unit to obtain a second alarm feature;

[0065] Performing a time series feature extraction operation on the second alarm feature according to the LSTM unit to obtain a third alarm feature;

[0066] A convolution pooling operation is performed on the third alarm feature according to the second convolution unit to obtain a first coding feature.

[0067] In a possible implementation, the second encoder includes a second self-attention unit, a third convolution unit, a third self-attention unit, and a fourth convolution unit connected in sequence, and the alarm type embedding feature is input into the second encoder to obtain a second encoding feature, including:

[0068] Performing a distillation operation on the warning type embedding feature according to the second self-attention unit to obtain a fourth warning feature;

[0069] Performing a convolution pooling operation on the fourth alarm feature according to the third convolution unit to obtain a fifth alarm feature;

[0070] performing a distillation operation on the fifth warning feature according to the third self-attention unit to obtain a sixth warning feature;

[0071] A convolution pooling operation is performed on the sixth alarm feature according to the fourth convolution unit to obtain a second coding feature.

[0072] In a possible implementation, generating a timing alarm feature of a network device according to the fault occurrence time and the alarm data includes:

[0073] According to the fault occurrence time and the alarm data, among the multiple alarms, determine the alarm whose alarm time is in a first time period and the alarm whose alarm time is in a second time period, wherein the first time period is the time period from a first time before the fault occurrence time to the fault occurrence time, and the second time period is the time period from the fault occurrence time to a second time after the fault occurrence time;

[0074] Determine, according to the alarms in the first time period and the alarms in the second time period, first alarm frequency information of the alarms of each alarm type in the first time period and second alarm frequency information in the second time period;

[0075] A time series alarm feature is generated according to first alarm frequency information of alarms of each alarm type in a first time period and second alarm frequency information in a second time period.

[0076] In a possible implementation, determining first alarm frequency information of alarms of each alarm type in the first time period and second alarm frequency information in the second time period according to the alarms in the first time period and the alarms in the second time period includes:

[0077] For each alarm type, determining a first alarm of the alarm type from the alarms in the first time period, and determining a second alarm of the alarm type from the alarms in the second time period;

[0078] Determining the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm;

[0079] Determining the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm;

[0080] The continuous alarm includes two adjacent alarms, the alarm types of the two adjacent alarms are the same, and the time difference between the alarm times of the two adjacent alarms is less than or equal to the preset duration;

[0081] The first alarm frequency information includes the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm; the second alarm frequency information includes the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm.

[0082] In a possible implementation, generating a time series alarm feature according to first alarm frequency information of alarms of each alarm type in a first time period and second alarm frequency information in a second time period includes:

[0083] Generate a first time sequence alarm matrix according to the frequency of the first alarm and the frequency of the second alarm;

[0084] Generate a second timing alarm matrix according to the alarm interval of the first alarm and the alarm interval of the second alarm;

[0085] Generate a third time sequence alarm matrix according to the continuous alarm frequency of the first alarm and the continuous alarm frequency of the second alarm;

[0086] The first timing alarm matrix, the second timing alarm matrix and the third timing alarm matrix are fused to obtain timing alarm features.

[0087] In a possible implementation, generating an alarm type embedding feature of a network device according to the respective alarm types of a plurality of alarms includes:

[0088] Perform word segmentation processing on the title texts of the respective alarm types of multiple alarms to obtain multiple word segments;

[0089] For each segmented word, determine the text encoding of the segmented word according to the frequency of the segmented word appearing in multiple segmented words;

[0090] The text encodings of multiple word segments are vectorized to obtain the embedded features of the alarm type.

[0091] In a possible implementation, vectorization is performed on the text encodings of multiple word segments to obtain an embedded feature of the alarm type, including:

[0092] For each alarm type, a text encoding vector of the alarm is generated according to the text encoding of the segmented words included in the title text of the alarm type;

[0093] The text encoding vectors of the multiple alarms are respectively input into the continuous skip-word model, and the text encoding vectors of the multiple alarms are respectively embedded according to the continuous skip-word model to generate alarm type embedding features.

[0094] In a possible implementation, the fault root cause location model is trained based on sample alarm data, sample fault work orders, and fault root cause labels of multiple sample network devices.

[0095] In a third aspect, the present application provides a fault root cause location device, comprising:

[0096] An acquisition module, used to acquire alarm data and fault work orders of network devices, wherein the alarm data includes the alarm time and alarm type of each of multiple alarms for faults of the network devices, and the fault work order includes the fault occurrence time of the fault;

[0097] The first generating module is used to generate a timing alarm feature of the network device according to the fault occurrence time and the alarm data;

[0098] A second generating module is used to generate an alarm type embedding feature of the network device according to the respective alarm types of the plurality of alarms;

[0099] A processing module, used to embed the time sequence alarm features and the alarm type into features, input them into the fault root cause location model, and obtain the fault root cause of the network device;

[0100] The fault root cause location model includes a first encoder, a second encoder, a fully connected layer and a classification layer.

[0101] In a possible implementation manner, the processing module is specifically used for:

[0102] Inputting the time series alarm feature into a first encoder to obtain a first encoding feature;

[0103] Inputting the alarm type embedded feature into a second encoder to obtain a second encoded feature;

[0104] Input the first encoding feature and the second encoding feature into the fully connected layer to obtain a fused feature;

[0105] The fused features are input into the classification layer to obtain the root cause of the failure of the network device.

[0106] In a possible implementation, the first encoder includes a first self-attention unit, a first convolution unit, an LSTM unit, and a second convolution unit connected in sequence, and the processing module is specifically used for:

[0107] Performing a distillation operation on the time series warning feature according to the first self-attention unit to obtain a first warning feature;

[0108] Performing a convolution pooling operation on the first alarm feature according to the first convolution unit to obtain a second alarm feature;

[0109] Performing a time series feature extraction operation on the second alarm feature according to the LSTM unit to obtain a third alarm feature;

[0110] A convolution pooling operation is performed on the third alarm feature according to the second convolution unit to obtain a first coding feature.

[0111] In a possible implementation, the second encoder includes a second self-attention unit, a third convolution unit, a third self-attention unit, and a fourth convolution unit connected in sequence, and the processing module is specifically used for:

[0112] Performing a distillation operation on the warning type embedding feature according to the second self-attention unit to obtain a fourth warning feature;

[0113] Performing a convolution pooling operation on the fourth alarm feature according to the third convolution unit to obtain a fifth alarm feature;

[0114] performing a distillation operation on the fifth warning feature according to the third self-attention unit to obtain a sixth warning feature;

[0115] A convolution pooling operation is performed on the sixth alarm feature according to the fourth convolution unit to obtain a second coding feature.

[0116] In a possible implementation, the first generating module is specifically used for:

[0117] According to the fault occurrence time and the alarm data, among the multiple alarms, determine the alarm whose alarm time is in a first time period and the alarm whose alarm time is in a second time period, wherein the first time period is the time period from a first time before the fault occurrence time to the fault occurrence time, and the second time period is the time period from the fault occurrence time to a second time after the fault occurrence time;

[0118] Determine, according to the alarms in the first time period and the alarms in the second time period, first alarm frequency information of the alarms of each alarm type in the first time period and second alarm frequency information in the second time period;

[0119] A time series alarm feature is generated according to first alarm frequency information of alarms of each alarm type in a first time period and second alarm frequency information in a second time period.

[0120] In a possible implementation, the first generating module is specifically used for:

[0121] For each alarm type, determining a first alarm of the alarm type from the alarms in the first time period, and determining a second alarm of the alarm type from the alarms in the second time period;

[0122] Determining the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm;

[0123] Determining the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm;

[0124] The continuous alarm includes two adjacent alarms, the alarm types of the two adjacent alarms are the same, and the time difference between the alarm times of the two adjacent alarms is less than or equal to the preset duration;

[0125] The first alarm frequency information includes the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm; the second alarm frequency information includes the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm.

[0126] In a possible implementation, the first generating module is specifically used to:

[0127] Generate a first time sequence alarm matrix according to the frequency of the first alarm and the frequency of the second alarm;

[0128] Generate a second timing alarm matrix according to the alarm interval of the first alarm and the alarm interval of the second alarm;

[0129] Generate a third time sequence alarm matrix according to the continuous alarm frequency of the first alarm and the continuous alarm frequency of the second alarm;

[0130] The first timing alarm matrix, the second timing alarm matrix and the third timing alarm matrix are fused to obtain timing alarm features.

[0131] In a possible implementation manner, the second generating module is specifically used for:

[0132] Perform word segmentation processing on the title texts of the respective alarm types of multiple alarms to obtain multiple word segments;

[0133] For each segmented word, determine the text encoding of the segmented word according to the frequency of the segmented word appearing in multiple segmented words;

[0134] The text encodings of multiple word segments are vectorized to obtain the embedded features of the alarm type.

[0135] In a possible implementation manner, the second generating module is specifically used for:

[0136] For each alarm type, a text encoding vector of the alarm is generated according to the text encoding of the segmented words included in the title text of the alarm type;

[0137] The text encoding vectors of the multiple alarms are respectively input into the continuous skip-word model, and the text encoding vectors of the multiple alarms are respectively embedded according to the continuous skip-word model to generate alarm type embedding features.

[0138] In a possible implementation, the fault root cause location model is trained based on sample alarm data, sample fault work orders, and fault root cause labels of multiple sample network devices.

[0139] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is used to enable a computer to execute any one of the fault root cause locating methods in the first aspect.

[0140] The method for locating the root cause of a fault provided by the present application first obtains the alarm data and fault work order of the network device, wherein the alarm data includes the alarm time and alarm type of each of the multiple alarms for the fault of the network device, and the fault work order includes the time when the fault occurs; then, according to the time when the fault occurs and the alarm data, the timing alarm feature of the network device is generated, and according to the alarm types of each of the multiple alarms, the alarm type embedding feature of the network device is generated; finally, the timing alarm feature and the alarm type embedding feature are input into the fault root cause location model to obtain the fault root cause of the network device; wherein the fault root cause location model includes a first encoder, a second encoder, a fully connected layer, and a classification layer. The solution of the present application does not rely on manual experience, but realizes the location of the root cause of the fault through a pre-trained fault root cause location model, which is highly efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0141] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0142] Figure 1 A flowchart of a method for locating the root cause of a fault provided in an embodiment of the present application;

[0143] Figure 2 A schematic diagram of the structure of a fault root cause location model provided in an embodiment of the present application;

[0144] Figure 3 A flowchart of generating a timing alarm feature provided by an embodiment of the present application;

[0145] Figure 4 A schematic diagram of generating a timing alarm feature provided by an embodiment of the present application;

[0146] Figure 5 A flowchart of generating an alarm type embedding feature provided in an embodiment of the present application;

[0147] Figure 6 A schematic diagram of generating an alarm type embedding feature provided in an embodiment of the present application;

[0148] Figure 7 A flowchart of a fault root cause location model processing provided in an embodiment of the present application;

[0149] Figure 8 A schematic diagram of the structure of a first encoder provided in an embodiment of the present application;

[0150] Fig. 9 A schematic diagram of the structure of a second encoder provided in an embodiment of the present application;

[0151] Fig.10 A schematic diagram of the processing process of the fault root cause location model provided in an embodiment of the present application;

[0152] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0153] Fig.12 A schematic diagram of the structure of a fault root cause locating device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0154] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0155] Through network equipment, operators can provide terminals with comprehensive, high-quality, and diversified communication services and respond to user needs in a timely manner.

[0156] As the scale of telecommunications networks continues to expand, network equipment failures are common. When network equipment fails, it will affect the communication process of terminals in a large range. Therefore, timely detection of network equipment failures and handling of failures are of great significance to ensure normal network communication.

[0157] At present, before a network device fails, a large amount of alarm data is usually received. Fault work orders are selectively issued according to the level of the alarm data, and maintenance personnel go to the site to troubleshoot and repair the fault according to the fault work order. Only after the maintenance personnel have troubleshooted and repaired the fault can they determine the root cause of the network device failure and take corresponding measures. Among them, the root cause refers to the main reason or fundamental reason that causes the network device failure. In some cases, there may be many reasons for the failure of the network device, among which the root cause is the main factor.

[0158] Due to the huge amount of alarm data and work orders generated, the above method of locating the root cause of the fault by maintenance personnel mainly relies on personal experience to locate the problem, which is inefficient. In addition, since different causes of faults often require different treatment measures, locating the root cause of the fault completely based on personal experience has unstable accuracy and may require repeated operations to solve, which is time-consuming and laborious.

[0159] Based on this, the embodiment of the present application provides a method for locating the root cause of a fault, so as to solve the problem that the number of existing network alarms and work orders is large, and the efficiency and accuracy of locating the root cause of a fault is low based on manual experience.

[0160] Figure 1 A flowchart of a method for locating the root cause of a fault provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method may include:

[0161] S11, obtaining alarm data and fault work orders of network equipment, wherein the alarm data includes the alarm time and alarm type of each of multiple alarms for faults of the network equipment, and the fault work order includes the fault occurrence time of the fault.

[0162] The network device is a network device that may have a fault, and the root cause of the fault of the network device needs to be located. Therefore, the alarm data and fault work order of the network device are first obtained. Before the network device fails, a large amount of alarm data of the network device will be received, and a corresponding fault work order can be generated based on the alarm data of the network device.

[0163] The alarm data of the network device includes the alarm time and alarm type of each of the multiple alarms for the failure of the network device. Specifically, within a period of time before and after the failure of the network device, the network device will initiate an alarm multiple times, and each alarm has a corresponding alarm time and alarm type. The alarm time is the time information when the network device initiates the alarm, and the alarm type is the type information of the alarm initiated by the network device. The alarm type may include, for example, a cell unavailable alarm, a 4G cell decommissioning alarm, a radio frequency unit standing wave alarm, and so on. In the process of locating the root cause of a fault, the alarm types of multiple alarms of the network device may be the same or different. The alarm type may be displayed in the form of an alarm title.

[0164] Optionally, the alarm data of the network device may also include an identifier of the network device or an identifier of a cell under the network device. The identifier of the network device may be, for example, an evolutionary Node BIdentifier, and the identifier of the network device is used to indicate that the above alarm data is the alarm data of the network device. The identifier of the cell may be, for example, an Evolved Access Network Cell Global Identifier (E-UTRAN Cell Global Identifier, ECGI), and the identifier of the cell is used to indicate that the above alarm data is the alarm data of a cell under the network device.

[0165] The fault work order of a network device includes the time when the fault of the network device occurred, that is, when the fault occurred. Optionally, the fault work order may also include a work order number, which is used to uniquely identify the fault work order. The fault work order may also include an identifier of the network device or an identifier of a cell under the network device. Similarly, the identifier of the network device may be, for example, an evolved network device identifier, which indicates that the above-mentioned fault work order is a fault work order for the network device through the identifier of the network device. The identifier of the cell may be, for example, an ECGI, which indicates that the above-mentioned fault work order is a fault work order for a cell under the network device. By using the identifier of the network device or the identifier of the cell in the alarm data and the fault work order, the alarm data and the fault work order of the same network device can be matched.

[0166] S12, generating a timing alarm feature of the network device according to the fault occurrence time and the alarm data.

[0167] The fault occurrence time included in the fault work order and the above-mentioned alarm data are used to generate the timing alarm characteristics of the network device, and the timing alarm characteristics include timing information.

[0168] In a possible implementation, a time sequence alarm feature can be generated based on the relationship between the alarm time and the fault occurrence time. For example, the above alarm data includes multiple alarms, each alarm has a different alarm time, and the alarm time may be before the fault occurrence time or after the fault occurrence time. The multiple alarms can be grouped according to the alarm time, and then the time sequence alarm feature of the network device is generated for the alarm type in each group.

[0169] S13, generating an alarm type embedding feature of the network device according to the respective alarm types of the plurality of alarms.

[0170] The alarm type embedded feature is the feature obtained by embedding the alarm type. The embedding process refers to the process of using a low-dimensional vector to represent the alarm type. In an embodiment of the present application, the alarm type has a corresponding title text. The title text is a text representation of the alarm type. For example, the cell unavailable alarm, 4G cell decommissioning alarm, and radio frequency unit standing wave alarm all describe the alarm type. When converted into text, it is the corresponding title text. By embedding the title text corresponding to the alarm type of each of the multiple alarms, the alarm type embedded feature of the network device can be obtained.

[0171] S14, embedding the time sequence alarm feature and the alarm type into the feature, and inputting them into the fault root cause location model to obtain the fault root cause of the network device.

[0172] Figure 2 A schematic diagram of the structure of the fault root cause location model provided in the embodiment of the present application, such as Figure 2 As shown, the fault root cause location model includes a first encoder, a second encoder, a fully connected layer and a classification layer. The first encoder and the second encoder are both connected to the fully connected layer, and the fully connected layer is connected to the classification layer. After the time series alarm feature and the alarm type embedded feature are input into the fault root cause location model, the time series alarm feature is input into the first encoder, the alarm type embedded feature is input into the second encoder, and the output results of the first encoder and the second encoder are both input into the fully connected layer, which are processed by the fully connected layer and the classification layer in turn, and finally the fault root cause is output.

[0173] The fault root cause location model needs to be trained before application. In the embodiment of the present application, the fault root cause location model is trained based on sample alarm data, sample fault work orders, and fault root cause labels of multiple sample network devices.

[0174] Specifically, firstly, sample alarm data, sample fault work orders, and fault root cause labels of multiple sample network devices are obtained, wherein the fault root cause label is a vector, and the dimension of the vector is determined according to the number of possible fault root causes. For example, the fault root causes may include six categories: power failure, transmission failure, software failure, hardware failure, dynamic ring failure, and false alarm. Then the dimension of the vector is 6, and each element value of the vector indicates the corresponding fault root cause.

[0175] Then, the sample alarm data and sample fault work order of the sample network device are input into the fault root cause location model, the sample alarm data and sample fault work order are processed by the fault root cause location model, the root cause of the fault of the sample network device is output, the loss value is calculated according to the output root cause of the fault of the sample network device and the root cause label of the fault root cause, and the parameters of the root cause location model are adjusted based on the loss value to complete a round of training. The root cause location model can be trained for multiple rounds based on the above method until the training process is completed after the model training termination condition is reached, so that the root cause of the fault of the network device can be located based on the root cause location module.

[0176] Based on any of the above embodiments, the scheme of the embodiments of the present application is described in detail below in conjunction with the accompanying drawings.

[0177] In a possible implementation, the alarm frequency related information of the network device can be extracted based on the alarm time and the fault occurrence time, so as to generate the timing alarm feature of the network device. Figure 3 This section introduces the process.

[0178] Figure 3 A flowchart of generating a timing alarm feature provided by an embodiment of the present application, such as Figure 3 As shown, including:

[0179] S31, based on the fault occurrence time and the alarm data, determine, among multiple alarms, the alarm whose alarm time is in the first time period and the alarm whose alarm time is in the second time period, wherein the first time period is the time period from the first moment before the fault occurrence time to the fault occurrence time, and the second time period is the time period from the fault occurrence time to the second moment after the fault occurrence time.

[0180] In the embodiment of the present application, there may be one or more first moments, and different first moments correspond to different first time periods. For example, the first moment may include a moment 3 minutes before the moment of the fault, a moment 5 minutes before the moment of the fault, a moment 10 minutes before the moment of the fault, and a moment 30 minutes before the moment of the fault. Accordingly, the first time period may include a time period of 3 minutes before the moment of the fault, a time period of 5 minutes before the moment of the fault, a time period of 10 minutes before the moment of the fault, and a time period of 30 minutes before the moment of the fault.

[0181] Similarly, in the embodiment of the present application, there may be one or more second moments, and different second moments may correspond to different second time periods. For example, the second moment may include a moment 3 minutes after the moment of the fault, a moment 5 minutes after the moment of the fault, a moment 10 minutes after the moment of the fault, and a moment 30 minutes after the moment of the fault. Accordingly, the second time period may include a time period of 3 minutes after the moment of the fault, a time period of 5 minutes after the moment of the fault, a time period of 10 minutes after the moment of the fault, and a time period of 30 minutes after the moment of the fault.

[0182] S32: Determine first alarm frequency information of alarms of each alarm type in the first time period and second alarm frequency information in the second time period according to the alarms in the first time period and the alarms in the second time period.

[0183] After the first time period and the second time period are determined, the alarms in the first time period and the alarms in the second time period can be determined according to the alarm times of the multiple alarms. Then, according to the alarms in the first time period and the alarms in the second time period, the first alarm frequency information of the alarms of each alarm type in the first time period and the second alarm frequency information in the second time period are determined.

[0184] For each alarm type, the first alarm frequency information includes the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm. The first alarm is an alarm of the alarm type within the first time period.

[0185] In a possible implementation, for each alarm type, a first alarm of the alarm type may be determined from alarms within a first time period.

[0186] Then, determine the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm. The first alarm is an alarm of the alarm type in the first time period, and the frequency of the first alarm is the number of times the alarm of the alarm type occurs in the first time period; the alarm interval of the first alarm refers to the time interval between the alarm moments of two adjacent alarms of the alarm type in the first time period; the continuous alarm frequency of the first alarm refers to the number of consecutive alarms of the alarm type in the first time period, and a continuous alarm refers to two adjacent alarms, the alarm type of the two adjacent alarms is the same, and the time difference between the alarm moments of the two adjacent alarms is less than or equal to the preset duration, which can be set as needed, for example, 1 minute, 2 minutes or other values.

[0187] For each alarm type, the second alarm frequency information includes the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm. The second alarm is an alarm of the alarm type within the second time period.

[0188] In a possible implementation, for each alarm type, a second alarm of the alarm type may be determined from the alarms in the second time period, and then the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm are determined.

[0189] The second alarm is an alarm of the alarm type in the second period, and the frequency of the second alarm is the number of times the alarm of the alarm type occurs in the second period; the alarm interval of the second alarm refers to the time interval between two adjacent alarms of the alarm type in the second period; the continuous alarm frequency of the second alarm refers to the number of consecutive alarms of the alarm type in the second period. The implementation method of determining the second alarm frequency information is similar to the implementation method of determining the first alarm frequency information, which will not be repeated here.

[0190] S33: Generate a time series alarm feature according to the first alarm frequency information of each alarm type in the first time period and the second alarm frequency information in the second time period.

[0191] Figure 4 A schematic diagram of generating a timing alarm feature provided by an embodiment of the present application, such as Figure 4 As shown, after obtaining the first alarm frequency information of each alarm type in the first time period and the second alarm frequency information in the second time period, the time series alarm feature can be generated.

[0192] Specifically, a first time sequence alarm matrix 41 is generated according to the frequency of the first alarm and the frequency of the second alarm. Figure 4 As shown, different rows of the first sequential alarm matrix 41 represent different time periods, including a first time period and a second time period, and the number of the first time period and the second time period can be one or more. Different columns of the first sequential alarm matrix 41 represent different alarm types. For any alarm type, the element value of the alarm type in the column of the first sequential alarm matrix 41 can be obtained according to the frequency of the first alarm and the frequency of the second alarm corresponding to the alarm type.

[0193] According to the alarm interval of the first alarm and the alarm interval of the second alarm, a second timing alarm matrix 42 can be generated. Figure 4 As shown, different rows of the second sequential alarm matrix 42 represent different time periods, including a first time period and a second time period, and the number of the first time period and the second time period can be one or more. Different columns of the second sequential alarm matrix 42 represent different alarm types. For any alarm type, according to the alarm interval of the first alarm and the alarm interval of the second alarm corresponding to the alarm type, the element value of the alarm type in the column of the second sequential alarm matrix 42 can be obtained.

[0194] According to the continuous alarm frequency of the first alarm and the continuous alarm frequency of the second alarm, a third time sequence alarm matrix 43 can be generated. Figure 4 As shown, different rows of the third sequential alarm matrix 43 represent different time periods, including a first time period and a second time period, and the number of the first time period and the second time period can be one or more. Different columns of the third sequential alarm matrix 43 represent different alarm types. For any alarm type, according to the continuous alarm frequency of the first alarm and the continuous alarm frequency of the second alarm corresponding to the alarm type, the element value of the alarm type in the column of the third sequential alarm matrix 43 can be obtained.

[0195] Then, the first timing alarm matrix 41, the second timing alarm matrix 42 and the third timing alarm matrix 43 are fused to obtain the timing alarm feature. The fusion process, for example, can be to perform matrix splicing processing on the first timing alarm matrix 41, the second timing alarm matrix 42 and the third timing alarm matrix 43 to obtain the timing alarm feature.

[0196] The above embodiment introduces the implementation scheme of generating a timing alarm feature. The following describes the implementation scheme of generating an alarm type embedded feature in conjunction with the accompanying drawings.

[0197] Figure 5 A flowchart of generating an alarm type embedded feature provided in an embodiment of the present application is as follows: Figure 5 As shown, including:

[0198] S51, performing word segmentation processing on the title texts of the respective alarm types of the plurality of alarms respectively to obtain a plurality of word segments.

[0199] Different alarm types have different title texts, for example, they may include "cell unavailable alarm", "4G cell decommissioning alarm", "radio unit standing wave alarm", etc. The above title texts are segmented separately to obtain multiple segmented words. For example, segmenting "cell unavailable alarm" can obtain the three segmented words "cell", "unavailable", and "alarm"; segmenting "4G cell decommissioning alarm" can obtain the four segmented words "4G", "cell", "decommissioning", and "alarm"; segmenting "radio unit standing wave alarm" can obtain the four segmented words "radio frequency", "unit", "standing wave", and "alarm", and so on.

[0200] S52, for each segmented word, determine the text encoding of the segmented word according to the frequency of occurrence of the segmented word in multiple segmented words.

[0201] The corresponding text code is determined according to the frequency of each word in multiple words. The frequency of the word can be negatively correlated with the corresponding number, so the higher the frequency, the smaller the corresponding number; or the frequency of the word can be positively correlated with the corresponding number, so the higher the frequency, the larger the corresponding number. Then, the number is represented in binary to obtain the corresponding text code.

[0202] S53, vectorizing the text encodings of the multiple word segments to obtain an embedded feature of the alarm type.

[0203] The alarm type embedding feature is generated based on different alarm types. For the alarm type of any alarm, the text encoding vector of the alarm can be generated according to the text encoding of the segmented words included in the title text of the alarm type.

[0204] Taking the title text of an alarm "Cell Unavailable Alarm" as an example, its corresponding word segmentation includes three words: "cell", "unavailable", and "alarm". The text encoding of "cell" is 10, the text encoding of "unavailable" is 0010, and the text encoding of "alarm" is 01000. Then, by concatenating these three words in the corresponding order, we can get the text encoding vector of the alarm as 10001001000.

[0205] After generating the text encoding vectors of each alarm, the text encoding vectors of the multiple alarms are input into a continuous Skip-Gram model, and the text encoding vectors of the multiple alarms are embedded according to the Skip-Gram model to generate alarm type embedding features.

[0206] Figure 6 A schematic diagram of generating an alarm type embedded feature provided in an embodiment of the present application, such as Figure 6 As shown in the figure, the title texts of the alarm types of multiple alarms are illustrated, including "cell unavailable alarm", "4G cell out-of-service alarm", "radio unit standing wave alarm", etc. According to each title text, the text encoding vector of each alarm can be generated, and then the alarm type embedding feature is generated through the processing of the Skip-Gram model. Figure 6 In the figure, after being processed by the Skip-Gram model, the “cell unavailable alarm” outputs a vector [12,34,67,11,32,8], the “4G cell decommissioning alarm” outputs a vector [22,12,4,5,32,8], and the “RF unit standing wave alarm” outputs a vector [54,12,56,18,25,8] after being processed by the Skip-Gram model. These output vectors are concatenated to generate the alarm type embedding feature.

[0207] After generating the time series alarm feature and the alarm type embedded feature, these two features can be input into the fault root cause location model to output the fault root cause of the network device. Figure 7 This section introduces the process.

[0208] Figure 7 The fault root cause location model processing flow chart provided in the embodiment of the present application is as follows: Figure 7 As shown, including:

[0209] S71, input the timing alarm feature into a first encoder to obtain a first encoding feature.

[0210] Figure 8 A schematic diagram of the structure of the first encoder provided in the embodiment of the present application, such as Figure 8 As shown, the first encoder includes a first self-attention unit, a first convolution unit, an LSTM unit, and a second convolution unit connected in sequence.

[0211] After the time series alarm feature is input into the first encoder, the time series alarm feature is firstly distilled according to the first self-attention unit, so as to remove the redundant information in the time series alarm feature, retain the main feature information, and obtain the first alarm feature.

[0212] Then, the first alarm feature is convoluted and pooled according to the first convolution unit to obtain the second alarm feature, and the second alarm feature is input into the Long Short-Term Memory (LSTM) unit, and the second alarm feature is extracted by the LSTM unit to obtain the third alarm feature. Finally, the third alarm feature is input into the second convolution unit, and the third alarm feature is convoluted and pooled according to the second convolution unit to obtain the first coding feature.

[0213] The first self-attention unit can be, for example, a multi-head prediction (Multi-Head ProbSparse) self-attention unit. The distillation operation is introduced by the first self-attention unit, so that the main features in the time series alarm features have a higher weight, and more key features can be extracted in the next layer. The distillation operation significantly cuts the time dimension of the input, and the process from the jth layer to the j+1th layer is shown in the following formula (1):

[0214]

[0215] in, is the output of the jth layer of the first self-attention unit, is the output of the j+1th layer of the first self-attention unit, is the key operation between the first self-attention unit and the attention block. Conv1d is a one-dimensional convolution operation on the time series (the width of the convolution kernel is 3), and the ELU function is used for activation. Finally, it passes through a maximum pooling layer with a step size of 2 and Downsampling is performed to reduce memory usage. To enhance the robustness of the distillation operation, half a copy of the main stack is constructed and the number of distillation layers of the first self-attention unit is gradually reduced by dropping one layer at a time to align the output dimensions.

[0216] S72, input the alarm type embedding feature into the second encoder to obtain a second encoding feature.

[0217] Fig. 9 A schematic diagram of the structure of the second encoder provided in the embodiment of the present application, such as Fig. 9 As shown, the second encoder includes a second self-attention unit, a third convolution unit, a third self-attention unit, and a fourth convolution unit connected in sequence.

[0218] After the warning type embedding feature is input into the second encoder, the warning type embedding feature is first distilled according to the second self-attention unit to obtain the fourth warning feature.

[0219] Then, the fourth warning feature is convoluted and pooled according to the third convolution unit to obtain the fifth warning feature, and the fifth warning feature is input into the third self-attention unit, and the fifth warning feature is distilled according to the third self-attention unit to obtain the sixth warning feature. Finally, the sixth warning feature is convoluted and pooled according to the fourth convolution unit to obtain the second encoding feature.

[0220] S73, input the first encoding feature and the second encoding feature into a fully connected layer to obtain a fusion feature.

[0221] Fig.10 A schematic diagram of the processing process of the fault root cause location model provided in the embodiment of the present application, such as Fig.10 As shown in the figure, after the first encoder processes the time series alarm feature to obtain the first encoded feature, and the second encoder processes the alarm type embedding feature to obtain the second encoded feature, the first encoded feature and the second encoded feature are concatenated as the input of the fully connected layer. The fully connected layer extracts the first encoded feature and the second encoded feature, and reduces the dimension of the feature to obtain the fusion feature.

[0222] S74, input the fused features into the classification layer to obtain the root cause of the failure of the network device.

[0223] The fused features are input into the classification layer, and finally the fused features are normalized by the normalized exponential function (Softmax function) of the classification layer to obtain the root cause of the network equipment failure. Taking the fault root cause location model as an example, which can locate the six types of fault root causes, namely power failure, transmission failure, software failure, hardware failure, dynamic environment failure, and false alarm, the fused features can obtain a vector including 6 elements after being processed by the classification layer, and then the vector is normalized by the Softmax function to obtain a normalized vector. The normalized vector also includes 6 elements, and the sum of these 6 elements is 1. These 6 elements represent the probability that the root cause of the fault is power failure, transmission failure, software failure, hardware failure, dynamic environment failure, and false alarm.

[0224] The output of a fault root cause location model is shown in Table 1 below. For each fault work order, it illustrates the probability that the corresponding network device has a corresponding fault. The fault corresponding to the highest probability is determined as the fault existing in the network device.

[0225] Table 1

[0226]

[0227] The method for locating the root cause of a fault provided by the embodiment of the present application first obtains the alarm data and fault work order of the network device, the alarm data includes the alarm time and alarm type of each of the multiple alarms for the fault of the network device, and the fault work order includes the fault occurrence time of the fault; then, according to the fault occurrence time and the alarm data, the timing alarm feature of the network device is generated, and according to the alarm types of each of the multiple alarms, the alarm type embedded feature of the network device is generated; finally, the timing alarm feature and the alarm type embedded feature are input into the fault root cause location model to obtain the fault root cause of the network device; wherein the fault root cause location model includes a first encoder, a second encoder, a fully connected layer and a classification layer. The solution of the embodiment of the present application does not rely on manual experience, but realizes the location of the root cause of the fault through a pre-trained fault root cause location model, which is highly efficient.

[0228] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Fig.11 As shown, the electronic device includes a memory 1120, a transceiver 1100, and a processor 1110, wherein:

[0229] The memory 1120 is used to store computer programs; the transceiver 1100 is used to send and receive data under the control of the processor 1110; the processor 1110 is used to read the computer program in the memory 1120 and perform the following operations:

[0230] Acquire alarm data and fault work orders of network devices, the alarm data including respective alarm times and alarm types of multiple alarms for faults of network devices, and the fault work orders including the time when the faults occurred;

[0231] Generate timing alarm features of network equipment based on fault occurrence time and alarm data;

[0232] Generate an embedded feature of an alarm type of a network device according to respective alarm types of a plurality of alarms;

[0233] The time series alarm features and alarm type are embedded into the features and input into the fault root cause location model to obtain the fault root cause of the network device;

[0234] The fault root cause location model includes a first encoder, a second encoder, a fully connected layer and a classification layer.

[0235] Specifically, the transceiver 1100 is used to receive and send data under the control of the processor 1110 .

[0236] Among them, Fig.11 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by processor 1110 and various circuits of memory represented by memory 1120 are linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1100 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium, which may include transmission media such as wireless channels, wired channels, optical cables, etc. The processor 1110 is responsible for managing the bus architecture and general processing, and the memory 1120 may store data used by the processor 1110 when performing operations.

[0237] Optionally, processor 1110 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD), and the processor may also adopt a multi-core architecture.

[0238] The processor calls the computer program stored in the memory to execute the method provided in the embodiment of the present application according to the obtained executable instructions. The processor and the memory can also be arranged physically separately.

[0239] In a possible implementation, the time sequence alarm feature and the alarm type are embedded in the feature and input into the fault root cause location model to obtain the fault root cause of the network device, including:

[0240] Inputting the time series alarm feature into a first encoder to obtain a first encoding feature;

[0241] Inputting the alarm type embedded feature into a second encoder to obtain a second encoded feature;

[0242] Input the first encoding feature and the second encoding feature into the fully connected layer to obtain a fused feature;

[0243] The fused features are input into the classification layer to obtain the root cause of the failure of the network device.

[0244] In a possible implementation, the first encoder includes a first self-attention unit, a first convolution unit, an LSTM unit, and a second convolution unit connected in sequence, and the time series alarm feature is input into the first encoder to obtain a first encoding feature, including:

[0245] Performing a distillation operation on the time series warning feature according to the first self-attention unit to obtain a first warning feature;

[0246] Performing a convolution pooling operation on the first alarm feature according to the first convolution unit to obtain a second alarm feature;

[0247] Performing a time series feature extraction operation on the second alarm feature according to the LSTM unit to obtain a third alarm feature;

[0248] A convolution pooling operation is performed on the third alarm feature according to the second convolution unit to obtain a first coding feature.

[0249] In a possible implementation, the second encoder includes a second self-attention unit, a third convolution unit, a third self-attention unit, and a fourth convolution unit connected in sequence, and the alarm type embedding feature is input into the second encoder to obtain a second encoding feature, including:

[0250] Performing a distillation operation on the warning type embedding feature according to the second self-attention unit to obtain a fourth warning feature;

[0251] Performing a convolution pooling operation on the fourth alarm feature according to the third convolution unit to obtain a fifth alarm feature;

[0252] performing a distillation operation on the fifth warning feature according to the third self-attention unit to obtain a sixth warning feature;

[0253] A convolution pooling operation is performed on the sixth alarm feature according to the fourth convolution unit to obtain a second coding feature.

[0254] In a possible implementation, generating a timing alarm feature of a network device according to the fault occurrence time and the alarm data includes:

[0255] According to the fault occurrence time and the alarm data, among the multiple alarms, determine the alarm whose alarm time is in a first time period and the alarm whose alarm time is in a second time period, wherein the first time period is the time period from a first time before the fault occurrence time to the fault occurrence time, and the second time period is the time period from the fault occurrence time to a second time after the fault occurrence time;

[0256] Determine, according to the alarms in the first time period and the alarms in the second time period, first alarm frequency information of the alarms of each alarm type in the first time period and second alarm frequency information in the second time period;

[0257] A time series alarm feature is generated according to first alarm frequency information of alarms of each alarm type in a first time period and second alarm frequency information in a second time period.

[0258] In a possible implementation, determining first alarm frequency information of alarms of each alarm type in the first time period and second alarm frequency information in the second time period according to the alarms in the first time period and the alarms in the second time period includes:

[0259] For each alarm type, determining a first alarm of the alarm type from the alarms in the first time period, and determining a second alarm of the alarm type from the alarms in the second time period;

[0260] Determining the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm;

[0261] Determining the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm;

[0262] The continuous alarm includes two adjacent alarms, the alarm types of the two adjacent alarms are the same, and the time difference between the alarm times of the two adjacent alarms is less than or equal to the preset duration;

[0263] The first alarm frequency information includes the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm; the second alarm frequency information includes the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm.

[0264] In a possible implementation, generating a time series alarm feature according to first alarm frequency information of alarms of each alarm type in a first time period and second alarm frequency information in a second time period includes:

[0265] Generate a first time sequence alarm matrix according to the frequency of the first alarm and the frequency of the second alarm;

[0266] Generate a second timing alarm matrix according to the alarm interval of the first alarm and the alarm interval of the second alarm;

[0267] Generate a third time sequence alarm matrix according to the continuous alarm frequency of the first alarm and the continuous alarm frequency of the second alarm;

[0268] The first timing alarm matrix, the second timing alarm matrix and the third timing alarm matrix are fused to obtain timing alarm features.

[0269] In a possible implementation, generating an alarm type embedding feature of a network device according to the respective alarm types of a plurality of alarms includes:

[0270] Perform word segmentation processing on the title texts of the respective alarm types of multiple alarms to obtain multiple word segments;

[0271] For each segmented word, determine the text encoding of the segmented word according to the frequency of the segmented word appearing in multiple segmented words;

[0272] The text encodings of multiple word segments are vectorized to obtain the embedded features of the alarm type.

[0273] In a possible implementation, vectorization is performed on the text encodings of multiple word segments to obtain an embedded feature of the alarm type, including:

[0274] For each alarm type, a text encoding vector of the alarm is generated according to the text encoding of the segmented words included in the title text of the alarm type;

[0275] The text encoding vectors of the multiple alarms are respectively input into the continuous skip-word model, and the text encoding vectors of the multiple alarms are respectively embedded according to the continuous skip-word model to generate alarm type embedding features.

[0276] In a possible implementation, the fault root cause location model is trained based on sample alarm data, sample fault work orders, and fault root cause labels of multiple sample network devices.

[0277] It should be noted here that the above-mentioned electronic device provided in the embodiment of the present application can implement all the method steps implemented by the method embodiment in which the execution subject is the electronic device, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0278] Fig.12 A schematic diagram of a fault root cause location device provided in an embodiment of the present application is shown in FIG. Fig.12As shown, the fault root cause locating device comprises:

[0279] The acquisition module 1210 is used to acquire alarm data and fault work orders of the network device, wherein the alarm data includes the alarm time and alarm type of each of multiple alarms for the fault of the network device, and the fault work order includes the fault occurrence time of the fault;

[0280] The first generating module 1220 is used to generate a timing alarm feature of the network device according to the fault occurrence time and the alarm data;

[0281] The second generating module 1230 is used to generate an alarm type embedding feature of the network device according to the respective alarm types of the plurality of alarms;

[0282] The processing module 1240 is used to embed the time sequence alarm feature and the alarm type into the feature, and input it into the fault root cause location model to obtain the fault root cause of the network device;

[0283] The fault root cause location model includes a first encoder, a second encoder, a fully connected layer and a classification layer.

[0284] In a possible implementation, the processing module 1240 is specifically configured to:

[0285] Inputting the time series alarm feature into a first encoder to obtain a first encoding feature;

[0286] Inputting the alarm type embedded feature into a second encoder to obtain a second encoded feature;

[0287] Input the first encoding feature and the second encoding feature into the fully connected layer to obtain a fused feature;

[0288] The fused features are input into the classification layer to obtain the root cause of the failure of the network device.

[0289] In a possible implementation, the first encoder includes a first self-attention unit, a first convolution unit, an LSTM unit, and a second convolution unit connected in sequence, and the processing module 1240 is specifically used to:

[0290] Performing a distillation operation on the time series warning feature according to the first self-attention unit to obtain a first warning feature;

[0291] Performing a convolution pooling operation on the first alarm feature according to the first convolution unit to obtain a second alarm feature;

[0292] Performing a time series feature extraction operation on the second alarm feature according to the LSTM unit to obtain a third alarm feature;

[0293] A convolution pooling operation is performed on the third alarm feature according to the second convolution unit to obtain a first coding feature.

[0294] In a possible implementation, the second encoder includes a second self-attention unit, a third convolution unit, a third self-attention unit, and a fourth convolution unit connected in sequence, and the processing module 1240 is specifically used to:

[0295] Performing a distillation operation on the warning type embedding feature according to the second self-attention unit to obtain a fourth warning feature;

[0296] Performing a convolution pooling operation on the fourth alarm feature according to the third convolution unit to obtain a fifth alarm feature;

[0297] performing a distillation operation on the fifth warning feature according to the third self-attention unit to obtain a sixth warning feature;

[0298] A convolution pooling operation is performed on the sixth alarm feature according to the fourth convolution unit to obtain a second coding feature.

[0299] In a possible implementation, the first generating module 1220 is specifically configured to:

[0300] According to the fault occurrence time and the alarm data, among the multiple alarms, determine the alarm whose alarm time is in a first time period and the alarm whose alarm time is in a second time period, wherein the first time period is the time period from a first time before the fault occurrence time to the fault occurrence time, and the second time period is the time period from the fault occurrence time to a second time after the fault occurrence time;

[0301] Determine, according to the alarms in the first time period and the alarms in the second time period, first alarm frequency information of the alarms of each alarm type in the first time period and second alarm frequency information in the second time period;

[0302] A time series alarm feature is generated according to first alarm frequency information of alarms of each alarm type in a first time period and second alarm frequency information in a second time period.

[0303] In a possible implementation, the first generating module 1220 is specifically configured to:

[0304] For each alarm type, determining a first alarm of the alarm type from the alarms in the first time period, and determining a second alarm of the alarm type from the alarms in the second time period;

[0305] Determining the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm;

[0306] Determining the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm;

[0307] The continuous alarm includes two adjacent alarms, the alarm types of the two adjacent alarms are the same, and the time difference between the alarm times of the two adjacent alarms is less than or equal to the preset duration;

[0308] The first alarm frequency information includes the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm; the second alarm frequency information includes the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm.

[0309] In a possible implementation, the first generating module 1220 is specifically configured to:

[0310] Generate a first time sequence alarm matrix according to the frequency of the first alarm and the frequency of the second alarm;

[0311] Generate a second timing alarm matrix according to the alarm interval of the first alarm and the alarm interval of the second alarm;

[0312] Generate a third time sequence alarm matrix according to the continuous alarm frequency of the first alarm and the continuous alarm frequency of the second alarm;

[0313] The first timing alarm matrix, the second timing alarm matrix and the third timing alarm matrix are fused to obtain timing alarm features.

[0314] In a possible implementation, the second generating module 1230 is specifically configured to:

[0315] Perform word segmentation processing on the title texts of the respective alarm types of multiple alarms to obtain multiple word segments;

[0316] For each segmented word, determine the text encoding of the segmented word according to the frequency of the segmented word appearing in multiple segmented words;

[0317] The text encodings of multiple word segments are vectorized to obtain the embedded features of the alarm type.

[0318] In a possible implementation, the second generating module 1230 is specifically configured to:

[0319] For each alarm type, a text encoding vector of the alarm is generated according to the text encoding of the segmented words included in the title text of the alarm type;

[0320] The text encoding vectors of the multiple alarms are respectively input into the continuous skip-word model, and the text encoding vectors of the multiple alarms are respectively embedded according to the continuous skip-word model to generate alarm type embedding features.

[0321] In a possible implementation, the fault root cause location model is trained based on sample alarm data, sample fault work orders, and fault root cause labels of multiple sample network devices.

[0322] Specifically, the above-mentioned fault root cause locating device provided in the embodiment of the present application can implement all the method steps implemented by the method embodiment in which the execution subject is an electronic device, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those of the method embodiment will not be described in detail here.

[0323] It should be noted that the division of units / modules in the above embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the functional units in the various embodiments of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated units may be implemented in the form of hardware or in the form of software functional units.

[0324] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of the method of each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0325] In some embodiments, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program, and the computer program is used to enable a computer to execute the fault root cause locating method provided by each of the above method embodiments.

[0326] Specifically, the above-mentioned computer-readable storage medium provided in the embodiment of the present application can implement all the method steps implemented by the above-mentioned method embodiments, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0327] It should be noted that computer-readable storage media can be any available media or data storage devices that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)), etc.

[0328] It should also be noted that the terms "first", "second", etc. in the embodiments of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first" and "second" are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more.

[0329] In the embodiments of the present application, the term "and / or" describes the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0330] In the embodiments of the present application, the term "plurality" refers to two or more than two, and other quantifiers are similar.

[0331] The technical solution provided in the embodiment of the present application can be applicable to a variety of systems, especially 5G systems. For example, the applicable system can be a global system of mobile communication (GSM) system, a code division multiple access (CDMA) system, a wideband code division multiple access (WCDMA) general packet radio service (GPRS) system, a long term evolution (LTE) system, a LTE frequency division duplex (FDD) system, a LTE time division duplex (TDD) system, an advanced long term evolution (LTE-A) system, a universal mobile telecommunication system (UMTS), a world-wide interoperability for microwave access (WiMAX) system, a 5G new air interface (NR) system, etc. These various systems include terminal equipment and network equipment. The system may also include a core network part, such as an evolved packet system (EPS), a 5G system (5GS), etc.

[0332] The terminal device involved in the embodiment of the present application may be a device that provides voice and / or data connectivity to a user, a handheld device with a wireless connection function, or other processing devices connected to a wireless modem. In different systems, the name of the terminal device may also be different. For example, in a 5G system, the terminal device may be called a user equipment (UE). A wireless terminal device can communicate with one or more core networks (CN) via a radio access network (RAN). The wireless terminal device may be a mobile terminal device, such as a mobile phone (or a "cellular" phone) and a computer with a mobile terminal device. For example, it may be a portable, pocket-sized, handheld, computer-built-in or vehicle-mounted mobile device that exchanges language and / or data with a wireless access network. For example, personal communication service (PCS) phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs) and other devices. The wireless terminal device may also be referred to as a system, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, an access point, a remote terminal device, an access terminal device, a user terminal device, a user agent, and a user device, but is not limited in the embodiments of the present application.

[0333] The network device involved in the embodiment of the present application may be a base station, which may include multiple cells providing services for the terminal. Depending on the specific application scenario, the base station may also be called an access point, or may be a device in the access network that communicates with the wireless terminal device through one or more sectors on the air interface, or other names. The network device may be used to interchange received air frames with Internet Protocol (IP) packets, and serve as a router between the wireless terminal device and the rest of the access network, wherein the rest of the access network may include an Internet Protocol (IP) communication network. The network device may also coordinate the attribute management of the air interface. For example, the network device involved in the embodiments of the present application may be a network device (Base Transceiver Station, BTS) in the Global System for Mobile communications (Global System for Mobile communications, GSM) or Code Division Multiple Access (Code Division Multiple Access, CDMA), or a network device (NodeB) in Wide-band Code Division Multiple Access (WCDMA), or an evolutionary network device (evolutional Node B, eNB or e-NodeB) in the long term evolution (long term evolution, LTE) system, a 5G base station (gNB) in the 5G network architecture (next generation system), or a home evolved Node B (Home evolved Node B, HeNB), a relay node, a home base station (femto), a pico base station (pico), etc., which is not limited in the embodiments of the present application. In some network structures, the network device may include a centralized unit (CU) node and a distributed unit (DU) node, and the centralized unit and the distributed unit may also be arranged geographically separately.

[0334] Network devices and terminal devices can each use one or more antennas for multiple-input multiple-output (MIMO) transmission. MIMO transmission can be single-user MIMO (SU-MIMO) or multi-user MIMO (MU-MIMO). Depending on the form and number of antenna combinations, MIMO transmission can be 2D-MIMO, 3D-MIMO, FD-MIMO or massive-MIMO, or it can be diversity transmission, precoded transmission or beamforming transmission, etc.

[0335] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0336] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer executable instructions. These computer executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0337] These processor executable instructions may also be stored in a processor readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0338] These processor-executable instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0339] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for locating the root cause of a fault, characterized in that: include: Acquire alarm data and a fault work order of a network device, wherein the alarm data includes the alarm time and alarm type of each of a plurality of alarms for a fault of the network device, and the fault work order includes the fault occurrence time of the fault; Generate a timing alarm feature of the network device according to the fault occurrence time and the alarm data; generating an alarm type embedding feature of the network device according to the respective alarm types of the plurality of alarms; The timing alarm feature and the alarm type embedding feature are input into a fault root cause location model to obtain the fault root cause of the network device; The fault root cause location model includes a first encoder, a second encoder, a fully connected layer and a classification layer.

2. The method for locating the root cause of a fault according to claim 1, characterized in that: The step of embedding the timing alarm feature and the alarm type feature into a fault root cause location model to obtain the fault root cause of the network device includes: Inputting the timing alarm feature into the first encoder to obtain a first encoding feature; Inputting the warning type embedding feature into the second encoder to obtain a second encoding feature; Inputting the first encoding feature and the second encoding feature into the fully connected layer to obtain a fused feature; The fused features are input into the classification layer to obtain the root cause of the failure of the network device.

3. The method for locating the root cause of a fault according to claim 2, characterized in that: The first encoder includes a first self-attention unit, a first convolution unit, a long short-term memory artificial neural network LSTM unit and a second convolution unit connected in sequence, and the timing alarm feature is input into the first encoder to obtain a first encoding feature, including: Performing a distillation operation on the time series alarm feature according to the first self-attention unit to obtain a first alarm feature; Performing a convolution pooling operation on the first alarm feature according to the first convolution unit to obtain a second alarm feature; Performing a time series feature extraction operation on the second alarm feature according to the LSTM unit to obtain a third alarm feature; Perform a convolution pooling operation on the third alarm feature according to the second convolution unit to obtain the first coding feature.

4. The method for locating the root cause of a fault according to claim 2, characterized in that: The second encoder includes a second self-attention unit, a third convolution unit, a third self-attention unit, and a fourth convolution unit connected in sequence, and the warning type embedding feature is input into the second encoder to obtain a second encoding feature, including: performing a distillation operation on the warning type embedding feature according to the second self-attention unit to obtain a fourth warning feature; Performing a convolution pooling operation on the fourth alarm feature according to the third convolution unit to obtain a fifth alarm feature; performing a distillation operation on the fifth warning feature according to the third self-attention unit to obtain a sixth warning feature; Perform a convolution pooling operation on the sixth alarm feature according to the fourth convolution unit to obtain the second coding feature.

5. The method for locating the root cause of a fault according to any one of claims 1 to 4, characterized in that: The generating, according to the fault occurrence time and the alarm data, a timing alarm feature of the network device includes: According to the fault occurrence time and the alarm data, among the multiple alarms, determine the alarm whose alarm time is in a first time period and the alarm whose alarm time is in a second time period, wherein the first time period is a time period from a first time before the fault occurrence time to the fault occurrence time, and the second time period is a time period from the fault occurrence time to a second time after the fault occurrence time; Determine, according to the alarms in the first time period and the alarms in the second time period, first alarm frequency information of the alarms of each alarm type in the first time period and second alarm frequency information in the second time period; The temporal alarm feature is generated according to the first alarm frequency information of the alarm of each alarm type in the first time period and the second alarm frequency information in the second time period.

6. The method for locating the root cause of a fault according to claim 5, characterized in that: The determining, according to the alarms in the first time period and the alarms in the second time period, first alarm frequency information of the alarms of each alarm type in the first time period and second alarm frequency information in the second time period includes: For each of the alarm types, determining a first alarm of the alarm type from the alarms in the first time period, and determining a second alarm of the alarm type from the alarms in the second time period; Determining the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm; Determining the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm; The continuous alarm includes two adjacent alarms, the alarm types of the two adjacent alarms are the same, and the time difference between the alarm times of the two adjacent alarms is less than or equal to the preset duration; The first alarm frequency information includes the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm; the second alarm frequency information includes the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm.

7. The method for locating the root cause of a fault according to claim 6, characterized in that: The generating the time sequence alarm feature according to the first alarm frequency information of the alarm of each alarm type in the first time period and the second alarm frequency information in the second time period includes: Generate a first timing alarm matrix according to the frequency of the first alarm and the frequency of the second alarm; Generate a second timing alarm matrix according to the alarm interval of the first alarm and the alarm interval of the second alarm; Generate a third sequential alarm matrix according to the continuous alarm frequency of the first alarm and the continuous alarm frequency of the second alarm; The first timing alarm matrix, the second timing alarm matrix and the third timing alarm matrix are fused to obtain the timing alarm feature.

8. The method for locating the root cause of a fault according to any one of claims 1 to 4, characterized in that: The step of generating an alarm type embedding feature of the network device according to the respective alarm types of the plurality of alarms includes: Performing word segmentation processing on the title texts of the respective alarm types of the multiple alarms to obtain multiple word segments; For each participle, determining a text encoding of the participle according to the frequency of occurrence of the participle in the multiple participles; Vectorization is performed on the text encodings of the multiple word segments to obtain the embedded features of the alarm type.

9. The method for locating the root cause of a fault according to claim 8, characterized in that: The vectorizing the text encodings of the multiple word segments to obtain the warning type embedding features includes: For each alarm type of an alarm, generating a text encoding vector of the alarm according to the text encoding of the segmented words included in the title text of the alarm type; The text encoding vectors of the respective multiple alarms are input into a continuous word skipping model, and the text encoding vectors of the respective multiple alarms are embedded according to the continuous word skipping model to generate the alarm type embedding features.

10. The fault root cause location method according to any one of claims 1 to 4, characterized in that: The fault root cause location model is trained based on sample alarm data, sample fault work orders, and fault root cause labels of multiple sample network devices.

11. An electronic device, characterized in that: Including memory, transceiver, processor; A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations: Acquire alarm data and a fault work order of a network device, wherein the alarm data includes the alarm time and alarm type of each of a plurality of alarms for a fault of the network device, and the fault work order includes the fault occurrence time of the fault; Generate a timing alarm feature of the network device according to the fault occurrence time and the alarm data; generating an alarm type embedding feature of the network device according to the respective alarm types of the plurality of alarms; The timing alarm feature and the alarm type embedding feature are input into a fault root cause location model to obtain the fault root cause of the network device; The fault root cause location model includes a first encoder, a second encoder, a fully connected layer and a classification layer.

12. The electronic device according to claim 11, characterized in that: The step of embedding the timing alarm feature and the alarm type feature into a fault root cause location model to obtain the fault root cause of the network device includes: Inputting the timing alarm feature into the first encoder to obtain a first encoding feature; Inputting the warning type embedding feature into the second encoder to obtain a second encoding feature; Inputting the first encoding feature and the second encoding feature into the fully connected layer to obtain a fused feature; The fused features are input into the classification layer to obtain the root cause of the failure of the network device.

13. The electronic device according to claim 12, characterized in that: The first encoder includes a first self-attention unit, a first convolution unit, an LSTM unit, and a second convolution unit connected in sequence, and the timing alarm feature is input into the first encoder to obtain a first encoding feature, including: Performing a distillation operation on the time series alarm feature according to the first self-attention unit to obtain a first alarm feature; Performing a convolution pooling operation on the first alarm feature according to the first convolution unit to obtain a second alarm feature; Performing a time series feature extraction operation on the second alarm feature according to the LSTM unit to obtain a third alarm feature; Perform a convolution pooling operation on the third alarm feature according to the second convolution unit to obtain the first coding feature.

14. The electronic device according to claim 12, characterized in that: The second encoder includes a second self-attention unit, a third convolution unit, a third self-attention unit, and a fourth convolution unit connected in sequence, and the warning type embedding feature is input into the second encoder to obtain a second encoding feature, including: performing a distillation operation on the warning type embedding feature according to the second self-attention unit to obtain a fourth warning feature; Performing a convolution pooling operation on the fourth alarm feature according to the third convolution unit to obtain a fifth alarm feature; performing a distillation operation on the fifth warning feature according to the third self-attention unit to obtain a sixth warning feature; Perform a convolution pooling operation on the sixth alarm feature according to the fourth convolution unit to obtain the second coding feature.

15. The electronic device according to any one of claims 11 to 14, characterized in that: The generating, according to the fault occurrence time and the alarm data, a timing alarm feature of the network device includes: According to the fault occurrence time and the alarm data, among the multiple alarms, determine the alarm whose alarm time is in a first time period and the alarm whose alarm time is in a second time period, wherein the first time period is a time period from a first time before the fault occurrence time to the fault occurrence time, and the second time period is a time period from the fault occurrence time to a second time after the fault occurrence time; Determine, according to the alarms in the first time period and the alarms in the second time period, first alarm frequency information of the alarms of each alarm type in the first time period and second alarm frequency information in the second time period; The temporal alarm feature is generated according to the first alarm frequency information of the alarm of each alarm type in the first time period and the second alarm frequency information in the second time period.

16. The electronic device according to claim 15, characterized in that: The determining, according to the alarms in the first time period and the alarms in the second time period, first alarm frequency information of the alarms of each alarm type in the first time period and second alarm frequency information in the second time period includes: For each of the alarm types, determining a first alarm of the alarm type from the alarms in the first time period, and determining a second alarm of the alarm type from the alarms in the second time period; Determining the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm; Determining the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm; The continuous alarm includes two adjacent alarms, the alarm types of the two adjacent alarms are the same, and the time difference between the alarm times of the two adjacent alarms is less than or equal to the preset duration; The first alarm frequency information includes the frequency of the first alarm, the alarm interval of the first alarm, and the continuous alarm frequency of the first alarm; the second alarm frequency information includes the frequency of the second alarm, the alarm interval of the second alarm, and the continuous alarm frequency of the second alarm.

17. The electronic device according to claim 16, characterized in that: The generating the time sequence alarm feature according to the first alarm frequency information of the alarm of each alarm type in the first time period and the second alarm frequency information in the second time period includes: Generate a first timing alarm matrix according to the frequency of the first alarm and the frequency of the second alarm; Generate a second timing alarm matrix according to the alarm interval of the first alarm and the alarm interval of the second alarm; Generate a third sequential alarm matrix according to the continuous alarm frequency of the first alarm and the continuous alarm frequency of the second alarm; The first timing alarm matrix, the second timing alarm matrix and the third timing alarm matrix are fused to obtain the timing alarm feature.

18. The electronic device according to any one of claims 11 to 14, characterized in that: The step of generating an alarm type embedding feature of the network device according to the respective alarm types of the plurality of alarms includes: Performing word segmentation processing on the title texts of the respective alarm types of the multiple alarms to obtain multiple word segments; For each participle, determining a text encoding of the participle according to the frequency of occurrence of the participle in the multiple participles; Vectorization is performed on the text encodings of the multiple word segments to obtain the embedded features of the alarm type.

19. The electronic device according to claim 18, characterized in that: The vectorizing the text encodings of the multiple word segments to obtain the embedded features of the alarm type includes: For each alarm type of an alarm, generating a text encoding vector of the alarm according to the text encoding of the segmented words included in the title text of the alarm type; The text encoding vectors of the respective multiple alarms are input into a continuous word skipping model, and the text encoding vectors of the respective multiple alarms are embedded according to the continuous word skipping model to generate the alarm type embedding features.

20. The electronic device according to any one of claims 11 to 14, characterized in that: The fault root cause location model is trained based on sample alarm data, sample fault work orders, and fault root cause labels of multiple sample network devices.

21. A fault root cause location device, characterized in that: include: An acquisition module, used to acquire alarm data and a fault work order of a network device, wherein the alarm data includes the alarm time and alarm type of each of multiple alarms for the fault of the network device, and the fault work order includes the fault occurrence time of the fault; A first generating module, used for generating a timing alarm feature of the network device according to the fault occurrence time and the alarm data; A second generating module, configured to generate an alarm type embedding feature of the network device according to the respective alarm types of the plurality of alarms; A processing module, used for inputting the timing alarm feature and the alarm type embedding feature into a fault root cause location model to obtain the fault root cause of the network device; The fault root cause location model includes a first encoder, a second encoder, a fully connected layer and a classification layer.

22. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is used to enable a computer to execute the fault root cause locating method according to any one of claims 1 to 10.

Images